Digital asset and vulnerability association relationship marking method and device, and storage medium

Abstract

This application discloses a method, apparatus, and storage medium for annotating the association between digital assets and vulnerabilities, relating to the field of network security technology. The method includes: receiving an asset annotation request and determining a target version node based on the request; starting from the target version node, obtaining falsification rule fragments stored on each accessed node; obtaining a target predicate collection list based on the falsification rule fragments of each accessed node; performing short-circuit evaluation on the predicates in the target predicate collection list according to priority to generate target values, and annotating the association between digital assets and vulnerabilities based on the target values. This application solves the technical problem of high maintenance costs of falsification rules in existing technologies for annotating the association between digital assets and vulnerabilities.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and more specifically, to a method, apparatus, and storage medium for annotating digital assets and vulnerability associations. Background Technology

[0002] Existing labeling technologies for the association between digital assets and vulnerabilities typically employ rule-based matching mechanisms, using predefined falsification conditions to determine whether an asset is unaffected by a specific vulnerability. However, when the same vulnerability affects multiple version branches or has multiple exception versions, existing solutions require constructing and storing a complete set of independent rules for each version or variant. This flat, unstructured rule storage method leads to the repeated definition and maintenance of identical or similar falsification conditions across different version nodes, causing the rule base to expand exponentially with the number of versions and vulnerabilities. This significantly increases the costs of redundant rule storage, manual verification, and update maintenance. Especially in scenarios with frequent software iterations, adding new versions or patching requires manually copying, modifying, and deploying a large number of duplicate rules, severely impacting the scalability and operational efficiency of the vulnerability management system.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a method, apparatus, and storage medium for annotating the association between digital assets and vulnerabilities, in order to at least solve the technical problem of high maintenance costs of falsification rules when annotating the association between digital assets and vulnerabilities in the prior art.

[0005] According to one aspect of the embodiments of this application, a method for annotating the association relationship between digital assets and vulnerabilities is provided, comprising: receiving an asset annotation request and determining a target version node according to the asset annotation request, wherein the target version node is located on a target version tree in a preset version tree database that matches the asset annotation request; starting from the target version node, obtaining a falsification rule fragment stored on each accessed node, wherein the falsification rule fragment includes an inheritance tag, a predicate set, and a covering predicate mapping; obtaining a target predicate collection list based on the falsification rule fragment of each accessed node, wherein the target predicate collection list is used to store currently effective predicates; performing short-circuit evaluation on the predicates in the target predicate collection list in order of priority to generate target values, and annotating the association relationship between digital assets and vulnerabilities according to the target values, wherein the short-circuit evaluation is used to terminate the evaluation process in advance when there is at least one predicate in the target predicate collection list with a target value of false.

[0006] Optionally, determining the target version node based on the asset labeling request includes: obtaining asset fingerprint information from the asset labeling request, the asset fingerprint information including a product identifier and a product version number; obtaining the version tree corresponding to the product identifier from the version tree database as the target version tree, wherein the version tree includes a root node, a major version node, a minor version node, a revision version node, and a build version node; and in the target version tree, selecting the node corresponding to the product version number as the target version node.

[0007] Optionally, in the target version tree, the node corresponding to the product version number is designated as the target version node, including: for each node in the target version tree, if there is a revision version node whose version number range description is consistent with the product version number, then the revision version node is designated as the target version node; if there is no revision version node, but there is a build version node whose version number range description is consistent with the product version number, then the build version node is designated as the target version node; if there are no revision version node and build version node, but there is a minor version node whose version number range description includes the product version number, then the minor version node is designated as the target version node; if there are no revision version node, build version node, and minor version node, but there is a major version node whose version number range description includes the product version number, then the major version node is designated as the target version node; if there are no revision version node, build version node, minor version node, and major version node, but there is a root node whose version number range description includes the product version number, then the root node is designated as the target version node; wherein, the version number range description is the set of versions stored in each node of the target version tree that represents the version range covered by that node.

[0008] Optionally, based on the falsification rule fragment of each visited node, a target predicate collection list is obtained, including: creating an initial predicate collection list and an initial predicate replacement record, wherein both the initial predicate collection list and the initial predicate replacement record are empty; for each visited node, if the inheritance flag of the visited node is true, then the target operation is executed to obtain the target predicate collection list, wherein the target operation is used to populate the initial predicate collection list and the initial predicate replacement record; if the inheritance flag of the visited node is false, then upward node access is stopped.

[0009] Optionally, the target operation includes the following steps: for each predicate in the predicate set of the accessed node, if the predicate identifier does not exist in the predicate replacement record, the predicate corresponding to the predicate identifier is added to the initial predicate collection list; for each mapping entry in the overriding predicate mapping of the accessed node, the identifier of the overriding predicate in the mapping entry is added to the initial predicate replacement record, and the new predicate specified in the mapping entry is added to the initial predicate collection list; if the predicate identifier of the new predicate already exists in the initial predicate collection list, the original predicate corresponding to the new predicate is removed from the initial predicate collection list.

[0010] Optionally, each predicate includes a predicate identifier, a predicate type, a variable name, and an operator; the predicate type includes version range type, configuration item equality type, file existence type, class existence type, and patch application type; the operator includes equal to, not equal to, belong to range, and not belong to range.

[0011] Optionally, the priority includes predicates of patch application type taking precedence over predicates of version range type, predicates of version range type taking precedence over predicates of configuration item equality type, predicates of configuration item equality type taking precedence over predicates of class existence type, and predicates of class existence type taking precedence over predicates of file existence type; among predicates of the same type, predicates whose operators are equal to or not equal to take precedence over predicates whose operators are belonging to or not belonging to a range.

[0012] Optionally, the predicates in the target predicate acquisition list are evaluated using short-circuit evaluation according to priority to generate target values. This includes: for each predicate in the target predicate acquisition list, obtaining the actual value corresponding to the variable name from the asset fingerprint information based on the variable name of the predicate; if the actual value and the variable name satisfy the operator definition of the predicate, then the target value is determined to be true; if the actual value and the variable name do not satisfy the operator definition of the predicate, then the target value is determined to be false.

[0013] Optionally, the association between digital assets and vulnerabilities is marked according to the target value, including: when the target value of any predicate in the target predicate collection list is false, the short-circuit evaluation is terminated and the association is marked as falsified; when the target values ​​of all predicates in the target predicate collection list are true, the association is marked as unfalsified; when there is at least one predicate in the target predicate collection list that cannot obtain the corresponding actual value in the asset fingerprint information based on the variable name of the predicate, and there is no target value of any predicate in the target predicate collection list that is false, the association is marked as unknown.

[0014] Optionally, when the association is marked as unknown, the method further includes: recording the variable names of predicates whose actual values ​​cannot be obtained from the asset fingerprint information, and generating a list of variable names; determining the missing data item corresponding to each variable name in the list of variable names, wherein the missing data item includes configuration item values, patch installation status, runtime configuration information or system attribute values; and triggering a supplementary information collection operation to the corresponding collection source based on the missing data item to obtain the target data item.

[0015] Optionally, the supplementary information collection operation includes: if the missing data item is a configuration item value or a system attribute value, a first query request is sent to the configuration management database or asset mapping system, and the target data item returned by the configuration management database or asset mapping system is received. The first query request includes an asset identifier and the name of the configuration item or system attribute corresponding to the missing data item. The asset identifier is extracted from the asset fingerprint information carried in the asset labeling request. If the missing data item is runtime configuration information, a collection instruction is sent to the information collection agent deployed on the asset side, and the target data item returned by the information collection agent is received. The collection instruction is used to obtain the current actual value of the runtime configuration information. If the missing data item is a patch installation status, a second query request is sent to the patch management system, and the target data item returned by the patch management system is received. The second query request includes the patch identifier corresponding to the patch installation status.

[0016] Optionally, after triggering the corresponding supplementary information collection operation, the method further includes: if the target data item is obtained within a preset time threshold, the target data item is used to fill the variable name of the corresponding predicate, short-circuit evaluation is re-executed, and the association relationship is updated; if the target data item is not obtained within the preset time threshold, an alarm message is output, and manually input correction information is received, the correction information is used to fill the variable name of the corresponding predicate, short-circuit evaluation is re-executed, and the association relationship is updated.

[0017] Optionally, the method further includes: listening to version release events or periodically scanning version information sources to obtain the version number string of the new version; standardizing the version number string to obtain a standardized version identifier; determining the insertion position of the new version node and its parent node in the target version tree based on the standardized version identifier; creating a new version node, wherein the inheritance flag of the new version node is set to true, the predicate set of the new version node is set to empty, and the overriding predicate mapping of the new version node is set to empty; and controlling the new version node to automatically inherit the falsification rule fragment of its parent node.

[0018] Optionally, the method further includes: monitoring vulnerability database update events to obtain vulnerability announcements for new vulnerabilities; extracting the affected product identifier, affected version range description, and patch version number from the vulnerability announcement; if the affected product identifier matches the product identifier in the asset labeling request, resolving the affected version range description into one or more version range objects; in the target version tree, obtaining all version nodes falling into the version range objects, tracing upwards along the path of each version node to the root node, and finding the node where all paths first intersect as the lowest common ancestor node; creating a falsification rule fragment for the new vulnerability on the lowest common ancestor node, wherein the inheritance flag of the lowest common ancestor node is true, the predicate set of the lowest common ancestor node includes a predicate of version range type, and the overriding predicate mapping of the lowest common ancestor node is empty.

[0019] According to another aspect of the embodiments, a digital asset and vulnerability association labeling device is also provided, comprising: a determining unit, configured to receive an asset labeling request and determine a target version node according to the asset labeling request, wherein the target version node is located on a target version tree in a preset version tree database that matches the asset labeling request; an acquiring unit, configured to acquire a falsification rule fragment stored on each accessed node starting from the target version node, wherein the falsification rule fragment includes an inheritance tag, a predicate set, and a covering predicate mapping; a generating unit, configured to obtain a target predicate collection list based on the falsification rule fragment of each accessed node, wherein the target predicate collection list is used to store currently effective predicates; and a labeling unit, configured to perform short-circuit evaluation on the predicates in the target predicate collection list in order of priority, generate target values, and label the association between digital assets and vulnerabilities according to the target values, wherein the short-circuit evaluation is used to terminate the evaluation process in advance when there is at least one predicate in the target predicate collection list with a target value of false.

[0020] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the above-described digital asset and vulnerability association labeling method.

[0021] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to execute the above-described digital asset and vulnerability association labeling method.

[0022] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the above-described method for annotating digital assets and vulnerability associations.

[0023] In this embodiment, the method of receiving asset labeling requests and locating target version nodes based on the asset labeling requests is adopted. By starting from the target version node, the falsification rule fragments stored on each node accessed by the system are obtained step by step. This achieves the purpose of dynamically aggregating falsification conditions scattered on multiple nodes into a unified target predicate collection list, thereby realizing the technical effect of efficient aggregation and centralized management of effective falsification rules. This solves the technical problem of high maintenance cost of falsification rules when labeling the association between digital assets and vulnerabilities in the prior art. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0025] Figure 1 This is a flowchart of an optional method for labeling digital assets and vulnerability associations according to an embodiment of this application;

[0026] Figure 2 This is an execution flowchart of an optional digital asset and vulnerability association labeling system according to an embodiment of this application;

[0027] Figure 3 This is a schematic diagram of an optional digital asset and vulnerability association labeling device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] According to an embodiment of this application, a method embodiment for annotating the association between digital assets and vulnerabilities is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] According to the embodiments of this application, a digital asset and vulnerability association labeling system (hereinafter referred to as the system) can be used as the execution subject of the digital asset and vulnerability association labeling method of this application. The digital asset and vulnerability association labeling system can be a software system or an embedded system combining software and hardware. Of course, the execution subject of the method in the embodiments of this application can also be other forms of execution subject, such as devices or equipment. Those skilled in the art should know that this application does not particularly limit the specific form of the execution subject.

[0032] Figure 1 This is a flowchart of an optional method for labeling digital assets and vulnerability associations according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0033] Step S101: Receive an asset labeling request and determine the target version node based on the asset labeling request. The target version node is located on the target version tree in the preset version tree database that matches the asset labeling request.

[0034] Optionally, an asset labeling request refers to a query command initiated by a security management system, asset mapping platform, or operation and maintenance tool to determine whether a digital asset is affected by a specific vulnerability. This request carries unique identification information about the asset, typically including the software name and version number.

[0035] Optionally, the target version node is a node in the version tree database that uniquely corresponds to the asset information, representing the specific version range of the software running on the asset.

[0036] Optionally, the version tree database is a pre-built collection of nodes organized hierarchically by version, with the software product as the root. Each node represents a version range and is used to support the location and invocation of subsequent rules.

[0037] Optionally, after receiving an asset labeling request from an external system, the system parses the software product identifier and version number included to form a standardized asset identifier. Then, a matching query is performed in the version tree database, prioritizing the search for nodes that are exactly the same as the identifier. If no exact match is found, the system backtracks upwards through the version hierarchy to find the closest generalized node, such as a minor or major version node. Finally, the most suitable node is determined as the target version node, serving as the starting point for subsequent rule searches.

[0038] Step S102: Starting from the target version node, obtain the falsification rule fragments stored on each accessed node, wherein the falsification rule fragments include inheritance tags, predicate sets, and overriding predicate mappings.

[0039] Optionally, a falsification rule fragment is the smallest rule unit stored on a version tree node, describing which conditions within the version range represented by that node determine that the asset is unaffected by the vulnerability. Each fragment consists of three components: an inheritance flag that determines whether to continue tracing the rule back to the parent node; a predicate set, a set of items used to express the judgment conditions; and a covering predicate mapping used to locally replace the conditions already defined in the parent node within this node. All of the above content is bound to the nodes in a structured data format in the database, without relying on external storage.

[0040] Optionally, starting from the target version node, the system visits its own node and its parent nodes at higher levels sequentially according to a preset traversal path until the traversal path ends. For each visited node, the system reads the falsification rule fragment associated with the visited node from the database, including the node's inheritance tag, predicate set, and overriding predicate mapping. The read operation does not involve parsing or modifying the rule content; it only completes the extraction and transmission of data. If a node does not store any rule fragments, it is considered to have no valid rules and is skipped.

[0041] Step S103: Based on the falsification rule fragment of each accessed node, obtain the target predicate collection list, wherein the target predicate collection list is used to store the currently effective predicates.

[0042] Optionally, the target predicate collection list is an intermediate set gradually constructed by the system during the traversal process to summarize all currently effective judgment conditions. A predicate is the basic unit constituting falsification logic, representing a specific judgment condition, such as whether the version is within a certain range or whether a certain patch is installed. The target predicate collection list does not include the structure of the original rule fragments; it only retains the content of the predicates that ultimately participate in the judgment, and each predicate is retained only once to avoid duplication.

[0043] Optionally, the system processes the falsification rule fragments of each visited node sequentially according to the traversal order. For the predicate set in each fragment, the system adds all its predicates to the list, but if a predicate has been declared as replaced by a subsequent node through overriding the predicate mapping, it is no longer retained. The inheritance flag controls whether to continue traversing upwards; if it is false, the process stops, and the collected predicates at this point constitute the final effective set. The list construction process does not involve recalculating the semantics of the predicates; it only completes the merging and deduplication of the content.

[0044] Step S104: Short-circuit evaluation is performed on the predicates in the target predicate collection list in order of priority to generate target values, and the correlation between digital assets and vulnerabilities is marked according to the target values. The short-circuit evaluation is used to terminate the evaluation process in advance when there is at least one predicate in the target predicate collection list with a false target value.

[0045] Optionally, short-circuit evaluation is a conditional judgment strategy, which verifies the truth value of predicates one by one in a preset order. Once any predicate is found to be false, the subsequent judgment is stopped immediately, and there is no need to continue to verify the remaining conditions.

[0046] Optionally, the system retrieves each predicate from the target predicate collection list in priority order and verifies it in conjunction with the current actual status of the asset (such as version number, configuration parameters, and patch information). If a predicate is determined to be false, the system immediately terminates the calculation of all subsequent predicates and directly outputs the target value.

[0047] In one optional embodiment, determining the target version node based on the asset labeling request includes: obtaining asset fingerprint information from the asset labeling request, the asset fingerprint information including a product identifier and a product version number; obtaining the version tree corresponding to the product identifier as the target version tree from the version tree database, wherein the version tree includes a root node, a major version node, a minor version node, a revision version node, and a build version node; and selecting the node corresponding to the product version number as the target version node in the target version tree.

[0048] Optionally, asset fingerprint information is structured data describing the core attributes of the software running on a digital asset, provided by the asset management system, configuration database, or a data collection agent deployed on a host. The product identifier is the unique name of the software, such as Apache Log4j Core or OpenSSL, used to distinguish different software products. The product version number is the specific version of the software currently running, such as "2.14.1" or "1.2.17," used to locate its position in the version evolution. Together, these two elements constitute the unique identification basis for the asset in vulnerability association assessments.

[0049] Optionally, the system receives asset labeling requests from external systems, which are transmitted in the form of structured data. The system extracts the product identifier and product version number from this data. The extraction process does not involve content parsing or format modification; it only reads the raw data. If any field is missing or empty, the labeling request is invalid, and the process terminates.

[0050] Optionally, the version tree database is a pre-built hierarchical data structure organized by software product, with each version tree corresponding to a software product. The root node represents the software as a whole and does not correspond to a specific version; the major version node represents the set of all versions under the same major version number, such as "2.x"; the minor version node represents the set of major and minor versions, such as "2.14.x"; the revision version node represents the version accurate to the revision number, such as "2.14.1"; and the build version node is a child node of the revision version, representing a version with a build tag or pre-release identifier, such as "2.14.1-beta1". These nodes form a tree structure through parent-child relationships, with the generalization level increasing from top to bottom.

[0051] Optionally, the system uses the extracted product identifier as a query condition to search the version tree database for a matching version tree. If a matching version tree exists, it is marked as the target version tree; otherwise, there is no corresponding rule, and the process terminates. The version tree structure is statically constructed, generated based on software release history, package manager records, or official version announcements. The system only performs the search operation and does not modify or rebuild the structure.

[0052] Optionally, the matching principle is to search step by step from the most precise to the most generalized: first, match the revision version node, then the construction version node, then the minor version node, the major version node, and finally the root node. The version number range description of the node is the version coverage range stored, such as "2.14.x", "2.x" or "all versions", used to determine whether the current product version number is included.

[0053] In one optional embodiment, in the target version tree, the node corresponding to the product version number is designated as the target version node, including: for each node in the target version tree, if there is a revision version node whose version number range description is consistent with the product version number, then the revision version node is designated as the target version node; if there is no revision version node, but there is a build version node whose version number range description is consistent with the product version number, then the build version node is designated as the target version node; if there are no revision version node and build version node, but there is a minor version node whose version number range description includes the product version number, then the minor version node is designated as the target version node; if there are no revision version node, build version node, and minor version node, but there is a major version node whose version number range description includes the product version number, then the major version node is designated as the target version node; if there are no revision version node, build version node, minor version node, and major version node, but there is a root node whose version number range description includes the product version number, then the root node is designated as the target version node; wherein, the version number range description is a set of versions stored in each node of the target version tree to characterize the version covered by that node.

[0054] Optionally, a revision node is the lowest-granularity node type in the version tree, with the version number range described precisely to the major version number, minor version number, and revision number, such as "2.14.1" or "3.0.5", excluding pre-release identifiers or build tags.

[0055] Optionally, the product version number is the software version information carried in the asset labeling request, which is standardized and formatted as "2.14.1". The version number range description is a field stored in each node that defines the version range covered by that node, and its content has the same format specification as the product version number.

[0056] Optionally, upon receiving the standardized product version number, the system first traverses all revision node in the version tree database, comparing the version number range description of each node with the product version number. Once a node with a perfect match is found, the subsequent search is immediately stopped, and that node is confirmed as the target version node.

[0057] Optionally, the build version node is a child node of the revision version node. The version number range description typically includes a build identifier or pre-release tag, such as "2.14.1-beta1" or "2.14.1+20240510". Although the build version node has the same main body as the revision version, it includes additional identifiers, representing an informal release or a version in a specific deployment environment. After standardization, the system can align the main body of this type of version number with the revision version, retaining only the tag as the distinguishing factor.

[0058] Optionally, if the system does not find a match in the revision node, it will switch to searching the build node. In this case, the system will precisely compare the product version number with the version number range description of each build node. If a completely matching build node is found, that node will be used as the target version node, and the search will not continue upwards.

[0059] Optionally, a minor version node covers all revisions under a combination of a major and minor version number. The version number range is typically described as "2.14.x" or "3.1.x," indicating that the node applies to all 2.14 series revisions. If the product version number is "2.14.3," it falls within the range covered by this minor version node. The range includes the product version number within the version interval defined by the node, regardless of the revision number.

[0060] Optionally, if the system fails to find an exact match in either the revision or build versions, it proceeds to the minor version node level. The system iterates through all minor version nodes, determining whether the version number range description includes the current product version number. For example, if the product version is "2.14.3" and a minor version node range is "2.14.x", then the inclusion relationship is considered valid, and that node is selected as the target version node. This determination is based solely on major and minor version number matching and does not involve the revision number.

[0061] Optionally, a major version node covers all minor versions and revisions under a major version number. The version number range is described as "2.x" or "3.x", indicating that the node applies to all versions under that major version. Product version numbers such as "2.14.3" belong to the "2.x" range, satisfying the inclusion relationship.

[0062] Optionally, if the system does not find a match in the revision, build, or minor version nodes, it proceeds to the major version node layer for judgment. The system checks the version number range description of each major version node. If its major version number is consistent with the major version of the product version number, such as "2.x" and "2.14.3", then the node is considered to cover the current version, and the node is selected as the target version node.

[0063] Optionally, the root node represents the entire software product, and the version number range describes all possible versions of the product, typically expressed as "all versions" or left blank. The root node does not correspond to any specific version number but serves as the final fallback matching node. When the product version number does not match any node at any level, the root node becomes the final destination.

[0064] Optionally, if the system fails to find a match after traversing all levels of nodes, it automatically sets the root node as the target version node. In this case, the system considers that the specific version information of the software product running on the asset cannot be located in the version tree.

[0065] Optionally, the system prioritizes the finest-grained matching, only backing up when an exact match is not possible, always selecting the node closest to the actual version of the asset. This mechanism avoids misuse of generalization rules due to incomplete version information and prevents complete inability to process due to unregistered versions, achieving a balance between high accuracy and high robustness.

[0066] In one optional embodiment, a target predicate collection list is obtained based on the falsification rule fragment of each accessed node, including: creating an initial predicate collection list and an initial predicate replacement record, wherein both the initial predicate collection list and the initial predicate replacement record are empty; for each accessed node, if the inheritance flag of the accessed node is true, a target operation is performed to obtain the target predicate collection list, wherein the target operation is used to populate the initial predicate collection list and the initial predicate replacement record; if the inheritance flag of the accessed node is false, then upward access to nodes is stopped.

[0067] Optionally, the initial predicate replacement record is a set used to record which predicates have been covered or replaced by subsequent nodes, in order to avoid duplicate or conflicting predicates being added multiple times.

[0068] Optionally, both the initial predicate collection list and the initial predicate replacement record are temporary memory structures that are initialized at the start of each annotation task and released after the task ends.

[0069] Optionally, the inheritance flag is a boolean value indicating whether the current node allows its parent node's rules to continue participating in the evaluation. If true, the rule can continue to be traced upwards; if false, upward access is terminated.

[0070] Optionally, the target operation is a processing action performed on the falsification rule fragment of the current node, including: adding the set of predicates in the node to the predicate collection list, and recording the replaced predicates declared in the overriding predicate mapping in the replacement record to mark the replaced predicates as no longer effective.

[0071] Optionally, the system visits each visited node sequentially from bottom to top. For each node, the inheritance flag is read first. If the inheritance flag is true, the system reads the falsification rule fragment of that node and extracts the predicate set and the overriding predicate mapping from it. For each predicate in the predicate set, the system checks whether the predicate has been marked as overridden in the replacement record. If it has not been overridden, the predicate is added to the predicate collection list; if it has been overridden, it is skipped. For each item in the overriding predicate mapping, the system records the identifier of the overridden predicate in the replacement record, which helps to automatically ignore the predicate if it appears again in subsequent nodes. When the system visits a node and finds that the inheritance flag of that node is false, it immediately interrupts the upward traversal process, no longer visits parent nodes, grandparent nodes, and other higher-level nodes, and the predicate collection list and replacement record remain in their current state and are no longer updated.

[0072] In one optional embodiment, the target operation includes the following steps: for each predicate in the predicate set of the accessed node, if the predicate identifier does not exist in the predicate replacement record, the predicate corresponding to the predicate identifier is added to the initial predicate collection list; for each mapping entry in the overriding predicate mapping of the accessed node, the identifier of the overriding predicate in the mapping entry is added to the initial predicate replacement record, and the new predicate specified in the mapping entry is added to the initial predicate collection list; if the predicate identifier of the new predicate already exists in the initial predicate collection list, the original predicate corresponding to the new predicate is removed from the initial predicate collection list.

[0073] Optionally, a predicate is the basic unit constituting a falsification judgment, representing a specific condition. A predicate identifier is a unique number for that predicate in the system, used to distinguish different predicates. A predicate set is a group of predicates defined on the current node, used to express the general falsification conditions within the version range covered by that node. A predicate replacement record is a set used to track which predicates have been covered or replaced by subsequent nodes, recording the identifiers of the replaced predicates.

[0074] Optionally, when processing the predicate set of the current node, the system reads the predicate identifier of each predicate one by one. For each identifier, it queries the current predicate replacement record to determine whether the identifier already exists. If it does not exist, it means that the predicate has not been covered by subsequent nodes, and the system adds the entire predicate to the initial predicate collection list. If it already exists, the predicate is skipped and no further processing is performed.

[0075] Optionally, the overriding predicate mapping is a mechanism used by the current node to declare a replacement for a rule of an ancestor node. It consists of a set of key-value pairs, where each entry contains an identifier of the overridden predicate and a new predicate. The new predicate is an alternative condition defined by the current node, used to modify or overwrite the original judgment of the ancestor node. The initial predicate collection list is the final set of predicates currently being built, which may contain predicates from multiple nodes.

[0076] Optionally, the system iterates through each entry in the overriding predicate mapping of the current node. First, it adds the identifier of the overridden predicate in the entry to the predicate replacement record, marking the predicate as invalid. Then, it adds the new predicate specified in the entry to the initial predicate collection list. If the predicate identifier of the new predicate already exists in the list (i.e., it has been added by a lower-level node before), the system deletes the original predicate with the same identifier from the list and replaces it with the current new predicate. This helps ensure that regardless of which level of node the new predicate comes from, it is ultimately retained only once, and the most recent declaration is used.

[0077] In one optional embodiment, each predicate includes a predicate identifier, a predicate type, a variable name, and an operator; the predicate type includes version range type, configuration item equality type, file existence type, class existence type, and patch application type; the operator includes equal to, not equal to, belong to range, and not belong to range.

[0078] In one optional embodiment, the priority includes predicates of patch application type taking precedence over predicates of version range type, predicates of version range type taking precedence over predicates of configuration item equality type, predicates of configuration item equality type taking precedence over predicates of class existence type, and predicates of class existence type taking precedence over predicates of file existence type; among predicates of the same type, predicates whose operators are equal to or not equal to take precedence over predicates whose operators are belonging to or not belonging to a range.

[0079] In one optional embodiment, short-circuit evaluation is performed on the predicates in the target predicate acquisition list in order of priority to generate a target value, including: for each predicate in the target predicate acquisition list, obtaining the actual value corresponding to the variable name from the asset fingerprint information according to the variable name of the predicate; if the actual value and the variable name satisfy the relationship defined by the operator of the predicate, the target value is determined to be true; if the actual value and the variable name do not satisfy the relationship defined by the operator of the predicate, the target value is determined to be false.

[0080] Optionally, a predicate is a basic logical unit used to determine whether an asset is affected by a vulnerability. Each predicate contains a variable name that represents an observable asset attribute, such as version, JndiLookup.class, log4j2.formatMsgNoLookups, etc.

[0081] Optionally, the actual value refers to the attribute value that actually exists on the current asset and corresponds to the variable name. It comes from asset fingerprint information, such as the software version reported by the system, whether the file exists, system attribute values, etc.

[0082] Optionally, the system iterates through each predicate in the target predicate acquisition list and reads the variable name defined by that predicate. Then, it searches the asset fingerprint information for a field that matches the variable name. For example, if the variable name is "version," the software version string is extracted from the fingerprint; if it is "JndiLookup.class," the system checks if this type of file exists in the deployment directory. The acquisition process does not perform semantic interpretation; it only completes the data mapping between "variable name" and "actual value." If there is no corresponding field in the fingerprint, it is considered that the value cannot be obtained, and the predicate is not evaluated at this time.

[0083] Optionally, the system evaluates the acquired actual values ​​based on the operators defined in the predicate definition. If the predicate satisfies the relation defined by the operators, the system marks the target value of the predicate as true. For example:

[0084] If the operator is "equals", the variable name is "version", the actual value is "2.14.1", and the expected value of the predicate is also "2.14.1", then the result of the judgment is true;

[0085] If the operator is "not equal to", the actual value is "true" and the expected value is "false", then the evaluation is true;

[0086] If the operator is "belongs to range", the actual version is "2.14.1", and the range is "2.0.0–2.14.1", then the condition is true.

[0087] Optionally, after the system completes the comparison between the actual value of the predicate and the operator, if the result does not meet the conditions, the target value of the predicate is directly determined to be false. For example, if the actual value of the variable name "JndiLookup.class" is "does not exist", but the predicate requires "equal to true", then it is determined to be false; if the variable name "version" is "2.15.0", but the predicate requires "belongs to the interval [2.0.0–2.14.1]", then it is determined to be false.

[0088] In one optional embodiment, the association between digital assets and vulnerabilities is marked according to the target value, including: when the target value of any predicate in the target predicate collection list is false, the short-circuit evaluation is terminated and the association is marked as falsified; when the target values ​​of all predicates in the target predicate collection list are true, the association is marked as unfalsified; when at least one predicate in the target predicate collection list cannot obtain the corresponding actual value in the asset fingerprint information based on the variable name of the predicate, and no predicate in the target predicate collection list has a target value of false, the association is marked as unknown.

[0089] Alternatively, falsification indicates that digital assets are not affected by query vulnerabilities, meaning there are clear conditions that exclude their vulnerability.

[0090] Optionally, after completing the short-circuit evaluation of each predicate in the target predicate collection list, the system checks the target value one by one. Once a target value of a predicate is found to be false, the system immediately stops evaluating all subsequent predicates and no longer accesses the remaining predicates in the list. Subsequently, the system directly marks the association between the asset and the vulnerability as falsified and outputs it.

[0091] Alternatively, "not disproven" means that there is currently insufficient evidence to prove that digital assets are not affected by the vulnerability, i.e., all verification conditions are met, indicating that the assets are still within the range of potential impact and need to be included in the risk watch list.

[0092] Optionally, the system iterates through each predicate in the target predicate collection list and confirms that all target values ​​are true. If all pass, the system does not interrupt the process and, after completing the evaluation of all predicates, marks the association between the asset and the vulnerability as unfalsified.

[0093] Optionally, "unknown" indicates that the current information is insufficient to determine whether the digital asset is affected by the vulnerability, and there is neither evidence to prove its security nor evidence to prove its danger, requiring further data.

[0094] Optionally, after the system completes the target value judgment of all predicates, if it finds that at least one predicate cannot be evaluated because there is no corresponding variable value in the asset fingerprint, and the target values ​​of all other predicates are true, that is, no false values ​​appear, then the association relationship is marked as unknown.

[0095] Alternatively, in practical applications, this mechanism can enable security operations personnel to clearly distinguish which assets have been confirmed to be secure, which assets still require attention, and which assets have insufficient information.

[0096] In an optional embodiment, when the association is marked as unknown, the method further includes: recording the variable names of predicates whose actual values ​​cannot be obtained from the asset fingerprint information, and generating a variable name list; determining the missing data item corresponding to each variable name in the variable name list, wherein the missing data item includes configuration item values, patch installation status, runtime configuration information or system attribute values; and triggering a supplementary information collection operation to the corresponding collection source based on the missing data item to obtain the target data item.

[0097] Optionally, after the system has evaluated all predicates in the target predicate collection list, if it finds that a certain predicate cannot obtain an actual value because there is no corresponding field in the asset fingerprint, the system records the variable name of that predicate. This process is repeated for all similar cases to form a unique list of variable names.

[0098] Optionally, missing data items refer to specific data content that could not be obtained due to the lack of asset fingerprint collection. The type of missing data item is determined by the semantics implied in the variable name. For example, "log4j2.formatMsgNoLookups" corresponds to a system property value; "patch-2024-001" corresponds to the patch installation status; " / usr / lib / liblog4j.so" corresponds to the existence of the file; and "maxThreads=200" corresponds to the configuration item value. The system matches variable names with the categories of missing data items through a preset mapping relationship.

[0099] Optionally, the data source refers to a system or agent that can provide missing data items, such as a configuration management database, an asset mapping platform, an information collection agent deployed on a host, a patch management system, etc.

[0100] Alternatively, the target data item is the correct data value that was originally missing, obtained through supplementary data collection.

[0101] Optionally, the system selects the corresponding collection source to initiate a request based on the type of missing data item: if the missing data item is a system attribute value, an instruction is sent to the information collection agent deployed on the asset side to request the collection of the current JVM system attributes; if it is a patch installation status, the system queries the patch management system for the deployment record of the patch on the asset; if it is a configuration item value, the system initiates an on-demand query to the configuration management database to obtain the configuration file content of the service; if it is runtime configuration information, the system obtains it by scanning the file system or process memory snapshot through the agent.

[0102] Optionally, through the above steps, the system no longer passively waits for complete information, but proactively intervenes, intelligently invoking data collection capabilities based on the type of missing information to drive data completion. This transforms the unknown state from an end point into a starting point for triggering automatic repair, thereby improving the automation level and response efficiency of vulnerability management.

[0103] In one optional embodiment, the supplementary information collection operation includes: if the missing data item is a configuration item value or a system attribute value, then a first query request is sent to the configuration management database or the asset mapping system, and the target data item returned by the configuration management database or the asset mapping system is received. The first query request includes an asset identifier and the name of the configuration item or system attribute corresponding to the missing data item. The asset identifier is extracted from the asset fingerprint information carried in the asset labeling request. If the missing data item is runtime configuration information, then a collection instruction is sent to the information collection agent deployed on the asset side, and the target data item returned by the information collection agent is received. The collection instruction is used to obtain the current actual value of the runtime configuration information. If the missing data item is a patch installation status, then a second query request is sent to the patch management system, and the target data item returned by the patch management system is received. The second query request includes the patch identifier corresponding to the patch installation status.

[0104] Optionally, when the system determines that the missing data item is a configuration item or system attribute, it extracts the asset's identifier from the asset labeling request and determines the specific configuration item or attribute name to be queried based on the variable name. For example, if the variable name is "log4j2.formatMsgNoLookups", then the query target is this system attribute. The system sends a request to the configuration management database or asset mapping system, containing the asset identifier and attribute name. The receiver locates the corresponding asset based on the identifier, searches for the corresponding attribute value in the configuration data, and returns a result such as "true", "false", or "not set" as the target data item.

[0105] Optionally, if the system determines that the missing information is runtime configuration information, such as whether JndiLookup.class exists, it sends a collection command to the information collection agent deployed on the asset. The command includes the file path or class name to be checked. After receiving the command, the agent immediately performs a scan locally, such as checking whether the specified Java class exists in the classpath or verifying whether a configuration file has been modified. After the collection is completed, the results are sent back to the system as the target data item.

[0106] Optionally, if the system identifies a missing patch installation status, it parses the corresponding patch identifier from the variable name. The system sends a query request to the enterprise's patch management system, carrying the asset identifier and patch identifier. The patch management system uses these two pieces of information to query the deployment record of the patch on the asset and returns the status (installed, not installed, or installation failed) as the target data item.

[0107] In an optional embodiment, after triggering the corresponding supplementary information collection operation, the method further includes: if the target data item is obtained within a preset time threshold, then the target data item is used to fill the variable name of the corresponding predicate, short-circuit evaluation is re-executed, and the association relationship is updated; if the target data item is not obtained within the preset time threshold, then an alarm message is output, and manually input correction information is received, the correction information is used to fill the variable name of the corresponding predicate, short-circuit evaluation is re-executed, and the association relationship is updated.

[0108] Optionally, after initiating supplementary information collection, the system starts a timer and waits for the target data item to be returned. If a result is received within the set time threshold, the system fills the data into the corresponding position of the variable name of the original missing predicate. Subsequently, the system automatically re-triggers the short-circuit evaluation process: starting from the first predicate, it evaluates the target value item by item. If a false value is found, the process terminates immediately; otherwise, if all values ​​are true, it is considered unfalsified. Finally, the system updates the association between the asset and the vulnerability based on the new results, such as changing it from unknown to unfalsified or falsified.

[0109] Optionally, the alarm information is a prompt generated by the system after a timeout, which includes asset identifiers, missing variable names, attempted data collection sources, and suggested investigation directions, and is used to notify security operations and maintenance personnel.

[0110] Optionally, if the target data item is not received within a preset time threshold, the system automatically generates an alarm message and pushes it to the security operations platform or the responsible person's email address. Simultaneously, the system retains the pending item in the management interface, allowing security personnel to manually view the context and input correction information. After the correction information is confirmed, the system fills the correction information as a valid value into the original predicate variable position, then re-executes the short-circuit evaluation process to re-determine the correlation and update the final result, such as changing it from unknown to unfalsified or falsified.

[0111] Optionally, through the above steps, the system constructs a complete closed-loop processing flow of automatic data collection, timeout alarm, manual correction, and automatic re-judgment, which solves the problem of missing information in security assessment.

[0112] In an optional embodiment, the method further includes: listening to version release events or periodically scanning version information sources to obtain the version number string of the new version; standardizing the version number string to obtain a standardized version identifier; determining the insertion position of the new version node and the parent node of the new version node in the target version tree based on the standardized version identifier; creating a new version node, wherein the inheritance flag of the new version node is set to true, the predicate set of the new version node is set to empty, and the overriding predicate mapping of the new version node is set to empty; and controlling the new version node to automatically inherit the falsification rule fragment of the parent node of the new version node.

[0113] Optionally, the system continuously monitors new versions in two ways: first, by listening to Webhook notifications from the version platform and receiving version release signals in real time; second, by actively scanning preset version information sources at fixed intervals (such as every morning) to capture the latest version number list.

[0114] Optionally, the standardized version identifier is structured version data that has been uniformly parsed and formatted, including fields such as major version number, minor version number, revision number and pre-release identifier, which facilitates accurate comparison and location by the system.

[0115] Optionally, the system performs three steps of cleaning, parsing, and conversion on the obtained version number string to eliminate the problem of inconsistent version number formats from different sources.

[0116] Optionally, cleaning is used to remove unnecessary modifiers from the version number string. A regular expression rule base is defined to match and remove common prefixes (such as "v", "ver", "version"), suffix modifiers (such as "-release", "-stable", "-final", "-SNAPSHOT"), and metadata (such as "+20220101"). The cleaned version number string retains the core numeric and delimiter sequences.

[0117] Optionally, parsing is used to extract semantic versioning components from the cleaned version number string. According to the semantic versioning specification, the core format of the version number string is: major version number, minor version number, and revision number separated by periods, followed by optional hyphenated pre-release identifiers and plus sign-separated build metadata. If the version number does not conform to this specification, a heuristic rule is used for parsing: count the number of period-separated segments; if there are two segments, they are treated as the major and minor version numbers respectively, with the revision number defaulting to zero; if there are four or more segments, the first three are treated as the major, minor, and revision numbers, and subsequent segments are treated as build tags. For cases where date format or hash value is used as the version identifier, a mapping table between version identifiers and semantic versioning is established, and the corresponding semantic version is obtained by querying the official software product release page or package manager metadata.

[0118] Optionally, the transformation is used to uniformly convert the parsed results into a comparable version data structure. This data structure contains at least four fields: a major version number, a minor version number, a revision number, and a pre-release identifier string. During version comparison, the major version number is compared first; if they are the same, the minor version number is compared; if they are still the same, the revision number is compared; if all three are the same, the lexicographical order of the pre-release identifier determines the version order. For official versions that do not contain a pre-release identifier, they have higher priority than pre-release versions that do contain a pre-release identifier. The standardized version number is used for locating version tree nodes, and the version number field stored in the version tree nodes also uses the same data structure.

[0119] Optionally, the system searches layer by layer in the target version tree based on the major, minor, and revision numbers of the standardized version identifier: if the major version number "2" already exists, it enters the "2.x" subtree; if the minor version number "17" does not exist under "2.x", it creates a minor version node "2.17.x" and uses it as the parent node of the new version; if "2.17.x" already exists and the revision number is "0", the new version is the revision version, and its parent node is "2.17.x". The system determines the insertion level and parent node through version number matching, does not create duplicate nodes, and only expands the tree structure when necessary. After determining the insertion position and parent node, a new node object is created, and the new node's properties are set as follows: the inheritance flag is forced to true; the predicate set is initialized to an empty list; and the overriding predicate mapping is initialized to an empty dictionary. The version number field of the node is filled with the standardized version identifier, and the type is determined according to the level (e.g., "2.17.0" is a revision version node). After the node is created, it is stored in the target version tree as a node in the graph database.

[0120] Optionally, after the new version node is created, the system reads the falsification rule fragment of the parent node of the new version node and copies all the content completely into the memory structure of the new version node. This process does not modify the parent node or trigger any additional calculations; it is simply a data copy. The inherited child node possesses all the rule capabilities of the parent node and can add new rules or overwrite old rules on top of it.

[0121] Optionally, the system enables new versions to automatically propagate and extend rules at zero cost, so that existing falsification conditions do not need to be redefined and all general rules take effect automatically. This reduces the workload of rule maintenance, avoids evaluation blind spots caused by omissions, and keeps version updates and vulnerability protection highly synchronized.

[0122] In an optional embodiment, the method further includes: monitoring vulnerability database update events to obtain vulnerability announcements for new vulnerabilities; extracting affected product identifiers, affected version range descriptions, and patch version numbers from the vulnerability announcements; if the affected product identifier matches a product identifier in an asset labeling request, resolving the affected version range description into one or more version range objects; in the target version tree, obtaining all version nodes falling into the version range objects, tracing upwards along the path of each version node to the root node, and finding the node where all paths first intersect as the lowest common ancestor node; creating a falsification rule fragment for the new vulnerability on the lowest common ancestor node, wherein the inheritance flag of the lowest common ancestor node is true, the predicate set of the lowest common ancestor node includes a predicate of version range type, and the overriding predicate mapping of the lowest common ancestor node is empty.

[0123] Optionally, the system can continuously monitor for new vulnerability releases by subscribing to webhook interfaces provided by the vulnerability database or periodically polling public APIs. Once an update is detected, the system automatically retrieves the full text of the corresponding vulnerability announcement, caches it in raw text format, and uses it as input data for subsequent analysis.

[0124] Optionally, the system performs structured parsing on the vulnerability announcement text, using preset keyword matching rules and regular expressions to extract three key pieces of information: the affected product identifier, the description of the affected version range, and the patch version number. Then, the system determines whether the extracted affected product identifier matches the product specified in the currently being processed asset labeling request. If a match is found, the affected version range description is semantically parsed and converted into one or more version range objects. For example, "2.0-beta9 to 2.14.1" is parsed into a lower bound of "2.0-beta9" and an upper bound of "2.14.1"; if the announcement describes multiple discontinuous ranges (such as "2.0–2.14, 3.0–3.2"), multiple version range objects are generated.

[0125] Optionally, the system searches for all revision node locations within the target version tree that fall within each version range object. For example, when the range is "[2.0-beta9, 2.14.1]", the system locates all nodes that satisfy this condition, such as "2.0-beta9", "2.14.0", and "2.14.1". For each located version node, the system starts from that node and ascends along the parent node path until it reaches the root node, forming a complete path. Then, the system compares all paths and finds the node where these paths first intersect, i.e., the lowest common ancestor node common to all affected versions.

[0126] Optionally, the system creates a new falsification rule fragment on the lowest common ancestor node, setting the following attributes: the inheritance flag is set to true, which helps subsequent versions inherit the rule; a new predicate is added to the predicate set, with the type being version range, the variable name being version, the operator being "belongs to range", and the constant value being the version range object obtained in the previous step; the overriding predicate mapping remains empty, not overriding any ancestor rules, only adding version constraints for this vulnerability. Subsequently, the falsification rule fragment is written to the version tree node as that node's response to the new vulnerability.

[0127] Optionally, through the above steps, the system achieves automatic rule injection for the scope of vulnerability impact. The system can insert a precise version constraint at the most appropriate position in the version tree without requiring any manual rule writing, automatically including all affected versions within the risk scope.

[0128] Figure 2 This is an execution flowchart of an optional digital asset and vulnerability association labeling system according to an embodiment of this application. Figure 2 As shown, the system first constructs a version tree for the target software product, using nodes to represent version categories and edges to represent inclusion relationships. Rule fragments containing inheritance tags, newly added predicates, and overriding mappings are distributed across the version tree nodes. Based on the priority principle of precise matching of the capital version number within the version tree, the system locates the corresponding version node. From the located node, it traverses the path from bottom to top, merging rule fragments to form a set of valid falsification rules. The valid rule set is then evaluated using a lazy evaluation and early stopping strategy, employing conjunctive evaluation to determine its state (i.e., short-circuit evaluation). Finally, a structured annotation result containing the falsification state, version tree path, and triggering predicate information is output. Furthermore, when a new version is released, inserted nodes automatically inherit rules from their parent nodes, fixing the overriding mappings added in the new version; when a new vulnerability is disclosed, version range predicates are injected into the lowest common ancestor node and automatically propagate along the version tree.

[0129] Figure 3 This is a schematic diagram of an optional digital asset and vulnerability association labeling device according to an embodiment of this application. According to another aspect of an embodiment of this application, a digital asset and vulnerability association labeling device is also provided, including: a determining unit 301, an acquiring unit 302, a generating unit 303, and a labeling unit 304.

[0130] The system includes the following components: a determination unit 301, which receives an asset labeling request and determines a target version node based on the request, wherein the target version node is located on a target version tree in a preset version tree database that matches the asset labeling request; an acquisition unit 302, which retrieves a falsification rule fragment stored on each accessed node, starting from the target version node, wherein the falsification rule fragment includes an inheritance tag, a predicate set, and a covering predicate mapping; a generation unit 303, which generates a target predicate collection list based on the falsification rule fragment of each accessed node, wherein the target predicate collection list stores currently active predicates; and a labeling unit 304, which performs short-circuit evaluation on the predicates in the target predicate collection list according to priority, generates target values, and labels the association between digital assets and vulnerabilities based on the target values, wherein the short-circuit evaluation is used to terminate the evaluation process early when at least one predicate in the target predicate collection list has a false target value.

[0131] Optionally, the determining unit 301 includes: a first obtaining subunit, used to obtain asset fingerprint information from the asset labeling request, the asset fingerprint information including a product identifier and a product version number; a second obtaining subunit, used to obtain the version tree corresponding to the product identifier as the target version tree in the version tree database, wherein the version tree includes a root node, a major version node, a minor version node, a revision version node, and a build version node; and a determining subunit, used to select the node corresponding to the product version number as the target version node in the target version tree.

[0132] Optionally, the sub-unit is determined as follows: a first determination module, configured to, for each node in the target version tree, if there exists a revision version node whose version number range description is consistent with the product version number, then take that revision version node as the target version node; a second determination module, configured to, if there is no revision version node, but there exists a build version node whose version number range description is consistent with the product version number, then take that build version node as the target version node; a third determination module, configured to, if there are no revision version nodes and build version nodes, but there exists a minor version node whose version number range description includes the product version number, then take that minor version node as the target version node; a fourth determination module, configured to, if there are no revision version nodes, build version nodes, and minor version nodes, but there exists a major version node whose version number range description includes the product version number, then take that major version node as the target version node; a fifth determination module, configured to, if there are no revision version nodes, build version nodes, minor version nodes, and major version nodes, but there exists a root node whose version number range description includes the product version number, then take that root node as the target version node; wherein, the version number range description is a set of versions stored in each node of the target version tree that represents the version range covered by that node.

[0133] Optionally, the generation unit 303 includes: a creation subunit for creating an initial predicate collection list and an initial predicate replacement record, wherein both the initial predicate collection list and the initial predicate replacement record are empty; a first judgment subunit for performing a target operation to obtain a target predicate collection list for each accessed node if the inheritance flag of the accessed node is true, wherein the target operation is used to populate the initial predicate collection list and the initial predicate replacement record; and a second judgment subunit for stopping upward access to nodes if the inheritance flag of the accessed node is false.

[0134] Optionally, the first judgment subunit includes: a first judgment module, used for the predicate identifier of each predicate in the predicate set of the accessed node, and if the predicate identifier does not exist in the predicate replacement record, then adding the predicate corresponding to the predicate identifier to the initial predicate collection list; a second judgment module, used for each mapping entry in the overriding predicate mapping of the accessed node, adding the identifier of the overriding predicate in the mapping entry to the initial predicate replacement record, and adding the new predicate specified in the mapping entry to the initial predicate collection list, and if the predicate identifier of the new predicate already exists in the initial predicate collection list, then removing the original predicate corresponding to the new predicate from the initial predicate collection list.

[0135] Optionally, each predicate includes a predicate identifier, a predicate type, a variable name, and an operator; the predicate type includes version range type, configuration item equality type, file existence type, class existence type, and patch application type; the operator includes equal to, not equal to, belong to range, and not belong to range.

[0136] Optionally, the priority includes predicates of patch application type taking precedence over predicates of version range type, predicates of version range type taking precedence over predicates of configuration item equality type, predicates of configuration item equality type taking precedence over predicates of class existence type, and predicates of class existence type taking precedence over predicates of file existence type; among predicates of the same type, predicates whose operators are equal to or not equal to take precedence over predicates whose operators are belonging to or not belonging to a range.

[0137] Optionally, the annotation unit 304 includes: an acquisition subunit, used to acquire, for each predicate in the target predicate acquisition list, the actual value corresponding to the variable name from the asset fingerprint information based on the variable name of the predicate; a first judgment subunit, used to determine the target value as true if the actual value and the variable name satisfy the operator definition of the predicate; and a second judgment subunit, used to determine the target value as false if the actual value and the variable name do not satisfy the operator definition of the predicate.

[0138] Optionally, the annotation unit 304 further includes: a first annotation subunit, used to terminate short-circuit evaluation and mark the association as falsified when the target value of any predicate in the target predicate collection list is false; a second annotation subunit, used to mark the association as unfalsified when the target values ​​of all predicates in the target predicate collection list are true; and a third annotation subunit, used to mark the association as unknown when at least one predicate in the target predicate collection list cannot obtain the corresponding actual value in the asset fingerprint information based on the variable name of the predicate, and no predicate in the target predicate collection list has a target value of false.

[0139] Optionally, the digital asset and vulnerability association labeling device further includes: a variable name generation unit, used to record the variable names of predicates whose actual values ​​cannot be obtained from asset fingerprint information, and generate a variable name list; a missing data item determination unit, used to determine the missing data item corresponding to each variable name in the variable name list, wherein the missing data item includes configuration item values, patch installation status, runtime configuration information or system attribute values; and a target data item generation unit, used to trigger a supplementary information collection operation to the corresponding collection source based on the missing data item, and obtain the target data item.

[0140] Optionally, the target data item generation unit includes: a first generation subunit, configured to send a first query request to the configuration management database or asset mapping system if the missing data item is a configuration item value or a system attribute value, and receive the target data item returned by the configuration management database or asset mapping system, wherein the first query request includes an asset identifier and the name of the configuration item or system attribute corresponding to the missing data item, and the asset identifier is extracted from the asset fingerprint information carried in the asset labeling request; a second generation subunit, configured to send a collection instruction to the information collection agent deployed on the asset side if the missing data item is runtime configuration information, and receive the target data item returned by the information collection agent, wherein the collection instruction is used to obtain the current actual value of the runtime configuration information; and a third generation subunit, configured to send a second query request to the patch management system if the missing data item is a patch installation status, and receive the target data item returned by the patch management system, wherein the second query request includes the patch identifier corresponding to the patch installation status.

[0141] Optionally, the digital asset and vulnerability association labeling device further includes: a first updating unit, configured to, if the target data item is obtained within a preset time threshold, fill the variable name of the corresponding predicate with the target data item, re-execute short-circuit evaluation, and update the association; and a second updating unit, configured to, if the target data item is not obtained within the preset time threshold, output alarm information, receive manually input correction information, fill the variable name of the corresponding predicate with the correction information, re-execute short-circuit evaluation, and update the association.

[0142] Optionally, the digital asset and vulnerability association labeling device further includes: a first monitoring unit, used to monitor version release events or periodically scan version information sources to obtain the version number string of the new version; to standardize the version number string to obtain a standardized version identifier; a position determination unit, used to determine the insertion position of the new version node and the parent node of the new version node in the target version tree based on the standardized version identifier; a node creation unit, used to create a new version node, wherein the inheritance flag of the new version node is set to true, the predicate set of the new version node is set to empty, and the overriding predicate mapping of the new version node is set to empty; and an inheritance unit, used to control the new version node to automatically inherit the falsification rule fragment of the parent node of the new version node.

[0143] Optionally, the digital asset and vulnerability association labeling device further includes: a second monitoring unit for monitoring vulnerability database update events and obtaining vulnerability announcements for new vulnerabilities; an extraction unit for extracting the affected product identifier, affected version range description, and patch version number from the vulnerability announcement; a parsing unit for parsing the affected version range description into one or more version range objects if the affected product identifier matches the product identifier in the asset labeling request; a tracing unit for obtaining all version nodes falling into the version range objects in the target version tree, tracing upwards along the path of each version node to the root node, and finding the node where all paths first intersect as the lowest common ancestor node; and a falsification rule fragment creation unit for creating falsification rule fragments for new vulnerabilities on the lowest common ancestor node, wherein the inheritance flag of the lowest common ancestor node is true, the predicate set of the lowest common ancestor node includes a predicate of version range type, and the overriding predicate mapping of the lowest common ancestor node is empty.

[0144] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0145] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0146] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0147] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0148] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0149] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0150] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for labeling the correlation between digital assets and vulnerabilities, characterized in that, include: Receive an asset labeling request and determine a target version node based on the asset labeling request, wherein the target version node is located on the target version tree in the preset version tree database that matches the asset labeling request; Starting from the target version node, obtain the falsification rule fragments stored on each accessed node, wherein the falsification rule fragments include inheritance tags, predicate sets, and overriding predicate mappings; Based on the falsification rule fragment of each accessed node, a target predicate collection list is obtained, wherein the target predicate collection list is used to store the currently effective predicates; The predicates in the target predicate collection list are evaluated in order of priority using short-circuit evaluation to generate target values. The association between digital assets and vulnerabilities is marked according to the target values. The short-circuit evaluation is used to terminate the evaluation process in advance when there is at least one predicate in the target predicate collection list whose target value is false.

2. The method according to claim 1, characterized in that, Determining the target version node based on the asset labeling request includes: Obtain asset fingerprint information from the asset labeling request, the asset fingerprint information including product identifier and product version number; In the version tree database, the version tree corresponding to the product identifier is obtained as the target version tree, wherein the version tree includes a root node, a major version node, a minor version node, a revision version node, and a build version node; In the target version tree, the node corresponding to the product version number is taken as the target version node.

3. The method according to claim 2, characterized in that, In the target version tree, the node corresponding to the product version number is designated as the target version node, including: For each node in the target version tree, if there exists a revised version node whose version number range description is consistent with the product version number, then the revised version node shall be regarded as the target version node. If the revision version node does not exist, but a build version node exists whose version number range description is consistent with the product version number, then the build version node is taken as the target version node; If the revision version node and the build version node do not exist, but the sub-version node whose version number range description includes the product version number exists, then the sub-version node is taken as the target version node. If the revision version node, build version node, and minor version node do not exist, but a major version node exists whose version number range description includes the product version number, then the major version node is taken as the target version node. If the revision node, build node, minor version node, and major version node do not exist, but a root node exists whose version number range description includes the product version number, then that root node is taken as the target version node. The version number range is described as the set of versions stored in each node of the target version tree to represent the version range covered by that node.

4. The method according to claim 1, characterized in that, Based on the falsification rule fragment for each visited node, a target predicate collection list is obtained, including: Create an initial predicate collection list and an initial predicate replacement record, wherein both the initial predicate collection list and the initial predicate replacement record are empty; For each accessed node, if the inheritance flag of the accessed node is true, then the target operation is performed to obtain the target predicate collection list, wherein the target operation is used to populate the initial predicate collection list and the initial predicate replacement record; If the inheritance flag of the visited node is false, then the upward access to nodes is stopped.

5. The method according to claim 4, characterized in that, The target operation includes the following steps: For each predicate in the predicate set of the accessed node, if the predicate identifier does not exist in the predicate replacement record, then the predicate corresponding to the predicate identifier is added to the initial predicate collection list; For each mapping entry in the overriding predicate mapping of the accessed node, the identifier of the overriding predicate in the mapping entry is added to the initial predicate replacement record, and the new predicate specified in the mapping entry is added to the initial predicate collection list. If the predicate identifier of the new predicate already exists in the initial predicate collection list, the original predicate corresponding to the new predicate is removed from the initial predicate collection list.

6. The method according to claim 5, characterized in that, Each predicate includes a predicate identifier, a predicate type, a variable name, and an operator; the predicate type includes version range type, configuration item equality type, file existence type, class existence type, and patch application type; the operator includes equal to, not equal to, belong to range, and not belong to range.

7. The method according to claim 6, characterized in that, The priority includes that the predicate of the patch application type takes precedence over the predicate of the version range type, the predicate of the version range type takes precedence over the predicate of the configuration item equality type, the predicate of the configuration item equality type takes precedence over the predicate of the class existence type, and the predicate of the class existence type takes precedence over the predicate of the file existence type; among predicates of the same type, the predicate whose operator is equal to or not equal to takes precedence over the predicate whose operator is belonging to or not belonging to the range.

8. The method according to claim 6, characterized in that, The predicates in the target predicate collection list are evaluated using short-circuit evaluation in order of priority to generate target values, including: For each predicate in the target predicate collection list, the actual value corresponding to the variable name is obtained from the asset fingerprint information based on the variable name of the predicate; If the actual value and the variable name satisfy the relationship defined by the operator of the predicate, then the target value is determined to be true; If the actual value and the variable name do not satisfy the relationship defined by the operator of the predicate, then the target value is determined to be false.

9. The method according to claim 8, characterized in that, The association between the digital asset and the vulnerability is marked based on the target value, including: When the target value of any predicate in the target predicate collection list is false, the short-circuit evaluation is terminated and the association is marked as falsified. When the target value of all the predicates in the target predicate collection list is true, the association is marked as unfalsified. If at least one of the predicates in the target predicate collection list cannot obtain the corresponding actual value in the asset fingerprint information based on the variable name of the predicate, and the target value of no predicate in the target predicate collection list is false, then the association relationship is marked as unknown.

10. The method according to claim 8, characterized in that, When the association is marked as unknown, the method further includes: Record the variable names of the predicates whose actual values ​​cannot be obtained based on the asset fingerprint information, and generate a list of variable names; For each variable name in the variable name list, determine the missing data item corresponding to that variable name, wherein the missing data item includes configuration item values, patch installation status, runtime configuration information, or system attribute values; Based on the missing data item, a supplementary information collection operation is triggered to the corresponding collection source to obtain the target data item.

11. The method according to claim 10, characterized in that, The supplementary information collection operation includes: If the missing data item is a value of the configuration item or a value of the system attribute, a first query request is sent to the configuration management database or the asset mapping system, and the target data item returned by the configuration management database or the asset mapping system is received. The first query request includes an asset identifier and the name of the configuration item or system attribute corresponding to the missing data item. The asset identifier is extracted from the asset fingerprint information carried in the asset labeling request. If the missing data item is the runtime configuration information, a collection instruction is sent to the information collection agent deployed on the asset side, and the target data item returned by the information collection agent is received. The collection instruction is used to obtain the current actual value of the runtime configuration information. If the missing data item corresponds to the patch installation status, a second query request is sent to the patch management system, and the target data item returned by the patch management system is received. The second query request includes the patch identifier corresponding to the patch installation status.

12. The method according to claim 10, characterized in that, After triggering the corresponding supplementary information collection operation, the method further includes: If the target data item is obtained within the preset time threshold, the target data item is used to fill the variable name of the corresponding predicate, the short-circuit evaluation is re-executed, and the association relationship is updated. If the target data item is not obtained within the preset time threshold, an alarm message is output, and manual correction information is received. The correction information is used to fill the variable name of the corresponding predicate, the short-circuit evaluation is re-executed, and the association relationship is updated.

13. The method according to claim 1, characterized in that, The method further includes: Listen for version release events or periodically scan version information sources to obtain the version number string of the new version; The version number string is standardized to obtain a standardized version identifier; In the target version tree, the insertion position of the new version node and the parent node of the new version node are determined according to the standardized version identifier; Create the new version node, wherein the inheritance flag of the new version node is set to true, the predicate set of the new version node is set to empty, and the overriding predicate mapping of the new version node is set to empty; Control the new version node to automatically inherit the falsification rule fragment of the parent node of the new version node.

14. The method according to claim 1, characterized in that, The method further includes: Monitor vulnerability database update events and obtain vulnerability announcements for new vulnerabilities; Extract the affected product identifier, the description of the affected version range, and the patch version number from the vulnerability announcement; If the affected product identifier matches the product identifier in the asset labeling request, then the affected version range description is parsed into one or more version range objects; In the target version tree, obtain all version nodes that fall into the version interval object, trace upwards along the path of each version node to the root node, and find the node where all paths first intersect as the lowest common ancestor node. Create the falsification rule fragment for the new vulnerability on the lowest common ancestor node, wherein the inheritance flag of the lowest common ancestor node is true, the predicate set of the lowest common ancestor node includes a version range type predicate, and the overriding predicate mapping of the lowest common ancestor node is empty.

15. A device for annotating the association between digital assets and vulnerabilities, characterized in that, include: A determining unit is configured to receive an asset labeling request and determine a target version node based on the asset labeling request, wherein the target version node is located on a target version tree in a preset version tree database that matches the asset labeling request; The acquisition unit is used to acquire the falsification rule fragments stored on each accessed node, starting from the target version node, wherein the falsification rule fragments include inheritance tags, predicate sets, and overriding predicate mappings; A generation unit is used to obtain a target predicate collection list based on the falsification rule fragment of each accessed node, wherein the target predicate collection list is used to store the currently effective predicates; The annotation unit is used to perform short-circuit evaluation on the predicates in the target predicate collection list in order of priority, generate target values, and annotate the association between digital assets and vulnerabilities according to the target values. The short-circuit evaluation is used to terminate the evaluation process in advance when there is at least one predicate in the target predicate collection list whose target value is false.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device on which the computer-readable storage medium is located performs the digital asset and vulnerability association labeling method according to any one of claims 1 to 14.

17. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the digital asset and vulnerability association labeling method according to any one of claims 1 to 14.

18. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement the digital asset and vulnerability association labeling method as described in any one of claims 1 to 14.

Images