WO2012034304A1

WO2012034304A1 - A vulnerability fixing method based on hierarchical vulnerability threat evaluation

Info

Publication number: WO2012034304A1
Application number: PCT/CN2010/078492
Authority: WO
Inventors: 张玉清; 刘奇旭; 付安民
Original assignee: 中国科学院研究生院
Priority date: 2010-09-14
Filing date: 2010-11-08
Publication date: 2012-03-22
Also published as: CN101950338A

Abstract

A vulnerability fixing method based on hierarchical vulnerability threat evaluation is disclosed. The method includes: 1) retrieving a plurality of information security properties of the target system, a vulnerability to be test, and the required attack conditions during a process of using the vulnerability; 2) attacking the vulnerability and recording the values of required attack conditions during the process of being used and the degree of loss caused by successful utilization; 3) obtaining a qualitative grade score of the vulnerability according to the loss degree; 4) obtaining an attack utilization score of the vulnerability according to the values for the required attack conditions; 5) obtaining a quantitative grade score of the vulnerability according to the attack utilization score and the qualitative scoring score; 6) determining the processing order for the vulnerability according to the quantitative grade score of the vulnerability and fixes them. The method combines the advantage of the qualitative and quantitative vulnerability evaluation methods.

Description

A vulnerability repair method based on hierarchical vulnerability threat assessment

The invention mainly belongs to the field of vulnerability threat assessment, and relates to a vulnerability repairing method, in particular to a vulnerability repairing method based on a hierarchical vulnerability threat assessment. Background technique

Vulnerabilities are defects of computer information systems that are intentionally or unintentionally generated in the process of demand, design, implementation, configuration, operation, etc. These defects exist in different forms in various levels and links of computer information systems, and are used by malicious subjects. , it will cause damage to the computer information system, thus affecting the operation of the normal service built on the computer information system. In recent years, most of the security threats such as computer viruses, worms, Trojans, and hackers that are harmful to China's politics, economy, and society have been exploited by malicious entities to spread, destroy, and steal.

As the number of vulnerabilities increases, the attack behavior becomes more and more complex. Network security devices such as firewalls and intrusion detection systems cannot fully resist various forms of attacks. This makes it especially important to understand and fix known vulnerabilities in a timely manner. If the user's vulnerability to the vulnerability is not well differentiated, then the first vulnerability fixed is likely to be irrelevant, and the final patch is a high-risk vulnerability that could expose the entire network to danger. The vulnerability threat assessment method can distinguish a large number of vulnerabilities according to their vulnerability according to the relevant attributes of the vulnerability, so as to ensure that the most serious vulnerabilities are fixed first.

Currently, there are two types of vulnerability rating methods at home and abroad: qualitative and quantitative. The qualitative rating is based on the vulnerability threat rating factor, which identifies a threat level for the vulnerability, for example: high, medium, and low levels; quantitative scores determine a threat score for the vulnerability based on the established rating factors, for example, ranging from 0-10 Any integer between. Most vendors represented by Microsoft conduct qualitative assessments of product vulnerabilities from different perspectives and ultimately determine the threat level of the vulnerability. Microsoft divides the vulnerability into four levels: emergency, important, medium, and low based on the degree of harm. The Common Vulnerability Scoring System (CVSS), proposed by the National Iranian American Council in 2004, is a quantitative vulnerability threat assessment method designed to establish a common vulnerability threat assessment system. The value is high and low, and the vulnerabilities are repaired in order. Based on the basic characteristics of the vulnerability, CVSS quantitatively evaluates the vulnerability of the vulnerability as a score between 0 and 10, and then sequentially repairs the vulnerability according to the score.

Qualitative ratings provide an intuitive indication of the vulnerability level of the vulnerability, and quantitative scoring can break down the vulnerability based on its level of harm. However, it is the qualitative and quantitative two different vulnerability assessment methods that lead to the current “follow-up” situation of vulnerability assessment. At the same time, the existing technology combines all the rating elements and directly derives the final rating or rating. As a result, this non-hierarchical vulnerability assessment method cannot, to a certain extent, divide the vulnerability into more detailed. Therefore, combining qualitative The advantages of rating and qualitative scoring, the establishment of a hierarchical vulnerability assessment method for quantitative scoring after a prioritized rating is scored, and then it is necessary to sequentially repair the vulnerability according to the level of the vulnerability. Summary of the invention

The object of the present invention is to propose a vulnerability repairing method based on hierarchical vulnerability threat assessment. This approach combines the advantages of both qualitative and quantitative vulnerability assessment methods to make the vulnerability as detailed as possible, thus helping users to fix a large number of vulnerabilities.

In view of the above problems, the solution of the present invention is: First, qualitatively rating the vulnerability according to the degree of influence of the vulnerability on the security attribute of the target system information; and then, based on the qualitative results of the vulnerability and various conditions in the utilization process of the vulnerability, The vulnerability degree is further quantitatively scored, and finally the vulnerability is sequentially repaired according to the level of the vulnerability. The qualitative rating and qualitative scoring process use different evaluation factors to evaluate the vulnerability.

The invention includes two levels of qualitative rating and quantitative rating, and its architecture is shown in FIG. The qualitative rating in the present invention analyzes the degree of influence of the vulnerability on the information security attribute of the target system, and then obtains a qualitative rating level of the vulnerability. The specific methods of qualitative assessment are as follows:

1) Analyze the degree of loss of information security attributes such as "confidentiality", "integrity", and "availability" of the target system after it is successfully exploited. The impact on the security attributes of the target information after successful exploits is the most important factor in assessing the vulnerability threat.

2) According to the degree to which the attributes such as "confidentiality", "integrity" and "availability" of the target system are affected, the "qualitative rating" of the leak is obtained.

3) According to the "Qualitative Ratings" and then the "Qualitative Rating Level Results", such as "High", "Medium" and "Low".

Specifically, the mapping relationship between "confidentiality", "integrity" and "availability" and vulnerability threats can be described as similar to the forms in Tables 1 to 4. The key elements in Table 1 are as follows:

1) Confidentiality means that only authorized entities can access information. There are three possible values for confidentiality effects: full, partial, and none. The value methods are shown in Table 2.

2) Integrity means ensuring that information such as files is not altered by unauthorized entities and that it is reliable to change the information by authorized users. There are three possible values for integrity impact: full, partial, and none. The value methods are shown in Table 3.

3) Availability means that resources can be obtained at any time as needed. The availability impact also contains three possible values: full, partial and none. The value methods are shown in Table 4.

4) Qualitative grade score is a natural number ranging from 0-9, which is determined by the combination of confidentiality influence, integrity impact and usability impact. It is the intermediate result of the qualitative rating process. Confidentiality impact, integrity impact and availability Sexual influences have three possible values of "complete, partial, and no", so the combination of the three effects has a total of 27 possible values, namely the situation in 27 of Table 1.

5) Qualitative rating levels are the end result of the qualitative rating process for vulnerabilities. Table 1 contains three qualitative rating levels: High, Medium, and Low. Table 1 lists the value of 10 combinations of qualitative grades with scores of 6, 7, 8, and 9 as "high"; and the values of 13 combinations of qualitative scores of 2, 3, 4, and 5 The rating is "medium"; the value of the four combinations with a qualitative score of 0 and 1 is rated as "low".

Table 1 Vulnerability Qualitative Rating Level Mapping Table

Table 2 Confidentiality influence value method

Degree of influence

None has no effect on the confidentiality of the system.

Some attackers have access to certain system files.

A full attacker can read all the data (memory, files, etc.) of the system. Table 3 Integrity impact method

Degree of influence

None has no effect on the integrity of the system.

Some attackers may modify or leak certain system files.

A full attacker can modify any file on the target system.

Table 4 Availability Impact Method

Degree of influence

None has no effect on the availability of the system.

Some attackers can reduce or disrupt the performance of resources.

A full attacker can make a resource completely unavailable.

The quantitative score in the present invention combines the attacker's attack process in the exploitation of the vulnerability, and combines the intermediate result "qualitative rating" with the "attack utilization score" in the qualitative rating process to further the vulnerability threat degree. Quantitative score. The specific method of quantitative scoring is as follows:

1) Analyze the various attack conditions required for the vulnerability to be exploited, such as attack scope, attack complexity, attack authentication times, user interaction attributes, and so on. The attack conditions in the exploitation process are the key factors that restrict the successful exploitation of the vulnerability.

2) According to the attack conditions required for the vulnerability to be attacked, the "attack utilization score" of the vulnerability is obtained by some calculation method, such as formula (1).

3) Based on the "qualitative grade score" in the qualitative rating process, through a certain calculation method, such as formula (2), combine "attack utilization score" with "qualitative grade score", and finally get "quantitative score Value ".

Attack utilization score = 2x attack range X attack complexity X authentication times X user interaction formula (1) Quantitative score score = qualitative grade score + attack utilization score formula (2) Specifically, in the quantitative scoring process, the formula The value of "attack range", "attack complexity", "number of authentications" and "user interaction" in (1) can be described as a form similar to Table 5 - Table 9. The key elements covered in Table 5 are described below:

1) The scope of the attack indicates the location of the target host where the attack can exploit the vulnerability. The farther the attacker can attack the host, the greater the threat of the vulnerability. There are three possible values for the attack scope: local, adjacency, and remote. The value method is shown in Table 6.

2) Attack complexity is used to measure how easily an attacker wants to exploit the vulnerability. The lower the difficulty of the conditions required for an attack, the greater the threat of the vulnerability. There are three possible values for attack complexity: high, medium, and low. Values are shown in Table 7. Shown.

3) The number of attack authentications indicates the number of times an attacker wants to exploit a vulnerability to authenticate the target. The fewer times an attacker is required to authenticate, the greater the vulnerability. There are three possible values for the number of attack authentications: None, Single, and Multiple. The value is shown in Table 8.

4) The user interaction attribute indicates whether the attacker needs the participation of the victim user in the attack process to finally complete the use of the vulnerability. For example, the user can click on a certain webpage or file to trigger the vulnerability. There are two possible values for user interaction attributes: need and not, and the vulnerability of the user interaction is more threatening. The value method is shown in Table 9.

Table 5 vulnerability attack utilization attribute value table

Finally, the vulnerabilities are sequentially repaired based on the vulnerability score. A small program that is specifically addressed to a specific vulnerability or security issue that specifically addresses the vulnerability or security issue, often referred to as a patch (or patch). The vulnerability is fixed by downloading and installing a patch for the vulnerability. For vulnerabilities that have not been patched, you can enhance the security of your system by upgrading security tools such as anti-virus software and intrusion detection systems.

The positive effects of the present invention are:

The method of the present invention can make the vulnerability more detailed as much as possible based on the intuitive degree of vulnerability threat, so that the high-risk vulnerability can be repaired in time. The effects of the present invention are illustrated in Table 10 by two specific vulnerability instances CVE-2008-4250 and CVE-2010-0108, wherein the CVE-2008-4250 vulnerability is the chief culprit in the "sweeping wave" worm outbreak, which is the most Harmful vulnerability.

The vulnerability assessment method used in the China National Security Vulnerability Library (http://www.nipc.org.cn) is a typical qualitative rating method that gives these two vulnerabilities an "emergency" threat level; The vulnerability assessment method used in the library (http://nvd.nist.gov) is a typical method of quantitative scoring, CVSS, which gives the two vulnerabilities a "10.0" score. It is concluded that the China National Security Vulnerability Database and the vulnerability assessment methods used in the US National Vulnerability Database cannot distinguish the difference in threat levels between the two vulnerabilities. The method of the present invention respectively assigns the two vulnerabilities "high / 10.00" and "high / 9.80", wherein "high" is a qualitative rating result, "10.00" and " 9.80" are quantitative score results, that is, intuitive to ordinary users It is recognized that the vulnerability has a "high" threat level, and it can distinguish the two vulnerabilities more clearly. CVE-2008-4250 is more threatening than CVE-2010-0108, thus helping network administrators to do An accurate repair order is judged to fix the vulnerability.

With the increasing number of vulnerabilities and the emergence of various vulnerability-based attacks, the hierarchical vulnerability assessment method combined with qualitative rating and quantitative scoring determines vulnerability fixes, which can be used for both domestic and international qualitative and quantitative vulnerability threat assessment methods. "The situation opens up a new situation, making high-risk loopholes repaired in time. Therefore, the present invention is of great significance for safeguarding the network security of our country.

Table 10 Comparison of the method of the present invention with existing methods

DRAWINGS

Figure 1 is an architectural diagram of the present invention;

2 is a flow chart of a specific implementation of the qualitative rating portion of the present invention;

Figure 3 is a flow chart showing the specific implementation of the quantitative scoring portion of the present invention. detailed description

The present invention comprises two parts, a qualitative rating and a quantitative rating. The two parts of the present invention are further described in detail below with reference to the accompanying drawings in conjunction with Tables 1 - 9 and CVE numbered CVE-2008-4250. The vulnerability numbered CVE-2008-4250 describes a buffer overflow vulnerability in a Windows system when a server service receives a specially crafted RPC request. A remote attacker could exploit this vulnerability to execute arbitrary programs on the target.

As shown in FIG. 2, the specific implementation process of the vulnerability vulnerability rating method of the present invention for the CVE-2008-4250 vulnerability includes the following steps:

Step 201: Analyze the impact of the vulnerability on confidentiality. Because the vulnerability can cause an attacker to execute arbitrary programs on the target, an attacker can use the vulnerability to read comprehensive data about the system. According to Table 2, the "confidential impact" of the vulnerability is considered "complete".

Step 202: Analyze the impact of the vulnerability on integrity. Also because the vulnerability can cause an attacker to execute arbitrary programs on the target, an attacker can exploit the vulnerability to modify any file on the target system. According to Table 3, the "integrity impact" of the vulnerability is considered "complete".

Step 203: Analyze the impact of the vulnerability on availability. Similarly, because the vulnerability can cause an attacker to execute any program on the target, the attacker can completely stop the target service by exploiting the vulnerability, thereby making the resource completely useless. According to Table 4, the vulnerability's "availability impact" value is "complete".

Step 204: Determine a qualitative level score. Through the results of steps 201, 202 and 203, it is concluded that the value of the combination of confidentiality, integrity and availability is: "complete-complete-complete". According to Table 1, the situation is in accordance with the first value of Table 1, so the "Qualitative Rating Score" of CVE-2008-4250 is "9".

Step 205: Determine a qualitative rating level. According to the result of step 204, the "qualitative level score" of CVE-2008-4250 is obtained as "9". Look up Table 1 again to get the "Qualitative Rating Level" of CVE-2008-4250 as "High". The qualitative rating process for CVE-2008-4250 ends. As shown in FIG. 3, the specific implementation process of the vulnerability quantitative scoring method of the present invention for the CVE-2008-4250 vulnerability includes the following steps:

Step 301: Determine the attack range. The "remote" attacker mentioned in the CVE-2008-4250 description may exploit this vulnerability to execute arbitrary programs on the target. Therefore, according to Table 6, the "attack range" of the vulnerability is "remote". By querying Table 5, you can get the value of "remote" as 1.0.

Step 302: Determine the attack complexity. The vulnerability mentioned in the description of CVE-2008-4250 is a buffer overflow. For the buffer overflow vulnerability, once the target system is determined, the attacker may arbitrarily launch an attack without any special access conditions and specialization issues. . Therefore, according to Table 7, the "attack complexity" of the vulnerability is taken as "low". By querying Table 5, the value of "low" is 0.71.

Step 303: Determine the number of attack authentications. CVE-2008-4250 is a vulnerability in the Windows system server service, and the server does not require user authentication when it is used, so the attacker does not need to be authenticated during the attack. According to Table 8, the "number of authentications" for this vulnerability is "none". By querying Table 5, the value of "None" is 0.704. Step 304: Determine user interaction. CVE-2008-4250 is a buffer overflow vulnerability in Windows Server Services, so an attacker can complete the attack process without user interaction during the attack. According to Table 9, the "user interaction" of the vulnerability is "not required". The value of "not required" is 1.0 by querying Table 5.

Step 305: Calculate the attack utilization score. According to the results of steps 301, 302, 303, and 304, the value of "attack utilization score" obtained according to formula (1) is 2*1.0*0.71 *0.704*1.0=1.00 (accurate to 2 digits after the decimal point).

Step 306: Calculate the quantitative score score. Based on the results of steps 204 and 305: CVE-2008-4250 has a "Qualitative Score Score" of "9" and an "Attack Use Score" of 1.00. The final "Quantitative Score Score" is obtained according to formula (2). At 10.00, the process of quantitative scoring for CVE-2008-4250 ended.

Finally, because the vulnerability score is 10, identify it as the most dangerous vulnerability and fix it first. Microsoft provided the patch with the number MS08-067 for the vulnerability, and the system administrator downloaded and automatically installed the patch to fix the vulnerability. The download address for the patch is: http : //www. microsoft, com/technet/ security/Bul letin/ms08-067. mspx.

Claims

Claim

A vulnerability repair method based on a hierarchical vulnerability assessment, the steps of which are:

1) extracting several information security attributes of the target system, a vulnerability to be tested, and the attack conditions required for the exploit process;

2) Attacking the vulnerability to be tested, recording the value of the attack condition required during the exploitation of the vulnerability to be tested, and the degree of loss to the selected information security attribute after the vulnerability is successfully exploited;

3) obtaining a qualitative grade score of the vulnerability to be tested according to the degree of loss caused by the recorded security attribute of the selected information;

4) According to the value of the required attack condition recorded, the attack utilization score of the vulnerability to be tested is obtained;

5) obtaining a quantitative score value of the vulnerability to be tested according to the attack utilization score and the qualitative rank score;

6) Determine the processing order of the vulnerability based on the quantitative score of the vulnerability to be tested, and fix the vulnerability.

2. The method according to claim 1, wherein the information security attribute comprises: confidentiality, integrity, availability; wherein: the value of the degree of confidentiality loss is: complete, partial, none, loss of integrity The values of the degree are: full, partial, none, and the degree of loss of availability is: full, partial, none.

3. The method according to claim 1 or 2, wherein the qualitative level score is divided into a plurality of intervals, each value interval corresponding to a certain level; and then the test is returned according to the qualitative level score The qualitative level corresponding to the vulnerability.

4. The method of claim 3 wherein the qualitative level comprises a high level, an intermediate level, and a low level.

The method of claim 1 or 2, wherein the required attack conditions include: an attack scope, an attack complexity, an attack authentication number, and a user interaction; wherein the attributes of the attack scope include: local, adjacency Remote, and each attribute corresponds to a value; the attributes of the attack complexity include: high, medium, and low, and each attribute corresponds to a value; the attributes of the attack authentication number include: none, single, multiple, and Each attribute corresponds to a value; the attributes of the user interaction include: required, not required, and each attribute corresponds to a value.

6. The method according to claim 5, wherein the attribute value ranges from 0.000 to 1.000; and the qualitative level score ranges from 0 to 9.

The method according to claim 6, wherein the attributes of the attack range are: 0.395, 0.646, 1.000; and the attributes of the attack complexity are: 0.350, 0.610, 0.710; The attributes of the attack authentication times are 0.704, 0.560, and 0.450. The attributes of the user interaction are 0.800/1.000.

8. The method according to claim 7, wherein the formula for obtaining the attack utilization score of the vulnerability to be tested is: attack utilization score = 2x attack range X attack complexity X authentication times X user interaction.

9. The method according to claim 8, wherein the formula for obtaining the quantitative score of the vulnerability to be tested is: a quantitative score score = a qualitative grade score + an attack utilization score.

10. The method of claim 5 wherein the adjacency comprises: Bluetooth, local Ethernet.