CN115982713A - Vulnerability repairing method and device, electronic equipment and computer readable storage medium - Google Patents

Abstract

The application provides a vulnerability fixing method, a vulnerability fixing device, electronic equipment and a computer readable storage medium, wherein a specific implementation mode of the method comprises the following steps: when a package management feature file of a target application is detected, determining a plurality of target components corresponding to the target application according to the package management feature file; respectively detecting vulnerability information corresponding to the target component in a preset risk component library; calculating the risk score of the target application according to the vulnerability information corresponding to the target components; and when the risk score is higher than a risk threshold value, repairing the vulnerability of the target application. The method can effectively reduce the security risk of the target application after the bug is repaired.

Description

Bug fixing method, device, electronic device and computer-readable storage medium

technical field

The present application relates to the field of information security, and in particular, relates to a vulnerability repair method, device, electronic equipment, and computer-readable storage medium.

Background technique

A software vulnerability is a security flaw in an operating system or software that allows an attacker to gain unauthorized access or damage the system. System vulnerability scanning is mainly used to scan the vulnerabilities of mainstream operating systems, application services, databases, network devices, virtualization platforms, video surveillance systems, and industrial control systems.

Since the defects and security holes in the open source software are also packaged in the software deployment package, it brings a greater security risk to the application with the software deployment package. In related technologies, there is a solution for repairing application vulnerabilities by patching or upgrading the application version. However, in this solution, there are problems such as difficulty in finding application component vulnerabilities, introduction of new risky components, lack of repair measures or inappropriate repair measures, etc., which will substantially lead to problems that the security risks of the application are still relatively large after the application vulnerabilities are repaired.

Contents of the invention

The purpose of the embodiments of the present application is to provide a vulnerability repair method, device, electronic device and computer-readable storage medium, so as to effectively reduce the security risk of the target application after the vulnerability is repaired.

In the first aspect, the embodiment of the present application provides a vulnerability repair method, the method includes: when detecting the package management feature file of the target application, determining a plurality of target components corresponding to the target application according to the package management feature file ; Detect the vulnerability information corresponding to the target component in the preset risk component library; calculate the risk score of the target application according to the vulnerability information corresponding to the multiple target components; when the risk score is higher than the risk threshold , repairing the vulnerability of the target application. In this way, after the vulnerability is fixed, the security risk of the target application can be effectively reduced.

Optionally, the step of building the preset risk component library includes: obtaining multiple components and multiple vulnerability information; the vulnerability information includes vulnerability risk scores corresponding to vulnerabilities, and vulnerability repair measures; for an application, according to the construction of the Establishing a component relationship graph based on dependencies among multiple components of the application; and storing each component included in the component relationship graph in association with its respective vulnerability information to obtain the preset risk component library. In this way, the relationship between applications and components, and between components and vulnerabilities is clearer and easier to manage.

Optionally, the calculating the risk score of the target application according to the vulnerability information corresponding to the plurality of target components includes: for a target component, determining a plurality of vulnerability information corresponding to the target component, and calculating the highest score The vulnerability risk score of the target component is determined as the risk score corresponding to the target component; and the weight proportional coefficient corresponding to the target component is determined; the product of the risk score corresponding to each target component and the weight proportional coefficient is calculated, and the multiple products are accumulated, A risk score of the target application is obtained. In this way, the determined risk score of the target application can effectively determine whether the target application can run normally.

Optionally, the plurality of target components are divided into direct components and indirect components based on the dependency relationship; wherein, the weight proportional coefficient of the direct component is greater than the weight proportional coefficient of the indirect component; and the calculation corresponding to each target component The product of the risk score of the target application and the weight proportional coefficient, and accumulate the multiple products to obtain the risk score of the target application, including: calculating the first product of the risk score corresponding to each direct component and the weight proportional coefficient, and each A second product of the risk score corresponding to each indirect component and a weight proportional coefficient; accumulating a plurality of the first products and a plurality of the second products to obtain the risk score of the target application. In this way, no new risk components are introduced, which improves the security of the target application after repair.

Optionally, when the risk score is higher than a risk threshold, repairing the vulnerability of the target application includes: when the risk score is higher than a risk threshold, searching for each of the preset risk component libraries. Vulnerability repair measures corresponding to the target components respectively; according to the vulnerability repair measures, the corresponding vulnerabilities of the target components are repaired.

Optionally, when the package management feature file of the target application is detected, determining the multiple target components corresponding to the target application according to the package management feature file includes: when the package management feature file of the target application is detected , if it is determined that the type of the package management characteristic file is a package management manifest file type, extracting a software bill of material of the target application, and determining the plurality of target components according to the software bill of material. In this way, the target component corresponding to the package management list file can be scanned from the file level, which deepens the scanning depth and enables more detailed scanning.

Optionally, when the package management feature file of the target application is detected, determining the multiple target components corresponding to the target application according to the package management feature file includes: when the package management feature file of the target application is detected , if it is determined that the type of the package management feature file is a binary file type, extracting binary machine code features preset in the package management feature file, and determining the plurality of target components according to the binary machine code features. In this way, the target component corresponding to the binary file can be scanned from the file level, which deepens the scanning depth and enables more detailed scanning.

In a second aspect, the embodiment of the present application provides a vulnerability repairing device, which includes a component determination module, a vulnerability detection module, a calculation module, and a repairing module. Wherein, the component determining module is configured to determine multiple target components corresponding to the target application according to the package management feature file when the package management feature file of the target application is detected; the vulnerability detection module is used to preset risk components Vulnerability information corresponding to the target component is detected in the library; a calculation module is used to calculate the risk score of the target application according to the vulnerability information corresponding to a plurality of target components; a repair module is used to calculate the risk score of the target application. When the risk threshold is higher than, the vulnerability of the target application is repaired. After the vulnerability is fixed, the security risk of the target application can be effectively reduced.

In the third aspect, the embodiment of the present application provides an electronic device, including a processor and a memory, the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the operation as described above The steps in the method provided in the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps in the method provided in the first aspect above are performed.

Other features and advantages of the present application will be set forth in the ensuing description and, in part, will be apparent from the description, or can be learned by practicing the embodiments of the present application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings that need to be used in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, so It should not be regarded as a limitation on the scope, and those skilled in the art can also obtain other related drawings according to these drawings without creative work.

FIG. 1 is a flow chart of a vulnerability repair method provided in an embodiment of the present application;

FIG. 2 is a structural block diagram of a vulnerability repair device provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of an electronic device for executing a method for repairing a bug provided by an embodiment of the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all of them. The components of the embodiments of the application generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations. Accordingly, the following detailed description of the embodiments of the application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative efforts belong to the scope of protection of the present application.

It should be noted that like numerals and letters denote similar items in the following figures, therefore, once an item is defined in one figure, it does not require further definition and explanation in subsequent figures. Meanwhile, in the description of the present application, the terms "first", "second" and the like are only used to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

It should be noted that, in the case of no conflict, the embodiments in the present application or the technical features in the embodiments may be combined.

In the related art, there is a problem that the security risk of the application is still relatively large after the vulnerability of the application is repaired; in order to solve this problem, the present application provides a method, device, electronic device and computer-readable storage medium for repairing the vulnerability; further , determine the target components of the target application from the file level, and then detect the vulnerability information corresponding to the target component in the preset library, and then evaluate the security risk of the target application based on the vulnerability information. When the security risk of the target application is determined to be high , to fix the detected vulnerabilities. In this way, the detection depth is deepened, and the vulnerabilities of the target application can be detected in more detail; moreover, since the security risk of the application is not reduced by patching or upgrading the application version, but the existing vulnerabilities in the target application are directly repaired, and then no There will be version compatibility issues or the introduction of new risky components. Therefore, after the vulnerability is fixed, the security risk of the target application can be effectively reduced.

In some application scenarios, the above vulnerability repairing method can be applied to terminal devices. The terminal device may include, for example, a mobile phone, a computer, and the like.

The defects in the solutions in the above related technologies are all the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above problems and the solutions to the above problems proposed by the embodiments of the present invention below, All should be the inventor's contribution to the invention during the process of the invention.

Please refer to FIG. 1 , which shows a flow chart of a method for repairing a bug provided by an embodiment of the present application. As shown in FIG. 1 , the vulnerability repair method includes the following steps 101 to 104 .

Step 101, when the package management characteristic file of the target application is detected, determine a plurality of target components corresponding to the target application according to the package management characteristic file;

In some application scenarios, the terminal device may, for example, use system vulnerability scanning and analysis software (Nessus) to detect the package management feature file of the target application. The above target application can be built from multiple open source components. The aforementioned package management feature files may include, for example, package management manifest files, binary files, and the like.

In these application scenarios, the terminal device can detect the package management signature file from the default installation path of the target application, and can determine multiple target components corresponding to the target application according to the package management signature file when the package management signature file is detected . The target components here can be regarded as open source components with security risks.

Step 102, respectively detecting vulnerability information corresponding to the target component in the preset risk component library;

For example, the preset risk component library may include information about multiple open source components and vulnerability information corresponding to each open source component. The relevant information here may include, for example, the name information and version information of the open source component, and the vulnerability information may include, for example, the name of the vulnerability, its cause, and its risk level. Then, after detecting multiple target components, the terminal device may detect vulnerability information corresponding to each target component in the preset risk component library.

In some application scenarios, there may be one vulnerability or multiple vulnerabilities in the target component. For each vulnerability, the terminal device can find the vulnerability information corresponding to the vulnerability from the preset risk component library.

Step 103, calculating the risk score of the target application according to the vulnerability information corresponding to the multiple target components;

After detecting the vulnerability information corresponding to the target component, the terminal device may calculate the risk score of the target application according to the vulnerability information corresponding to each target component. In some application scenarios, for example, the risk scores corresponding to each target component may be counted, and the average value of the risk scores of each target component may be regarded as the risk score of the target application.

Step 104, when the risk score is higher than a risk threshold, repair the vulnerability of the target application.

After calculating the risk score of the target application, the terminal device can determine whether the risk score is higher than the risk threshold. In some application scenarios, if the risk score of the target application is higher than the risk threshold, it can be considered that the security risk of the target application is relatively high, and it needs to be repaired to continue working. If the risk score of the target application is lower than the risk threshold, it can be considered that the security risk of the target application is small, and it can continue to work normally.

If the terminal device determines that the risk score of the target application is higher than the risk threshold, it can repair the vulnerability of the target application. In some application scenarios, for example, the target component can be directly replaced with a non-vulnerable version to achieve the purpose of repair.

In this embodiment, through the above steps 101 to 104, the vulnerability of the target application can be scanned from the file level, the scanning depth of the vulnerability is deepened, and the vulnerability of the target application can be detected in more detail; and, because it is not through patching or upgrading The application version is used to reduce the security risk of the application, but the existing vulnerabilities in the target application are directly fixed, so that there will be no version compatibility issues or the introduction of new risky components. Therefore, after the vulnerability is fixed, the security risk of the target application can be effectively reduced.

In some optional implementation manners, the foregoing preset risk component library may be pre-built. The construction steps of the preset risk component library include:

Step 1, obtaining a plurality of components and a plurality of vulnerability information; the vulnerability information includes a vulnerability risk score corresponding to the vulnerability, and vulnerability repair measures;

In some application scenarios, a large amount of component information and vulnerability information can be obtained first. For example, it can be obtained from Internet vulnerability information disclosure platforms such as CVE (Common Vulnerabilities & Exposures, Common Vulnerability Disclosure), CVND (China National Vulnerability Database, National Information Security Vulnerability Sharing Platform), and CNNVD (China National Vulnerability Database of Information Security, National Information Security Vulnerability Database) A lot of vulnerability information. The vulnerability information here may include the vulnerability risk score corresponding to the vulnerability, the vulnerability repair measures, and may also include the description information of the vulnerability, the vulnerability name, the vulnerability number and other information. In these application scenarios, for example, the vulnerability risk score corresponding to the vulnerability can be obtained through CVSS (Common Vulnerability Scoring System, Common Vulnerability Scoring System). Step 2, for an application, according to the dependencies between multiple components that build the application Relationship building component relationship graph;

After obtaining multiple components and multiple vulnerability information, multiple components can be integrated according to the application where the components are located. Specifically, for an application, multiple components for building the application may be determined. Further, there may be dependencies among various components. For example, if component A needs to depend on the output of component B to run, it can be considered that component A depends on component B, and there is a dependency relationship between the two.

Then, after determining the dependency relationship among the various components, a component relationship graph can be established according to the dependency relationship, so as to associate multiple components used to build the same application.

In some application scenarios, in order to facilitate the management of the component relationship graph (such as searching and locating), a permanent uniform resource locator can be set for each component, and then the permanent uniform resource locator can be used to uniquely represent a component. The permanent uniform resource locator may consist of, for example, the name of the package manager, the name of the vendor, the name of the component, and the version of the component.

In step 3, each component included in the component relationship graph is associated and stored with their respective vulnerability information to obtain the preset risk component library.

After the component relationship graph is constructed, each component in the component relationship graph can be stored in association with its respective vulnerability information. For example, component A may have vulnerabilities a1 and a2, and component A may be associated with vulnerability information corresponding to vulnerabilities a1 and a2.

In the component relationship graphs corresponding to multiple applications, after the components and vulnerability information are associated and stored, the preset risk component library can be obtained. It should be noted that a component can participate in the construction of multiple applications, and a vulnerability may exist in multiple components. Therefore, when constructing component relationship graphs, component relationship graphs corresponding to different applications can be associated through component or vulnerability information.

In this implementation manner, a preset risk component library may be established according to the relationship between applications and components, and between components and vulnerabilities. In this way, the relationship between applications and components, and between components and vulnerabilities is clearer and easier to manage.

In some optional implementation manners, when the package management feature file of the target application is detected in step 101 above, determining multiple target components corresponding to the target application according to the package management feature file includes: When the package management signature file of the target application is detected, if it is determined that the type of the package management signature file is a package management list file type, extract the software bill of materials of the target application, and determine the multiple target component.

In some application scenarios, when the terminal device detects the package management feature file, it may determine the type of the package management feature file. That is, it can be determined whether the package management feature file is a package management manifest file or a binary file.

In these application scenarios, if the type of the package management feature file is the package management manifest file type, the software bill of material (Software Bill of Material, referred to as SBOM file) of the target application can be extracted, and then multiple target component.

For example, the terminal device can search for the package management feature file from the source code of the target application (for example, code written in a programming language with a package management mechanism such as Java language, PHP language, Golang language), and the type of the package management feature file is When a package manages a manifest file type, its SBOM file can be extracted to obtain multiple target components. If one of the target components is a Fastjson component, it may find 2 vulnerability information from the preset risk component library. One of them can be, for example, "The vulnerability numbered CVE-2022-25845 has a deserialization risk in version 1.2.80 and below"; the other can be, for example, "The vulnerability numbered CVE-2017-18349 is in the A vulnerability exists that could allow a remote attacker to execute arbitrary code via a specially crafted JSON request."

In some application scenarios, if you find the above two vulnerability information, you can continue to search for corresponding vulnerability repair measures in the preset risk component library. The information content corresponding to the vulnerability repair measures may include, for example, "Version affected by the vulnerability: Fastjson<=1.2.80; version not affected by the vulnerability: Fastjson=1.2.83; versions below 1.2.80 can be replaced with 1.2 .83 version".

In this implementation manner, if the package management feature file is a package management list file type, the target component may be determined based on the software bill of materials. In this way, the target component corresponding to the package management list file can be scanned from the file level, which deepens the scanning depth and enables more detailed scanning.

In some optional implementation manners, when the package management feature file of the target application is detected in step 101 above, determining multiple target components corresponding to the target application according to the package management feature file includes: When detecting the package management feature file of the target application, if it is determined that the type of the package management feature file is a binary file type, extract the preset binary machine code feature in the package management feature file, and determine according to the binary machine code feature The plurality of target components.

In some application scenarios, when the terminal device detects that the package management feature file is a binary file, it can extract the preset binary machine code features in the binary file, and then further determine the target component according to the information content corresponding to the binary machine code features . The information content corresponding to the aforementioned binary machine code feature may include, for example, a constant character string, a partial class name, a function name, or other configuration information.

For example, the terminal device can use the ldd command (command for analyzing the dependency relationship of shared objects) to find the package management feature file from the source code of the target application (such as code written in C language, C++ language, etc.), and the package management feature file When the file type is a binary file type, you can further use the nm command to list the symbols of the binary file. Then extract binary machine code feature information such as constant strings, partial class names, function names, etc. Then, the code similarity calculation is further performed through matching algorithms such as machine learning and natural language processing, and the name information, version information, etc. corresponding to the target component are determined, and then the target component is determined.

In this implementation manner, if the package management characteristic file is a binary file type, the target component may be determined based on binary machine code characteristics. In this way, the target component corresponding to the binary file can be scanned from the file level, which deepens the scanning depth and enables more detailed scanning.

In some optional implementation manners, the calculation of the risk score of the target application according to the vulnerability information corresponding to the plurality of target components described in step 103 above includes the following sub-steps:

Sub-step 1031, for a target component, determine a plurality of vulnerability information corresponding to the target component, and determine the vulnerability risk score with the highest score as the risk score corresponding to the target component;

In some application scenarios, the target component may have one or more vulnerability information. Therefore, it is necessary to comprehensively consider one or more vulnerability information to determine the risk corresponding to the target component. Specifically, if the target component only corresponds to one piece of vulnerability information, the vulnerability risk score in the vulnerability information may be determined as the risk score corresponding to the target component. If the target component corresponds to multiple vulnerability information, the vulnerability risk scores corresponding to the multiple vulnerability information may be compared, and the vulnerability risk score with the highest score is determined as the risk score of the target component.

Sub-step 1032, determine the weight proportional coefficient corresponding to the target component;

In some application scenarios, each target component may be assigned a corresponding weight proportional coefficient in advance according to the importance of the target component. Then, after the risk score corresponding to the target component is determined, the weight proportional coefficient corresponding to the target component can be determined. The above weight proportional coefficient can be regarded as the importance of the target component for building the target application.

Sub-step 1033, calculate the product of the risk score corresponding to each target component and the weight proportional coefficient, and accumulate the multiple products to obtain the risk score of the target application.

After the risk score and weight proportional coefficient corresponding to the target component are determined, the product of the two can be calculated, and the obtained multiple products can be accumulated to obtain the risk score of the target application.

In this implementation manner, the risk score of the target application can be calculated through the above steps from sub-step 1031 to sub-step 1033 . Since the vulnerability risk score with the highest score is used in the calculation process, the risk score calculated through the vulnerability risk score can be regarded as the highest risk score of the target application. Therefore, if the risk score is greater than the risk threshold, it can be considered that the target application has a relatively high security risk and needs to be repaired. Therefore, the risk score of the target application determined through the above steps from sub-step 1031 to sub-step 1033 can effectively determine whether the target application can run normally.

In some optional implementation manners, the multiple target components are divided into direct components and indirect components based on the dependency relationship; wherein, the weight proportional coefficient of the direct component is greater than the weight proportional coefficient of the indirect component;

In some application scenarios, since there is a dependency relationship between multiple target components for building a target application, they can be divided into direct components and indirect components according to the dependency relationship. Specifically, the direct component may be located at the end of the component relationship graph, and the indirect component may be located at the upper level or the upper level of the direct component in the component relationship graph.

Since the direct component is more important for constructing the target application than the indirect component, the direct component can be given a larger weight proportional coefficient, and the indirect component can be given a smaller weight proportional coefficient.

In this way, calculating the product of the risk score corresponding to each target component and the weight proportional coefficient described in the above sub-step 1033, and accumulating the multiple products to obtain the risk score of the target application includes: calculating each direct The first product of the risk score corresponding to the component and the weight proportional coefficient, and the second product of the risk score corresponding to each indirect component and the weight proportional coefficient; a plurality of the first products, a plurality of the second products Accumulate to obtain the risk score of the target application.

表征目标应用的风险分数的计算步骤。其中，S_project表示目标应用的风险分数；W_direct表示直接组件的权重比例系数；W_indirect表示间接组件的权重比例系数；S_package表示目标组件的风险分数；且

When calculating the risk score of the target application, the terminal device can separately calculate the first product of the risk score corresponding to each direct component and the weight proportional coefficient, and the second product of the risk score corresponding to each indirect component and the weight proportional coefficient . Then, the multiple first products and the multiple second products can be accumulated to obtain the risk score of the target application. For example, you can

The calculation steps to characterize the risk score of the target application. Among them, S _project represents the risk score of the target application; W _direct represents the weight proportional coefficient of the direct component; W _indirect represents the weight proportional coefficient of the indirect component; S _package represents the risk score of the target component; and

In this implementation, by dividing the target components into direct components and indirect components, the reliability of the risk score of the target application can be improved.

In some optional implementation manners, when the risk score is higher than a risk threshold, repairing the vulnerability of the target application includes: when the risk score is higher than a risk threshold, starting from the preset risk component Finding the vulnerability repair measures corresponding to each of the target components in the database; and repairing the vulnerabilities corresponding to the target components according to the vulnerability repair measures.

In some application scenarios, after determining the risk score of the target application, the terminal device can determine whether the risk score is greater than the risk threshold. If it is greater, it can be considered that the security risk of the target application is greater, and then the corresponding vulnerability can be repaired . The aforementioned risk thresholds may include, for example, 0.7, 0.75, and other thresholds that can be used to indicate that the target application has relatively large security risks.

In these application scenarios, when the risk score of the target application is higher than the risk threshold, the vulnerability information corresponding to each target component can be found from the preset risk component library, and then the corresponding vulnerability repair measures can be found from the vulnerability information. Then, the vulnerability of the target component can be repaired according to the vulnerability repair measure. When the vulnerabilities of all target components are fixed, the vulnerabilities of the target application are also fixed.

In this implementation manner, the purpose of repairing the vulnerability of the target application is achieved by repairing the vulnerability of the target component. In this way, no new risk components are introduced, which improves the security of the target application after repair.

In some application scenarios, when the terminal device detects that the risk score of the target application is higher than the risk threshold, it can provide alarm information, so that it can analyze the components of the target application and the scope of vulnerability impact based on the alarm information, and formulate a new vulnerability troubleshooting plan Or measures that can substantially reduce the security risk of the target application, such as a vulnerability repair plan.

Please refer to FIG. 2 , which shows a structural block diagram of a vulnerability repairing device provided by an embodiment of the present application. The vulnerability repairing device may be a module, program segment or code on an electronic device. It should be understood that the device corresponds to the above-mentioned method embodiment in FIG. 1 , and can execute various steps involved in the method embodiment in FIG. 1 . The specific functions of the device can refer to the description above. To avoid repetition, detailed descriptions are appropriately omitted here.

Optionally, the vulnerability repairing apparatus includes a component determination module 201 , a vulnerability detection module 202 , a calculation module 203 and a repair module 204 . Wherein, the component determining module 201 is configured to determine a plurality of target components corresponding to the target application according to the package management characteristic file when detecting the package management characteristic file of the target application; the vulnerability detection module 202 is configured to The vulnerability information corresponding to the target component is respectively detected in the risk component library; the calculation module 203 is used to calculate the risk score of the target application according to the vulnerability information corresponding to the multiple target components; the repair module 204 is used to When the risk score is higher than a risk threshold, the vulnerability of the target application is repaired.

Optionally, the step of building the preset risk component library includes: obtaining multiple components and multiple vulnerability information; the vulnerability information includes vulnerability risk scores corresponding to vulnerabilities, and vulnerability repair measures; for an application, according to the construction of the Establishing a component relationship graph based on dependencies among multiple components of the application; and storing each component included in the component relationship graph in association with its respective vulnerability information to obtain the preset risk component library.

Optionally, the calculation module 203 is further configured to: for a target component, determine a plurality of vulnerability information corresponding to the target component, and determine the vulnerability risk score with the highest score as the risk score corresponding to the target component; and determine the target component The weight proportional coefficient corresponding to the component; calculate the product of the risk score corresponding to each target component and the weight proportional coefficient, and accumulate the multiple products to obtain the risk score of the target application.

Optionally, the multiple target components are divided into direct components and indirect components based on the dependency relationship; wherein, the weight proportional coefficient of the direct component is greater than the weight proportional coefficient of the indirect component; and the calculation module 203 is further used to: calculate each The first product of the risk score corresponding to each direct component and the weight proportional coefficient, and the second product of the risk score corresponding to each indirect component and the weight proportional coefficient; a plurality of said first products, a plurality of said second products The squares are accumulated and accumulated to obtain the risk score of the target application.

Optionally, the repairing module 204 is further configured to: when the risk score is higher than a risk threshold, search for vulnerability repairing measures corresponding to each of the target components from the preset risk component library; according to the vulnerability repairing measures Fix the vulnerability corresponding to the target component.

Optionally, the component determining module 201 is further configured to: when detecting the package management characteristic file of the target application, if it is determined that the type of the package management characteristic file is a package management list file type, extract the software bill of materials of the target application , and determine the multiple target components according to the software bill of material.

Optionally, the component determining module 201 is further configured to: when detecting the package management feature file of the target application, if it is determined that the type of the package management feature file is a binary file type, extract the binary file preset in the package management feature file. machine code features, and determine the multiple target components according to the binary machine code features.

It should be noted that those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the foregoing method embodiment, and the description will not be repeated here.

Please refer to FIG. 3. FIG. 3 is a schematic structural diagram of an electronic device for performing a vulnerability repair method provided by an embodiment of the present application. The electronic device may include: at least one processor 301, such as a CPU, and at least one communication interface 302 , at least one memory 303 and at least one communication bus 304 . Wherein, the communication bus 304 is used to realize the direct connection and communication of these components. Wherein, the communication interface 302 of the device in the embodiment of the present application is used for signaling or data communication with other node devices. The memory 303 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk memory. Optionally, the memory 303 may also be at least one storage device located away from the aforementioned processor. Computer-readable instructions are stored in the memory 303 , and when the computer-readable instructions are executed by the processor 301 , the electronic device can execute the above-mentioned method process shown in FIG. 1 .

It can be understood that the structure shown in FIG. 3 is only for illustration, and the electronic device may also include more or less components than those shown in FIG. 3 , or have a configuration different from that shown in FIG. 3 . Each component shown in FIG. 3 may be implemented by hardware, software or a combination thereof.

An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method process performed by the electronic device in the method embodiment shown in FIG. 1 can be executed.

An embodiment of the present application provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, The computer can execute the methods provided in the foregoing method embodiments. For example, the method may include: when detecting the package management feature file of the target application, determining multiple target components corresponding to the target application according to the package management feature file ; Detect the vulnerability information corresponding to the target component in the preset risk component library; calculate the risk score of the target application according to the vulnerability information corresponding to the multiple target components; when the risk score is higher than the risk threshold , repairing the vulnerability of the target application.

In the embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

In addition, a unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Furthermore, each functional module in each embodiment of the present application may be integrated to form an independent part, each module may exist independently, or two or more modules may be integrated to form an independent part.

In this document, relational terms such as first and second etc. are used only to distinguish one entity or operation from another without necessarily requiring or implying any such relationship between these entities or operations. Actual relationship or sequence.

The above descriptions are only examples of the present application, and are not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and changes may be made to the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application shall be included within the protection scope of this application.

Claims (10)

1. A vulnerability fixing method is characterized by comprising the following steps:

when a package management characteristic file of a target application is detected, determining a plurality of target components corresponding to the target application according to the package management characteristic file;

respectively detecting vulnerability information corresponding to the target component in a preset risk component library;

calculating the risk score of the target application according to the vulnerability information corresponding to the target components;

and when the risk score is higher than a risk threshold value, repairing the vulnerability of the target application.

2. The method of claim 1, wherein the step of constructing the library of pre-set risk components comprises:

acquiring a plurality of components and a plurality of vulnerability information; the vulnerability information comprises vulnerability risk scores and vulnerability repair measures corresponding to vulnerabilities;

aiming at an application, establishing a component relation map according to the dependency relationship among a plurality of components for constructing the application; and

and respectively associating and storing each component included in the component relation map with the relevant vulnerability information to obtain the preset risk component library.

3. The method of claim 2, wherein the calculating the risk score of the target application according to the vulnerability information corresponding to the target components comprises:

aiming at a target component, determining a plurality of vulnerability information corresponding to the target component, and determining the vulnerability risk score with the highest score as the risk score corresponding to the target component; and

determining a weight proportion coefficient corresponding to the target component;

and calculating the product of the risk score corresponding to each target component and the weight proportion coefficient, and accumulating the products to obtain the risk score of the target application.

4. The method of claim 3, wherein the plurality of target components are divided into direct components and indirect components based on the dependencies; wherein the weight scaling factor of the direct component is greater than the weight scaling factor of the indirect component; and

the calculating a product of the risk score corresponding to each target component and the weight proportion coefficient, and accumulating the products to obtain the risk score of the target application includes:

calculating a first product of the risk score and the weight scaling factor corresponding to each direct component and a second product of the risk score and the weight scaling factor corresponding to each indirect component;

and accumulating the plurality of first products and the plurality of second products to obtain the risk score of the target application.

5. The method according to any one of claims 2-4, wherein the fixing the vulnerability of the target application when the risk score is higher than a risk threshold value comprises:

when the risk score is higher than a risk threshold value, searching vulnerability repair measures corresponding to the target assemblies from the preset risk assembly library;

and repairing the bug corresponding to the target component according to the bug repairing measure.

6. The method according to claim 1, wherein the determining a plurality of target components corresponding to the target application according to the package management profile when the package management profile of the target application is detected comprises:

when a package management feature file of a target application is detected, if the type of the package management feature file is determined to be a package management list file type, extracting a software bill of materials of the target application, and determining the target components according to the software bill of materials.

7. The method according to claim 1, wherein the determining a plurality of target components corresponding to the target application according to the package management profile when the package management profile of the target application is detected comprises:

when a package management feature file of a target application is detected, if the type of the package management feature file is determined to be a binary file type, extracting a preset binary machine code feature in the package management feature file, and determining the target components according to the binary machine code feature.

8. A vulnerability repair apparatus, comprising:

the component determining module is used for determining a plurality of target components corresponding to the target application according to the package management characteristic file when the package management characteristic file of the target application is detected;

the vulnerability detection module is used for respectively detecting vulnerability information corresponding to the target component in a preset risk component library;

the calculation module is used for calculating the risk score of the target application according to the vulnerability information corresponding to the target components;

and the repairing module is used for repairing the vulnerability of the target application when the risk score is higher than a risk threshold value.

9. An electronic device comprising a processor and a memory, the memory storing computer readable instructions that, when executed by the processor, perform the method of any one of claims 1-7.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1 to 7.

Images