Method for determining vulnerability repair information, apparatus, system, storage medium, and product

Abstract

Disclosed in embodiments of the present invention are a method for determining vulnerability repair information, an apparatus, a system, a storage medium, and a product. The method comprises: acquiring a description text of a protected system, wherein the protected system comprises a component, and the description text is represented in a natural language; identifying the component from the description text on the basis of natural language processing; by taking the name of the identified component as a first retrieval item, querying in a knowledge base a vulnerability repair mode corresponding to the first retrieval item; and determining vulnerability repair information of the identified component on the basis of the vulnerability repair mode. The component is automatically identified in a natural language processing manner, avoiding tedious labor of manual identification of the component, and improving the repair efficiency. By means of common vulnerabilities and exposures information or a secure uniform resource locator stored in the knowledge base, the vulnerability repair information can be quickly determined, and the knowledge base can be updated conveniently.

Description

Methods, apparatus, systems, storage media, and products for determining vulnerability remediation information Technical Field

[0001] This invention relates to the field of information security technology, and in particular to methods, apparatus, systems, storage media, and products for determining vulnerability remediation information. Background Technology

[0002] Vulnerability management refers to the management and control of the entire process of vulnerability scanning, assessment, and remediation for protected systems (such as computer systems, network systems, and software applications). In vulnerability management, component discovery and identification are crucial, including determining the component name, current version, manufacturer, and the Security Uniform Resource Locator (URL) that provides the security patch, etc.

[0003] By associating identified components with Common Vulnerabilities & Exposures (CVE) information, vulnerabilities that may affect the components can be identified, along with vulnerability remediation information, thereby ensuring comprehensive coverage of vulnerability management.

[0004] Currently, component identification mainly relies on manual methods, which is labor-intensive and inefficient.

[0005] Summary of the Invention

[0006] The embodiments of the present invention propose methods, apparatus, systems, storage media, and products for determining vulnerability remediation information, thereby improving remediation efficiency.

[0007] A method for determining vulnerability remediation information includes:

[0008] Obtain the description text of the protected system, the protected system comprising components, the description text being represented in natural language;

[0009] Based on Natural Language Processing (NLP), the components are identified from the descriptive text, or in other words, natural language processing is performed on the descriptive text.

[0010] Using the name of the identified component as the first search term, query the knowledge base for the vulnerability remediation method corresponding to the first search term;

[0011] Based on the aforementioned vulnerability remediation method, the vulnerability remediation information of the identified components is determined.

[0012] Therefore, automatically identifying components using NLP avoids the tedious work of manual component identification and improves repair efficiency.

[0013] In one implementation, the knowledge base stores the correspondence between the names of recorded components and the vulnerability remediation methods of the recorded components, wherein the vulnerability remediation methods of the recorded components include the CVE information of the recorded components;

[0014] The process of determining the vulnerability remediation information of the identified components based on the vulnerability remediation method includes:

[0015] Using the CVE information corresponding to the first search term as the second search term, query the vulnerability database for vulnerability remediation information corresponding to the second search term.

[0016] It is evident that by using CVE information stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0017] In one implementation, the knowledge base stores the correspondence between the names of recorded components and the vulnerability remediation methods of the recorded components, wherein the vulnerability remediation method of the recorded components includes the security Uniform Resource Locator (URL) of the recorded components, and the security URL is adapted to locate the network address that provides the vulnerability remediation information of the recorded components.

[0018] The process of determining the vulnerability remediation information of the identified components based on the vulnerability remediation method includes:

[0019] Access the network address located by the secure URL corresponding to the first search item to obtain vulnerability remediation information for the identified components.

[0020] As can be seen, by using secure URLs stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0021] In one implementation, the step of querying the knowledge base for a vulnerability remediation method corresponding to the first search item includes:

[0022] Determine the similarity between the name of the identified component and the name of each recorded component in the knowledge base;

[0023] The vulnerability remediation method corresponding to the name of the recorded component with the highest similarity is determined as the vulnerability remediation method of the identified component, wherein the highest similarity is greater than a predetermined similarity threshold.

[0024] Therefore, by calculating similarity, it is possible to quickly find the vulnerability remediation method corresponding to the first search term.

[0025] In one implementation, it includes:

[0026] When no recorded component name with a similarity greater than the similarity threshold to the identified component name can be found in the knowledge base, the crawler is enabled to obtain the vulnerability remediation method of the identified component from the network.

[0027] Add the names of the identified components and the corresponding vulnerability remediation methods for the identified components to the knowledge base.

[0028] It is evident that for cases with similarity below the threshold, the knowledge base can be easily updated by crawling web pages to obtain vulnerability remediation methods for identified components and adding corresponding records.

[0029] An apparatus for determining vulnerability remediation information, comprising:

[0030] An acquisition module is used to acquire the description text of a protected system, the protected system comprising components, and the description text being represented in natural language;

[0031] An NLP module is used to identify the components from the description text based on NLP.

[0032] The query module is used to search the knowledge base for vulnerability remediation methods corresponding to the first search term, using the name of the identified component as the first search term.

[0033] The determination module is used to determine the vulnerability remediation information of the identified components based on the vulnerability remediation method.

[0034] Therefore, automatically identifying components using NLP avoids the tedious work of manual component identification and improves repair efficiency.

[0035] In one implementation, the knowledge base stores the correspondence between the names of recorded components and the vulnerability remediation methods of the recorded components, wherein the vulnerability remediation methods of the recorded components include the CVE information of the recorded components;

[0036] The determining module is used to query vulnerability remediation information corresponding to the second search item in the vulnerability database, using the CVE information corresponding to the first search item as the second search item.

[0037] It is evident that by using CVE information stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0038] In one implementation, the knowledge base stores the correspondence between the names of recorded components and the vulnerability remediation methods of the recorded components, wherein the vulnerability remediation method of the recorded component includes the security URL of the recorded component, and the security URL is adapted to locate the network address that provides the vulnerability remediation information of the recorded component.

[0039] The determining module is used to access the network address located by the security URL corresponding to the first search item in order to obtain vulnerability remediation information for the identified components.

[0040] As can be seen, by using secure URLs stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0041] In one implementation, the query module is configured to determine the similarity between the name of the identified component and the name of each recorded component in the knowledge base; and to determine the vulnerability repair method corresponding to the name of the recorded component with the highest similarity as the vulnerability repair method of the identified component, wherein the highest similarity is greater than a predetermined similarity threshold.

[0042] Therefore, by calculating similarity, it is possible to quickly find the vulnerability remediation method corresponding to the first search term.

[0043] In one implementation, the query module is configured to enable the crawler to obtain the vulnerability repair method of the identified component from the network when no recorded component name with a similarity greater than the similarity threshold can be found in the knowledge base; and to add the correspondence between the name of the identified component and the vulnerability repair method of the identified component to the knowledge base.

[0044] As can be seen, for cases where the similarity is below the threshold, vulnerability remediation methods for identified components can be obtained from the network through web crawling, and corresponding records can be added to the knowledge base for convenient updating.

[0045] A system for determining vulnerability remediation information, comprising:

[0046] A knowledge base stores the correspondence between the names of recorded components and the vulnerability remediation methods for those recorded components;

[0047] An apparatus is configured to acquire a description text of a protected system, the protected system comprising components, the description text being represented in natural language; perform NLP on the description text to identify the components; use the name of the identified component as a first search term to query a knowledge base for a vulnerability remediation method corresponding to the first search term; and determine vulnerability remediation information for the identified component based on the vulnerability remediation method.

[0048] Therefore, automatically identifying components using NLP avoids the tedious work of manual component identification and improves repair efficiency.

[0049] In one implementation, the vulnerability remediation method for the recorded component includes the CVE information of the recorded component; the system further includes:

[0050] A vulnerability database is used to store the correspondence between recorded CVE information and the vulnerability remediation information of the recorded CVE information;

[0051] The device is configured to use general vulnerability disclosure information corresponding to the first search term as the second search term to query vulnerability remediation information corresponding to the CVE information in the vulnerability database.

[0052] It is evident that by using CVE information stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0053] In one implementation, the vulnerability remediation method for the recorded component includes a secure URL for the recorded component, the secure URL being adapted to locate a network address that provides vulnerability remediation information for the recorded component; the system further includes:

[0054] A server is configured to store vulnerability remediation information for the identified components in a network address located at a secure URL corresponding to the first search term.

[0055] The device is configured to access a network address located by a secure URL corresponding to the first search item in order to obtain vulnerability remediation information for the identified components from the server.

[0056] As can be seen, by using secure URLs stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0057] An electronic device, comprising:

[0058] processor;

[0059] Memory for storing the executable instructions of the processor;

[0060] The processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the method for determining vulnerability remediation information as described above.

[0061] A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the method for determining vulnerability remediation information as described above.

[0062] A computer program product includes a computer program that, when executed by a processor, implements the method for determining vulnerability remediation information as described above. Attached Figure Description

[0063] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which will make the above and other features and advantages of the present invention more apparent to those skilled in the art. In the drawings:

[0064] Figure 1 is an exemplary flowchart of a method for determining vulnerability remediation information according to an embodiment of the present invention.

[0065] Figure 2 is an exemplary schematic diagram illustrating the determination of vulnerability remediation information based on CVE information according to an embodiment of the present invention.

[0066] Figure 3 is an exemplary schematic diagram illustrating the determination of vulnerability remediation information based on a secure URL according to an embodiment of the present invention.

[0067] Figure 4 is a schematic diagram of an exemplary process for maintaining a knowledge base according to an embodiment of the present invention.

[0068] Figure 5 is an exemplary structural diagram of a system for determining vulnerability remediation information according to an embodiment of the present invention.

[0069] Figure 6 is an exemplary structural diagram of an apparatus for determining vulnerability remediation information according to an embodiment of the present invention.

[0070] Figure 7 is an exemplary structural diagram of an electronic device according to an embodiment of the present invention.

[0071] The accompanying figure is labeled as follows: Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of the present invention clearer, the following embodiments are provided to further illustrate the present invention in detail.

[0073] For the sake of brevity and intuitiveness, the following description uses several representative embodiments to illustrate the solution of the present invention. Numerous details in the embodiments are only used to aid in understanding the solution of the present invention. However, it is obvious that the technical solution of the present invention can be implemented without being limited to these details. To avoid unnecessarily obscuring the solution of the present invention, some embodiments are not described in detail, but only a framework is given. In the following text, "comprising" means "including but not limited to," and "according to..." means "at least according to..., but not limited to only according to...". Due to Chinese language habits, unless the quantity of a component is specifically indicated below, it means that the component can be one or more, or can be understood as at least one.

[0074] Currently, most component analysis relies on manual identification, which is inefficient. This involves manually discovering components in a protected system (e.g., new or updated components), manually collecting component attribute information (such as component name, current version, vendor, and relevant security URLs), and manually fixing component vulnerabilities. Components can include software, hardware, and firmware components, among others. Relying on expert experience, manual identification also struggles to guarantee accuracy. Currently, there are also methods that identify components using rule-based matching (e.g., regular expressions). However, writing rules also relies on expert experience, and rule-based matching also struggles to guarantee accurate component identification.

[0075] In one embodiment of this invention, NLP (Natural Language Processing, such as semantic entity recognition algorithms) is introduced to identify components, and the identified components are matched with a knowledge base to obtain vulnerability remediation methods from the knowledge base. Furthermore, component attribute information, such as supplier names and URLs, can be obtained from the knowledge base. This avoids the tedious work of manually identifying components, thereby improving remediation efficiency. In addition, vulnerability remediation can be automatically implemented based on the obtained vulnerability remediation methods for timely vulnerability handling.

[0076] The above disclosure details the technical defects existing in the relevant technology, the causes of these defects, and the thought process and analysis involved in overcoming them. In fact, the understanding of these technical defects is not common knowledge in the field, but rather a novel discovery made by the inventors during their research. Furthermore, the tracing of the causes of these defects and the thought process and analysis involved in overcoming them are also the results of the inventors' gradual analysis during the actual research process, and are not common knowledge in the field.

[0077] Figure 1 is an exemplary flowchart of a method for determining vulnerability remediation information according to an embodiment of the present invention. In Figure 1, the method includes:

[0078] Step 101: Obtain the description text of the protected system, which contains components, and the description text is represented in natural language.

[0079] Here, the protected system can include computer systems (including hardware and software devices), network systems (including hardware and software devices), software applications and database systems (including hardware and software devices), industrial OT systems, and so on. For example, the protected system can be implemented as a website, database, communication software, programmable logic controller (PLC) control program, and industrial control system, etc.

[0080] A protected system contains components. This can specifically mean that the component is part of the protected system, was used during the development of the protected system, or requires the use of the component, etc. Components can include software components, hardware components, and firmware components. Software components can include various open-source software, commercial off-the-shelf components, and built-in components (e.g., SIMATIC PLCs for controlling PLCs, etc.). Vulnerabilities in these components may be released periodically or irregularly.

[0081] Specifically, components may include: (1) built-in components (e.g., a communication stack integrated into the product); (2) components delivered with a version; (3) user-side operating systems, where new security updates need to be tested based on product performance; (4) development tools for implementing / providing protected systems (e.g., development tools not delivered to the end customer), etc. Moreover, components may contain different version levels, such as: (1) general versions (e.g., version 9.x of a reading software product); (2) specific versions (e.g., version 9.2 of a reading software product); (3) subsets of versions (e.g., version 9.2 of a reading software product for x86).

[0082] The descriptive text of a protected system is represented in natural language. This descriptive text can be specifically implemented as a specification document for the protected system (e.g., a specification document containing introductory text for components), a structure file for the protected system (e.g., a textual description of the specific components), log text of the protected system in its daily operations (e.g., log text describing component names, functions, and attributes), and so on. Typically, descriptive text represented in natural language is unstructured data.

[0083] Step 102: Identify components from the descriptive text based on NLP.

[0084] For example, descriptive text can be input into an NLP model to identify components. NLP models are machine learning models used for natural language processing. NLP models can understand and generate human language and perform tasks such as text classification, sentiment analysis, question answering, and machine translation. Here, NLP models can include Bidirectional Encoder Representations from Transformers (BERT) models, Generative Pre-trained Transformer (GPT) models, Bidirectional Long Short-Term Memory (BSSM) models, and so on. For instance, the NLP model in step 102 can be implemented as a BERT model. BERT is a pre-trained model that uses the encoder part of a Transformer to capture bidirectional contextual information in the text.

[0085] In one implementation, identifying components from descriptive text based on NLP includes: performing Named Entity Recognition (NER) on the descriptive text based on an NLP model to identify components. NER is an important task in NLP, aiming to identify named entities (i.e., components) with specific meanings from text. NER can be divided into two subtasks: entity boundary recognition and entity category recognition. Entity boundary recognition refers to finding the start and end positions of entities in the text, while entity category recognition refers to determining the category to which the entity belongs. Specifically, the NER process includes: (1) Text preprocessing: performing preprocessing operations such as word segmentation and part-of-speech tagging on the descriptive text used as training data for subsequent processing. (2) Feature extraction: extracting features from the preprocessed descriptive text for training the model. Traditional methods use rule-based feature extraction methods, such as part-of-speech, word form, and context. Deep learning-based methods, such as those based on convolutional neural networks (CNN) and recurrent neural networks (RNN), can directly learn features from the descriptive text. (3) Model Training: The extracted features are trained using labeled data. Commonly used models include the Maximum Entropy Model and Conditional Random Fields. (4) Entity Prediction: The trained model is used to predict entities from new descriptive text used as test data. During the prediction process, heuristic methods, such as the Viterbi Algorithm, can be used for decoding to find the optimal entity boundaries and category combinations.

[0086] The NLP-based recognition results can include the component name. Preferably, when the description text contains other attribute information of the component (e.g., component version, component supplier, component description information, and supplier URL, etc.), NLP can also identify this attribute information.

[0087] Step 103: Using the name of the identified component as the first search term, query the knowledge base for the vulnerability remediation method corresponding to the first search term.

[0088] Here, a knowledge base can be pre-established. The knowledge base stores the mapping between recorded component names and their corresponding vulnerability remediation methods. Then, using the name of an identified component as the first search term, the knowledge base can be queried for the vulnerability remediation method corresponding to that first search term. The knowledge base stores the mapping between recorded component names and their corresponding vulnerability remediation methods in structured data. The structured data can also further store component attribute information. Preferably, the knowledge base is queried for the vulnerability remediation method corresponding to the first search term by using the name of the identified component and other attribute information of the component identified by NLP (e.g., component version, component vendor, component description information, and vendor URL, etc.) as the first search term.

[0089] Example 1: Taking the component name "Jenkins Plugin:structs" as an example, this example illustrates a demonstrative storage structure for structured data.

[0090] {

[0091] Supplier: "Jenkins"

[0092] "Component Name": "Jenkins Plugin:structs"

[0093] Version: 1.22

[0094] "URL": "www.aaaaaaaa.com / xxxxxx",

[0095] "Safe URL": "www.aaaaaaaa.com / xxxxxx"

[0096] }

[0097] Specifically: The "URL" field stores the vendor's URL (e.g., homepage address); the "Secure URL" field stores the URL used to provide vulnerability patching information for the "Jenkins Plugin:structs" component. The "Secure URL" specifies the vulnerability patching method. By accessing the address pointed to by the secure URL, one can obtain vulnerability patching information for version 1.22 of the "Jenkins Plugin:structs" component.

[0098] Example 2: Taking Apache Log4j2 as an example, another exemplary storage structure for structured data is illustrated.

[0099] {

[0100] "Supplier": "Apache"

[0101] Component Name: "Apache Log4j2"

[0102] Version: "beta9"

[0103] "URL": "www.aaaaaaaa.com / xxxxxx",

[0104] "CVE ID": "CVE-2021-44228",

[0105] }

[0106] Specifically: The "URL" field stores the vendor's URL (e.g., Apache's homepage address); the "CVE ID" field stores the CVE ID of the "Apache Log4j2" component. The CVE information stored in the "CVE ID" field (i.e., CVE-2021-44228) is the vulnerability remediation method. Using CVE-2021-44228, vulnerability remediation information for the "Apache Log4j2" component, specifically for beta 9, can be obtained from the vulnerability database.

[0107] Step 104: Based on the vulnerability remediation method, determine the vulnerability remediation information for the identified components.

[0108] In one implementation, the vulnerability remediation methods for recorded components stored in the knowledge base include the CVE information of the recorded components. Specifically, the CVE information may include: (1) CVE ID, such as CVE-2021-44228; (2) assigner; (3) release date; (4) update date; (5) vulnerability description; (6) reference, which is generally the source information or reference information of the vulnerability; (7) CVE numbering agency, indicating the agency that applied for the CVE ID; and (8) record creation date, indicating the time when the CVE ID was released to the CVE numbering agency (CNA) or the CVE record was published on the CVE list. Step 104 specifically includes: using the CVE information corresponding to the first search term as the second search term, querying vulnerability remediation information corresponding to the second search term in a vulnerability database (e.g., the National Vulnerability Database (NVD)). The vulnerability database provides vulnerability remediation information for each CVE (e.g., patch package, severity score, and impact rating, etc.). Preferably, the vulnerability database also provides advanced search functions, supporting the retrieval of vulnerability information by operating system, vendor name, product name, product version number, and vulnerability type, severity, exploit scope, and impact. Preferably, the vulnerability database can also be the official vulnerability database of a CVE organization, for example, accessible at https: / / cve.mitre.org / cve / search_cve_list.html.

[0109] It is evident that by using CVE information stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0110] In one implementation, the knowledge base stores the correspondence between the names of recorded components and their corresponding vulnerability remediation methods. The vulnerability remediation method for a recorded component includes its security URL, which is adapted to locate the network address providing the vulnerability remediation information. Step 104 specifically includes: accessing the network address located by the security URL corresponding to the first search term to obtain the vulnerability remediation information for the identified component. For example, the vulnerability remediation information may include: the vulnerability patch package, the vulnerability severity score, and the vulnerability impact rating, etc.

[0111] As can be seen, by using secure URLs stored in the knowledge base, vulnerability remediation information can be quickly determined, thereby improving remediation efficiency.

[0112] In one implementation, step 103 specifically includes: determining the similarity between the name of the identified component and the name of each recorded component in the knowledge base; determining the vulnerability repair method corresponding to the name of the recorded component with the highest similarity as the vulnerability repair method of the identified component, wherein the highest similarity of the vulnerability repair method is greater than a predetermined similarity threshold.

[0113] Therefore, by calculating similarity, it is possible to quickly find the vulnerability remediation method corresponding to the first search term.

[0114] In one implementation, the method includes: when no recorded component name with a similarity greater than a similarity threshold to the name of an identified component can be found in the knowledge base, enabling the crawler to obtain the vulnerability remediation method of the identified component from the network; and adding the correspondence between the name of the identified component and the vulnerability remediation method of the identified component to the knowledge base.

[0115] It is evident that for cases with similarity below the threshold, the knowledge base can be easily updated by crawling web pages to obtain vulnerability remediation methods for identified components and adding corresponding records.

[0116] Figure 2 is an exemplary schematic diagram illustrating the determination of vulnerability remediation information based on CVE information according to an embodiment of the present invention.

[0117] In Figure 2, a description text 10 of the protected system, represented in natural language and containing components, is input into, for example, a BERT model 11. The BERT model 11 identifies component 12. Using the name of the identified component 12 as the first search term, a vulnerability remediation method 14 corresponding to the first search term is queried in the knowledge base 13. The vulnerability remediation method 14 in the knowledge base 13 specifically refers to the CVE information of the recorded component whose name has the highest similarity to the identified component 12 and whose similarity is greater than a similarity threshold among the recorded components in the knowledge base 13. Then, the vulnerability remediation method 14 is used to query the vulnerability database 15 (e.g., the NVD database) to obtain the vulnerability remediation information 16 of the identified component 12. For example, the vulnerability remediation information 16 may include: security patches for the vulnerability, vulnerability severity scores, and vulnerability impact ratings, etc.

[0118] Figure 3 is an exemplary schematic diagram illustrating the determination of vulnerability remediation information based on a secure URL according to an embodiment of the present invention.

[0119] In Figure 3, a description text 10 of the protected system containing the component, represented in natural language, is input into, for example, a BERT model 11. The BERT model 11 identifies the component 12. Using the name of the identified component 12 as the first search term, a vulnerability remediation method 24 corresponding to the first search term is queried in the knowledge base 13. The vulnerability remediation method 24 specifically refers to the secure URL of the recorded component in the knowledge base 13 whose name has the highest similarity to the identified component 12 and whose similarity is greater than a similarity threshold. Then, the vulnerability remediation method 24 is used to access the server 25 to download the vulnerability remediation information 26 for the identified component 12. For example, the vulnerability remediation information 26 may include a security patch for the vulnerability, a severity score for the vulnerability, and an impact rating for the vulnerability, etc.

[0120] This invention also provides an exemplary process for maintaining a knowledge base. Figure 4 is a schematic diagram of an exemplary process for maintaining a knowledge base according to an embodiment of the invention. As shown in Figure 4, the process includes:

[0121] Step 201: Obtain the description text of the protected system.

[0122] Step 202: Input the description text into the BERT model so that the BERT model can identify the components of the protected system.

[0123] Step 203: Calculate the similarity between the name of the identified component and the name of each recorded component in the knowledge base, and determine the highest similarity.

[0124] Step 204: Determine whether the highest similarity is greater than the predetermined similarity threshold. If yes (corresponding to the "Y" branch), proceed to step 205; otherwise (corresponding to the "N" branch), proceed to step 206 and subsequent steps.

[0125] Step 205: Identify the vulnerability remediation method of the recorded component with the highest similarity in the knowledge base as the vulnerability remediation method of the identified component, and exit this process.

[0126] Step 206: Determine whether a user instruction indicating that the identified component is a new component has been received. If yes (corresponding to the "Y" branch), proceed to step 208; otherwise (corresponding to the "N" branch), proceed to step 207. Here, when the highest similarity is not greater than the similarity threshold, the user can determine whether the identified component is a new component.

[0127] Step 207: Based on the user's instructions, update the name and / or vulnerability remediation method of the recorded component with the highest similarity in the knowledge base, and then execute step 205.

[0128] Step 208: Add the identified component to the knowledge base.

[0129] Step 209: Enable the crawler to obtain the vulnerability remediation methods of the identified components from the network, associate the vulnerability remediation methods with the identified components and store them in the database, and then execute step 205.

[0130] The following description uses the field of industrial automation as an example to illustrate the implementation of the present invention.

[0131] In recent years, with the introduction of open communication protocols based on Industrial Ethernet, industrial control systems have become more open, connecting with the outside world more frequently. External security threats are increasing, and many attacks can infiltrate industrial control systems via the internet. PLCs are widely used in industrial automation, such as analog control, digital control, position control, centralized system control, and variable frequency speed control of motors. PLCs are core equipment in industrial automation, and their security is crucial to the safe and stable operation of the entire system. The Ethernet communication components included in PLCs connect the PLC to an Ethernet network, enabling efficient and reliable data exchange with other devices or systems. Quick and convenient vulnerability patching of the Ethernet communication components in PLCs has significant security implications.

[0132] Step 1: Obtain the description text of the PLC as the protected system, which is represented in natural language. For example, the description text can be implemented as the PLC's specification document (e.g., the specification document contains introductory text of the CP 443-1 component as an Ethernet communication component), the PLC system's structure document (e.g., a textual description of the various components specifically included in the PLC), or the PLC system's log text during daily operation (e.g., the log text describes the name, function, and attributes of each component).

[0133] Step 2: Based on NLP, identify the “CP 443-1” component as an Ethernet communication component from the description text.

[0134] Step 3: Using "CP 443-1" as the search term, search the knowledge base for CVE information corresponding to that search term. For example, the search result might be CVE-2017-6868.

[0135] Step 4: Using "CVE-2017-6868" as the search term, search for the security patch corresponding to "CVE-2017-6868" in NVD. Then, download and install the security patch to fix the "CVE-2017-6868" vulnerability in the "CP 443-1" component of the PLC.

[0136] The above description, using PLC vulnerability patching as an example, illustrates a specific application in the field of industrial automation. Those skilled in the art will recognize that the above description is merely illustrative and not intended to specifically limit the scope of protection of the embodiments of this invention. In fact, the embodiments of this invention can be applied to many components in industrial control systems, such as human-machine interfaces (HMIs), as well as electrical equipment such as power analyzers and relay platform units, and many protected systems such as monitoring and data acquisition systems (SCADA).

[0137] Figure 5 is an exemplary structural diagram of a system for determining vulnerability remediation information according to an embodiment of the present invention. As shown in Figure 5, the system for determining vulnerability remediation information includes: a knowledge base 40, which stores the correspondence between the names of recorded components and the vulnerability remediation methods of the recorded components; a device 41, used to acquire the description text of a protected system, wherein the protected system contains components, and the description text is represented in natural language; to identify components from the description text based on NLP; to query the knowledge base 40 for vulnerability remediation methods corresponding to the first search term, using the name of the identified component as the first search term; and to determine the vulnerability remediation information of the identified components based on the vulnerability remediation methods.

[0138] In one implementation, the vulnerability repair method of the recorded component includes the CVE information of the recorded component; the system also includes: a vulnerability database 42, used to store the correspondence between the recorded CVE information and the vulnerability repair information of the recorded CVE; and a device 41, used to query the vulnerability database 42 for vulnerability repair information corresponding to the CVE information, using the CVE information corresponding to the first search term as the second search term.

[0139] In one implementation, the vulnerability remediation method for the recorded component includes a secure URL for the recorded component, the secure URL being adapted to locate a network address that provides vulnerability remediation information for the recorded component; the system further includes: a server 43, configured to store vulnerability remediation information for the identified component in the network address located by the secure URL corresponding to the first search term; and a device 41, configured to access the network address located by the secure URL corresponding to the first search term to obtain vulnerability remediation information for the identified component from the server 43.

[0140] In summary, the embodiments of this invention include: obtaining the description text of a protected system, wherein the protected system comprises components, and the description text is represented in natural language; identifying the components from the description text based on NLP; querying a knowledge base for vulnerability remediation methods corresponding to the first search term, using the name of the identified component as the first search term; and determining the vulnerability remediation information of the identified component based on the vulnerability remediation method. Automatic component identification using NLP avoids the tedious manual identification of components and improves remediation efficiency. Vulnerability remediation information can be quickly determined using CVE information or secure URLs stored in the knowledge base, and the knowledge base can be easily updated.

[0141] Figure 6 is an exemplary structural diagram of an apparatus for determining vulnerability remediation information according to an embodiment of the present invention. As shown in Figure 6, the apparatus 600 for determining vulnerability remediation information includes: an acquisition module 601, used to acquire a description text of a protected system, the protected system containing components, the description text being represented in natural language; a natural language processing module 602, used to identify components from the description text based on NLP; a query module 603, used to query a knowledge base for vulnerability remediation methods corresponding to the first search term, using the name of the identified component as the first search term; and a determination module 604, used to determine the vulnerability remediation information of the identified components based on the vulnerability remediation methods.

[0142] In one implementation, the knowledge base stores the correspondence between the names of recorded components and the vulnerability repair methods of the recorded components, wherein the vulnerability repair methods of the recorded components include the CVE information of the recorded components; the determination module 604 is used to query the vulnerability repair information corresponding to the second search item in the vulnerability database, using the CVE information corresponding to the first search item as the second search item.

[0143] In one implementation, the knowledge base stores the correspondence between the names of recorded components and the vulnerability repair methods of the recorded components, wherein the vulnerability repair methods of the recorded components include the security URL of the recorded components, and the security URL is adapted to locate the network address that provides the vulnerability repair information of the recorded components; the determination module 604 is used to access the network address located by the security URL corresponding to the first search item to obtain the vulnerability repair information of the identified components.

[0144] In one implementation, the query module 603 is used to determine the similarity between the name of the identified component and the name of each recorded component in the knowledge base; and to determine the vulnerability repair method corresponding to the name of the recorded component with the highest similarity as the vulnerability repair method of the identified component, wherein the highest similarity is greater than a predetermined similarity threshold.

[0145] In one implementation, the query module 603 is used to enable the crawler to obtain the vulnerability repair method of the identified component from the network when no recorded component name with a similarity greater than the similarity threshold can be found in the knowledge base; and to add the correspondence between the name of the identified component and the vulnerability repair method of the identified component to the knowledge base.

[0146] This invention also proposes an electronic device with a processor-memory architecture. Figure 7 is an exemplary structural diagram of an electronic device with a processor-memory architecture according to an embodiment of the present invention. As shown in Figure 7, the electronic device 700 includes a processor 701, a memory 702, and a computer program stored on the memory 702 and executable on the processor 701. When the computer program is executed by the processor 701, it implements the method for determining vulnerability repair information as described above. Specifically, the memory 702 can be implemented as various storage media such as electrically erasable programmable read-only memory (EEPROM), flash memory, and programmable programmable read-only memory (PROM). The processor 701 can be implemented as including one or more central processing units (CPUs) or one or more field-programmable gate arrays (FPGAs), wherein the FPGA integrates one or more CPU cores. Specifically, the CPU or CPU core can be implemented as a CPU, MCU, or DSP, etc.

[0147] It should be noted that not all steps and modules in the above processes and structural diagrams are mandatory; some steps or modules can be omitted as needed. The execution order of the steps is not fixed and can be adjusted as required. The division of modules is merely for the convenience of description and functional division. In actual implementation, a module can be implemented by multiple modules, and the functions of multiple modules can also be implemented by the same module. These modules can be located in the same device or in different devices.

[0148] The hardware modules in each embodiment can be implemented mechanically or electronically. For example, a hardware module may include specially designed permanent circuitry or logic devices (such as dedicated processors, such as FPGAs or ASICs) to perform specific operations. A hardware module may also include programmable logic devices or circuitry (such as general-purpose processors or other programmable processors) temporarily configured by software to perform specific operations. The choice between mechanical implementation, dedicated permanent circuitry, or temporarily configured circuitry (such as software-configured circuitry) can be made based on cost and time considerations.

[0149] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method of determining vulnerability fix information, characterized by, The method comprises: obtaining (101) a description text of a protected system, the protected system comprising components, the description text being represented in a natural language; identifying (102) the components from the description text based on natural language processing; querying (103) a vulnerability fixing manner corresponding to the first search item in a knowledge base, taking the name of the identified component as the first search item; determining (104) the vulnerability fixing information of the identified component based on the vulnerability fixing manner.

2. The method of claim 1, wherein, The knowledge base stores a correspondence between the name of a recorded component and the vulnerability fixing manner of the recorded component, wherein the vulnerability fixing manner of the recorded component comprises Common Vulnerability and Exposure information of the recorded component; The determining (104) of the vulnerability fixing information of the identified component based on the vulnerability fixing manner comprises: querying the vulnerability fixing information corresponding to the second search item in a vulnerability database, taking the Common Vulnerability and Exposure information corresponding to the first search item as the second search item.

3. The method of claim 1, wherein, The knowledge base stores a correspondence between the name of a recorded component and the vulnerability fixing manner of the recorded component, wherein the vulnerability fixing manner of the recorded component comprises a secure uniform resource locator adapted to locate a network address providing the vulnerability fixing information of the recorded component; The determining (104) of the vulnerability fixing information of the identified component based on the vulnerability fixing manner comprises: accessing the network address located by the secure uniform resource locator corresponding to the first search item to obtain the vulnerability fixing information of the identified component.

4. The method according to any one of claims 1-3, wherein The querying (103) of the vulnerability fixing manner corresponding to the first search item in the knowledge base comprises: determining a similarity between the name of the identified component and the name of each recorded component in the knowledge base; determining the vulnerability fixing manner corresponding to the name of the recorded component with the highest similarity as the vulnerability fixing manner of the identified component, wherein the highest similarity is greater than a predetermined similarity threshold.

5. The method of claim 4, wherein, The method comprises: enabling a crawler to obtain the vulnerability fixing manner of the identified component from a network when no recorded component name with a similarity to the name of the identified component greater than the similarity threshold can be queried in the knowledge base; adding the correspondence between the name of the identified component and the vulnerability fixing manner of the identified component in the knowledge base.

6. An apparatus for determining vulnerability fix information, the apparatus comprising: The method comprises: an obtaining module (601) configured to obtain a description text of a protected system, the protected system comprising components, the description text being represented in a natural language; a natural language processing module (602) configured to identify the components from the description text based on natural language processing; a querying module (603) configured to query a vulnerability fixing manner corresponding to the first search item in a knowledge base, taking the name of the identified component as the first search item; a determining module (604) configured to determine the vulnerability fixing information of the identified component based on the vulnerability fixing manner.

7. The apparatus of claim 6, wherein, The knowledge base stores a correspondence between a name of a recorded component and a vulnerability fixing manner of the recorded component, wherein the vulnerability fixing manner of the recorded component comprises common vulnerability and exposure information of the recorded component; The determination module (604) is configured to take the common vulnerability and exposure information corresponding to the first search item as a second search item, and query vulnerability fixing information corresponding to the second search item in a vulnerability library.

8. The apparatus of claim 6, wherein, The knowledge base stores a correspondence between a name of a recorded component and a vulnerability fixing manner of the recorded component, wherein the vulnerability fixing manner of the recorded component comprises a secure uniform resource locator of the recorded component, and the secure uniform resource locator is adapted to locate a network address providing vulnerability fixing information of the recorded component; The determination module (604) is configured to access a network address located by the secure uniform resource locator corresponding to the first search item to obtain the vulnerability fixing information of the identified component.

9. The apparatus according to any one of claims 6-8, wherein The query module (603) is configured to determine a similarity between the name of the identified component and a name of each recorded component in the knowledge base, and determine a vulnerability fixing manner corresponding to a name of a recorded component with a highest similarity as the vulnerability fixing manner of the identified component, wherein the highest similarity is greater than a predetermined similarity threshold.

10. The apparatus according to claim 9, wherein The query module (603) is configured to enable a crawler to obtain the vulnerability fixing manner of the identified component from a network when no recorded component with a name similar to the name of the identified component and greater than the similarity threshold is found in the knowledge base, and add a correspondence between the name of the identified component and the vulnerability fixing manner of the identified component in the knowledge base. Comprise:

11. A system for determining patch information, the system comprising: A knowledge base (40) that stores a correspondence between a name of a recorded component and a vulnerability fixing manner of the recorded component; An apparatus (41) that is configured to obtain a description text of a protected system, wherein the protected system comprises a component, and the description text is represented in a natural language; perform natural language processing on the description text to identify the component; take a name of the identified component as a first search item, and query a vulnerability fixing manner corresponding to the first search item in the knowledge base (40); and determine vulnerability fixing information of the identified component based on the vulnerability fixing manner. The vulnerability fixing manner of the recorded component comprises common vulnerability and exposure information of the recorded component; and the system further comprises:

12. The system of claim 11, wherein, A vulnerability library (42) that is configured to save a correspondence between a recorded common vulnerability and exposure information and vulnerability fixing information of the recorded common vulnerability and exposure information; The apparatus (41) is configured to take the common vulnerability and exposure information corresponding to the first search item as a second search item, and query vulnerability fixing information corresponding to the vulnerability and exposure information in the vulnerability library (42). ​ 13. The system of claim 11, wherein, The patching of the recorded component includes a secure uniform resource locator of the recorded component, the secure uniform resource locator being adapted to locate a network address providing patch information of the recorded component; the system further comprises: a server (43) for storing the patch information of the identified component in a network address located by a secure uniform resource locator corresponding to the first search term; the means (41) for accessing the network address located by the secure uniform resource locator corresponding to the first search term to obtain the patch information of the identified component from the server (43).

14. An electronic device, comprising: comprising: a processor (701); a memory (702) for storing executable instructions of the processor (701); the processor (701) is configured to read the executable instructions from the memory (702) and execute the executable instructions to implement the method for determining patch information according to any one of claims 1-6.

15. A computer readable storage medium having stored thereon computer instructions, wherein, the computer instructions, when executed by the processor, implement the method for determining patch information according to any one of claims 1-6.

16. A computer program product, characterised in that, a computer program, when executed by the processor, implements the method for determining patch information according to any one of claims 1-6.

Images