A method, device, medium and product for long-tail sparse security threat-oriented large model data enhancement and vulnerability risk quantification governance

Abstract

This application discloses a method, device, medium, and product for large-scale model data augmentation and vulnerability risk quantification governance of long-tail sparse security threats, relating to the field of vulnerability governance. The method includes acquiring unstructured logs to be governed and identified candidate security entity pairs; based on the unstructured logs and candidate security entity pairs, using a deep text classification and network relationship discrimination model to determine predicted probabilities and define predefined standard vulnerability relationships, obtaining standard security triples and performing multi-source fusion with a multi-source heterogeneous asset database to obtain a comprehensive risk score for each vulnerability; correcting the score using a business correlation correction coefficient to obtain the final risk score; and automatically classifying vulnerabilities into preset intelligent governance levels based on the final risk score, generating a dynamic vulnerability remediation priority ranking list. This application improves the accuracy of capturing long-tail, sparse, and unknown security threats and achieves automated vulnerability remediation priority orchestration.

Description

Technical Field

[0001] This application relates to the field of vulnerability management, and in particular to a method, device, medium and product for large-scale model data augmentation and vulnerability risk quantification management of long-tail sparse security threats. Background Technology

[0002] As enterprises continue to deepen their digital transformation, the scale of enterprise information systems is constantly expanding. The number of network assets, business systems, and various open-source and third-party application components is experiencing explosive growth, leading to a rapid accumulation and frequent updates of vulnerability data. In actual enterprise security operations and vulnerability remediation, security managers not only need to rely on automated tools to discover vulnerabilities, but also need to accurately determine which vulnerabilities should be prioritized for remediation and how to rationally allocate limited security resources from a vast amount of vulnerability data. Therefore, as the core foundation for protecting digital assets, vulnerability resource management systems have become a key link in enterprise network security defense systems. The accuracy of their risk assessments and the rationality of their prioritization directly affect the overall security protection effect and the operational security of the enterprise.

[0003] However, most vulnerability risk assessment and mitigation methods in related technologies suffer from severe disconnect from business applications and algorithmic bottlenecks, making it difficult to meet the high-precision defense requirements of complex business scenarios. This is specifically manifested in the following two core dimensions: First, enterprise internal security data exhibits multi-source heterogeneity and suffers from severe long-tail sparsity threats. Related technologies suffer from extremely low generalization rates due to a lack of prior external security semantic knowledge. In real-world corpus environments and enterprise operational scenarios, vulnerability-related data is scattered across multiple heterogeneous systems, including vulnerability scanning logs, asset management systems, business performance metrics, and external threat intelligence platforms. Not only are there differences in field definitions and evaluation standards between different data sources, but more challengingly, over 85% of vulnerability risk categories fall under extremely sparse long-tail threats (e.g., rare vulnerabilities in specific self-developed business components, or hidden, cross-system, and cross-syntactic boundary intertwined threats). Current vulnerability assessment methods mostly focus on the technical attributes of the vulnerability itself, or only emphasize shallow text rule matching and sample expansion of existing enterprise logs. However, even with the introduction of external knowledge sources such as Large Language Models (LLMs) for few-shot hints or CoT reasoning in recent years, significant adaptive bottlenecks remain when facing complex enterprise-level vulnerability governance scenarios. First, conventional open-ended large-scale models have led to severe biases in high-frequency co-occurrence and premature cessation of knowledge mining. When general-purpose large-scale language models diverge in an unconstrained semantic space, they are easily dominated by the weights of their underlying pre-trained corpus, making them prone to repeatedly generating superficially obvious, high-frequency co-occurrence asset relationships (e.g., shallow facts such as a server running an operating system). However, for hidden and sparse threat signals in the long tail region, lacking sufficient labeled samples and hidden under long-distance boundaries across sentences (e.g., rare vulnerability topology evolution relationships of specific self-developed business components), large-scale language models lack the spontaneous motivation for deep exploration. Second, current prompt word engineering and simple one-way generation paradigms lack closed-loop control and feedback regulation mechanisms. Large-scale language models cannot perceive what density of incremental facts is truly lacking in the underlying vulnerability resource management system, resulting in an extreme scarcity of high-repetition-rate, high-signal-to-noise-ratio long-tail samples produced by data augmentation. Based on this, there is an urgent need to propose an adaptive closed-loop iterative control mechanism that can dynamically monitor the saturation of the knowledge space and forcibly reshape the exploration boundaries of large-scale language models through negative constraint mechanisms.

[0004] Second, the expansion of asset scale leads to a quadratic explosive growth in the number of asset entity pairs. The gradient dominance effect generated by massive simple negative samples severely obscures the true core high-risk signals. In enterprise-level vulnerability resource management scenarios, as the length of processed asset text and logs increases and entity density rises, the combination of entity pairs explodes quadratically with the number of assets, resulting in most asset entity pairs not having a predefined high-risk security relationship physically. This high-dimensional combination space naturally leads to extreme instance-level positive and negative sample imbalance, generating massive amounts of easy negative samples. During the training and parameter optimization stages of the discriminant network, these significantly larger simple negative samples dominate gradient backpropagation, producing an extremely severe gradient dominance effect. This gradient signal, dominated by massive redundant background noise, severely erodes and obscures the discriminative boundaries of truly high-value, sparse positive samples, causing the classifier to suffer severe overfitting and classification surface bias on imbalanced datasets. The relevant technologies generally lack a systematic adaptive gradient adjustment strategy to balance the optimization objectives of positive and negative samples, which makes it impossible for the system to accurately focus on difficult negative samples and long-tail high-risk vulnerabilities that affect core assets and endanger critical business links in the massive amount of garbage background noise.

[0005] In summary, the relevant technologies suffer from at least the following shortcomings: First, the data augmentation and mining paradigms remain superficial, lacking external security prior logic guidance, making it difficult to capture long-tail sparse threats; second, when faced with extreme sample imbalances caused by massive assets, there is a lack of effective gradient balancing mechanisms, resulting in core high-risk signals being submerged by redundant noise. Therefore, there is an urgent need to propose a large-scale model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats. This method should introduce powerful external semantic priors into the data space to expand high-quality samples and reshape sample weight allocation in the gradient space, thereby ensuring the adaptive optimization efficiency and security resource scheduling accuracy of the enterprise vulnerability resource management system. Summary of the Invention

[0006] The purpose of this application is to provide a method, device, medium, and product for large-scale model data augmentation and vulnerability risk quantification governance of long-tail sparse security threats, so as to improve the accuracy of vulnerability resource management system in capturing long-tail, sparse, and unknown security threats, and to realize automated vulnerability remediation priority orchestration.

[0007] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a method for large-scale model data augmentation and vulnerability risk quantification governance targeting long-tail sparse security threats, including: Obtain unstructured logs to be governed and candidate security entity pairs identified from the unstructured logs to be governed; the unstructured logs include unstructured security asset text, unstructured threat intelligence, and unstructured vulnerability descriptions; Based on the unstructured logs to be addressed and the candidate security entity pairs, a trained deep text classification and network relationship discrimination model is used to determine the predicted probability of each candidate security entity pair corresponding to a predefined standard vulnerability relationship. The deep text classification and network relationship discrimination model includes a text encoding layer, an entity representation aggregation layer, an entity pair relationship fusion layer, and a multi-label classification layer. Based on the predicted probability, a predefined standard vulnerability relationship between the candidate security entity pairs is determined to obtain a standard security triplet for vulnerability risk scoring. The vulnerability information corresponding to the standard security triplet is fused with the multi-source heterogeneous asset database in the vulnerability resource management system to obtain a comprehensive risk score for each vulnerability; the source heterogeneous asset database includes asset CMDB, real-time vulnerability scanning reports and threat intelligence sources; The comprehensive risk score is corrected based on the business correlation correction coefficient to obtain the final risk score, and the final risk score is output to the vulnerability resource management system. The vulnerability resource management system automatically classifies vulnerabilities into preset intelligent governance levels based on the final risk score and generates a dynamic vulnerability remediation priority ranking list.

[0008] In one embodiment, the training process of the deep text classification and network relationship discrimination model specifically includes: Obtain unstructured logs for training and candidate security entity pairs for training identified from the unstructured logs for training; The unstructured logs used for training are subjected to progressive reasoning based on a pipelined thought chain and adaptive feedback iteration with negative constraints to synthesize an initial set of security relation proposals in a discrete symbolic space. The initial set of security relation proposals includes all initial security relation proposals generated at the end of the iteration. The initial security relation proposals are triplets about the subject, natural language predicate, and object. The progressive reasoning based on the pipelined thought chain is a multi-hop reasoning architecture that decomposes the security relation mining task into three progressive reasoning stages: autonomous entity recognition, context role resolution, and security relation proposal synthesis. The natural language predicates in the initial security relationship proposal and the predefined standard vulnerability relationship pattern set read from the standard vulnerability knowledge base are normalized and aligned to obtain the standard security triples for training, and output to the original vulnerability governance training space to form training samples. The training samples are used to perform forward computation on the deep text classification and network relationship discrimination model. A parameter iterative controller based on gradient equalization and probability shift is used to run a dynamic asymmetric loss function to calculate the total loss of the multi-label classification. Backpropagation and model parameter updates are performed based on the total loss of the multi-label classification until the preset convergence condition is met, and the trained deep text classification and network relationship discrimination model is obtained.

[0009] In one embodiment, the unstructured vulnerability description log used for training undergoes progressive reasoning based on a pipelined thought chain and adaptive feedback iteration with negative constraints to synthesize an initial set of security relation proposals in a discrete symbolic space, specifically including: The unstructured vulnerability description logs used for training and the prompts containing examples of thought paths are input into the large model server to perform autonomous entity recognition to extract a set of candidate security entities. The large model server performs context role parsing for each candidate security entity, and generates a structured semantic background explanation by combining network topology context explanation prompts; the network topology context explanation prompts include prompts for the role instruction domain, prompts for the task instruction domain, prompts for the input parameter domain, and prompts for the output constraint domain. The large model server generates natural language predicates in an unrestricted semantic space based on structured semantic background interpretation, and synthesizes initial security relationship proposals with corresponding candidate security entities; The current knowledge density is calculated by monitoring the number of initial security relationship proposals that have been generated. When the current knowledge density does not reach the preset knowledge density target threshold, a feedback iteration mechanism is automatically triggered. The set of initial security relationship proposals that have been generated is fed back to the large model server as a negative constraint until the current knowledge density reaches the preset knowledge density target threshold and the iteration terminates. All initial security relationship proposals generated when the iteration terminates are taken as the initial security relationship proposal set.

[0010] In one implementation, the natural language predicates in the initial security relationship proposal are normalized and aligned with a predefined set of standard vulnerability relationship patterns read from a standard vulnerability knowledge base to obtain standard security triples for training, specifically including: Each initial security relationship proposal in the initial security relationship proposal set is serialized and concatenated to form a continuous natural language evidence chain as the premise background for natural language reasoning; Read the predefined standard vulnerability relationship pattern set of the vulnerability resource management system, inject declarative semantic templates into the predefined standard vulnerability relationships, and construct positive candidate hypotheses and negative candidate hypotheses to generate a candidate hypothesis set covering the global label pattern space; The aforementioned background and the set of candidate hypotheses are input into a pre-trained deep multilingual natural language inference model to calculate a comprehensive secure alignment score, and the global optimal alignment result is retrieved using the tu-suo maximization method. When the overall security alignment score of the global optimal alignment result is greater than the confidence threshold, the corresponding initial security relationship proposal is determined to have passed the authenticity verification. The natural language predicate in the initial security relationship proposal is replaced with the predefined standard vulnerability relationship in the global optimal alignment result and mapped to the standard security triplet for training.

[0011] In one embodiment, the vulnerability information corresponding to the standard security triplet is fused with the unstructured security asset text and the unstructured threat intelligence to obtain a comprehensive risk score for each vulnerability, specifically including: The vulnerability information corresponding to the standard security triplet is fused with the unstructured security asset text and the unstructured threat intelligence from multiple sources and uniformly mapped to a scoring range of 0 to 100 to obtain the vulnerability basic severity score, asset importance score, business impact score, and remediation urgency score. The comprehensive risk score for each vulnerability is calculated by weighting and summing the vulnerability severity score, asset importance score, business impact score, and remediation urgency score, along with their corresponding preset weights.

[0012] In one embodiment, the comprehensive risk score is corrected according to the business association correction coefficient to obtain the final risk score, specifically including: Using formula Determine the final risk score; among which, For the final risk score; For comprehensive risk scoring; This is a business-related adjustment factor.

[0013] In one embodiment, before performing pipelined thought chain-based progressive reasoning and negative constraint adaptive feedback iteration on the unstructured logs used for training, and synthesizing an initial set of security relation proposals in the discrete symbol space, the method further includes: The unstructured security asset text, the unstructured threat intelligence, and the unstructured vulnerability description are formatted and cleaned to obtain the processed unstructured logs.

[0014] Secondly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned large model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats.

[0015] Thirdly, this application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-mentioned large model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats.

[0016] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats.

[0017] According to the specific embodiments provided in this application, this application has the following technical effects: This application provides a method, device, medium, and product for large-scale model data augmentation and vulnerability risk quantification governance of long-tail sparse security threats. The method includes: acquiring unstructured logs to be governed and candidate security entity pairs identified from the unstructured logs; determining the predicted probability of each candidate security entity pair corresponding to a predefined standard vulnerability relationship using a trained deep text classification and network relationship discrimination model based on the unstructured logs and candidate security entity pairs; the deep text classification and network relationship discrimination model includes a text encoding layer, an entity representation aggregation layer, an entity pair relationship fusion layer, and a multi-label classification layer; determining the predefined standard vulnerability relationship between candidate security entity pairs based on the predicted probability to obtain standard security triples; performing multi-source fusion of the vulnerability information corresponding to the standard security triples with a multi-source heterogeneous asset database in a vulnerability resource management system to obtain a comprehensive risk score for each vulnerability; correcting the comprehensive risk score based on a business association correction coefficient to obtain a final risk score, and outputting the final risk score to the vulnerability resource management system; the vulnerability resource management system automatically classifies vulnerabilities into preset intelligent governance levels based on the final risk score and generates a dynamic vulnerability remediation priority ranking list. This application improves the accuracy of vulnerability resource management systems in capturing long-tail, sparse, and unknown security threats, and enables automated vulnerability remediation priority orchestration. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats, provided as an embodiment of this application; Figure 2A flowchart illustrating the implementation of a large-model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats provided in an embodiment of this application; Figure 3 A flowchart of progressive reasoning and negative constraint adaptive feedback iteration based on pipeline thinking chain provided for an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] The technical problem this application aims to solve is to overcome the shortcomings of existing enterprise-level vulnerability resource management systems in complex network operation scenarios. Firstly, it overcomes the deficiencies of traditional data augmentation, which focuses on shallow text rule matching, and the difficulty in uncovering rare edge threats due to high-frequency bias in conventional large-scale model generation paradigms. When existing large-scale models directly intervene in network security text processing, they typically exhibit a unidirectional, feedback-free generation flow, unable to adaptively evaluate information increments, leading to repeated high-frequency redundant relationships and extremely low detection capability for long-tailed, hidden edge threats that cross topological interweaving and long-distance cross-sentence associations. This application aims to construct an adaptive negative feedback iterative control mechanism composed of dynamic knowledge density and reverse constraints. Through real-time quantitative monitoring and forced boundary blocking of the large-scale model output space, it forces the information flow to converge deeply into the long-tailed sparse space, thereby curbing the serious underreporting risks caused by the lack of threat samples in enterprise vulnerability governance from the source. Secondly, as the scale of affected assets continues to expand, the number of asset entities explodes quadratically with the number of assets. During the optimization and training phase of the discriminant network, the massive amount of redundant simple negative samples will produce a severe gradient dominance effect, submerging the discrimination boundary of the truly core high-risk signals, leading to severe classification surface bias and overfitting in the system classifier. In addition, most existing risk assessment methods mainly focus on the technical attributes of the vulnerability itself, lacking a comprehensive consideration of the importance of assets, the degree of business criticality, and the impact on business continuity. The assessment results are inconsistent with the actual risks of enterprises, making it difficult to achieve adaptive and precise resource scheduling for vulnerability remediation priorities.

[0023] In one exemplary embodiment, such as Figure 1As shown, a method for large-scale model data augmentation and vulnerability risk quantification governance targeting long-tail sparse security threats is provided and applied to an enterprise vulnerability resource management system, including the following steps: S1: Obtain the unstructured logs to be governed and the candidate security entity pairs identified from the unstructured logs to be governed; the unstructured logs include unstructured security asset text, unstructured threat intelligence, and unstructured vulnerability descriptions.

[0024] In this embodiment, an intelligent synthesis engine for long-tail sparse security threat data is used to perform adaptive closed-loop data augmentation with negative constraints; unstructured logs D to be addressed, including unstructured security asset text, unstructured threat intelligence, and unstructured vulnerability descriptions, are obtained through the system's multi-source heterogeneous security data interface.

[0025] S2: Based on the unstructured logs to be addressed and the candidate security entity pairs, the predicted probability of each candidate security entity pair corresponding to each predefined standard vulnerability relationship is determined using a trained deep text classification and network relationship discrimination model; the deep text classification and network relationship discrimination model includes a text encoding layer, an entity representation aggregation layer, an entity pair relationship fusion layer, and a multi-label classification layer.

[0026] In this embodiment, the text encoding layer is used to perform context encoding on the unstructured logs; the entity representation aggregation layer is used to form subject entity representations and object entity representations based on the mention positions of candidate security entities in the unstructured logs; the entity pair relationship fusion layer is used to fuse the subject entity representations, object entity representations, and their contextual association features; and the multi-label classification layer is used to output the predicted probability of candidate security entity pairs corresponding to each predefined standard vulnerability relationship.

[0027] The training process of the deep text classification and network relationship discrimination model specifically includes: S2-1: Obtain unstructured logs for training and candidate security entity pairs for training identified from the unstructured logs for training.

[0028] S2-2: Perform pipelined reasoning and negative constraint adaptive feedback iteration on the unstructured logs used for training to synthesize an initial set of security relation proposals in the discrete symbol space; the initial set of security relation proposals includes all initial security relation proposals produced when the iteration terminates; the initial security relation proposals are triplets about the subject, natural language predicate, and object; the pipelined reasoning is a multi-hop reasoning architecture that decomposes the security relation mining task into three progressive reasoning stages: autonomous entity recognition, context role resolution, and security relation proposal synthesis.

[0029] In one embodiment, S2-2 specifically includes: S2-2-1: Input the training unstructured logs and prompts containing examples of thought paths into the large model server, and perform autonomous entity recognition to extract a set of candidate safe entities.

[0030] In this embodiment, the unstructured log D and the included thought path examples are input into an external security big model server to openly detect and capture asset mentions and low-frequency long-tail security entities that co-occur across sentences, thereby constructing a candidate security entity set. : in, This is the nth candidate security entity; The processing function for autonomous entity recognition is executed for the large model server, which is used to extract candidate safe entities based on unstructured logs, entity recognition guidance instructions and thought path examples; This is an example of a thought process that includes the process of identifying candidate security entities and the corresponding identification results, used to guide a large model server to identify asset mentions and low-frequency long-tail security entities that co-occur across sentences through context learning; This is an example of a thought process.

[0031] S2-2-2: The large model server performs context role parsing for each candidate security entity, and generates a structured semantic background explanation by combining the network topology context explanation prompt information; the network topology context explanation prompt information includes prompt words in the role instruction domain, prompt words in the task instruction domain, prompt words in the input parameter domain, and prompt words in the output restriction domain.

[0032] In this embodiment, the large model server is driven to perform interpretation-first multi-hop inference on candidate security entities, analyze the attribute types and functional positioning of each candidate security entity in a specific network topology context, and transform implicit textual clues into a structured set of semantic background explanations. : ,in, in, This is an explanation of the nth structured semantic context. Execute the context role resolution processing function for the large model server, used to resolve unstructured logs. The i-th candidate security entity Candidate Security Entity Set In addition to network topology contextual explanation prompts, a structured semantic background explanation is generated for the i-th candidate security entity. ; Provide contextual explanation prompts for the network topology used to guide the large model in performing contextual role resolution, including prompts for the role instruction domain, prompts for the task instruction domain, prompts for the input parameter domain, and prompts for the output constraint domain.

[0033] S2-2-3: The large model server generates natural language predicates in an unrestricted semantic space based on structured semantic background interpretation, and synthesizes initial security relationship proposals with corresponding candidate security entities.

[0034] In this embodiment, natural language predicates with high semantic generalization are generated within an unrestricted semantic space. Synthesize the initial security relationship proposal set .in, As the main body; As an object; To base on unstructured logs Candidate Security Entity Set A set of structured semantic background explanations The relation composition processing function generates the initial secure relation proposal using relation composition prompts; This is used to guide the generation of natural language predicates and synthesize relational synthesis prompts for initial security relation proposals.

[0035] S2-2-4: Calculate the current knowledge density by monitoring the number of initial security relationship proposals that have been generated. When the current knowledge density does not reach the preset knowledge density target threshold, automatically trigger the feedback iteration mechanism, and feed back the set of initial security relationship proposals that have been generated as a negative constraint to the large model server until the current knowledge density reaches the preset knowledge density target threshold to terminate the iteration. All initial security relationship proposals generated when the iteration terminates are taken as the initial security relationship proposal set.

[0036] In this embodiment, the current knowledge density is calculated by monitoring the number of currently generated independent security triples (initial security relationship proposals), and a feedback iteration mechanism is automatically triggered when the preset knowledge density target threshold τ is not reached. in, This is the initial set of security relationship proposals generated at time t+1; E represents the set of initial security relationship proposals that have been generated so far; C represents the set of candidate security entities; and C represents the set of structured semantic background explanations corresponding to the candidate security entities. Feedback iteration prompts are used to guide the large model server to avoid the currently generated initial security relationship proposals and continue to generate new initial security relationship proposals.

[0037] The currently identified set of facts is fed back as a negative constraint to the large model server, forcing it to avoid existing discoveries, deeply explore hidden long-tail vulnerability relationships in the long-tail interval, and complete the discrete symbol space synthesis of enhanced samples.

[0038] S2-3: Normalize and align the natural language predicates in the initial security relationship proposal with the predefined standard vulnerability relationship pattern set read from the standard vulnerability knowledge base to obtain standard security triples for training, and output them to the original vulnerability governance training space to form training samples.

[0039] In this embodiment, a cross-domain security semantic normalization alignment engine is used to perform fact consistency verification and standard vulnerability database pattern mapping.

[0040] In one embodiment, S3 specifically includes: S2-3-1: Perform serialization and splicing on each initial security relationship proposal in the initial security relationship proposal set to convert it into a continuous natural language evidence chain as the premise background for natural language reasoning.

[0041] In this embodiment, adopting deterministic reorganization logic refers to rearranging the subjects in the initial security relationship proposal based on pre-defined field arrangement rules. Natural language predicate and object The data is sequentially combined in a fixed order to obtain the prerequisite background required for the natural language inference model. Specifically, for the same subject, natural language predicate, and object, the same combination result is obtained according to the field arrangement rules. The field arrangement rules combine the subject, natural language predicate, and object in that order, transforming the initial security relationship proposal generated by the intelligent synthesis engine for long-tail sparse security threat data into a continuous chain of natural language evidence, serving as the prerequisite background for natural language inference. ,in, A function to perform serialization and combination according to the field arrangement rules.

[0042] S2-3-2: Read the predefined standard vulnerability relationship pattern set of the vulnerability resource management system, inject declarative semantic templates into the predefined standard vulnerability relationships, and construct positive candidate hypotheses and negative candidate hypotheses to generate a candidate hypothesis set covering the global label pattern space.

[0043] In this embodiment, the standard vulnerability relationship pattern set of the vulnerability resource management system is read, and the predefined standard vulnerability relationships are... Inject declarative semantic templates And a two-way permutation strategy was adopted to construct positive candidate hypotheses. With the reverse candidate hypothesis Exhaustive generation of a set of candidate hypotheses covering the global label pattern space. .

[0044] S2-3-3: Input the aforementioned background and the set of candidate hypotheses into the pre-trained deep multilingual natural language inference model, calculate the comprehensive security alignment score, and use the graph maximization method to retrieve the globally optimal alignment result.

[0045] In this embodiment, the aforementioned background and candidate hypothesis set are input into a pre-trained deep multilingual natural language inference model, and a comprehensive security alignment score is calculated: in, For predefined standard vulnerability relationships In direction The candidate hypothesis is as follows: Forward or reverse; The semantic entailment probability output by the pre-trained deep multilingual natural language inference model is used to represent the previous context. When the described security relationship is based on facts, candidate hypotheses can be derived. The greater the semantic implication probability, the more semantically consistent the initial security relationship proposal is with the predefined standard vulnerability relationship. The contradiction probability output by the pre-trained deep multilingual natural language inference model is used to represent the previous context. When the described security relationship is based on facts, the candidate hypothesis is... The probability that the described predefined standard vulnerability relationship conflicts with or cannot be simultaneously established with this factual basis is considered. A higher semantic contradiction probability indicates a greater semantic inconsistency between the initial security relationship proposal and the predefined standard vulnerability relationship. The globally optimal alignment result is retrieved when both the semantic implication probability and the semantic contradiction probability are between 0 and 1. .

[0046] S2-3-4: When the comprehensive security alignment score of the global optimal alignment result is greater than the confidence threshold, the corresponding initial security relationship proposal is determined to have passed the authenticity verification. The natural language predicate in the initial security relationship proposal is replaced with the predefined standard vulnerability relationship in the global optimal alignment result and mapped to the standard security triplet for training.

[0047] In this embodiment, when its confidence level (comprehensive security alignment score) meets the following conditions... hour, The confidence threshold is used to normalize and align the standard security triples. As an enhancement sample, it is added to the original vulnerability governance training space to filter out the security illusions generated by the large model.

[0048] S2-4: Using the training samples, perform forward computation on the deep text classification and network relationship discrimination model. Using a parameter iterative controller based on gradient equalization and probability shift, run a dynamic asymmetric loss function to calculate the total loss of the multi-label classification. Then, perform backpropagation and model parameter update based on the total loss of the multi-label classification until the preset convergence condition is met, and obtain the trained deep text classification and network relationship discrimination model.

[0049] In this embodiment, a training optimization parameter iterative controller based on gradient equalization and probability shift is used to run a dynamic asymmetric loss function during the parameter optimization stage of the deep text classification and network relationship discrimination model, thereby reshaping the sample weight allocation; the parameter iterative controller will adjust the total loss of multi-label classification. Decoupling to positive sample loss branch With negative sample loss branch That is, the total loss satisfies By setting asymmetric focusing hyperparameter constraints The positive sample loss branch calculation satisfies: .

[0050] in, This is a positive sample focusing hyperparameter used to adjust the degree of decay of the positive sample loss as the relationship prediction probability changes; The relation prediction probability output by the deep text classification and network relation discrimination model is used to represent candidate safe entity pairs. There are predefined standard vulnerability relationships. The probability of a relationship prediction ranges from 0 to 1. The higher the predicted probability, the more likely the candidate security entity is to be a match for the other entity. There are predefined standard vulnerability relationships. The higher the probability, the better.

[0051] The negative sample loss branch calculation satisfies: .

[0052] in, The negative sample focusing hyperparameter is used to adjust the degree of decay of the negative sample loss as the correction probability changes, and m is the probability offset threshold, used to determine the lower bound of the predicted probability of the relationship involved in the calculation of negative sample loss; To predict the probability of a relationship The corrected probability obtained after performing probability offset processing, when When not greater than m, A value of 0 indicates that the gradient backpropagation for negative samples is truncated; when When it is greater than m, for .

[0053] The loss from the large number of easily discernible negative background samples generated by portfolio explosion decays exponentially with decreasing prediction probability, the interference of redundant negative gradients is removed and suppressed, and parameter optimization space is reserved for sparse positive samples; an adjustable probability offset threshold is introduced. Construct corrected probabilities: The gradient backpropagation of redundant background negative samples with prediction probabilities extremely close to zero is fully shifted and hard-removed, forcing the classification network to accurately focus on difficult negative samples near the discrimination boundary during parameter iteration, thus ensuring the adaptive optimization efficiency of the vulnerability risk feature identification network.

[0054] The training input of the deep text classification and network relationship discrimination model includes unstructured logs, candidate security entity pairs identified from the unstructured logs, and the relationship labels corresponding to the candidate security entity pairs. The training output is the predicted probability of each candidate security entity pair corresponding to a predefined standard vulnerability relationship. During training, the standard security triples obtained after normalization and alignment are used as augmented samples to supplement the original vulnerability governance training space, and are input together with the original labeled samples into the deep text classification and network relationship discrimination model for forward computation. The total loss of multi-label classification is calculated using the aforementioned dynamic asymmetric loss function, and backpropagation is performed based on the total loss of multi-label classification to update the model parameters of the text encoding layer, entity representation aggregation layer, entity pair relationship fusion layer, and multi-label classification layer. The forward computation, loss calculation, backpropagation, and parameter update are repeated until the preset training rounds are reached or the preset convergence condition is met, resulting in the trained deep text classification and network relationship discrimination model.

[0055] The training phase enables the deep text classification and network relationship discrimination model to learn standard vulnerability relationships between vulnerabilities, assets, business systems, and threat intelligence in unstructured logs. In the model application phase, the unstructured logs to be addressed and their corresponding candidate security entities are input into the trained model. Based on the predicted probabilities output by the model, predefined standard vulnerability relationships are determined, forming standard security triples for vulnerability risk scoring. The intelligent quantitative assessment module for vulnerability risk, based on these standard security triples, associates vulnerabilities with affected assets, business systems, and threat intelligence sources in the asset CMDB (Configuration Management Database), thereby determining the basic vulnerability severity score, asset importance score, business impact score, remediation urgency score, and business association correction coefficient. Therefore, the training results of the deep text classification and network relationship discrimination model are not directly used as the final risk score, but rather provide standardized vulnerability relationship identification results and multi-source data association basis for the vulnerability risk scoring process.

[0056] In this embodiment, before performing progressive reasoning based on a pipelined thought chain and adaptive feedback iteration with negative constraints on the unstructured logs used for training, and synthesizing the initial set of security relation proposals in the discrete symbol space, the following steps are also included: The unstructured security asset text, unstructured threat intelligence, and unstructured vulnerability descriptions are formatted and cleaned to obtain processed unstructured logs.

[0057] S3: Determine the predefined standard vulnerability relationship between the candidate security entity pairs based on the predicted probability to obtain a standard security triplet for vulnerability risk scoring.

[0058] S4: The vulnerability information corresponding to the standard security triplet is fused with the multi-source heterogeneous asset database in the vulnerability resource management system to obtain the comprehensive risk score of each vulnerability; the source heterogeneous asset database includes asset CMDB, real-time vulnerability scanning reports and threat intelligence sources.

[0059] In this embodiment, the vulnerability risk intelligent quantitative assessment module is used to perform cascaded calculation of vulnerability governance priorities in the integrated vulnerability asset environment.

[0060] In one embodiment, S4 specifically includes: S4-1: The vulnerability information corresponding to the standard security triplet is fused with the unstructured security asset text and the unstructured threat intelligence from multiple sources and uniformly mapped to a scoring range of 0~100 to obtain the vulnerability basic severity score, asset importance score, business impact score, and remediation urgency score.

[0061] In this embodiment, vulnerability information corresponding to the standard security triplet is fused with multi-source heterogeneous security data from the enterprise's actual assets and business environment, and uniformly mapped to a scoring range of 0-100 to eliminate dimensional differences. The quantified score includes: the basic severity score of the vulnerability. Asset Importance Score Business Impact Score and repair urgency score .

[0062] S4-2: Calculate the comprehensive risk score for each vulnerability by weighting and summing the vulnerability severity score, asset importance score, business impact score, and remediation urgency score, along with their corresponding preset weights.

[0063] In this embodiment, based on the preset weights corresponding to each feature dimension The weighted summation is then performed to calculate the overall risk score (RiskScore) for the target vulnerability. The calculation formula is as follows: .

[0064] S5: Based on the business correlation correction coefficient, the comprehensive risk score is corrected to obtain the final risk score, and the final risk score is output to the vulnerability resource management system.

[0065] In this embodiment, a business association correction coefficient k is introduced to characterize the strength of the association between the affected assets and the core business system. The vulnerability resource management system obtains business association data related to the affected assets from the asset CMDB, business service catalog, network topology diagram, application dependency table, and business continuity management data. Specifically, based on the asset level, region, business type carried by the asset, and whether the asset belongs to the core production environment recorded in the asset CMDB, the asset criticality score is calculated. The degree of topology correlation score is calculated based on the network topology path length between the affected assets and the core business system, whether there is a direct connection, and whether it is located in the core business access link. Based on the number of calls, dependency levels, and service dependencies of the core business systems to the applications, components, or services carried by the affected assets, a business dependency score is calculated. The business continuity impact score is calculated based on the degree of impact on business continuity, transaction processing, or critical business functions caused by the failure, malfunction, or attack of affected assets. .

[0066] The asset criticality score The topological correlation score The business dependency score and the business continuity impact score. Normalized to The interval is defined, and a business association strength score is calculated according to a preset weight, specifically as follows: ;in, The score represents the strength of business association. , , , These are preset weights corresponding to the degree of asset criticality, the degree of topological correlation, the degree of business dependence, and the degree of impact on business continuity, respectively. Based on the aforementioned business association strength score Calculate the business correlation correction factor, specifically as follows: ;in, This is the maximum value of the preset business association correction coefficient. In this embodiment, Set it to 0.10 to adjust the business correlation coefficient. The range of values ​​is .

[0067] When the affected assets have no business dependency on the core business system Set to 0, business correlation correction coefficient Set to 0; when the affected asset is a direct carrier of the core business system, located in the critical access link of the core business, and has a high degree of dependence on the core business. The business correlation correction coefficient is close to 1. near Based on the aforementioned business association correction coefficient Using the formula Calculate the final risk score, where, For comprehensive risk scoring, This is used for the final risk score.

[0068] S6: The vulnerability resource management system automatically classifies vulnerabilities into preset intelligent governance levels based on the final risk score and generates a dynamic vulnerability remediation priority ranking list.

[0069] Based on the final risk score, vulnerabilities are automatically classified into three intelligent governance levels: high-risk, medium-risk, and low-risk. A dynamic vulnerability remediation priority ranking list is generated, and the evaluation results are output to the vulnerability resource management system for vulnerability remediation strategy formulation, disposal sequence arrangement, and resource allocation decisions.

[0070] This embodiment is built within an enterprise-level vulnerability resource management system of a power company or financial institution. The system is hosted on a distributed cluster of multiple servers, with a hardware environment featuring an NVIDIA RTX 3090 deep learning accelerator card with 24GB of video memory, used to run local discriminative networks and Natural Language Inference (NLI) verification models. The system interacts routinely with externally deployed general-purpose large language model (LLM) servers (such as GPT-3.5-turbo or open-source large language models (such as Llama, Mistral, or Gemma series) deployed in a private enterprise cluster and fine-tuned using cybersecurity corpora) through a secure API interface group.

[0071] The overall operating environment and underlying data flow of this embodiment are as follows: Figure 2 As shown, its core application lies in improving the accuracy of vulnerability resource management systems in capturing long-tail, sparse, and unknown security threats, and in realizing automated vulnerability remediation priority orchestration.

[0072] Step S1: Input and preprocessing of multi-source heterogeneous security data.

[0073] The vulnerability resource management system obtains raw unstructured logs at high frequency through proactive scanning interfaces, full-traffic threat intelligence monitoring interfaces, and the asset management database (CMDB). .

[0074] In actual operation, unstructured logs It contains lengthy textual descriptions such as "Component A has a risk of boundary overflow when processing specific serialization requests. This component is widely deployed in our company's core payment link gateway." Due to the massive scale of assets, the potential relationship combinations between entity pairs exhibit a quadratic explosion, with the vast majority of combinations being harmless background noise, showing severe positive and negative sample imbalance and long-tail sparsity.

[0075] Step S2: Implementation details of intelligent synthesis of sparse security threat data based on Pipeline-CoT.

[0076] To address the problem of an extremely scarce number of existing vulnerability annotation samples due to long-tail sparseness, this embodiment activates an intelligent data synthesis engine. For example... Figure 3 As shown, the specific execution steps are as follows: S21: Pipeline-CoT-based progressive reasoning (which can also employ an automated security agent topology probing process based on the ReAct (reasoning-action) interaction framework) is guided by discrete symbol space synthesis. The system injects the captured unstructured logs D into carefully designed few-shot prompts. These prompts contain pre-defined thought path examples. This is used to activate the context learning capabilities of the external large language model. The large model first performs autonomous entity recognition, extracting potential candidate safe entity pairs (subjects). With the object For example, subject: gateway component A, object: payment business core link.

[0077] Subsequently, the large model enters the context role resolution phase, injecting specific network topology contextual explanation prompts. In specific implementation, the system constructs a prompt control structure comprising a role command domain, a task command domain, an input parameter domain, and an output constraint domain. The role instruction field is configured with a specific instruction: "You are a senior cybersecurity architect and vulnerability analysis expert." This is used to define the knowledge boundaries when generating security semantics from a large language model. The task instruction field is configured with a specific instruction: "Based on the input vulnerability logs, analyze the functional positioning of the target component within the overall network topology." This is used to guide the model to perform interpretation-first multi-hop logical reasoning. Dynamic injection of the input parameter field into the original vulnerability log mentioned above (The specific text injected in this embodiment is: "component") Responsible for handling core routing and forwarding...”); The output constraint field is configured with a specific format constraint: "Generate semantic context interpretation" "This is used to enforce restrictions on the structured attributes of data returned from large models."

[0078] Guided by this framework, the large model generates structured semantic contextual explanations. Finally, in the relation proposal synthesis stage, the large model diverges freely within an unconstrained semantic space, outputting natural language predicates with high semantic generalization. (e.g., "deployed in...and endangering"), thereby synthesizing initial security relation proposals in the discrete symbol space: .

[0079] S22: Negative Constraint Feedback Iteration Based on Dynamic Knowledge Density. To prevent large models from repeatedly generating high-frequency, obvious asset relationships (leading to insufficient mining of long-tail sparse relationships), the system dynamically monitors the number of currently generated independent safe triples through an internal counter. When the output rate of new relationships falls below the preset knowledge density target threshold τ (τ is set to 0.05 in this embodiment) within 10 consecutive iterations, the system automatically triggers the feedback iteration control mechanism: .

[0080] At this point, the system will set together all currently identified initial security relationships. As a reverse negative constraint, the lock is repackaged and locked, along with Feeding the large model again forces it to avoid existing discoveries during generation, thereby compelling it to explore hidden and rare vulnerability relationships at the edge of the long tail.

[0081] Step S3: Implementation details of cross-domain secure semantic normalization alignment based on multilingual NLI.

[0082] Because the predicates generated by the large model in the unconstrained semantic space (Such as "deployed in...and endangering") cannot be directly identified by the vulnerability resource management system and may be accompanied by security illusions. This embodiment uses deterministic reorganization logic and natural language reasoning (NLI) framework for normalization alignment: S31: Construction and bidirectional permutation of declarative semantic templates. The system first serializes and concatenates the structured proposals generated by the large model into a continuous chain of natural language evidence, serving as the background for NLI. : .

[0083] Simultaneously, the system reads a set of predefined standard vulnerability relationship patterns from the standard vulnerability knowledge base. Assume one of the predefined standard vulnerability relationships is... The system injects declarative semantic templates into it and employs a two-way permutation strategy to construct positive candidate hypotheses. With the reverse candidate hypothesis : ; .

[0084] S32: Two-way implication score calculation and factual consistency verification. (Presupposition background) With the candidate hypothesis set generated by exhaustive search The input is fed into a pre-trained deep multilingual natural language inference model (mDeBERTa-v3-base in this example) deployed on a local RTX 3090 graphics card. (The pre-trained deep multilingual natural language inference model can also be replaced by a security semantic vector embedding model to calculate the cosine similarity between open predicates and standard schemas; or a closed-set multi-label supervised classification network directly trained locally based on BERT / RoBERTa). The model backpropagates to calculate the semantic entailment probability between the two sentences. and the probability of contradiction And calculate the overall security alignment score: .

[0085] Find the globally optimal alignment result by using the graph-maximization search. The score satisfies the confidence threshold if and only if the score meets the confidence threshold. At that point, the system determined that the sample generated by the large model passed the authenticity check and belonged to the category of high signal-to-noise ratio samples. Finally, the natural language description was accurately and securely mapped to standard schema relationships: .

[0086] This standardized security triplet, as high-quality incremental data, is directly injected into the training space of the vulnerability resource management system, fundamentally eliminating the interference of false security illusions.

[0087] Step S4: Implementation details of DAL parameter iterative control based on gradient equalization and probability shift.

[0088] During the deep text classification and network relationship discrimination training phase of the vulnerability resource management system, due to the huge amount of internal assets, the number of entity pairs generated by pairwise combinations of assets, network nodes, and self-developed components increases with the number of asset nodes. Presenting a quadratic order The explosive growth of this phenomenon has resulted in the vast majority of entity pairs in the constructed training space not having any real vulnerability mapping or security threat association. During backpropagation, the accumulated negative gradients of these massive amounts of simple background negative samples, which are easily judged as unrelated, will dominate, severely obscuring and eroding the classification surface of truly high-risk and sparse positive samples within the classification boundary.

[0089] To reshape the distribution of sample weights and control the parameter iteration of the discriminant network, this embodiment activates the parameter iteration controller and runs the Dynamic Asymmetric Loss (DAL) function during the backpropagation gradient calculation of the discriminant network. Specific control and calculation details are as follows: S41: Decoupling the loss branch and focusing on asymmetric weights. The parameter iterative controller distinguishes the total loss across multiple labels. Decoupling into independent positive sample loss branches With negative sample loss branch In this embodiment, asymmetric focusing hyperparameter constraints are set. For and For truly existing sparse high-risk vulnerability-related samples (positive samples), due to The positive sample branch degenerates into the standard cross-entropy loss, maintaining its normal gradient backpropagation strength without any artificial weakening. .

[0090] For the majority of background noise samples (negative samples), the loss is calculated using an adjustment factor. Apply asymmetric constraints. Because... When the discrimination network has a very high probability of correctly predicting a simple negative sample (i.e., the probability that its prediction has a flawed correlation), When the probability approaches 0, the loss contribution of this sample will decrease exponentially to the square as the predicted probability decreases, thus freeing up enough optimization boundaries in the total gradient space for sparse high-risk positive samples.

[0091] S42: Probabilistic offset truncation and hard removal of negative gradients. To completely eliminate the long-tailed cumulative gradient noise generated by massive amounts of easily identifiable redundant negative samples, the controller introduces an adjustable probability offset threshold. (In this embodiment, it is set) Construct the modified probability function: .

[0092] In the specific parameter iteration implementation, if the network predicts the probability of the relationship between a certain harmless asset and the output... Because this value is less than the set probability offset threshold After the above After operator mapping, its corrected prediction probability It is directly forced to be assigned a value of 0. Substitute it into the negative sample loss branch. During the differentiation calculation, the backpropagation gradient flow generated by the sample is completely truncated (hard removal). Through this shift truncation control, the discriminative classification feature network is forcibly stripped of a massive amount of invalid interference from easily discriminable negative samples during parameter iteration, accurately focusing on difficult negative samples near the classification boundary, significantly improving the adaptive convergence efficiency of the underlying discriminative model of the vulnerability resource management system.

[0093] S43: Model structure, inputs and outputs, and specific training process.

[0094] During model training, standard security triples used for training are used as augmentation samples, which, together with the original labeled samples in the original vulnerability governance training space, constitute the training samples. Each training sample includes unstructured logs, candidate security entity pairs, and their corresponding relationship labels. The training samples are input into the model to perform forward computation, obtaining the predicted probabilities of each predefined standard vulnerability relationship; the total loss for multi-label classification is calculated according to the dynamic asymmetric loss function described in S41 and S42; backpropagation is performed based on the total loss for multi-label classification, and the model parameters are updated; forward computation, loss calculation, backpropagation, and model parameter updates are repeated until a preset number of training rounds are reached or a preset convergence condition is met, resulting in a trained deep text classification and network relationship discrimination model.

[0095] S44: Connection between the training phase and the vulnerability risk scoring process. After model training is complete, the unstructured logs to be addressed and the candidate security entities within them are input into the trained deep text classification and network relationship discrimination model. The model outputs the predicted probability of each candidate security entity corresponding to a predefined standard vulnerability relationship. Based on the predicted probability, the corresponding predefined standard vulnerability relationship is determined, forming a standard security triplet for vulnerability risk scoring. The vulnerability risk intelligent quantitative assessment module, based on the standard security triplet for vulnerability risk scoring, associates the vulnerability with affected assets, business systems, and threat intelligence sources in the asset CMDB to determine the basic severity score of the vulnerability. Asset Importance Score Business Impact Score and repair urgency score And the business association correction coefficient k. Therefore, the model training phase does not directly output the final risk score, but provides standard vulnerability relationship identification results through the trained model, which serve as the input basis for subsequent multi-source fusion, comprehensive risk score calculation and business association correction.

[0096] Step S5: Example of intelligent quantitative assessment of vulnerability risks and linkage with business systems.

[0097] When the cross-domain security semantic normalization alignment engine outputs a structured standard security triplet... Subsequently, the vulnerability risk intelligent quantitative assessment module integrates it with multi-source heterogeneous asset databases (such as asset CMDB, real-time vulnerability scanning reports, and threat intelligence sources) in the enterprise vulnerability resource management system.

[0098] To ensure that the semantic relationships extracted by the algorithm layer can deeply adapt to the real-world production and business scenarios of enterprises, and to eliminate dimensional differences between multi-source data, the module first normalizes and maps the feature data of each dimension, transforming them uniformly to... scalar interval: S51: Multidimensional feature scalar normalization mapping.

[0099] Vulnerability Basic Severity Score Linear mapping is performed based on technical indicators provided by the Common Vulnerability Evaluation System (CVSS) or the National Vulnerability Database (CNNVD). In this embodiment, an unknown vulnerability contained in a component is classified as medium-risk after technical analysis, and the mapping score is... .

[0100] Asset Importance Score Extract the asset level (e.g., core system, intranet production, edge testing) of the affected asset host in the CMDB. In this embodiment, the target asset belongs to the payment settlement gateway core node, and the mapping score is... .

[0101] Business Impact Score This involves quantifying the potential disruption to upstream and downstream business continuity caused by the asset anomaly. System topology correlation analysis shows that the anomaly will disrupt core transaction links, resulting in a calculated business impact score. .

[0102] Repair urgency score The vulnerability's exploit maturity is determined by combining external threat intelligence (e.g., the existence of publicly available PoCs, exploits, or active attacks in the wild). In this embodiment, intelligence indicates that the long-tail vulnerability has been captured in wild exploit code, and the urgency level is mapped to a score. .

[0103] S52: Comprehensive risk score and business-related cascading correction calculation. The evaluation module calls the preset feature dimension weight vector (set in this embodiment). And satisfy The scores are weighted and summed (a non-linear fusion algorithm can also be used, for example, by normalizing the multi-dimensional feature scalar). Using the input features, machine learning models such as Support Vector Machine (SVM), Extreme Gradient Boosting Tree (XGBoost), or Multilayer Perceptron (MLP) are used to perform end-to-end regression prediction of the true risk level of the vulnerability, and the comprehensive risk score of the target vulnerability is calculated. : ; .

[0104] To highlight the amplifying effect of the core production chain on vulnerability risks, this embodiment introduces a business association correction coefficient k. The entities affected by the vulnerability are identified as critical assets of the core business system, aligned via Pipeline-CoT and the NLI engine. Asset criticality scores are calculated based on the asset CMDB, business service catalog, network topology diagram, application dependency table, and business continuity management data. Topological correlation score Business Dependence Score And the impact score of business continuity .set up ,and =0.10, then the business association strength score is... Business correlation correction coefficient The final risk score, RiskScore, is calculated using a cascaded correction formula: .

[0105] S53: Intelligent governance level classification and system response linkage. The vulnerability resource management system uses the final risk score calculated... Automatically compare with the preset governance range (e.g.: The vulnerability is automatically classified as a high-risk vulnerability (at an extremely high risk level).

[0106] Based on this, the system automatically inserts the vulnerability at the top of the dynamic vulnerability remediation priority ranking list, bypassing the original conventional scheduling process, and triggers a coordinated response through the system's built-in API data interface: automatically dispatching high-priority remediation work orders to security operations personnel (SIEM / SOC teams), coordinating with the firewall (WAF) to issue temporary virtual patch blocking policies, and orchestrating automated asset decommissioning or isolation scripts. This example demonstrates that this application can effectively correct the shortcomings of traditional methods that rely solely on technical scores (in this example...). The system addresses the blind allocation of resources caused by the "medium-risk" scenario, and enables intelligent governance of vulnerabilities that accurately match the actual operational risks of enterprises.

[0107] Those skilled in the art will understand that the quantification scores and weighting coefficients (such as...) in the above steps... (etc.), probability offset threshold (like ) and business-related correction coefficient (like The values ​​mentioned above are merely specific values ​​for a preferred embodiment of this application. In actual deployments of vulnerability resource management systems for different industries (such as finance, power, and government), the aforementioned hyperparameters and adaptive judgment thresholds can be dynamically adjusted or periodically corrected and optimized based on historical vulnerability handling results, industry compliance requirements, and the scale of network assets. These local numerical adjustments do not deviate from the core protection scope of the technical solution of this application.

[0108] Example of comparing simulation test data with classical methods: In a real-world distributed testing environment, when dealing with an unknown vulnerability in a gateway component, traditional methods rely on general vulnerability standards for technical analysis, classifying it as medium-risk (technical mapping). If the traditional remediation strategy that relies solely on technical score (CVSS) is followed, this vulnerability will be ignored or shelved indefinitely by security operations personnel, resulting in a serious risk of high-risk underreporting.

[0109] This application, through the fusion of multi-source heterogeneous security data, extracts that this component belongs to the core node of the payment settlement gateway (asset importance). The anomaly will jeopardize the continuity of the core transaction chain (business impact). Furthermore, external intelligence indicates that active exploitation of the code has occurred in the wild (urgent need to fix). The basic value is calculated by weighted summation of the feature dimension weight vectors. At this point, the system further utilizes the Pipeline-CoT and NLI engines to precisely identify the entities affected by the vulnerability as critical assets belonging to the core business system, and automatically cascades them to assign them the highest business-related correction coefficient. After calculation using the cascading correction formula, the final risk score was automatically adjusted to 88.55.

[0110] Based on this, the system automatically bypasses traditional scheduling, classifying vulnerabilities into extremely high-risk management levels, automatically dispatching high-priority remediation work orders, and coordinating with the firewall to distribute virtual patches. The simulation results and coordinated examples fully demonstrate that this application, by introducing multi-dimensional business cascading corrections on top of traditional technical scoring, achieves intelligent vulnerability management with transparent rules and strong interpretability, resulting in a higher return on security resource investment than traditional CVSS assessment methods.

[0111] Compared with related technologies, this application has the following significant technical advantages and innovative benefits from the introduction of classical methods for comparison: Compared to traditional generative data augmentation and synonym replacement methods, this significantly improves the generalization recognition rate of marginal long-tail sparse threats. Related techniques mostly employ traditional generative data augmentation or shallow text synonym replacement methods. These methods are limited to local semantic mining within the document, lacking external semantic priors and unable to capture the hidden relationships of long-tail sparse entities across physical text boundaries. This application innovatively constructs a Pipeline-CoT engine based on adaptive feedback iteration, utilizing the open-world knowledge of a large language model to directly synthesize highly expressive natural language predicates in a discrete symbolic space; coupled with a negative constraint adaptive feedback iteration mechanism, it can achieve high-expressive natural language predicates even when the knowledge density is below a preset threshold. The time-forced model avoids existing discoveries and deeply explores hidden long-distance asset threat correlations, effectively solving the shortcomings of traditional GDA methods such as semantic rigidity and inability to discover edge long-tail threats.

[0112] Compared to traditional control methods that forcibly restrict label output, this approach completely filters out security fact illusions. Related technologies, in order to adapt large models to the standard patterns of security systems, typically force large models to directly output predefined closed-set labels in the prompts. This easily leads to severe security fact illusions or classification bias in unrestricted cybersecurity texts. This application improves upon this by adopting a decoupled collaborative architecture for generation and discrimination, allowing large models to diverge freely in an unrestricted semantic space to retain fine-grained features. Subsequently, an NLI normalization alignment engine based on probabilistic semantic implication is introduced for secondary verification. The system reorganizes open-ended proposals into evidentiary premises and exhaustively constructs bidirectional permutation candidate hypotheses using standard vulnerability database patterns. A deep multilingual natural language inference model is then used to quantitatively calculate the alignment score. Only when the confidence threshold (e.g.) is met... Only samples with a certain signal-to-noise ratio are allowed to be injected into the underlying training space, which fundamentally ensures the high signal-to-noise ratio and consistency with the facts of the incremental samples.

[0113] Compared to the classic Focal Loss function, it perfectly overcomes the problem of gradient dominance caused by massive amounts of simple negative samples due to the explosion in asset size: in enterprise-level vulnerability resource management scenarios, the number of asset entities increases quadratically with the number of assets ( The explosive growth of data leads to extreme sample imbalance. While the traditional Focal Loss function can focus on difficult samples through dynamic weights, its long-tailed accumulated negative gradient still dominates when faced with massive amounts of absolutely easy negative samples with prediction probabilities extremely close to zero, obscuring the discrimination boundary of truly sparse, high-risk positive samples. This application innovatively designs a Dynamic Asymmetric Loss (DAL) function and introduces a probability offset threshold. It not only achieves this through asymmetric focusing hyperparameter constraints This improvement causes the loss of easily discernible negative samples to decay exponentially quadratically with decreasing prediction probability, and further performs complete shift truncation and gradient hard removal when the probability is extremely close to zero. This improvement completely eliminates the interference of massive amounts of background noise, forcing the classification feature network to accurately focus on difficult negative samples near the classification boundary during parameter iteration, significantly improving the model's adaptive optimization efficiency.

[0114] Compared to traditional assessment methods that only bind technical severity attributes (such as relying solely on the general vulnerability assessment system CVSS score), this approach achieves precise resource allocation: Existing vulnerability assessment methods often over-rely on single technical severity attributes provided by external public vulnerability databases, leading to a severe disconnect between assessment results and complex real-world business scenarios, which can easily result in decision-making bias and high-risk underreporting. This application builds upon this foundation to construct a multi-dimensional cascaded assessment system of "technology-asset-business," linearly mapping the technical indicators of general vulnerability standards to vulnerability severity scores. And fully introduce asset importance Business impact and repair urgency A multi-dimensional unified model was performed. After weighted summation, a business correlation correction coefficient representing the strength of the correlation between affected assets and the core system was innovatively cascaded. It accurately reflects the differentiated real business risks brought about by vulnerabilities of the same technical severity level in ordinary testing environments and core production and certification links, and truly realizes automated and precise security resource orchestration and scheduling.

[0115] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described large model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats.

[0116] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the above-described method for large-model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats.

[0117] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the above-described large-model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats.

[0118] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 4 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a large-scale data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats.

[0119] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0121] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0122] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0123] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0124] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for large-scale model data augmentation and vulnerability risk quantification governance targeting long-tail sparse security threats, characterized in that, include: Obtain the unstructured logs to be governed and the candidate security entity pairs identified from the unstructured logs to be governed; Unstructured logs include unstructured security asset text, unstructured threat intelligence, and unstructured vulnerability descriptions; Based on the unstructured logs to be addressed and the candidate security entity pairs, a trained deep text classification and network relationship discrimination model is used to determine the predicted probability of each candidate security entity pair corresponding to a predefined standard vulnerability relationship. The deep text classification and network relationship discrimination model includes a text encoding layer, an entity representation aggregation layer, an entity pair relationship fusion layer, and a multi-label classification layer. Based on the predicted probability, a predefined standard vulnerability relationship between the candidate security entity pairs is determined to obtain a standard security triplet for vulnerability risk scoring. The vulnerability information corresponding to the standard security triplet is fused with the multi-source heterogeneous asset database in the vulnerability resource management system to obtain a comprehensive risk score for each vulnerability; the source heterogeneous asset database includes asset CMDB, real-time vulnerability scanning reports and threat intelligence sources; The comprehensive risk score is corrected based on the business correlation correction coefficient to obtain the final risk score, and the final risk score is output to the vulnerability resource management system. The vulnerability resource management system automatically classifies vulnerabilities into preset intelligent governance levels based on the final risk score and generates a dynamic vulnerability remediation priority ranking list.

2. The method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats as described in claim 1, characterized in that, The training process of the deep text classification and network relationship discrimination model specifically includes: Obtain unstructured logs for training and candidate security entity pairs for training identified from the unstructured logs for training; The unstructured logs used for training are subjected to progressive reasoning based on a pipelined thought chain and adaptive feedback iteration with negative constraints to synthesize an initial set of security relation proposals in a discrete symbolic space. The initial set of security relation proposals includes all initial security relation proposals generated at the end of the iteration. The initial security relation proposals are triplets about the subject, natural language predicate, and object. The progressive reasoning based on the pipelined thought chain is a multi-hop reasoning architecture that decomposes the security relation mining task into three progressive reasoning stages: autonomous entity recognition, context role resolution, and security relation proposal synthesis. The natural language predicates in the initial security relationship proposal and the predefined standard vulnerability relationship pattern set read from the standard vulnerability knowledge base are normalized and aligned to obtain the standard security triples for training, and output to the original vulnerability governance training space to form training samples. The training samples are used to perform forward computation on the deep text classification and network relationship discrimination model. A parameter iterative controller based on gradient equalization and probability shift is used to run a dynamic asymmetric loss function to calculate the total loss of the multi-label classification. Backpropagation and model parameter updates are performed based on the total loss of the multi-label classification until the preset convergence condition is met, and the trained deep text classification and network relationship discrimination model is obtained.

3. The method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats as described in claim 2, characterized in that, The unstructured vulnerability description logs used for training are subjected to pipelined reasoning and negative constraint adaptive feedback iteration to synthesize an initial set of security relation proposals in the discrete symbol space, specifically including: The unstructured vulnerability description logs used for training and the prompts containing examples of thought paths are input into the large model server to perform autonomous entity recognition to extract a set of candidate security entities. The large model server performs context role parsing for each candidate security entity, and generates a structured semantic background explanation by combining network topology context explanation prompts; the network topology context explanation prompts include prompts for the role instruction domain, prompts for the task instruction domain, prompts for the input parameter domain, and prompts for the output constraint domain. The large model server generates natural language predicates in an unrestricted semantic space based on structured semantic background interpretation, and synthesizes initial security relationship proposals with corresponding candidate security entities; The current knowledge density is calculated by monitoring the number of initial security relationship proposals that have been generated. When the current knowledge density does not reach the preset knowledge density target threshold, a feedback iteration mechanism is automatically triggered. The set of initial security relationship proposals that have been generated is fed back to the large model server as a negative constraint until the current knowledge density reaches the preset knowledge density target threshold and the iteration terminates. All initial security relationship proposals generated when the iteration terminates are taken as the initial security relationship proposal set.

4. The method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats as described in claim 2, characterized in that, The natural language predicates in the initial security relationship proposal are normalized and aligned with the predefined standard vulnerability relationship pattern set read from the standard vulnerability knowledge base to obtain the standard security triples for training, specifically including: Each initial security relationship proposal in the initial security relationship proposal set is serialized and concatenated to form a continuous natural language evidence chain as the premise background for natural language reasoning; Read the predefined standard vulnerability relationship pattern set of the vulnerability resource management system, inject declarative semantic templates into the predefined standard vulnerability relationships, and construct positive candidate hypotheses and negative candidate hypotheses to generate a candidate hypothesis set covering the global label pattern space; The aforementioned background and the set of candidate hypotheses are input into a pre-trained deep multilingual natural language inference model to calculate a comprehensive secure alignment score, and the global optimal alignment result is retrieved using the tu-suo maximization method. When the overall security alignment score of the global optimal alignment result is greater than the confidence threshold, the corresponding initial security relationship proposal is determined to have passed the authenticity verification. The natural language predicate in the initial security relationship proposal is replaced with the predefined standard vulnerability relationship in the global optimal alignment result and mapped to the standard security triplet for training.

5. The method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats as described in claim 1, characterized in that, The vulnerability information corresponding to the standard security triplet is fused with the unstructured security asset text and the unstructured threat intelligence to obtain a comprehensive risk score for each vulnerability, specifically including: The vulnerability information corresponding to the standard security triplet is fused with the unstructured security asset text and the unstructured threat intelligence from multiple sources and uniformly mapped to a scoring range of 0 to 100 to obtain the vulnerability basic severity score, asset importance score, business impact score, and remediation urgency score. The comprehensive risk score for each vulnerability is calculated by weighting and summing the vulnerability severity score, asset importance score, business impact score, and remediation urgency score, along with their corresponding preset weights.

6. The method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats as described in claim 1, characterized in that, The comprehensive risk score is adjusted based on the business relevance adjustment coefficient to obtain the final risk score, which specifically includes: Using formula Determine the final risk score; among which, For the final risk score; For comprehensive risk scoring; This is a business-related adjustment factor.

7. The method for large-scale model data augmentation and vulnerability risk quantification governance for long-tail sparse security threats as described in claim 2, characterized in that, Before performing pipelined reasoning and negative constraint adaptive feedback iteration on the unstructured logs used for training, and synthesizing the initial set of security relation proposals in the discrete symbol space, the process further includes: The unstructured security asset text, the unstructured threat intelligence, and the unstructured vulnerability description are formatted and cleaned to obtain the processed unstructured logs.

8. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the large model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the large-model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats as described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the large-model data augmentation and vulnerability risk quantification governance method for long-tail sparse security threats as described in any one of claims 1-7.

Images