A vulnerability processing method based on a multi-element and risk quantification model

Abstract

The application provides a vulnerability processing method based on a multi-element and risk quantification model, which comprises the following steps: identifying network assets through an asset automatic discovery engine, establishing asset baselines and periodically comparing, identifying abnormal assets and calculating asset risk weights, and forming an asset database; constructing a risk quantification model based on three elements of vulnerability V, asset A and threat T, calculating the risk value of each asset-vulnerability correlation pair and performing priority sorting; generating a treatment work order according to the priority and assigning it to a processing object, tracking the repair progress and performing automatic verification, and closing the work order after verification; acquiring external threat intelligence in real time and matching it with the asset database, warning and emergency response for high-risk assets, and feeding back the intelligence data to the risk quantification model to dynamically update the risk value and priority. The application can realize intelligent management of the whole life cycle of vulnerabilities, and significantly improve the vulnerability disposal efficiency and the network security risk prevention and control capability.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a vulnerability handling method based on a multi-factor and risk quantification model. Background Technology

[0002] As cyberattacks become increasingly industrialized and tool-based, vulnerability exploitation cycles have drastically shortened from the traditional monthly timeframe to days or even hours. High-risk vulnerabilities can trigger large-scale attacks within hours of being publicly disclosed. Enterprises commonly face core pain points in vulnerability remediation, including unclear asset inventory, a massive number of vulnerabilities, chaotic remediation priorities, incomplete handling processes, and a disconnect between threat intelligence and local assets. Traditional vulnerability management models mostly remain at the rudimentary stage of scanning and exporting reports, relying solely on fixed CVSS scores to assess vulnerability severity. This fails to consider the business value of assets, exposure levels, and real-time threat landscape, resulting in limited security resources being consumed by numerous low-risk vulnerabilities, while high-risk vulnerabilities that truly impact core business operations cannot be remediated in a timely manner.

[0003] Currently, mainstream vulnerability management products and technical solutions still have significant limitations: some products only have vulnerability discovery capabilities and lack unified asset management, risk assessment, and closed-loop handling mechanisms; some simple platform-type products only realize the aggregation and display of multi-source vulnerability data, without building a scientific multi-dimensional risk quantification model, and cannot accurately distinguish the actual risk level of vulnerabilities; most products do not integrate automated workflow engines, and vulnerability handling relies on manual offline processes, which are invisible and untraceable; at the same time, existing solutions generally lack the ability to link threat intelligence in real time, and cannot achieve early detection and rapid response to sudden high-risk vulnerabilities, making it difficult to meet the requirements of practical security operations. Summary of the Invention

[0004] In view of this, the embodiments of this application provide a vulnerability handling method based on a multi-factor and risk quantification model, which can realize intelligent management of the entire vulnerability lifecycle and significantly improve the efficiency of vulnerability handling and the ability to prevent and control network security risks.

[0005] The technical solution of this application embodiment is implemented as follows: In a first aspect, embodiments of this application provide a vulnerability handling method based on a multi-factor and risk quantification model, comprising the following steps: The system uses an automatic asset discovery engine to identify online assets, establish asset baselines and perform periodic comparisons, identify abnormal assets and calculate asset risk weights to form an asset database. Based on the asset data and asset risk weights in the asset database, combined with vulnerability information obtained from vulnerability scanning and real-time threat intelligence data, a risk quantification model is constructed, which includes vulnerability element V, asset element A, and threat element T. The risk value of each asset-vulnerability pair is calculated based on the risk quantification model, and the priority of vulnerability handling is ranked according to the risk value. Based on the obtained vulnerability handling priority ranking results, corresponding handling work orders are generated and assigned to the handling objects. The work order repair progress is tracked, and automated verification is performed after the repair is completed. The work order is closed after verification. The system acquires external threat intelligence in real time and automatically matches it with the asset database. It provides real-time early warning and emergency response for assets with high-risk vulnerabilities and feeds newly acquired threat intelligence data back to the risk quantification model to dynamically update vulnerability risk values ​​and handling priorities.

[0006] Secondly, embodiments of this application also provide a vulnerability processing device based on a multi-factor and risk quantification model, the device comprising: The identification module is used to identify network assets through the automatic asset discovery engine, establish asset baselines and perform periodic comparisons, identify abnormal assets and calculate asset risk weights to form an asset database. The construction module is used to construct a risk quantification model containing vulnerability element V, asset element A, and threat element T based on asset data and asset risk weights in the asset database, combined with vulnerability information obtained from vulnerability scanning and threat intelligence data acquired in real time. Based on the risk quantification model, the risk value of each asset-vulnerability association pair is calculated, and the vulnerability handling priority is sorted according to the risk value. The processing module is used to generate corresponding level processing work orders based on the obtained vulnerability handling priority ranking results and assign them to the processing objects, track the work order repair progress, and perform automated verification after the repair is completed. After verification, the work order is closed. The update module is used to acquire external threat intelligence in real time and automatically match it with the asset database. It provides real-time early warning and emergency response for assets with high-risk vulnerabilities and feeds back the newly acquired threat intelligence data to the risk quantification model to dynamically update the vulnerability risk value and handling priority.

[0007] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a storage medium, and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the vulnerability handling method based on a multi-factor and risk quantification model as described in any of the first aspects.

[0008] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, performs the vulnerability handling method based on a multi-factor and risk quantification model as described in any one of the first aspects.

[0009] The embodiments of this application have the following beneficial effects: By automatically discovering assets, comparing baselines, and calculating risk weights, the fundamental problem of unclear asset inventory in vulnerability management was first solved, providing accurate asset data for subsequent risk assessment. Based on this, a three-factor risk quantification model (Vulnerability V-Asset A-Threat T) was constructed, independently calculating and ranking the risk of each asset-vulnerability pair, breaking through the limitations of traditional single-scoring models and achieving a scientific prioritization of vulnerability remediation. Furthermore, through automatic work order allocation, progress tracking, and automated verification, a closed-loop management system for the entire vulnerability process from discovery to closure was completed, significantly improving vulnerability handling efficiency. Simultaneously, through real-time threat intelligence matching and early warning, and a model feedback iteration mechanism, dynamic risk assessment and rapid emergency response were achieved, forming a complete vulnerability governance closed loop and comprehensively enhancing cybersecurity risk prevention and control capabilities. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart illustrating steps S101-S104 provided in the embodiments of this application; Figure 2 This is an example diagram of the weighting factors for each dimension in the risk model provided in the embodiments of this application; Figure 3 This is a schematic diagram of the vulnerability processing device based on a multi-factor and risk quantification model provided in an embodiment of this application; Figure 4 This is a schematic diagram of the composition structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0013] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0014] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0015] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0016] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application and is not intended to limit this application.

[0018] See Figure 1 , Figure 1This is a flowchart illustrating steps S101-S104 of the vulnerability handling method based on a multi-factor and risk quantification model provided in this application embodiment, which will be combined with... Figure 1 Steps S101-S104 are explained below.

[0019] In step S101, network assets are identified through an automatic asset discovery engine, an asset baseline is established and periodically compared, abnormal assets are identified and asset risk weights are calculated to form an asset database. In step S102, based on the asset data and asset risk weights in the asset database, combined with the vulnerability information obtained from vulnerability scanning and the threat intelligence data acquired in real time, a risk quantification model containing vulnerability element V, asset element A and threat element T is constructed. Based on the risk quantification model, the risk value of each asset-vulnerability pair is calculated, and the vulnerability handling priority is sorted according to the risk value. In step S103, based on the obtained vulnerability handling priority ranking results, corresponding handling work orders are generated and assigned to the handling objects. The work order repair progress is tracked, and automated verification is performed after the repair is completed. The work order is closed after verification. In step S104, external threat intelligence is acquired in real time and automatically matched with the asset database. Real-time early warning and emergency response are carried out for assets with high-risk vulnerabilities. The newly acquired threat intelligence data is fed back to the risk quantification model to dynamically update the vulnerability risk value and handling priority.

[0020] First, an automatic asset discovery engine identifies all assets within the enterprise's cyberspace. After identification, an initial asset baseline is established based on the initially discovered asset data. This baseline records all asset information under normal enterprise conditions. Subsequently, the network assets are rescanned according to a preset period (e.g., daily, weekly, or monthly), and the scan results are compared with the asset baseline to automatically identify abnormal assets such as newly added, missing, and changed assets. Simultaneously, this embodiment automatically calculates the risk weight of each asset based on factors such as its exposure level and business importance, ultimately forming an asset database containing all asset information and risk weights.

[0021] Next, the system integrates asset data and asset risk weights from the asset database with vulnerability information obtained from vulnerability scanning and real-time threat intelligence data to construct a three-element risk quantification model comprising vulnerability element V, asset element A, and threat element T. This model performs independent risk calculations for each asset-vulnerability pair, obtaining a comprehensive risk value for each pair. The system then sorts all vulnerabilities from highest to lowest based on the calculated comprehensive risk values, generating a vulnerability remediation priority list.

[0022] Then, based on the vulnerability handling priority ranking obtained in the previous step, the system will automatically generate corresponding handling work orders and accurately assign them to the responsible parties for that asset according to preset allocation rules. During the work order processing, the system will track the repair progress of the work order throughout and update the work order status in real time. When the responsible party submits a repair completion request, the system will automatically trigger an automated verification task for the corresponding vulnerability of the asset, re-scanning to verify whether the vulnerability has been successfully repaired. If the verification passes, the system will automatically update the vulnerability status to repaired and close the work order; if the verification fails, the system will return the work order to the responsible party, requiring them to repair it again.

[0023] Finally, the system will obtain the latest threat intelligence data from external threat intelligence sources in real time and automatically match the obtained threat intelligence with the local asset database. If a high-risk vulnerability matching the threat intelligence is found in a local asset, the system will immediately issue a real-time alert for that asset and initiate the corresponding emergency response process. At the same time, the system will feed the newly acquired threat intelligence data back to the risk quantification model, dynamically update the threat element parameters in the model, and then recalculate the risk value and handling priority of all asset-vulnerability pairs.

[0024] In some embodiments, the asset auto-discovery engine collaboratively collects raw asset data through a TIER1 centralized management platform, a TIER2 network probe, and a TIER3 local agent. It then performs multi-source fusion and attribute rule mapping on the collected asset data to establish the asset database, which includes flag attributes and data attributes. The asset baseline is generated based on the initial asset data in the asset database and is used for subsequent periodic asset comparisons.

[0025] The TIER1 centralized management platform, deployed in the enterprise's security management center, serves as the core control and data processing center for the entire automated asset discovery engine. It is responsible for formulating asset discovery strategies, scheduling TIER2 network probes and TIER3 local agents to execute collection tasks, receiving and processing the collected raw asset data, storing and managing the asset database, providing a query and display interface for asset information, and enabling integration with third-party systems. The TIER2 network probes are deployed in various key areas of the enterprise network, such as near core switches and at the exit points of various business partitions. Through remote network scanning, it actively probes network assets in its area, obtaining network and transport layer attribute information such as IP addresses, MAC addresses, open ports, running services, and operating system types. The TIER3 local agent is installed on target assets such as servers, workstations, and terminal devices within the enterprise. By calling the asset's local system interfaces, it can obtain more accurate and detailed local asset information, including a list of installed software, software versions, running processes, system configurations, and hardware information.

[0026] After collecting the raw asset data, the system performs multi-source fusion processing, integrating asset data from different sources and formats, including TIER2 network probes, TIER3 local agents, and third-party asset management systems. This eliminates data redundancy and inconsistencies, creating a unified asset view. Simultaneously, the system uses an attribute rule mapping mechanism to automatically convert machine-recognized natural asset attributes into the human-managed attributes required for internal enterprise management. The resulting asset database contains two categories: identifier attributes and data attributes. Identifier attributes uniquely identify an asset, while data attributes describe various asset characteristics. Based on the initial asset data in the database, the system automatically generates an asset baseline. This baseline serves as the benchmark for subsequent periodic asset comparisons, enabling timely detection of asset changes.

[0027] In some embodiments, the multi-source fusion specifically includes: The system sequentially performs data extraction, format conversion, and data cleaning operations on asset data imported from a third-party asset management system, converting the preprocessed data into a unified asset import format and integrating it into the local asset database. The attribute rule mapping specifically includes: pre-establishing mapping rules between the natural attributes of assets and the attributes managed by humans, and automatically mapping the machine-recognized natural attributes to management attributes during the asset discovery process.

[0028] The multi-source fusion process mainly includes data extraction, format conversion, and data cleaning. Data extraction refers to the system extracting necessary asset attribute fields from third-party asset management systems (such as CMDB, ITSM, etc.). These fields typically include asset number, asset name, IP address, MAC address, department, and responsible person. Format conversion involves converting data in different formats (such as JSON, XML, CSV, etc.) extracted from third-party systems into a unified data format supported by the local asset database, ensuring correct import and storage. Data cleaning involves quality checks and processing of the converted data, including deleting duplicate data, correcting erroneous data, completing missing data, and standardizing data. For example, the system automatically identifies and merges multiple records for the same asset, unifies date data in different formats into a standard format, marks missing responsible person information, and prompts the administrator to supplement it. The pre-processed data is then converted to a unified asset import format and integrated into the local asset database, combining it with locally collected asset data.

[0029] Attribute rule mapping refers to the system's pre-established mapping rule base between the natural attributes of assets and their manually managed attributes. During asset discovery, the system automatically maps machine-recognized natural attributes to corresponding managed attributes based on these rules. Natural asset attributes refer to inherent attributes that can be directly obtained through technical means, such as IP address, MAC address, operating system type, and open ports. Manually managed attributes refer to attributes defined by the enterprise for internal management purposes, such as organizational structure, business lines, asset level, and geographical location. Mapping rules can be flexibly configured by administrators according to the enterprise's actual situation, supporting various mapping relationships such as one-to-one, one-to-many, and many-to-one. For example, an administrator can configure a rule: IP address range 192.168.1.0 / 24 corresponds to organizational structure = R&D department. When the system discovers assets within this IP range, it will automatically set their organizational structure attribute to R&D department. Another rule can be configured: operating system type = Windows Server 2019 corresponds to asset level = important, automatically setting the asset level for servers running this operating system. This automatic mapping mechanism greatly reduces the workload of manually maintaining asset information and improves the efficiency and accuracy of asset management.

[0030] In some embodiments, before constructing a risk quantification model, a vulnerability scanning task is performed to obtain vulnerability information. Each vulnerability information obtained from the scan is then bound to the corresponding asset in the asset database using a unique asset tag to form an asset-vulnerability association dataset. The asset-vulnerability association dataset and real-time threat intelligence data are used together as inputs to the risk quantification model.

[0031] Before executing a vulnerability scan, the system formulates a scanning strategy based on asset information in the asset database, determining parameters such as the scope of assets to be scanned, scanning ports, and scanning plugins. After the scan is completed, the system obtains vulnerability scan results containing information such as vulnerability CVE number, vulnerability name, vulnerability description, CVSS score, and affected versions. Next, the system binds each vulnerability entry to a corresponding asset in the asset database, based on a unique asset tag. A unique asset tag is a globally unique identifier assigned to each asset by the system, typically in UUID (Universally Unique Identifier) ​​format, ensuring that no duplicate asset identifiers appear throughout the system. Binding through unique asset tags effectively avoids vulnerability-asset mismatches caused by IP address changes, duplicate hostnames, or other reasons.

[0032] After the binding is complete, the system generates an asset-vulnerability association dataset. Each record in this dataset contains a unique identifier for an asset and a unique identifier for a vulnerability present on that asset, as well as the association information between the two. If an asset has multiple vulnerabilities, the system generates multiple association records, each corresponding to one vulnerability; similarly, if a vulnerability affects multiple assets, the system also generates multiple association records, each corresponding to one asset. The generated asset-vulnerability association dataset, along with real-time threat intelligence data, is input into the risk quantification model as the foundation for model calculations. The risk quantification model performs independent risk calculations for each asset-vulnerability association record, obtaining a comprehensive risk value for each association pair. This approach ensures that the risk assessment results accurately reflect the actual risk of each specific vulnerability on each specific asset, providing a scientific and accurate basis for subsequent vulnerability mitigation decisions.

[0033] In some embodiments, see Figure 2 , Figure 2 This is an example diagram of the weighting factors for each dimension in the risk model provided in the embodiments of this application, such as... Figure 2 As shown, the first three columns of the table break down the three core elements, with each sub-factor corresponding to a specific data source and value standard. The Vulnerability (V) dimension, in addition to the traditional CVSS basic score, time score, and environment score, supplements two dynamic factors: vulnerability discussion popularity and vulnerability age, reflecting the speed of vulnerability propagation and the exploitation window on the internet. The Asset (A) dimension comprehensively covers the confidentiality, integrity, and availability (CIA) triple of information security, while also incorporating external accessibility and business importance, comprehensively assessing asset value from both technical and business perspectives. The Threat (T) dimension quantifies the current true state of network threats from multiple angles, including attack frequency, duration, exploitability (whether there is a Proof of Concept), and activity level.

[0034] The last three columns of the table clearly explain how the three elements interact to generate actual risks, as well as the specific dimensions for calculating these risks. The Combination Relationship column clearly demonstrates the formation logic of potential security incidents: a complete potential security incident consisting of asset + vulnerability + threat is only formed when three conditions are simultaneously met: the scan results are bound to a vulnerability and an asset; intelligence data is bound to a threat and a vulnerability; and intelligence data is bound to a threat and an asset. The Potential Incident Probability column corresponds to the conditional probability chain rule in the claims, calculating the likelihood of an incident occurring from multiple dimensions such as asset access probability, unauthorized access probability, and vulnerability exploitation difficulty. The Potential Incident Loss Factor column comprehensively assesses the various losses that may be caused after an incident occurs from four aspects: business availability, information leakage, asset damage, and corporate reputation.

[0035] This table design achieves full transparency and configurability in risk calculation. The weight and value standards for each factor can be adjusted according to the actual needs of different industries and enterprises. For example, the financial industry can increase the weight of information leakage losses and business availability losses, while the energy and industrial control industries can increase the weight of reliability protection levels and asset importance. This modular and scalable design enables the risk quantification model in this embodiment to adapt to various application scenarios such as finance, energy, and cloud services, while ensuring the objectivity, consistency, and traceability of risk assessment results.

[0036] In some embodiments, the risk quantification model adopts a four-layer computing architecture, and the calculation formula is as follows: ; Where R is the overall risk value; Let i represent the vulnerability element of the i-th vulnerability, the asset element of the i-th asset, and the threat element of the i-th threat, respectively. F is the function for determining potential safety accidents, taking the value 0 or 1. = ,in This indicates that the i-th vulnerability is associated with the j-th asset. This indicates that the j-th asset is associated with the k-th threat. This indicates that the i-th vulnerability is related to the k-th threat, and a potential security incident is determined only when all three are related. P is the probability function of a potential accident occurring. ; in, Let k be the prior probability of the occurrence of the k-th threat. Let be the conditional probability that the j-th asset is attacked when the k-th threat occurs. The conditional probability of exploiting the i-th vulnerability when the k-th threat attacks the j-th asset; Let k be the number of times the k-th threat has occurred in history. This represents the total number of times all threats have occurred throughout history. Let $k$ be the number of times the $k$-th threat attacked the $j$-th asset in history. This represents the number of times in history the k-th threat has exploited the i-th vulnerability to attack the j-th asset; W is the risk value function for a single potential accident. ,in Let n be the probability of the nth potential accident. Let i be the vulnerability weight of the i-th vulnerability. Let the importance weight of the j-th asset be... Let M be the loss factor for the m-th type of accident, where M is the total number of accident loss types. G is a combined risk value function for multiple potential accidents. , The weighting coefficient for the q-th risk value. , The maximum value among all individual potential accident risk values. This represents the q-th individual potential accident risk value after sorting from largest to smallest. H is the minimum of all individual potential accident risk values, where H is the preset risk upper limit coefficient and Q is the total number of individual potential accidents. L represents the set of accident loss factors; Vulnerability elements This includes CVSS basic score, CVSS time score, CVSS environment score, vulnerability discussion popularity, and vulnerability age; these asset elements... This includes external access to assets, authorization level, information leakage protection level, reliability protection level, and business importance; the aforementioned threat elements. The factors include attack frequency, attack duration, presence of Proof-of-Concept (POC), and average exploitation activity. Based on the initial priority, two operational factors—vulnerability ignore rate and remediation difficulty—are added to generate the final vulnerability handling priority ranking.

[0037] The risk quantification model adopts a four-layer progressive calculation architecture, from bottom to top: the potential accident determination layer, the potential accident occurrence probability calculation layer, the single potential accident risk value calculation layer, and the comprehensive risk value calculation layer for multiple potential accidents. The first layer is the potential accident determination function F, which is a step function and can only take the value of 0 or 1. = ,in This indicates that the i-th vulnerability is related to the j-th asset, meaning that the j-th asset contains the i-th vulnerability. This indicates that the j-th asset is associated with the k-th threat, meaning that the k-th threat may attack the j-th asset. This indicates that the i-th vulnerability is associated with the k-th threat, meaning the k-th threat may exploit the i-th vulnerability. Only when all three associations exist simultaneously... Only when the value is 1 is it considered that there is a potential safety hazard; otherwise... A value of 0 indicates that there is no potential safety incident. The purpose of this layer is to filter out safety incidents that are theoretically possible but actually impossible, reducing unnecessary calculations.

[0038] The second layer is the potential incident probability function P, which is calculated using the chain rule of conditional probability, perfectly matching the actual process of a cyberattack. Cyberattacks typically follow the sequence of threat occurrence → asset attack → vulnerability exploitation. Therefore, the probability of a potential incident is equal to the prior probability of the threat occurring multiplied by the conditional probability of the asset being attacked when the threat occurs, and then multiplied by the conditional probability of exploiting the vulnerability when the threat attacks the asset. ,in Let k be the prior probability of the occurrence of the k-th threat. Let be the conditional probability that the j-th asset is attacked when the k-th threat occurs. This represents the conditional probability of exploiting the i-th vulnerability when the k-th threat attacks the j-th asset. These probability values ​​are calculated based on statistical analysis of historical attack data. Let k be the number of times the k-th threat has occurred in history. This represents the total number of times all threats have occurred throughout history. Let $k$ be the number of times the $k$-th threat attacked the $j$-th asset in history. Let $\frac{k}{i}$ be the number of times in history the $k$-th threat exploited the $i$-th vulnerability to attack the $j$-th asset. This can be simplified to obtain... = This formula greatly simplifies the calculation process.

[0039] The third layer is the risk value function W for a single potential accident, which multiplies the probability of a potential accident occurring by the potential loss caused by the accident to obtain the risk value of a single potential accident. ,in Let n be the probability of the nth potential accident. Let i be the vulnerability weight of the i-th vulnerability. Let the importance weight of the j-th asset be... Let M be the loss factor for the m-th type of incident, where M is the total number of incident loss types. Incident losses typically include multiple types such as business availability loss, information leakage loss, information asset damage loss, and corporate reputation loss. The system will assign different weights to different types of loss factors based on the type of vulnerability and the attributes of the assets.

[0040] The fourth layer is the comprehensive risk value function G for multiple potential accidents, which is used to calculate the comprehensive risk value when there are multiple potential accidents on an asset. ,in The maximum value among all individual potential accident risk values. This represents the q-th individual potential accident risk value after sorting from largest to smallest. H represents the minimum risk value among all individual potential accident risk values, where H is the preset risk ceiling coefficient, and Q is the total number of individual potential accidents. The weighting coefficient for the q-th risk value. This calculation method uses a weighted average approach, with higher-risk potential accidents receiving greater weight. This highlights the impact of high-risk accidents while avoiding the problem of an excessively high overall risk value due to the superposition of multiple low-risk accidents.

[0041] Furthermore, this claim specifies in detail the concrete quantitative indicators included in each of the vulnerability element V, asset element A, and threat element T. Vulnerability Elements These metrics include CVSS basic score, CVSS time score, CVSS environment score, vulnerability discussion popularity, and vulnerability age. These indicators reflect the severity and exploitability of the vulnerability from different dimensions. Asset elements These metrics include external accessibility to assets, authorization level, information leakage protection level, reliability protection level, and business importance. These indicators reflect the value of the assets and the extent of their impact after an attack. Threat Elements Indicators including attack frequency, attack duration, presence of Proof-of-Concept (POC), and average exploit activity reflect the current threat activity level and attack difficulty. Based on the initial priority calculated using a risk quantification model, the system further incorporates two operational factors: vulnerability ignore ratio and remediation difficulty, to generate a final vulnerability handling priority ranking. The vulnerability ignore ratio is the ratio of the number of times a vulnerability has been falsely reported and ignored to the total number of alerts, used to correct the false positive rate of vulnerability scans. Remediation difficulty refers to the workload and technical difficulty required to remediate the vulnerability, used to balance risk and remediation cost. The introduction of operational factors ensures that vulnerability prioritization considers not only technical risks but also the actual operational situation of the enterprise, making the ranking results more reasonable and feasible.

[0042] In some embodiments, the automatic generation of handling work orders specifically involves: matching preset work order levels and allocation rules according to vulnerability handling priorities, and accurately assigning work orders to the corresponding business line's processing objects; the work order system tracks the work order status in real time, records all handling operation logs, and automatically escalates alarms and notifies superior management personnel for work orders that have not been handled within the specified time limit. The automated verification process is as follows: when the object submits a repair completion application, the system automatically triggers a targeted review scan task for the corresponding vulnerability of the asset, and compares and verifies the review scan results with the original vulnerability information; if the verification is successful, the vulnerability status is updated to "repaired" and the work order is closed; if the verification fails, the work order is automatically returned with the reason for not repairing marked, and the object is required to repair it again.

[0043] The automatic generation of work orders is based on vulnerability handling priorities and preset work order rules. The system pre-configures work order levels, processing time limits, and allocation rules for vulnerabilities of different priorities. For example, extremely high-risk vulnerabilities generate Level 1 Emergency work orders, requiring remediation within 24 hours; high-risk vulnerabilities generate Level 2 Important work orders, requiring remediation within 72 hours; medium-risk and low-risk vulnerabilities generate Level 3 and Level 4 work orders, requiring remediation within one week and one month, respectively. Allocation rules are typically configured based on attributes such as the asset's department, business line, and geographical location. The system automatically assigns work orders to the corresponding business line based on these attributes. After a work order is generated, the system notifies the recipient via email, SMS, instant messaging, etc. During work order processing, the system tracks the work order status in real time, including pending, processing, pending verification, completed, and returned, and records all handling operation logs, including the operator, operation time, and operation content, achieving full traceability of the handling process. For work orders that are not processed within the specified time limit, the system will automatically escalate the alarm, first notifying the person responsible for the work, and if the work order is still not processed, it will notify the person's superiors in turn, until the work order is processed, ensuring that the vulnerability is dealt with in a timely manner.

[0044] Automated verification is used to validate the effectiveness of vulnerability remediation. Once an object completes vulnerability remediation and submits a remediation completion application in the system, the system automatically triggers a targeted remediation scan task for the corresponding vulnerability on that asset. Unlike a full scan, a targeted remediation scan only scans the specific vulnerability on the asset for which a remediation application has been submitted, excluding other vulnerabilities. This significantly reduces scanning time and improves verification efficiency. After the remediation scan is complete, the system compares the scan results with the original vulnerability information. If the remediation scan shows that the vulnerability no longer exists, the verification passes, the system automatically updates the vulnerability status to "remediated," and closes the corresponding work order. If the remediation scan shows that the vulnerability still exists, the verification fails, the system automatically returns the work order to the object, indicating the reason for non-remediation, such as patch installation failure or configuration changes not taking effect, requiring the object to remediate. This method not only improves the efficiency and accuracy of vulnerability remediation verification but also ensures that all vulnerabilities are truly remediated, avoiding the situation of merely remediating on paper.

[0045] In some embodiments, the real-time early warning and emergency response processing specifically includes: acquiring external network threat intelligence in real time, extracting vulnerability CVE numbers, POC information and attack characteristics, and accurately matching them with vulnerability information and asset attributes in the local asset database; for assets that are successfully matched and whose risk value exceeds a preset threshold, immediately generating a level-one early warning message, and automatically initiating an emergency response workflow that includes emergency work order dispatch and temporary protection strategy issuance.

[0046] The system acquires external network threat intelligence in real time through multiple channels, including commercial threat intelligence sources, open-source threat intelligence sources, and industry-shared threat intelligence. The frequency of threat intelligence acquisition can be configured according to the enterprise's needs, and for high-risk threat intelligence, it can achieve real-time acquisition at the minute or even second level. The acquired raw threat intelligence data usually contains a large amount of redundant information and data in different formats. The system will first preprocess this data, including data cleaning, data formatting, and data standardization, to extract key information from the intelligence, such as vulnerability CVE number, vulnerability name, vulnerability severity level, POC information, EXP information, attack characteristics, and affected software versions.

[0047] Next, the system will precisely match the extracted key threat intelligence information with vulnerability information and asset attributes in the local asset database. The matching process employs a multi-dimensional matching algorithm. First, it performs precise matching based on the vulnerability CVE number to find all assets in the local assets containing the vulnerability. Then, it performs secondary matching based on the affected software version, filtering out assets that have been upgraded to secure versions. Finally, it can further filter based on attributes such as the asset's exposure level and business importance. Through this multi-dimensional matching, high-risk vulnerabilities that exist in local assets, are being exploited, or are about to be exploited can be quickly and accurately located.

[0048] For assets that are successfully matched and whose overall risk value exceeds a preset threshold, the system will immediately generate a Level 1 warning and notify security management personnel through various means, such as pop-up alerts, email alerts, SMS alerts, and telephone alerts. Simultaneously, the system will automatically initiate a preset emergency response workflow, which includes a series of predefined emergency handling measures. First, the system will automatically generate an emergency handling work order and directly assign it to the highest-level handling target, requiring vulnerability remediation to be completed in the shortest possible time. Second, before the patch is released or the vulnerability is remediated, the system will automatically issue temporary protection policies to security devices such as firewalls, intrusion prevention systems, and web application firewalls to block attack traffic targeting the vulnerability, such as blocking specific IP addresses, ports, and URLs, thus buying valuable time for vulnerability remediation. Furthermore, the system will continuously monitor attacks targeting the vulnerability, update the threat landscape in real time, and dynamically adjust protection strategies based on the attack situation. Once the vulnerability is remediated and verified through automated checks, the system will automatically terminate the emergency response workflow and generate a complete emergency response report, summarizing the process, effectiveness, and lessons learned from the emergency response.

[0049] In summary, the embodiments of this application have the following beneficial effects: By automatically discovering assets, comparing baselines, and calculating risk weights, the fundamental problem of unclear asset inventory in vulnerability management was first solved, providing accurate asset data for subsequent risk assessment. Based on this, a three-factor risk quantification model (Vulnerability V-Asset A-Threat T) was constructed, independently calculating and ranking the risk of each asset-vulnerability pair, breaking through the limitations of traditional single-scoring models and achieving a scientific prioritization of vulnerability remediation. Furthermore, through automatic work order allocation, progress tracking, and automated verification, a closed-loop management system for the entire vulnerability process from discovery to closure was completed, significantly improving vulnerability handling efficiency. Simultaneously, through real-time threat intelligence matching and early warning, and a model feedback iteration mechanism, dynamic risk assessment and rapid emergency response were achieved, forming a complete vulnerability governance closed loop and comprehensively enhancing cybersecurity risk prevention and control capabilities.

[0050] Based on the same inventive concept, this application also provides a vulnerability processing device based on a multi-factor and risk quantification model, which corresponds to the vulnerability processing method based on a multi-factor and risk quantification model in the first embodiment. Since the principle of the device in this application is similar to the above-mentioned vulnerability processing method based on a multi-factor and risk quantification model, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0051] like Figure 3 As shown, Figure 3 This is a schematic diagram of the vulnerability processing device 300 based on a multi-factor and risk quantification model provided in this application embodiment. The vulnerability processing device 300 based on a multi-factor and risk quantification model includes: The identification module is used to identify network assets through the automatic asset discovery engine, establish asset baselines and perform periodic comparisons, identify abnormal assets and calculate asset risk weights to form an asset database. The construction module is used to construct a risk quantification model containing vulnerability element V, asset element A, and threat element T based on asset data and asset risk weights in the asset database, combined with vulnerability information obtained from vulnerability scanning and threat intelligence data acquired in real time. Based on the risk quantification model, the risk value of each asset-vulnerability association pair is calculated, and the vulnerability handling priority is sorted according to the risk value. The processing module is used to generate corresponding level processing work orders based on the obtained vulnerability handling priority ranking results and assign them to the processing objects, track the work order repair progress, and perform automated verification after the repair is completed. After verification, the work order is closed. The update module is used to acquire external threat intelligence in real time and automatically match it with the asset database. It provides real-time early warning and emergency response for assets with high-risk vulnerabilities and feeds back the newly acquired threat intelligence data to the risk quantification model to dynamically update the vulnerability risk value and handling priority.

[0052] Those skilled in the art should understand that Figure 3 The functions of each unit in the vulnerability processing device 300 based on the multi-factor and risk quantification model can be understood by referring to the relevant description of the vulnerability processing method based on the multi-factor and risk quantification model mentioned above. Figure 3 The functions of each unit in the vulnerability handling device 300 based on a multi-factor and risk quantification model shown can be implemented by a program running on a processor or by specific logic circuits.

[0053] In some embodiments, the asset auto-discovery engine collaboratively collects raw asset data through a TIER1 centralized management platform, a TIER2 network probe, and a TIER3 local agent. It then performs multi-source fusion and attribute rule mapping on the collected asset data to establish the asset database, which includes flag attributes and data attributes. The asset baseline is generated based on the initial asset data in the asset database and is used for subsequent periodic asset comparisons.

[0054] In some embodiments, the multi-source fusion specifically includes: The system sequentially performs data extraction, format conversion, and data cleaning operations on asset data imported from a third-party asset management system, converting the preprocessed data into a unified asset import format and integrating it into the local asset database. The attribute rule mapping specifically includes: pre-establishing mapping rules between the natural attributes of assets and the attributes managed by humans, and automatically mapping the machine-recognized natural attributes to management attributes during the asset discovery process.

[0055] In some embodiments, before constructing a risk quantification model, a vulnerability scanning task is performed to obtain vulnerability information. Each vulnerability information obtained from the scan is then bound to the corresponding asset in the asset database using a unique asset tag to form an asset-vulnerability association dataset. The asset-vulnerability association dataset and real-time threat intelligence data are used together as inputs to the risk quantification model.

[0056] In some embodiments, the risk quantification model adopts a four-layer computing architecture, and the calculation formula is as follows: ; Where R is the overall risk value; Let i represent the vulnerability element of the i-th vulnerability, the asset element of the i-th asset, and the threat element of the i-th threat, respectively. F is the function for determining potential safety accidents, taking the value 0 or 1. = ,in This indicates that the i-th vulnerability is associated with the j-th asset. This indicates that the j-th asset is associated with the k-th threat. This indicates that the i-th vulnerability is related to the k-th threat, and a potential security incident is determined only when all three are related. P is the probability function of a potential accident occurring. ; in, Let k be the prior probability of the occurrence of the k-th threat. Let be the conditional probability that the j-th asset is attacked when the k-th threat occurs. The conditional probability of exploiting the i-th vulnerability when the k-th threat attacks the j-th asset; Let k be the number of times the k-th threat has occurred in history. This represents the total number of times all threats have occurred throughout history. Let $k$ be the number of times the $k$-th threat attacked the $j$-th asset in history. This represents the number of times in history the k-th threat has exploited the i-th vulnerability to attack the j-th asset; W is the risk value function for a single potential accident. ,in Let n be the probability of the nth potential accident. Let i be the vulnerability weight of the i-th vulnerability. Let the importance weight of the j-th asset be... Let M be the loss factor for the m-th type of accident, where M is the total number of accident loss types. G is a combined risk value function for multiple potential accidents. , The weighting coefficient for the q-th risk value. , The maximum value among all individual potential accident risk values. This represents the q-th individual potential accident risk value after sorting from largest to smallest. H is the minimum of all individual potential accident risk values, where H is the preset risk upper limit coefficient and Q is the total number of individual potential accidents. L represents the set of accident loss factors; Vulnerability elements This includes CVSS basic score, CVSS time score, CVSS environment score, vulnerability discussion popularity, and vulnerability age; these asset elements... This includes external access to assets, authorization level, information leakage protection level, reliability protection level, and business importance; the aforementioned threat elements. The factors include attack frequency, attack duration, presence of Proof-of-Concept (POC), and average exploitation activity. Based on the initial priority, two operational factors—vulnerability ignore rate and remediation difficulty—are added to generate the final vulnerability handling priority ranking.

[0057] In some embodiments, the automatic generation of handling work orders specifically involves: matching preset work order levels and allocation rules according to vulnerability handling priorities, and accurately assigning work orders to the corresponding business line's processing objects; the work order system tracks the work order status in real time, records all handling operation logs, and automatically escalates alarms and notifies superior management personnel for work orders that have not been handled within the specified time limit. The automated verification process is as follows: when the object submits a repair completion application, the system automatically triggers a targeted review scan task for the corresponding vulnerability of the asset, and compares and verifies the review scan results with the original vulnerability information; if the verification is successful, the vulnerability status is updated to "repaired" and the work order is closed; if the verification fails, the work order is automatically returned with the reason for not repairing marked, and the object is required to repair it again.

[0058] In some embodiments, the real-time early warning and emergency response processing specifically includes: acquiring external network threat intelligence in real time, extracting vulnerability CVE numbers, POC information and attack characteristics, and accurately matching them with vulnerability information and asset attributes in the local asset database; for assets that are successfully matched and whose risk value exceeds a preset threshold, immediately generating a level-one early warning message, and automatically initiating an emergency response workflow that includes emergency work order dispatch and temporary protection strategy issuance.

[0059] The aforementioned vulnerability handling device, based on a multi-factor and risk quantification model, first addresses the fundamental issue of unclear asset inventory in vulnerability management through automatic asset discovery, baseline comparison, and risk weight calculation, providing accurate asset data for subsequent risk assessment. Building upon this, it constructs a three-factor risk quantification model (Vulnerability V-Asset A-Threat T), independently calculating and ranking the risk of each asset-vulnerability pair, overcoming the limitations of traditional single-scoring models and achieving a scientific prioritization of vulnerability remediation. Furthermore, through automatic work order allocation, progress tracking, and automated verification, it completes closed-loop management of the entire vulnerability process from discovery to closure, significantly improving vulnerability handling efficiency. Simultaneously, through real-time threat intelligence matching and early warning, and a model feedback iteration mechanism, it achieves dynamic risk assessment and rapid emergency response, forming a complete vulnerability governance closed loop and comprehensively enhancing cybersecurity risk prevention and control capabilities.

[0060] like Figure 4 As shown, Figure 4 This is a schematic diagram of the composition structure of the electronic device 400 provided in the embodiments of this application. The electronic device 400 includes: The device includes a processor 401, a storage medium 402, and a bus 403. The storage medium 402 stores machine-readable instructions that can be executed by the processor 401. When the electronic device 400 is running, the processor 401 communicates with the storage medium 402 via the bus 403. The processor 401 executes the machine-readable instructions to perform the steps of the vulnerability handling method based on a multi-factor and risk quantification model described in the embodiments of this application.

[0061] In practical applications, the various components in the electronic device 400 are coupled together via a bus 403. It is understood that the bus 403 is used to achieve communication between these components. In addition to a data bus, the bus 403 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 4 The general designated all buses as Bus 403.

[0062] The aforementioned electronic devices, through automatic asset discovery, baseline comparison, and risk weight calculation, firstly address the fundamental issue of unclear asset inventory in vulnerability management, providing accurate asset data for subsequent risk assessment. Based on this, a three-factor risk quantification model (Vulnerability V-Asset A-Threat T) is constructed, independently calculating and ranking the risk of each asset-vulnerability pair, overcoming the limitations of traditional single-scoring models and achieving a scientific prioritization of vulnerability remediation. Furthermore, through automatic work order allocation, progress tracking, and automated verification, a closed-loop management system for the entire vulnerability process from discovery to closure is completed, significantly improving vulnerability handling efficiency. Simultaneously, through real-time threat intelligence matching and early warning, and a model feedback iteration mechanism, dynamic risk assessment and rapid emergency response are achieved, forming a complete vulnerability governance closed loop and comprehensively enhancing cybersecurity risk prevention and control capabilities.

[0063] This application also provides a computer-readable storage medium storing executable instructions. When the executable instructions are executed by at least one processor 401, the vulnerability handling method based on a multi-factor and risk quantification model described in this application is implemented.

[0064] In some embodiments, the storage medium may be a magnetic random access memory (FRAM), a read-only memory (ROM), or a programmable read-only memory (PROM). Erasable Programmable Read-Only Memory (EPROM) Electrically Erasable Programmable Read-Only Memory (EEPROM) Read-only memory, flash memory, magnetic surface storage, optical disc, or CD-ROM ROM, Compact Disc Read It can be a memory such as a memory only; or it can be a device that includes one or any combination of the above-mentioned memories.

[0065] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0066] As an example, executable instructions may, but do not necessarily, correspond to files in the file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0067] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0068] The aforementioned computer-readable storage media, through automatic asset discovery, baseline comparison, and risk weight calculation, firstly solves the fundamental problem of unclear asset inventory in vulnerability management, providing accurate asset data for subsequent risk assessment. Based on this, a three-factor risk quantification model (Vulnerability V-Asset A-Threat T) is constructed, independently calculating and ranking the risk of each asset-vulnerability pair, overcoming the limitations of traditional single-scoring models and achieving a scientific prioritization of vulnerability remediation. Furthermore, through automatic work order allocation, progress tracking, and automated verification, a closed-loop management system for the entire vulnerability process from discovery to closure is completed, significantly improving vulnerability handling efficiency. Simultaneously, through real-time threat intelligence matching and early warning, and a model feedback iteration mechanism, dynamic risk assessment and rapid emergency response are achieved, forming a complete vulnerability governance closed loop and comprehensively enhancing cybersecurity risk prevention and control capabilities.

[0069] In the several embodiments provided in this application, it should be understood that the disclosed methods and electronic devices can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components may be combined, or integrated into another system, or some features may be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0070] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0071] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0072] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a platform server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0073] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A vulnerability handling method based on a multi-factor and risk quantification model, characterized in that, Includes the following steps: The system uses an automatic asset discovery engine to identify online assets, establish asset baselines and perform periodic comparisons, identify abnormal assets and calculate asset risk weights to form an asset database. Based on the asset data and asset risk weights in the asset database, combined with vulnerability information obtained from vulnerability scanning and real-time threat intelligence data, a risk quantification model is constructed, which includes vulnerability element V, asset element A, and threat element T. The risk value of each asset-vulnerability pair is calculated based on the risk quantification model, and the priority of vulnerability handling is ranked according to the risk value. Based on the obtained vulnerability handling priority ranking results, corresponding handling work orders are generated and assigned to the handling objects. The work order repair progress is tracked, and automated verification is performed after the repair is completed. The work order is closed after verification. The system acquires external threat intelligence in real time and automatically matches it with the asset database. It provides real-time early warning and emergency response for assets with high-risk vulnerabilities and feeds newly acquired threat intelligence data back to the risk quantification model to dynamically update vulnerability risk values ​​and handling priorities.

2. The vulnerability handling method based on a multi-factor and risk quantification model according to claim 1, characterized in that, The asset auto-discovery engine collects raw asset data collaboratively through the TIER1 centralized management platform, TIER2 network probe, and TIER3 local agent. It performs multi-source fusion and attribute rule mapping on the collected asset data to establish the asset database containing flag attributes and data attributes. The asset baseline is generated based on the initial asset data in the asset database and is used for subsequent periodic asset comparisons.

3. The vulnerability handling method based on a multi-factor and risk quantification model according to claim 2, characterized in that, The multi-source fusion specifically includes: The system sequentially performs data extraction, format conversion, and data cleaning operations on asset data imported from a third-party asset management system, converting the preprocessed data into a unified asset import format and integrating it into the local asset database. The attribute rule mapping specifically includes: pre-establishing mapping rules between the natural attributes of assets and the attributes managed by humans, and automatically mapping the machine-recognized natural attributes to management attributes during the asset discovery process.

4. The vulnerability handling method based on a multi-factor and risk quantification model according to claim 1, characterized in that, Before constructing the risk quantification model, a vulnerability scanning task is first performed to obtain vulnerability information. Each vulnerability information obtained from the scan is then bound to the corresponding asset in the asset database using a unique asset tag to form an asset-vulnerability association dataset. This asset-vulnerability association dataset, together with real-time threat intelligence data, serves as the input to the risk quantification model.

5. The vulnerability handling method based on a multi-factor and risk quantification model according to claim 1, characterized in that, The risk quantification model adopts a four-layer computational architecture, and the calculation formula is as follows: ； Where R is the overall risk value; Let i represent the vulnerability element of the i-th vulnerability, the asset element of the i-th asset, and the threat element of the i-th threat, respectively. F is the function for determining potential safety accidents, taking the value 0 or 1. = ,in This indicates that the i-th vulnerability is associated with the j-th asset. This indicates that the j-th asset is associated with the k-th threat. This indicates that the i-th vulnerability is related to the k-th threat, and a potential security incident is determined only when all three are related. P is the probability function of a potential accident occurring. ； in, Let k be the prior probability of the occurrence of the k-th threat. Let be the conditional probability that the j-th asset is attacked when the k-th threat occurs. The conditional probability of exploiting the i-th vulnerability when the k-th threat attacks the j-th asset; Let k be the number of times the k-th threat has occurred in history. This represents the total number of times all threats have occurred throughout history. Let $k$ be the number of times the $k$-th threat attacked the $j$-th asset in history. This represents the number of times in history the k-th threat has exploited the i-th vulnerability to attack the j-th asset; W is the risk value function for a single potential accident. ,in Let n be the probability of the nth potential accident occurring. Let i be the vulnerability weight of the i-th vulnerability. Let the importance weight of the j-th asset be... Let M be the loss factor for the m-th type of accident, where M is the total number of accident loss types. G is a comprehensive risk value function for multiple potential accidents. , The weighting coefficient for the q-th risk value. , The maximum value among all individual potential accident risk values. This represents the q-th individual potential accident risk value after sorting from largest to smallest. H represents the minimum risk value among all individual potential accidents, where H is the preset risk ceiling coefficient and Q is the total number of individual potential accidents. L represents the set of accident loss factors; Vulnerability elements This includes CVSS basic score, CVSS time score, CVSS environment score, vulnerability discussion popularity, and vulnerability age; these asset elements... This includes external access to assets, authorization level, information leakage protection level, reliability protection level, and business importance; the aforementioned threat elements. The factors include attack frequency, attack duration, presence of Proof-of-Concept (POC), and average exploitation activity. Based on the initial priority, two operational factors—vulnerability ignore rate and remediation difficulty—are added to generate the final vulnerability handling priority ranking.

6. The vulnerability handling method based on a multi-factor and risk quantification model according to claim 1, characterized in that, The automatic generation of handling work orders specifically involves: matching the preset work order level and allocation rules according to the vulnerability handling priority, and accurately assigning the work order to the corresponding business line's processing object; the work order system tracks the work order status in real time, records all handling operation logs, and automatically escalates alarms and notifies superior management personnel for work orders that have not been handled within the specified time limit. The automated verification process is as follows: when the object submits a repair completion application, the system automatically triggers a targeted review scan task for the corresponding vulnerability of the asset, and compares and verifies the review scan results with the original vulnerability information; if the verification is successful, the vulnerability status is updated to "repaired" and the work order is closed; if the verification fails, the work order is automatically returned with the reason for not repairing marked, and the object is required to repair it again.

7. The vulnerability handling method based on a multi-factor and risk quantification model according to claim 1, characterized in that, The real-time early warning and emergency response processing specifically includes: acquiring external network threat intelligence in real time, extracting vulnerability CVE numbers, POC information and attack characteristics, and accurately matching them with vulnerability information and asset attributes in the local asset database; for assets that are successfully matched and whose risk value exceeds a preset threshold, immediately generating a level-one early warning message and automatically initiating an emergency response workflow that includes emergency work order dispatch and temporary protection strategy issuance.

8. A vulnerability handling device based on a multi-factor and risk quantification model, characterized in that, The device includes: The identification module is used to identify network assets through the automatic asset discovery engine, establish asset baselines and perform periodic comparisons, identify abnormal assets and calculate asset risk weights to form an asset database. The construction module is used to construct a risk quantification model containing vulnerability element V, asset element A, and threat element T based on asset data and asset risk weights in the asset database, combined with vulnerability information obtained from vulnerability scanning and threat intelligence data acquired in real time. Based on the risk quantification model, the risk value of each asset-vulnerability association pair is calculated, and the vulnerability handling priority is sorted according to the risk value. The processing module is used to generate corresponding level processing work orders based on the obtained vulnerability handling priority ranking results and assign them to the processing objects, track the work order repair progress, and perform automated verification after the repair is completed. After verification, the work order is closed. The update module is used to acquire external threat intelligence in real time and automatically match it with the asset database. It provides real-time early warning and emergency response for assets with high-risk vulnerabilities and feeds back the newly acquired threat intelligence data to the risk quantification model to dynamically update the vulnerability risk value and handling priority.

9. An electronic device, characterized in that, include: The device includes a processor, a storage medium, and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the vulnerability handling method based on a multi-factor and risk quantification model as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the vulnerability handling method based on a multi-factor and risk quantification model as described in any one of claims 1 to 7.

Images