Vulnerability information identification method and apparatus, and electronic device

Abstract

The present application relates to the technical field of vulnerability identification. Disclosed are a vulnerability information identification method and apparatus, and an electronic device. The method comprises: acquiring the name of a vulnerability; using a preset vulnerability information identification model to identify the name of the vulnerability, so as to obtain candidate vulnerability information; on the basis of the candidate vulnerability information, performing matching to obtain corresponding vulnerability description information in a preset information database, the corresponding vulnerability description information being target vulnerability information; and if no corresponding vulnerability description information is matched, the candidate vulnerability information being target vulnerability information. In this way, the trained vulnerability information identification model can relatively accurately acquire candidate vulnerability information, but there are still certain identification errors during identification with the vulnerability information identification model; and therefore by means of using vulnerability description information summarized and stored in an information database, determining target vulnerability information on the basis of candidate vulnerability information again can make the obtained target vulnerability information more accurate.

Description

Information identification method and device for vulnerability, and electronic device

[0001] Cross-reference to Related Applications

[0002] This application claims priority to Chinese Patent Application No. 202410652541.6, filed on May 24, 2024, entitled “Information identification method and device for vulnerability, and electronic device,” the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the technical field of vulnerability identification, and in particular to an information identification method and device for vulnerability, and an electronic device. BACKGROUND

[0004] A vulnerability is a defect in the specific implementation of hardware, software, protocol, or system security policy, which can enable an attacker to access or damage the system without authorization. Since the vulnerability type, product type, and version information in the vulnerability name are usually arranged in a predetermined order and separated by spaces, in related technologies, the spaces in the vulnerability name are identified, and the vulnerability name is divided into multiple strings according to the spaces, and each string is combined to obtain the vulnerability type, product type, and version information of the vulnerability. However, with the continuous development of vulnerability technology, currently, extra useless information may be inserted into the vulnerability name, so that the way of identifying the spaces in the vulnerability name to extract the vulnerability information in the vulnerability name has low accuracy of the identified vulnerability information.

[0005] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present application, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0006] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an overall description of the application, nor is it intended to identify key / important elements or delineate the scope of the embodiments, but to serve as a prelude to the detailed description below.

[0007] The embodiments of the present application provide an information identification method and device for vulnerability, and an electronic device, to improve the accuracy of the vulnerability information determined from the vulnerability name.

[0008] The embodiment of the present application provides a vulnerability information identification method, comprising: obtaining a vulnerability name; identifying the vulnerability name by using a preset vulnerability information identification model to obtain candidate vulnerability information; matching corresponding vulnerability description information in a preset information database according to the candidate vulnerability information, wherein the vulnerability description information is target vulnerability information; if no corresponding vulnerability description information is matched, the candidate vulnerability information is the target vulnerability information.

[0009] In the above embodiment, since the model can capture the potential rules, patterns and structures behind the data through the learning process. Therefore, the trained vulnerability information identification model can accurately obtain the candidate vulnerability information. However, there may be some identification errors in the identification of the vulnerability information identification model. Therefore, the target vulnerability information can be determined again according to the candidate vulnerability information by using the vulnerability description information that has been summarized and stored in the information database, so that the obtained target vulnerability information is more accurate.

[0010] Further, the vulnerability description information in the preset information database comprises a plurality of vulnerability type names and corresponding common defect list numbers and common defect list vulnerability descriptions; the candidate vulnerability information comprises a vulnerability type name; and the matching of the corresponding vulnerability description information in the preset information database according to the candidate vulnerability information comprises: matching the common defect list numbers and the common defect list vulnerability descriptions corresponding to the vulnerability type name output by the vulnerability information identification model in the preset information database.

[0011] In the above embodiment, since the preset information database prerecords a plurality of vulnerability type names and corresponding common defect list numbers and common defect list vulnerability descriptions, the correct common defect list numbers and common defect list vulnerability descriptions can be matched in the preset information database through the vulnerability type name, so that the user can obtain the correct vulnerability information.

[0012] Further, the plurality of vulnerability type names in the preset information database are represented by word vectors, and when the corresponding vulnerability description information in the preset information database is matched according to the candidate vulnerability information, the vulnerability type name output by the vulnerability information identification model is further converted into a candidate word vector, the vector similarity of the candidate word vector and each word vector in the preset information database is calculated, and the common defect list number and the common defect list vulnerability description corresponding to the vector similarity greater than a preset threshold and having the highest similarity are determined as the target vulnerability information.

[0013] In the above embodiment, the preset information database pre-records a plurality of vulnerability type names and corresponding common defect list numbers and common defect list vulnerability descriptions. Since the alternative vulnerability information identified by the vulnerability information identification model is not necessarily completely correct, by determining the vector similarity between the alternative word vector and each word vector in the preset information database, the fault tolerance of the identified vulnerability information can be increased, thereby ensuring that the user can obtain relatively correct vulnerability information.

[0014] Further, the vulnerability description information in the preset information database includes a mapping dictionary of manufacturer names, product names, and / or manufacturer product names; the alternative vulnerability information includes manufacturer names and / or product names and / or version information; and matching corresponding vulnerability description information in the preset information database according to the alternative vulnerability information includes matching corresponding product names and / or manufacturer names in the preset information database according to the manufacturer names or product names output by the vulnerability information identification model, and then taking the matched product names and / or manufacturer names and / or version information output by the vulnerability information identification model as target vulnerability information.

[0015] In the above embodiment, since the mapping dictionary of manufacturer names, product names, and / or manufacturer product names is pre-recorded in the preset information database, the user can obtain correct vulnerability information by comparing the alternative vulnerability information with the information stored in the preset information database.

[0016] Further, the mapping dictionary of manufacturer names, product names, and / or manufacturer product names is saved in the preset information database in the form of a string; and matching corresponding standard product information in the preset information database according to the product type information output by the vulnerability information identification model includes: S11. converting the alternative vulnerability information output by the vulnerability information identification model into a string form and taking it as a to-be-compared string; S12. searching the preset information database to determine whether there is a string matching the to-be-compared string; if there is, it is determined that the corresponding product name and / or manufacturer name is matched; if there is not, step S13 is performed; S13. deleting the last character of the to-be-compared string as a new to-be-compared string; and repeating S12-S13 until the corresponding product name and / or manufacturer name is matched or the number of remaining characters of the to-be-compared string is less than a set threshold.

[0017] In the above embodiment, since there may be some useless information in the vulnerability name, and the vulnerability information identification model may also have some useless information during the identification process of the vulnerability name, by deleting the last character of the to-be-compared string for comparison, the final matching result can be more accurate, thereby enabling the user to obtain correct vulnerability information.

[0018] Further, after obtaining the vulnerability name, the method further includes: extracting the vulnerability name through a preset regular algorithm to obtain a vulnerability number in the vulnerability name.

[0019] In the above embodiment, since the vulnerability number can be used to identify and track a specific security vulnerability, and each vulnerability number is unique. Therefore, by identifying the vulnerability number, it can help security researchers, manufacturers, developers and users to accurately identify, describe and discuss a specific vulnerability.

[0020] Further, the vulnerability information identification model is obtained by: obtaining a sample vulnerability name set labeled with sample candidate vulnerability information as a training data set; training a preset named entity recognition model using the training data set to obtain the vulnerability information identification model.

[0021] Further, the sample vulnerability name set is obtained by: obtaining publicly published vulnerability data; the vulnerability data includes: proof of concept data and / or exploit data; parsing the vulnerability data to extract vulnerability names in the vulnerability data to form a sample vulnerability name set.

[0022] In the above embodiment, POC (proof of concept data) is a short and incomplete implementation for verifying the existence of a vulnerability. EXP (exploit data) is an action program for attacking using a verified vulnerability. In the proof of concept data and the exploit data, there will be vulnerability names, so the proof of concept data and the exploit data can be used to extract sample vulnerability names, and then the sample vulnerability name set labeled with sample candidate vulnerability information is used for model training, to obtain a vulnerability information identification model that can more accurately identify candidate vulnerability information from vulnerability names.

[0023] The embodiment of the application provides a vulnerability information identification device, which comprises: an acquisition module configured to acquire a vulnerability name; a model identification module configured to identify the vulnerability name by using a preset vulnerability information identification model to obtain candidate vulnerability information; and a vulnerability information determination module configured to match corresponding vulnerability description information in a preset information database according to the candidate vulnerability information, wherein the vulnerability description information is target vulnerability information, and if no corresponding vulnerability description information is matched, the candidate vulnerability information is target vulnerability information.

[0024] The embodiment of the application provides an electronic device, which comprises a processor and a memory, wherein the memory stores computer executable instructions capable of being executed by the processor, and the processor executes the computer executable instructions to implement the vulnerability information identification method.

[0025] The foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application. BRIEF DESCRIPTION OF DRAWINGS

[0026] One or more embodiments are illustrated by way of example in the figures that are not intended to be limiting of the application as defined by the claims. The drawings show, by way of example, embodiments in which the principles of the present application can be applied. Like reference numerals and characters

[0027] FIG. 1 is a schematic diagram of a vulnerability information identification method according to an embodiment of the present application;

[0028] FIG. 2 is a schematic diagram of another vulnerability information identification method according to an embodiment of the present application;

[0029] FIG. 3 is a schematic diagram of a vulnerability information identification apparatus according to an embodiment of the present application;

[0030] FIG. 4 is a schematic diagram of an electronic device according to an embodiment of the present application.

[0031] Icons: acquisition module 1; model identification module 2; vulnerability information determination module 3; memory 4; communication interface 5; bus 6; processor 7. DETAILED DESCRIPTION

[0032] In order to enable a more detailed understanding of the features and technical content of the embodiments of the present application, the implementation of the embodiments of the present application will be described in detail below in conjunction with the drawings, which are only used for reference and do not limit the embodiments of the present application. In the following technical description, in order to facilitate explanation, a plurality of details are provided to provide a full understanding of the disclosed embodiments. However, one or more embodiments can still be implemented without these details. In other cases, well-known structures and devices can be simplified to facilitate the drawings.

[0033] The terms "first", "second", and the like in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances to implement the embodiments of the present application described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion.

[0034] Unless otherwise specified, the term "a plurality of" means two or more.

[0035] The term "corresponding" can refer to an association or binding relationship. A and B correspond to each other means that there is an association or binding relationship between A and B.

[0036] Embodiment one

[0037] The method for identifying information of a vulnerability provided in the embodiments of the present application can be used as shown in FIG. 1, which is a schematic diagram of the basic flow of the method for identifying information of a vulnerability provided in the embodiments of the present application, and includes the following steps:

[0038] In step S101, a vulnerability name is obtained.

[0039] In some embodiments, the vulnerability scanning software can automatically identify and match known vulnerabilities during the scanning process, and indicate the vulnerability name in the scanning report. Thus, the vulnerability name can be obtained by scanning using the vulnerability scanning software.

[0040] In step S102, a preset vulnerability information identification model is used to identify the vulnerability name, and obtain candidate vulnerability information.

[0041] The candidate vulnerability information can include a vulnerability type name and / or a manufacturer name and / or a product name and / or version information.

[0042] In some embodiments, the vulnerability information identification model can be obtained by the following method: obtaining a sample vulnerability name set with sample candidate vulnerability information as a training data set; using the training data set to train a preset named entity identification model to obtain the vulnerability information identification model. Each sample vulnerability name in the sample vulnerability name set is extracted from publicly released proof of concept data and exploit data.

[0043] In the above embodiments, the sample vulnerability name set can be obtained by the following method: obtaining publicly released vulnerability data; the vulnerability data includes proof of concept data and / or exploit data; parsing the vulnerability data to extract the vulnerability name in the vulnerability data to form the sample vulnerability name set.

[0044] For example, code repositories related to POC (proof of concept data) and EXP (exploit data) are collected from the Internet, and codes are downloaded from the code repositories; according to the type of the code repository from which the codes are downloaded, the corresponding parsing method is used to parse the codes to obtain the preset fields in the codes as vulnerability names; and all the obtained vulnerability names form the sample vulnerability name set.

[0045] In the above embodiments, the sample vulnerability name set with sample candidate vulnerability information can be obtained as a training data set by the following method: sending the sample vulnerability name set to a preset labeling platform to obtain the sample vulnerability name set with sample candidate vulnerability information fed back by the labeling platform. The labeling platform can label the sample vulnerability name set with sample candidate vulnerability information by manual means.

[0046] Exemplarily, code repositories related to POCs and EXPs are collected from the Internet, and codes are downloaded from the code repositories. The code repositories are, for example, tools or platforms such as nuclei and Metasploit Framework. Since the engines of POCs and EXPs are different, the code formats of the codes downloaded from the code repository related to POCs and the codes downloaded from the code repository related to EXPs are also different, and different methods need to be used for parsing to obtain the corresponding vulnerability name field and then obtain the sample vulnerability name. For example, the nuclei is a YAML (another markup language) format POC (proof of concept) plugin, and the info.name field needs to be extracted as the sample vulnerability name after YAML parsing. The Metasploit Framework needs to traverse the Ruby (a simple and efficient object-oriented scripting language) code of the EXP plugin and extract the vulnerability name field in the corresponding plugin as the sample vulnerability name by using a regular algorithm. The extracted sample vulnerability name forms a sample vulnerability name set, and the sample vulnerability name set is manually labeled with candidate vulnerability information to obtain a sample vulnerability name set labeled with sample candidate vulnerability information.

[0047] Notably, other models that can extract vulnerability information from vulnerability names after training in the prior art, such as neural network models, can also be used for training, which is not limited herein. Meanwhile, the training method of the model can use the training method in the prior art, which is not limited herein. Exemplarily, a mature natural language processing framework such as spacy (a text preprocessing library) can be used for model training on the training data set and finally generate a vulnerability information recognition model for processing.

[0048] In step S103, the corresponding vulnerability description information is matched in the preset information database according to the candidate vulnerability information, and the corresponding vulnerability description information is the target vulnerability information. If the corresponding vulnerability description information is not matched, the candidate vulnerability information is the target vulnerability information.

[0049] In some embodiments, the preset information database can be obtained by: obtaining a CWE (Common Weakness Enumeration) list; extracting relevant information of a Weakness node in the CWE list; and supplementing the relevant information with preset vulnerability type supplementary names to form the information database. In this way, there is still some difference between the vulnerability type names and vulnerability type aliases in the CWE list and the vulnerability names actually used by security personnel. For example, the official alias of CWE-77 is Command Injection, while the commonly used alias of security personnel also includes Remote Command Injection and Command Execution. Therefore, the additional aliases used by security personnel are counted as preset vulnerability type supplementary names, so that the target vulnerability information screened according to the alternative vulnerability information and the preset information database is more accurate.

[0050] The relevant information of the Weakness node includes: id, name, description, alternate_terms, and related_attack_patterns. The id represents the unique number of the vulnerability type, the name represents the vulnerability type name, the description represents the relevant description of the vulnerability type, the alternate_terms represents the vulnerability type alias, and the related_attack_patterns represents the associated CAPEC (Common Attack Pattern Enumeration and Classification) attack pattern number.

[0051] It can be understood that the CWE list is a category system for hardware and software weaknesses and vulnerabilities, which covers almost all vulnerability types. For example, the CWE list can be downloaded from a preset website. Since the CWE list downloaded from the website is generally in XML format, the relevant information of the Weakness node can be extracted from the CWE list in XML format.

[0052] In some embodiments, the vulnerability description information in the preset information database includes: a plurality of vulnerability type names and corresponding common weakness enumeration numbers and common weakness enumeration vulnerability descriptions; the alternative vulnerability information includes a vulnerability type name; and the matching of the corresponding vulnerability description information in the preset information database according to the alternative vulnerability information can include: matching the common weakness enumeration number and the common weakness enumeration vulnerability description corresponding to the vulnerability type name output by the vulnerability information recognition model in the preset information database.

[0053] In an implementation form of the above embodiment, the vulnerability type name output by the vulnerability information identification model is matched with the corresponding common defect list number and common defect list vulnerability description in the preset information database, which can be: determining the common defect list number and common defect list vulnerability description corresponding to the vulnerability type name in the preset information database as the target vulnerability information.

[0054] It can be understood that, assuming that the string constituting the vulnerability type name output by the vulnerability information identification model is a first string, and the string constituting the vulnerability type name in the preset information database is a second string. The vulnerability type names are the same, that is, the position and order of each character of the first string are the same as the position and order of each character of the second string.

[0055] In another implementation form of the above embodiment, the plurality of vulnerability type names in the preset information database are represented by word vectors, and when the alternative vulnerability information is matched with the corresponding vulnerability description information in the preset information database, it can include: converting the vulnerability type name output by the vulnerability information identification model into an alternative word vector, calculating the vector similarity between the alternative word vector and each word vector in the preset information database; determining the common defect list number and common defect list vulnerability description corresponding to the vector similarity greater than the preset threshold and the highest similarity as the target vulnerability information.

[0056] In the above embodiment, the vulnerability type name output by the vulnerability information identification model can be converted into an alternative word vector through a preset word vector model. The preset word vector model can use a model capable of extracting a word vector in the prior art, for example: Word2Vec. This is not limited.

[0057] In the above embodiment, the vector similarity between the alternative word vector and each word vector in the preset information database can be calculated by using an algorithm capable of calculating the similarity between word vectors in the prior art, for example: using a cosine similarity matching algorithm, which is not limited.

[0058] In another implementation of the above embodiment, the matching of the corresponding vulnerability description information in the preset information database according to the alternative vulnerability information includes: comparing the vulnerability type name output by the vulnerability information recognition model with the vulnerability type names in the preset information database; in the case that there is a vulnerability type name in the preset information database that is the same as the vulnerability type name output by the vulnerability information recognition model, determining the general defect list number and the general defect list vulnerability description corresponding to the vulnerability type name in the preset information database that is the same as the vulnerability type name output by the vulnerability information recognition model as the target vulnerability information. In the case that there is no vulnerability type name in the preset information database that is the same as the vulnerability type name output by the vulnerability information recognition model, determining the similarity between the vulnerability type names in the preset information database and the vulnerability type name output by the vulnerability information recognition model, and determining the general defect list number and the general defect list vulnerability description corresponding to the vulnerability type name with the highest similarity and greater than a preset threshold as the target vulnerability information.

[0059] In the above embodiment, the plurality of vulnerability type names in the preset information database are represented using word vectors, and the similarity between the vulnerability type names in the preset information database and the vulnerability type name output by the vulnerability information recognition model can be determined as follows: converting the vulnerability type name output by the vulnerability information recognition model into an alternative word vector, and calculating the vector similarity between the alternative word vector and each word vector in the preset information database.

[0060] In the above embodiment, the similarity between the vulnerability type names in the preset information database and the vulnerability type name output by the vulnerability information recognition model can also be determined as follows: obtaining a first string constituting the vulnerability type name output by the vulnerability information recognition model and a second string constituting each vulnerability type name in the preset information database; for each second string: obtaining the total number of characters of the characters in the second string; comparing the characters in the same order position in the second string and the first string in turn, and in the case of consistency, accumulating the number of successful comparisons; in the case that each character in the second string is compared, calculating the number of successful comparisons divided by the total number of characters to obtain the similarity between the first vulnerability type name and the second vulnerability type name corresponding to the second string.

[0061] For example, assume that the first string is abd and the second string is abh. Compare the first character "a" in the second string with the first character "a" in the first string. If they are identical, the number of successful comparisons is 1. Compare the second character "b" in the second string with the second character "b" in the first string. If they are identical, the number of successful comparisons is 2. Compare the third character "d" in the second string with the third character "h" in the first string. If they are not identical, the number of successful comparisons is still 2. The total number of characters in the second string is 3, so the similarity is 2 / 3.

[0062] It is worth noting that, in the case where the number of characters in the second string is greater than the number of characters in the first string, the comparison results of the extra characters are all not identical.

[0063] In some embodiments, the vulnerability description information in the preset information database includes: a mapping dictionary of manufacturer names, product names and / or manufacturer product names; the alternative vulnerability information includes manufacturer names and / or product names and / or version information; and the corresponding vulnerability description information is matched in the preset information database according to the alternative vulnerability information, including: the manufacturer name or product name output by the vulnerability information identification model is matched with the corresponding product name and / or manufacturer name in the preset information database, and then the matched product name and / or manufacturer name and / or version information output by the vulnerability information identification model are taken as the target vulnerability information.

[0064] In an implementation of the above embodiment, the mapping dictionary of manufacturer names, product names and / or manufacturer product names is saved in the preset information database in the form of a string; and the corresponding standard product information is matched in the preset information database according to the product type information output by the vulnerability information identification model, including: S11. converting the alternative vulnerability information output by the vulnerability information identification model into a string form and taking it as a to-be-compared string; S12. searching the preset information database to determine whether there is a string matching the to-be-compared string; if there is, it is determined that the corresponding product name and / or manufacturer name are matched; if there is not, step S13 is performed; S13. deleting the last character of the to-be-compared string as a new to-be-compared string; and repeating S12-S13 until the corresponding product name and / or manufacturer name are matched, or the number of remaining characters of the to-be-compared string is less than a set threshold.

[0065] In the above implementation, converting the alternative vulnerability information output by the vulnerability information identification model into a string form can be: converting the alternative vulnerability information according to a first preset format, and taking the string of the converted alternative vulnerability information as the to-be-compared string.

[0066] For example, the alternative vulnerability information is converted according to the first preset format, i.e., the text of the manufacturer name and / or the product name and / or the version information in the alternative vulnerability information is converted to lowercase, and the space is replaced by an underscore "_".

[0067] In the above embodiment, the mapping dictionary of the manufacturer name, the product name and / or the manufacturer product name stored in the preset information database can also be converted according to a second preset format in advance, so that the mapping dictionary of the manufacturer name, the product name and / or the manufacturer product name stored in the preset information database is consistent with the format of the manufacturer name and / or the product name and / or the version information in the alternative vulnerability information. For example, the second preset format is that the text of the mapping dictionary of the manufacturer name, the product name and / or the manufacturer product name stored in the preset information database is converted to uppercase, and the underscore "_" is replaced by a space.

[0068] It can be understood that the manufacturer name and / or the product name and / or the version information in the alternative vulnerability information can be that the alternative vulnerability information only includes the manufacturer name. It can be that the alternative vulnerability information only includes the product name. It can be that the alternative vulnerability information only includes the version information. It can be that the alternative vulnerability information includes the manufacturer name and the product name. It can be that the alternative vulnerability information includes the manufacturer name and the version information. It can be that the alternative vulnerability information includes the product name and the version information. It can be that the alternative vulnerability information includes the manufacturer name, the product name and the version information.

[0069] In the above embodiment, it is assumed that the string stored in the preset information database is a third string. If the position and the order of each character of the third string are the same as the position and the order of each character of the to-be-compared string, it is determined that the to-be-compared string matches the third string. For example, it is assumed that the to-be-compared string is a_bnv. There are a third string ab_nv, a third string a_nv, a third string a_bnv and a third string a_bnvcg. Only the third string a_bnv matches the to-be-compared string.

[0070] In the above embodiment, the information database can be obtained by: obtaining a product type table of CPE (Common Platform Enumeration); extracting all CPE vector information in the product type table of CPE, and extracting all product manufacturer information to form the information database.

[0071] The product manufacturer information includes vendors, products and vendor_product_maps.

[0072] vendors is a list of all vendor names. products is a list of all product names. vendor_product_maps is a dictionary of all vendor and product name mappings, with the KEY being the vendor_product combination.

[0073] In some embodiments, no version information is stored in the preset information database, so that the corresponding version information cannot be matched in the preset information database. Therefore, the version information will be directly used as the target vulnerability information together with the remaining candidate vulnerability information. For example, the version information will be directly used as the target vulnerability information together with the successfully matched vendor name and product name.

[0074] In some embodiments, after obtaining the vulnerability name, the method further comprises: extracting the vulnerability name by using a preset regular algorithm to obtain the vulnerability number in the vulnerability name.

[0075] For example, the CVE number generally follows the form of CVE-[year]-number. Assuming that the CVE number of the vulnerability name needs to be extracted, the CVE number is, for example, “CVE-2023-1234”. The vulnerability name can be extracted by using a regular expression such as “CVE-\d{4}-\d+” to obtain the vulnerability number. Here, CVE- matches the literal “CVE-”. \d{4} matches four digits, representing the year. - matches the hyphen “-” character. \d+ matches one or more digits, representing the remaining part of the number.

[0076] In some embodiments, after obtaining the target vulnerability information, the method further comprises: displaying the target vulnerability information and the vulnerability number to the user.

[0077] For example, the target vulnerability information and the vulnerability number can be sent to the user in the form of a short message or an email, or the target vulnerability information and the vulnerability number are sent to a preset display screen to make the preset display screen display the target vulnerability information and the vulnerability number.

[0078] Another vulnerability information identification method is provided in the embodiments of the present application. Assuming that the vulnerability type name output by the vulnerability information identification model is a first vulnerability type name, and the vulnerability type name stored in the preset information database is a second vulnerability type name. FIG. 2 is a basic flowchart of another vulnerability information identification method provided in the embodiments of the present application, which comprises:

[0079] In step S201, the vulnerability name is obtained, and then step S202 is performed.

[0080] Step S202, the preset vulnerability information recognition model is used to recognize the vulnerability name, and obtain candidate vulnerability information, the candidate vulnerability information including manufacturer name and / or product name, vulnerability type name, version information; then step S203 is executed.

[0081] Step S203, comparing the first vulnerability type name with each second vulnerability type name, and then executing step S204.

[0082] Step S204, determining whether there is a second vulnerability type name identical to the first vulnerability type name, and in the case that there is a second vulnerability type name identical to the first vulnerability type name, executing step S205. In the case that there is no second vulnerability type name identical to the first vulnerability type name, executing step S206.

[0083] Step S205, determining the general defect list number and general defect list vulnerability description corresponding to the second vulnerability type name as target vulnerability information, and then executing step S210.

[0084] Step S206, determining the similarity between the first vulnerability type name and each second vulnerability type name, and then executing step S207.

[0085] Step S207, determining whether there is a similarity greater than a preset threshold. In the case that there is a similarity greater than a preset threshold, executing step S208.

[0086] Step S208, determining the general defect list number and general defect list vulnerability description corresponding to the highest similarity greater than the preset threshold as target vulnerability information, and then executing step S210.

[0087] Step S209, determining the first vulnerability type name as target vulnerability information, and then executing step S210.

[0088] Step S210, matching the product name and / or manufacturer name corresponding to the manufacturer name or product name output by the vulnerability information recognition model in the preset information database, and then taking the matched product name and / or manufacturer name and / or version information output by the vulnerability information recognition model as target vulnerability information, and then executing step S211.

[0089] Step S211, extracting the vulnerability number in the vulnerability name through a preset regular algorithm, and then executing step S212.

[0090] Step S212, displaying the target vulnerability information and the vulnerability number to the user.

[0091] Embodiment two

[0092] With reference to FIG. 3, the embodiment of the present application provides a vulnerability information identification device, comprising: an acquisition module 1, a model identification module 2 and a vulnerability information determination module 3. The acquisition module 1 is configured to acquire a vulnerability name; the model identification module 2 is configured to identify the vulnerability name by using a preset vulnerability information identification model to obtain candidate vulnerability information; and the vulnerability information determination module 3 is configured to match corresponding vulnerability description information in a preset information database according to the candidate vulnerability information, wherein the vulnerability description information is target vulnerability information; if no corresponding vulnerability description information is matched, the candidate vulnerability information is the target vulnerability information.

[0093] Optionally, the vulnerability description information in the preset information database comprises a plurality of vulnerability type names and corresponding common vulnerability and exposure (CVE) list numbers and CVE list vulnerability descriptions; and the candidate vulnerability information comprises a vulnerability type name. The vulnerability information determination module 3 is configured to match the corresponding vulnerability description information in the preset information database according to the candidate vulnerability information by: matching the vulnerability type name output by the vulnerability information identification model in the preset information database to obtain the corresponding CVE list numbers and CVE list vulnerability descriptions.

[0094] Optionally, the plurality of vulnerability type names in the preset information database are represented by word vectors. The vulnerability information determination module 3 is configured to match the corresponding vulnerability description information in the preset information database according to the candidate vulnerability information by: converting the vulnerability type name output by the vulnerability information identification model into a candidate word vector, calculating the vector similarity between the candidate word vector and each word vector in the preset information database; and determining the CVE list number and the CVE list vulnerability description corresponding to the highest vector similarity greater than a preset threshold as the target vulnerability information.

[0095] Optionally, the vulnerability description information in the preset information database comprises a manufacturer name, a product name and / or a mapping dictionary of the manufacturer product name; and the candidate vulnerability information comprises a manufacturer name and / or a product name and / or version information. The vulnerability information determination module 3 is configured to match the corresponding vulnerability description information in the preset information database according to the candidate vulnerability information by: matching the manufacturer name or the product name output by the vulnerability information identification model in the preset information database to obtain the corresponding product name and / or manufacturer name, and then taking the matched product name and / or manufacturer name and / or the version information output by the vulnerability information identification model as the target vulnerability information.

[0096] Optionally, the mapping dictionary of the vendor name, the product name and / or the vendor product name is saved in the preset information database in the form of a string. The vulnerability information determination module 3 is configured to match the corresponding standard product information in the preset information database according to the product type information output by the vulnerability information identification model in the following manner: S11. converting the alternative vulnerability information output by the vulnerability information identification model into a string form, and taking the string as a to-be-compared string; S12. searching the preset information database to determine whether there is a string matching the to-be-compared string; if yes, it is determined that the corresponding product name and / or the vendor name are matched; if no, step S13 is performed; S13. deleting the last character of the to-be-compared string as a new to-be-compared string; repeating S12-S13 until the corresponding product name and / or the vendor name are matched, or the number of remaining characters of the to-be-compared string is less than a set threshold.

[0097] Optionally, the vulnerability information identification device further comprises a number determination module configured to extract the vulnerability number in the vulnerability name by a preset regular algorithm.

[0098] Optionally, the model identification module 2 is configured to obtain the vulnerability information identification model in the following manner: obtaining a sample vulnerability name set labeled with sample alternative vulnerability information as a training data set; training a preset named entity recognition model by using the training data set to obtain the vulnerability information identification model.

[0099] Optionally, the model identification module 2 is configured to obtain the sample vulnerability name set in the following manner: obtaining publicly published vulnerability data; the vulnerability data comprises proof of concept data and / or exploit data; parsing the vulnerability data to extract the vulnerability name in the vulnerability data to form the sample vulnerability name set.

[0100] It can be understood that the embodiments described in Embodiment One are also applicable in Embodiment Two without conflict. For the sake of brevity, the description is not repeated here.

[0101] Embodiment Three

[0102] In combination with FIG. 4, the electronic device provided by the embodiments of the present application includes a processor 7 and a memory 4. Optionally, the device can also include a communication interface 5 and a bus 6. The processor 7, the communication interface 5 and the memory 4 can complete communication with each other through the bus 6. The communication interface 5 can be used for information transmission. The processor 7 can invoke the logical instructions in the memory 4 to execute the vulnerability information identification method of the above-described embodiments.

[0103] In addition, when the logical instructions in the memory 4 described above are implemented in the form of a software function unit and sold or used as an independent product, they can be stored in a computer-readable storage medium.

[0104] The memory 4 is a computer readable storage medium, and can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiments of the present application. The processor 7 executes the program instructions / modules stored in the memory 4, thereby performing functional applications and data processing, that is, implementing the information identification method of the vulnerability in the above embodiments.

[0105] The memory 4 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; and the data storage area can store data created according to the use of the terminal device, etc. In addition, the memory 4 can include a high-speed random access memory, and can also include a non-volatile memory.

[0106] By using the electronic device provided in the embodiments of the present application, the model can capture the potential rules, patterns and structures behind the data through the learning process. Thus, the trained vulnerability information identification model can more accurately obtain the candidate vulnerability information. However, there may still be some identification errors in the identification by the vulnerability information identification model. Therefore, the target vulnerability information can be determined again according to the candidate vulnerability information by using the vulnerability description information that has been summarized and stored in the information database, so that the obtained target vulnerability information is more accurate.

[0107] The embodiments of the present application provide a storage medium, which stores computer executable instructions, and the computer executable instructions are configured to execute the information identification method of the vulnerability.

[0108] The embodiments of the present application provide a computer program product, which includes a computer program stored in a storage medium, and the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the information identification method of the vulnerability.

[0109] The computer readable storage medium described above can be a transitory computer readable storage medium or a non-transitory computer readable storage medium.

[0110] The technical solutions of the embodiments of the present application can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes one or more instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method of the embodiments of the present application. The aforementioned storage medium can be a non-transitory storage medium, including: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, etc. various media that can store program codes, or a transitory storage medium.

[0111] In the embodiments provided by the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. The embodiments described above are merely exemplary, for example, the division of units is only a logical function division, and there can be another division manner in actual implementation; for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In this way, the actual implementation can be divided into other forms.

[0112] The above merely provides an example of the present application, but should not be used to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. Meanwhile, the above embodiments can be combined with each other in the case of no conflict, to form a new embodiment.

Claims

1. A method of identifying information of a vulnerability, characterized by, The method comprises the following steps: obtaining a vulnerability name; identifying the vulnerability name by using a preset vulnerability information identification model to obtain candidate vulnerability information; matching corresponding vulnerability description information in a preset information database according to the candidate vulnerability information, wherein the corresponding vulnerability description information is target vulnerability information; if no corresponding vulnerability description information is matched, the candidate vulnerability information is the target vulnerability information.

2. The method of claim 1, wherein, The vulnerability description information in the preset information database comprises a plurality of vulnerability type names and corresponding common vulnerability list numbers and common vulnerability list vulnerability descriptions; The candidate vulnerability information comprises a vulnerability type name; The matching of the corresponding vulnerability description information in the preset information database according to the candidate vulnerability information comprises: matching corresponding common vulnerability list numbers and common vulnerability list vulnerability descriptions in the preset information database according to the vulnerability type name output by the vulnerability information identification model.

3. The method of claim 2, wherein, The plurality of vulnerability type names in the preset information database are represented by word vectors, and when the corresponding vulnerability description information in the preset information database is matched according to the candidate vulnerability information, the method further comprises: converting the vulnerability type name output by the vulnerability information identification model into a candidate word vector, and calculating the vector similarity between the candidate word vector and each word vector in the preset information database; determining the common vulnerability list number and the common vulnerability list vulnerability description corresponding to the vector similarity that is greater than a preset threshold and has the highest similarity as the target vulnerability information.

4. The method of claim 1, wherein, The vulnerability description information in the preset information database comprises a manufacturer name, a product name and / or a mapping dictionary of the manufacturer product name; The candidate vulnerability information comprises a manufacturer name and / or a product name and / or version information; The matching of the corresponding vulnerability description information in the preset information database according to the candidate vulnerability information comprises: matching the product name and / or the manufacturer name corresponding to the manufacturer name or the product name output by the vulnerability information identification model in the preset information database, and then taking the matched product name and / or manufacturer name and / or the version information output by the vulnerability information identification model as the target vulnerability information.

5. The method of claim 4, wherein, The manufacturer name, the product name and / or the mapping dictionary of the manufacturer product name are saved in the preset information database in the form of a string; The matching of the corresponding standard product information in the preset information database according to the product type information output by the vulnerability information identification model comprises: S11. converting the candidate vulnerability information output by the vulnerability information identification model into a string form and taking it as a to-be-compared string; S12. checking whether there is a string matching the to-be-compared string in the preset information database; if there is, it is determined that the corresponding product name and / or manufacturer name is matched; if not, step S13 is performed; S13. deleting the last character of the to-be-compared string as a new to-be-compared string; circulating S12-S13 until the corresponding product name and / or manufacturer name is matched, or the number of remaining characters of the to-be-compared string is less than a set threshold.

6. The method according to any one of claims 1 to 5, characterized in that, After obtaining the vulnerability name, the method further comprises: The vulnerability number in the vulnerability name is obtained by presetting a regular algorithm to extract the vulnerability name.

7. The method according to any one of claims 1 to 5, characterized in that, The vulnerability information recognition model is obtained by the following method: A sample vulnerability name set labeled with sample candidate vulnerability information is obtained as a training data set; The training data set is used to train a preset named entity recognition model to obtain the vulnerability information recognition model.

8. The method of claim 7, wherein, The sample vulnerability name set is obtained by the following method: Obtain publicly published vulnerability data; the vulnerability data includes: proof of concept data and / or exploit data; The vulnerability data is parsed to extract the vulnerability name in the vulnerability data to form a sample vulnerability name set.

9. An information identifying apparatus of a vulnerability, characterized by comprising: Comprise: An acquisition module is configured to acquire a vulnerability name; A model recognition module is configured to use a preset vulnerability information recognition model to recognize the vulnerability name to obtain candidate vulnerability information; A vulnerability information determination module is configured to match corresponding vulnerability description information in a preset information database according to the candidate vulnerability information, wherein the vulnerability description information is target vulnerability information; If no corresponding vulnerability description information is matched, the candidate vulnerability information is target vulnerability information.

10. An electronic device, comprising: Comprise a processor and a memory, the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the vulnerability information recognition method in any one of claims 1 to 8.

Images