CN115203706A

CN115203706A - Vulnerability risk analysis method based on digital cloud and server

Info

Publication number: CN115203706A
Application number: CN202210860839.7A
Authority: CN
Inventors: 莫晓东
Original assignee: Individual
Current assignee: Individual
Priority date: 2021-12-21
Filing date: 2021-12-21
Publication date: 2022-10-18
Also published as: CN114168973A

Abstract

The invention relates to the technical field of cloud computing, in particular to a vulnerability risk analysis method and a server based on a digital cloud, wherein if a global security vulnerability analysis result represents that an application program to be subjected to security vulnerability analysis has a first vulnerability risk, prompt information is sent to an application terminal corresponding to the application program; if the global security vulnerability analysis result represents that the application program to be subjected to security vulnerability analysis has a second vulnerability risk, generating a repair patch aiming at the second vulnerability risk and issuing the repair patch to the application terminal so as to enable the application terminal to install the repair patch; the risk level of the first vulnerability risk is located in a first grade interval, the risk level of the second vulnerability risk is equal to the risk level located in a second grade interval, and the grade of the first grade interval is lower than that of the second grade interval.

Description

Vulnerability risk analysis method based on digital cloud and server

The invention relates to a divisional application with the application number of 'CN202111570325. X', the application date of '12/21/2021', the invention name of 'an APP security vulnerability analysis method and a server based on cloud computing'.

Technical Field

The embodiment of the invention relates to the technical field of cloud computing, in particular to a vulnerability risk analysis method and a server based on a digital cloud.

Background

Nowadays, with the rapid development of the mobile internet, applications (APPs) come into existence, and the potential safety hazard of the APPs also comes to the end, and in order to ensure the safety of the APPs, it is necessary to perform security hole analysis on the APPs. Common security vulnerability analysis includes program confidentiality detection, component security detection, data security detection, business security detection, and the like. After long-term research and analysis of the APP security processing technology by the inventor, it is found that, because a plurality of APP service items are generated in different program running states during current APP running, and many potential security vulnerability risks may exist in the items, it is difficult for the conventional security vulnerability analysis method to comprehensively analyze the APP for security vulnerabilities.

Disclosure of Invention

In view of this, the embodiment of the invention provides a vulnerability risk analysis method and a server based on a digital cloud.

In a first aspect, an embodiment of the present invention provides a vulnerability risk analysis method based on a digital cloud, which is applied to a cloud computing server, and the method at least includes the following steps: determining a to-be-processed item distribution label of a plurality of interactive service items of an application program to be subjected to security vulnerability analysis in a target intrusion attack simulation scene; determining interactive service item risk descriptions obtained by mapping the interactive service items in a plurality of groups of target user interaction information respectively through the to-be-processed item distribution labels; the multiple groups of target user interaction information are target user interaction information obtained by detecting application programs to be subjected to security vulnerability analysis in a running state of a plurality of programs; and determining a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis through the upstream and downstream influence records of the pre-generated service items corresponding to the application program to be subjected to security vulnerability analysis and the interactive service item risk descriptions of the target user interaction information corresponding to the running states of the plurality of programs of the plurality of interactive service items.

By means of the design, on the premise that a to-be-processed item distribution label of a plurality of interactive service items of an application program to be subjected to security vulnerability analysis in a target intrusion attack simulation scene is determined, interactive service item risk descriptions obtained by mapping the plurality of interactive service items in a plurality of groups of target user interaction information respectively can be determined based on the to-be-processed item distribution label, and finally, global security vulnerability analysis results of the application program to be subjected to security vulnerability analysis are determined based on pre-generated service item upstream and downstream influence records corresponding to the application program to be subjected to security vulnerability analysis and the interactive service item risk descriptions of the plurality of interactive service items in the target user interaction information corresponding to a plurality of program running states respectively. Therefore, the invention can determine the upstream and downstream influence conditions of the plurality of interactive service items in different program running states through the interactive service item risk description of the plurality of interactive service items in different program running states, can be favorable for more comprehensively and accurately determining the interactive service item risk description based on the upstream and downstream influence conditions, and can indicate the upstream and downstream influence conditions among the interactive service items through the service item upstream and downstream influence records generated in advance, so that the determined interactive service item risk description is more comprehensive and accurate, and the accuracy and the reliability of the global security vulnerability analysis result can be further improved.

For an independently implementable technical solution, the determining, through the to-be-processed item distribution tag, interactive service item risk descriptions obtained by mapping the plurality of interactive service items in a plurality of sets of target user interaction information respectively includes: determining local mapping unit data of the plurality of interactive service items in the plurality of groups of target user interaction information respectively through the to-be-processed item distribution labels, and mining user interaction content expressions corresponding to the plurality of groups of target user interaction information respectively; mining interactive service item risk description bound with the interactive service item from user interactive content expressions respectively corresponding to the multiple groups of target user interactive information through local mapping unit data of the interactive service item in the multiple groups of target user interactive information; and determining the mined interactive service item risk description bound with the interactive service item as the interactive service item risk description mapped in the multiple groups of target user interaction information.

By the design, the interactive service item risk description bound with the interactive service item can be determined based on the association factors between the local mapping unit data of the interactive service item in the multiple groups of target user interaction information and the user interaction content expression, and the interactive service item risk description bound with the interactive service item can be further efficiently determined.

For an independently implementable solution, the local mapping unit data includes a user interaction information track feature of the local mapping unit; the mining of the interactive service item risk description bound with the interactive service item from the user interaction content expressions respectively corresponding to the multiple groups of target user interaction information through the local mapping unit data of the interactive service item in the multiple groups of target user interaction information comprises: for each group of target user interaction information in the multiple groups of target user interaction information, mining user interaction content expression corresponding to the user interaction information track characteristic from user interaction content expression corresponding to the target user interaction information through the user interaction information track characteristic of the local mapping unit of the interaction service items in the multiple groups of target user interaction information; and determining the user interaction content expression corresponding to the mined user interaction information track characteristics as the interactive service item risk description bound with the interactive service items.

For an independently implementable technical solution, determining a global security vulnerability analysis result of an application program to be subjected to security vulnerability analysis by a pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to security vulnerability analysis and an interactive service item risk description of target user interaction information corresponding to a plurality of program running states of a plurality of interactive service items respectively, includes: for each interactive service item in the interactive service items, determining optimized interactive service item risk description of the interactive service item in different program running states through interactive service item risk description of the interactive service item in different program running states and interactive service item risk description of the remaining interactive service items which are in contact with the interactive service item; and determining a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis according to the optimized interactive service item risk description corresponding to the interactive service items respectively and the pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to the security vulnerability analysis.

If the design is designed, the interactive service item risk description of the interactive service item can be optimized through the interactive service item risk description of each interactive service item in different program running states and the interactive service item risk description of the remaining interactive service items which are in contact with the interactive service item, the optimized interactive service item risk description covers the descriptions of the remaining interactive service items in a group of program running states on a certain level and also covers the descriptions of the interactive service items among different program running states, so that the description of the interactive service items is closer to accuracy, and the determined global security vulnerability analysis result is more comprehensive and accurate.

For an independently implementable technical solution, determining an optimized interactive service item risk description of the interactive service item in different program running states by using the interactive service item risk description of the interactive service item in different program running states and the interactive service item risk description of the remaining interactive service items associated with the interactive service item includes: taking each program running state in the program running states as a target program running state, and sequentially implementing the following steps: performing first optimization on the interactive service item risk description of the interactive service item in different program running states through the interactive service item risk description of the interactive service item in different program running states and first upstream and downstream influence conditions among local mapping units of the interactive service item in different program running states to obtain first optimized interactive service item risk description; performing second optimization on the interactive service item risk description of the interactive service item in the target program running state through the interactive service item risk description of the interactive service item in the target program running state and the interactive service item risk description of the remaining interactive service item which is matched with the interactive service item in the target program running state and has a second upstream and downstream influence condition with the interactive service item, so as to obtain second optimized interactive service item risk description; and determining the optimized interactive service item risk description of the interactive service item in the running state of the target program according to the first optimized interactive service item risk description and the second optimized interactive service item risk description.

For an independently implementable technical solution, determining a global security vulnerability analysis result of an application program to be subjected to security vulnerability analysis by a pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to security vulnerability analysis and an interactive service item risk description of target user interaction information corresponding to a plurality of program running states of a plurality of interactive service items respectively, includes: for each interactive service item in the interactive service items, splicing the interactive service item risk descriptions of the interactive service items in different program running states to obtain service item splicing risk descriptions corresponding to the interactive service items; and determining a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis according to the pre-generated service item upstream and downstream influence records corresponding to the application program to be subjected to security vulnerability analysis and the service item splicing risk descriptions corresponding to the interactive service items respectively.

By the design, through the splicing processing of the interactive service item risk description under different program running states, the determined service item splicing risk description can be compatible with the descriptions of the different program running states, and the accuracy of the global security vulnerability analysis result can be improved.

For an independently implementable solution, the interactive service item risk description comprises several layers of interactive service item description values; the step of splicing the interactive service item risk descriptions of the interactive service items in different program running states to obtain the service item splicing risk description corresponding to the interactive service items comprises the following steps: for each of the multiple layers, determining multiple interactive service item description values corresponding to the layer in different program running states of the interactive service item, and determining a spliced interactive service item description value corresponding to the layer by combining the multiple interactive service item description values; and determining service item splicing risk description corresponding to the interactive service items according to the spliced interactive service item description values corresponding to the plurality of layers respectively.

For an independently implementable technical solution, the determining, by combining the obtained interactive service item description values, a spliced interactive service item description value corresponding to the layer includes any one of: selecting the interactive service item description value with the highest quantization value from the plurality of interactive service item description values as the spliced interactive service item description value corresponding to the layer; taking the quantitative centralized trend of the interactive service item description values as the spliced interactive service item description values corresponding to the layers; and determining importance coefficients corresponding to the interactive service item description values respectively, and determining spliced interactive service item description values corresponding to the layers according to the overall quantitative calculation result between the interactive service item description values and the importance coefficients corresponding to the interactive service item description values respectively.

For an independently implementable technical solution, determining a global security vulnerability analysis result of an application program to be subjected to security vulnerability analysis through a pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to security vulnerability analysis and a service item splicing risk description corresponding to each of a plurality of interactive service items, includes: optimizing service item splicing risk descriptions corresponding to the interactive service items respectively through a third upstream and downstream influence condition between the interactive service items, wherein the third upstream and downstream influence condition is included in a pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to the security vulnerability analysis, so as to obtain optimized service item splicing risk descriptions; and determining a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis according to the optimized service item splicing risk description.

By the design, the service item splicing risk descriptions corresponding to the interactive service items can be optimized based on the third upstream and downstream influence conditions between the interactive service items covered by the pre-generated service item upstream and downstream influence records, so that the optimized service item splicing risk descriptions are obtained.

For an independently implementable technical solution, each of the interactive service items of the application program to be subjected to the security vulnerability analysis is used as a first interactive service item, and each of the interactive service items having the third upstream and downstream impact condition is used as a second interactive service item; the second interactive service item is a visual application program functional item; the first interactive service transaction includes one or both of a visual application function item and a visual application annotation item.

For an independently implementable technical solution, the determining, by the optimized service item splicing risk description, a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis includes: transmitting the optimized service item splicing risk description into an AI machine learning model which is debugged in advance to obtain security vulnerability analysis loss; the security vulnerability analysis loss is used for reflecting a comparison result between a current security vulnerability analysis index of the application program to be subjected to the security vulnerability analysis and a security vulnerability analysis index to be processed; determining a plurality of interactive service items of the application program to be subjected to the security vulnerability analysis to be an updated item distribution label in the target intrusion attack simulation scene through the security vulnerability analysis loss and the to-be-processed item distribution label in the application program to be subjected to the security vulnerability analysis, and determining a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis through the updated item distribution label.

For an independently implementable technical solution, the determining a to-be-processed item distribution tag of a plurality of interactive service items of an application to be subjected to security vulnerability analysis in a target intrusion attack simulation scenario includes any one of: determining a plurality of groups of target user interaction information obtained by detecting the application program to be subjected to the security vulnerability analysis in a plurality of program running states, and determining a to-be-processed item distribution label of a plurality of interaction service items of the application program to be subjected to the security vulnerability analysis in the target intrusion attack simulation scene according to the plurality of groups of target user interaction information; and determining item positioning feedback corresponding to a plurality of groups of positioning requests issued by the service item positioning thread respectively, and determining a to-be-processed item distribution label of a plurality of interactive service items of the application program to be subjected to security vulnerability analysis in the target intrusion attack simulation scene through the item positioning feedback. For an independently implementable technical solution, each set of target user interaction information in the multiple sets of target user interaction information determined is used as first target user interaction information, and each set of target user interaction information in the multiple sets of target user interaction information used for the interactive service item mapping is used as second target user interaction information; at least part of the user interaction information in the first target user interaction information is consistent with at least part of the user interaction information in the second target user interaction information; or the first target user interaction information and the second target user interaction information do not have the same user interaction information.

In a second aspect, an embodiment of the present invention further provides a cloud computing server, including a processor, a network module, and a memory; the processor and the memory communicate through the network module, and the processor reads the computer program from the memory and operates to perform the above-described method.

In the following description, other features will be set forth in part. These features will be in part apparent to those of ordinary skill in the art upon examination of the following and the accompanying drawings or may be learned by production or use. The features of the present application may be realized and attained by practice or use of various aspects of the methodologies, instrumentalities and combinations particularly pointed out in the detailed examples that follow.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained according to the drawings without inventive efforts.

Fig. 1 is a flowchart of a vulnerability risk analysis method based on a digital cloud according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. The components of embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a wide variety of different configurations.

Thus, the following detailed description of the embodiments of the present invention, presented in the figures, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined or explained in subsequent figures.

The cloud computing server 10 in the embodiment of the present invention may be a server having data storage, transmission, and processing functions, and the cloud computing server 10 includes: memory 1100, processor 1200, network module 1300, and digital cloud-based vulnerability risk analysis apparatus 20.

The memory 1100, the processor 1200 and the network module 1300 are electrically connected directly or indirectly to enable data transmission or interaction. For example, the components may be electrically connected to each other via one or more communication buses or signal lines. The memory 1100 stores a digital cloud-based vulnerability risk analysis apparatus 20, the digital cloud-based vulnerability risk analysis apparatus 20 includes at least one software functional module which can be stored in the memory 1100 in a form of software or firmware (firmware), and the processor 1200 executes various functional applications and data processing by running software programs and modules stored in the memory 1100, such as the digital cloud-based vulnerability risk analysis apparatus 20 in the embodiment of the present invention, so as to implement the digital cloud-based vulnerability risk analysis method in the embodiment of the present invention.

The Memory 1100 may be, but is not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Read-Only Memory (EPROM), an electrically Erasable Read-Only Memory (EEPROM), and the like. The memory 1100 is used for storing programs, and the processor 1200 executes the programs after receiving execution instructions.

The processor 1200 may be an integrated circuit chip having data processing capabilities. The Processor 1200 may be a general-purpose Processor including a Central Processing Unit (CPU), a Network Processor (NP), and the like. The various methods, steps and logic blocks disclosed in embodiments of the present invention may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The network module 1300 is configured to establish a communication connection between the cloud computing server 10 and another communication terminal device through a network, so as to implement transceiving operation of network signals and data. The network signal may include a wireless signal or a wired signal.

An embodiment of the present invention further provides a computer storage medium, where a computer program is stored, and the computer program implements the foregoing method when running.

Fig. 1 shows a flowchart of a vulnerability risk analysis method based on a digital cloud according to an embodiment of the present invention. The method steps defined by the flow related to the method are applied to the cloud computing server 10 and can be implemented by the processor 1200, and the method specifically includes the following technical solutions recorded in steps 101 to 103.

Step 101, determining a to-be-processed item distribution label of a plurality of interactive service items of an application program to be subjected to security vulnerability analysis in a target intrusion attack simulation scene.

For example, the applications to be analyzed for security vulnerabilities may be different types of APPs, such as a hand-trip APP, a stock APP, an office APP, and so on. The interactive service event can be a service event generated after a user enables the APP to perform a series of behavior operations through the terminal. The target intrusion attack simulation scenario may be a simulated network environment set in advance for risk analysis. The transaction tag distribution can be understood as location information or distribution information of the interactive service transaction.

102, determining interactive service item risk descriptions obtained by mapping a plurality of interactive service items in a plurality of groups of target user interactive information respectively based on the to-be-processed item distribution labels; the multi-group target user interaction information is obtained by detecting the application program to be subjected to security vulnerability analysis in the running state of the programs.

For example, the interactive service item risk description may be understood as feature information of the interactive service item, the user interaction information may be understood as a user log, and the program running state may include multiple states, such as a double-end interaction running state, a multi-end interaction running state, an authority authentication start running state, and the like.

103, determining a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis based on the pre-generated service item upstream and downstream influence records corresponding to the application program to be subjected to the security vulnerability analysis and the interactive service item risk description of the target user interaction information corresponding to the running states of the plurality of interactive service items respectively.

For example, the service item upstream and downstream impact records are used to characterize the association between different interactive service items or upstream and downstream impacts, such as what impact the implementation of interactive service item A will have on the implementation of subsequent interactive service item B. In other words, the service item upstream and downstream influence records can enrich the relation among different interactive service items, thereby providing a global security vulnerability analysis basis.

It can be understood that, in order to improve the technical problems of the background art, the embodiment of the present invention provides a technical solution for optimizing global security vulnerability analysis indexes by combining pre-generated service item upstream and downstream influence records and interactive service item risk descriptions of a plurality of interactive service items in different program running states, so as to improve the accuracy and the reliability of the global security vulnerability analysis indexes, and further, the method and the system can be relatively completely applied to various application scenarios.

In the embodiment of the present invention, the to-be-processed item distribution label may be understood as a basic item distribution label for a plurality of interactive service items (which may be understood as a plurality of interactive service key points) of the same application to be subjected to the security vulnerability analysis. In practical implementation, the to-be-processed item distribution label may be obtained by performing information conversion and AI machine learning model analysis based on a plurality of sets of target user interaction information, may also be obtained by performing item positioning feedback calculation based on a service item positioning thread of a collaborative service, and may also be determined in other ways, which is not limited in this embodiment of the present invention.

It can be understood that, on the premise of determining the to-be-processed item distribution tag, the selected target user interaction information and the target user interaction information for subsequently performing interactive service item mapping may be user interaction information obtained by detecting the same application program to be subjected to security vulnerability analysis. In actual implementation, the user interaction information may be completely consistent user interaction information, may also be partially identical user interaction information, and may also be completely inconsistent user interaction information. Regarding each group of target user interaction information selected by the determined to-be-processed item distribution label as first target user interaction information and each group of target user interaction information used for interactive service item mapping as second target user interaction information, at least part of user interaction information in the first target user interaction information is consistent with at least part of user interaction information in the second target user interaction information; or, the first target user interaction information and the second target user interaction information do not have the same user interaction information, and it can be understood that although the first target user interaction information and the second target user interaction information are both user interaction information detected for an application program to be subjected to security vulnerability analysis at a certain security vulnerability analysis index, when the application program to be subjected to security vulnerability analysis is detected, the running states of the adopted detection programs are different.

In the embodiment of the present invention, the interaction service items of the application program to be subjected to security vulnerability analysis may correspond to interaction service content of the application program to be subjected to security vulnerability analysis, and taking a visual application program as the application program to be subjected to security vulnerability analysis as an example, the interaction service items may be understood as visual application program function items corresponding to visual application program functions, and may also be understood as visual application program annotation items (which may be understood as application program mark points) capable of identifying the visual application program.

It can be understood that, on the premise that the to-be-processed item distribution label is determined, the vulnerability risk analysis method based on the digital cloud provided by the embodiment of the invention can determine the local mapping unit data of a plurality of interactive service items in a plurality of groups of target user interaction information respectively, and determine the interactive service item risk description of the plurality of interactive service items in different program running states based on the local mapping unit data.

In the embodiment of the present invention, the multiple sets of target user interaction information for performing local mapping (which may be understood as two-dimensional mapping) may be obtained by detecting the same application to be subjected to security vulnerability analysis in a plurality of program running states, in other words, one program running state may correspond to one set of target user interaction information. In a relevant scene, the multiple groups of target user interaction information can be obtained by simultaneously detecting the same application program to be subjected to security vulnerability analysis by a plurality of detection modules arranged on the intelligent terminal, and the detection modules can be selected according to different user implementation requirements.

In the embodiment of the present invention, the data (two-dimensional mapping point information) related to the local mapping unit may be determined based on a migration relationship (transformation condition) between the transaction distribution tag list where the to-be-processed transaction distribution tag is located and the local tag list where the target user interaction information is located, in other words, the interactive service transaction may be mapped onto the target user interaction information according to the migration relationship, so as to determine information such as a user interaction information track of the local mapping unit of the interactive service transaction on the target user interaction information.

In the embodiment of the invention, based on the local mapping unit data of the interactive service items in the multiple groups of target user interaction information, the interactive service item risk description of the interactive service items in different program running states can be determined. In practical implementation, the determined interactive service item risk description can be understood as a risk description for splicing different program running states, and because it is considered that for the same application program to be subjected to security vulnerability analysis, certain upstream and downstream influence conditions (which can be understood as upstream and downstream relations) exist between corresponding interactive service items in different program running states, optimization of related interactive service item contents can be realized. In addition, under the same program running state, certain upstream and downstream influence conditions exist between corresponding interactive service items, and optimization of related interactive service item contents can be realized, so that the determined interactive service item risk description is closer to a real security vulnerability analysis index of an application program to be subjected to security vulnerability analysis.

In the embodiment of the invention, the pre-generated service item upstream and downstream influence records can correspond to an application program with certain security vulnerability analysis indexes to be subjected to security vulnerability analysis, and the interaction service item risk description of a plurality of interaction service items under different program running states can be limited by combining the service item upstream and downstream influence records, so that the determined global security vulnerability analysis indexes are more comprehensive and accurate.

Further, the global security vulnerability analysis result (multidimensional analysis result) determined based on the upstream and downstream influence conditions of the interactive service items and the interactive service item risk description can be understood as being obtained by combining updated item distribution labels obtained by updating the to-be-processed item distribution label of each interactive service item in a plurality of interactive service items of the application program to be subjected to security vulnerability analysis, in other words, the updated item distribution labels of the plurality of interactive service items can represent the global security vulnerability analysis index of the application program to be subjected to security vulnerability analysis.

In practical implementation, the determination of the interactive service item risk description of the interactive service item is considered to play a main role in optimizing the global security vulnerability analysis index, so that the process of determining the interactive service item risk description can be explained in detail.

For a solution that can be implemented independently, the process of determining the interactive service item risk description may exemplarily include the following steps one-three.

The method comprises the steps of firstly, determining local mapping unit data of a plurality of interactive service items in a plurality of groups of target user interactive information respectively based on a to-be-processed item distribution label, and mining user interactive content expressions corresponding to the plurality of groups of target user interactive information respectively.

And step two, mining the interactive service item risk description bound with the interactive service item from the user interactive content expressions respectively corresponding to the interactive information of the multiple groups of target users based on the local mapping unit data of the interactive service item in the interactive information of the multiple groups of target users.

And step three, determining the mined interactive service item risk description bound with the interactive service item as the interactive service item risk description obtained by mapping in a plurality of groups of target user interaction information.

In the embodiment of the present invention, in order to mine the interactive service item risk description bound to the interactive service item, for each group of target user interaction information, based on the user interaction information track characteristics of the local mapping unit of the interactive service item in the multiple groups of target user interaction information, a user interaction content expression corresponding to the user interaction information track characteristics is mined from the user interaction content expression corresponding to the target user interaction information, and the mined user interaction content expression is used as the interactive service item risk description bound to the interactive service item.

In actual implementation, the user interaction content expression corresponding to the target user interaction information may be obtained by processing based on the user interaction information, may also be obtained by mining a network based on a debugged description, and may also be determined by other methods capable of mining various information characterizing an application program to be subjected to security vulnerability analysis, a scene where the application program to be subjected to security vulnerability analysis is located, and the like.

Furthermore, the global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis is determined more comprehensively and accurately. The interactive service item risk description of the interactive service item may be optimized based on the upstream and downstream impact conditions of the interactive service item, and then a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis may be determined based on the optimized interactive service item risk description and a pre-generated upstream and downstream impact record of the service item corresponding to the application program to be subjected to the security vulnerability analysis, which may be exemplarily described in the following step 103A1 and step 103 A2.

Step 103A1, for each interactive service item in the plurality of interactive service items, determining an optimized interactive service item risk description of the interactive service item in different program operation states based on the interactive service item risk descriptions of the interactive service item in different program operation states and the interactive service item risk descriptions of the remaining interactive service items linked to the interactive service item.

103A2, determining a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis through optimized interactive service item risk description corresponding to the interactive service items respectively and a pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to the security vulnerability analysis.

In the embodiment of the present invention, for each interactive service item, the remaining interactive service items associated with the interactive service item may be understood as interactive service items having an upstream and downstream influence on the interactive service item. The upstream and downstream influence conditions mainly correspond to the upstream and downstream influence conditions between the interactive service items in the same program running state, and for the interactive service item risk description of the interactive service items in different program running states (degree running dimension, degree running level), the upstream and downstream influence conditions between the local mapping units determined for the same interactive service item in different program running states can be determined. Taking each program running state in the program running states as a target program running state, optimization of the interactive service item risk description of the interactive service item in each program running state can be performed through the following steps, and the steps 103a11 and 103a12 can be included for illustration.

103A11, performing first optimization on the interactive service item risk description of the interactive service item in different program running states based on the interactive service item risk description of the interactive service item in different program running states and first upstream and downstream influence conditions between the local mapping units of the interactive service item in different program running states to obtain first optimized interactive service item risk description; and performing second optimization on the interactive service item risk description of the interactive service item in the target program running state based on the interactive service item risk description of the interactive service item in the target program running state and the interactive service item risk description of the remaining interactive service items which are matched with the interactive service item in the target program running state and have a second upstream and downstream influence condition with the interactive service item, so as to obtain the second optimized interactive service item risk description.

Step 103a12, determining an optimized interactive service item risk description of the interactive service item in the target program running state based on the first optimized interactive service item risk description and the second optimized interactive service item risk description.

In the embodiment of the present invention, the first upstream and downstream influence conditions of the interactive service items between the local mapping units in different program running states are determined in advance, and based on the first upstream and downstream influence conditions, the interactive service item risk description of the interactive service item in one program running state may be optimized based on the interactive service item risk description of the interactive service item in each program running state, which may be understood that the interactive service item risk description after the first optimization concatenates the interactive service item features of the same interactive service item in other program running states.

In addition, the interactive service item risk description of the interactive service item can be optimized based on the interactive service item risk description of the remaining interactive service items which are both adapted to the running state of the target program and have a second upstream and downstream influence condition with the interactive service item. The second upstream and downstream impact condition may also be generated in advance, such that the determined second optimized interactive service item risk describes the interactive service item characteristics of other interactive service items spliced to the same program running state. Therefore, the determined interactive service item risk description under any program running state can be more comprehensive and accurate by combining the first optimized interactive service item risk description and the second optimized interactive service item risk description.

It can be understood that, in the process of optimizing the interactive service item risk description by combining the interactive service item risk description after the first optimization and the interactive service item risk description after the second optimization, the first optimization may be performed first, and then the second optimization may be performed on the premise of the first optimization; or the second optimization can be carried out firstly, and then the first optimization is carried out on the premise of the second optimization; the first optimization and the second optimization can be performed synchronously, and then the results of the first optimization and the second optimization are spliced to realize the optimization of the interactive service item risk description, which is not limited herein.

In the actual implementation process, the optimization of the interactive service item risk description can be realized by using an AI machine learning model. Before the description optimization, a visual description may be generated based on the first upstream and downstream influence condition, the second upstream and downstream influence condition, and the interactive service item risk description of the interactive service item is continuously optimized by performing a running average process on the visual description.

According to the vulnerability risk analysis method based on the digital cloud, provided by the embodiment of the invention, the interactive service item risk description can be spliced (fused) firstly, and then the global vulnerability analysis result of the application program to be subjected to the security vulnerability analysis is determined by combining the pre-generated upstream and downstream influence records of the service item, so that the accuracy of the global vulnerability analysis result is improved. Therefore, the global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis is determined according to the interaction service item risk description of the interaction service item of the target user interaction information corresponding to the running states of the plurality of programs, and the records of the upstream and downstream influences of the service item generated in advance corresponding to the application program to be subjected to security vulnerability analysis, which are described in step 103, and may be specifically described by the following contents described in step 103B1 and step 103B 2.

Step 103B1, for each interactive service item in the plurality of interactive service items, splicing the interactive service item risk descriptions of the interactive service items in different program running states to obtain a service item splicing risk description corresponding to the interactive service item.

103B2, determining a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis based on the pre-generated service item upstream and downstream influence records corresponding to the application program to be subjected to the security vulnerability analysis and the service item splicing risk descriptions corresponding to the interactive service items respectively.

In the embodiment of the invention, the interactive service item risk description under different program running states can be spliced for the interactive service item, and the service item splicing risk description obtained in this way can be compatible with the security vulnerability analysis indexes of the application program to be subjected to security vulnerability analysis under each program running state on a certain level.

For an independently implementable solution, the interactive service item risk description comprises several layers of interactive service item description values. Based on this, the step 103B1 may splice the interactive service item risk descriptions of the interactive service items in different program running states to obtain the service item splicing risk description corresponding to the interactive service item, which may exemplarily include the following technical solutions recorded in the steps 103B11 and 103B 12.

Step 103B11, for each of the multiple layers, determining multiple interactive service item description values corresponding to the layer in different program running states of the interactive service item, and determining a spliced interactive service item description value corresponding to the layer by combining the obtained multiple interactive service item description values.

And 103B12, determining service item splicing risk description corresponding to the interactive service items based on the spliced interactive service item description values respectively corresponding to the plurality of layers.

In the embodiment of the present invention, for each layer of the interactive service item risk description, the interactive service item description value with the highest quantization value may be selected from a plurality of interactive service item description values corresponding to the layer in different program running states, and determined as the spliced interactive service item description value corresponding to the layer, so as to reflect the description of each layer as much as possible. In the actual implementation process, the importance coefficient may be determined manually or may be determined by a neural network model that is debugged in advance, which is not limited herein.

In the process of confirming the global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis, the embodiment of the invention can optimize the service item splicing risk description based on the pre-generated upstream and downstream influence records of the service item corresponding to the application program to be subjected to security vulnerability analysis, thereby further improving the accuracy of the determined security vulnerability analysis index. Therefore, the step 103B2 may determine a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis through the pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to security vulnerability analysis and the service item splicing risk description corresponding to each of the plurality of interactive service items, which may exemplarily include the following contents recorded in the steps 103B21 and 103B 22.

Step 103B21, based on a third upstream and downstream influence condition between the interactive service items included in the pre-generated upstream and downstream influence records of the service item corresponding to the application to be subjected to the security vulnerability analysis, optimizing the service item splicing risk descriptions corresponding to the interactive service items respectively to obtain the optimized service item splicing risk descriptions.

And 103B22, determining a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis based on the optimized service item splicing risk description.

In the embodiment of the present invention, the pre-generated upstream and downstream influence record of the service items may include a third upstream and downstream influence situation between the interactive service items, where the third upstream and downstream influence situation may be an upstream and downstream influence situation formed by sequentially connecting the visual application program function items of the visual application program according to the visual application program operation nodes, and the service item splicing risk description corresponding to each interactive service item may be updated more comprehensively and accurately on a certain level, so that the determined global security vulnerability analysis index of the application program to be subjected to the security vulnerability analysis is also more comprehensive and accurate.

For an independently implementable solution, the global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis may be determined according to the following steps, which may exemplarily include the contents recorded in step 210 and step 220.

Step 210, transmitting the optimized service item splicing risk description into an AI machine learning model which is debugged in advance to obtain security hole analysis loss; the security vulnerability analysis loss aims to reflect the comparison result between the current security vulnerability analysis index of the application program to be subjected to the security vulnerability analysis and the security vulnerability analysis index to be processed.

Step 220, based on the security vulnerability analysis loss and the to-be-processed item distribution label of the plurality of interactive service items of the application program to be subjected to the security vulnerability analysis in the target intrusion attack simulation scene, determining an updated item distribution label of the plurality of interactive service items of the application program to be subjected to the security vulnerability analysis in the target intrusion attack simulation scene, and determining a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis based on the updated item distribution label.

In the embodiment of the invention, the AI machine learning model is used to determine the related security vulnerability analysis loss (which can be understood as the security vulnerability analysis deviation), the security vulnerability analysis loss corresponds to the comparison result (deviation condition) between the current security vulnerability analysis index and the to-be-processed security vulnerability analysis index, and based on the security vulnerability analysis loss and the to-be-processed item distribution label, the updated item distribution label of the application program to be subjected to the security vulnerability analysis in the target intrusion attack simulation scene can be determined, so that the global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis can be determined.

In practical implementation, the to-be-processed security vulnerability analysis index may be obtained by combining to-be-processed item distribution tags of a plurality of interactive service items of the application program to be subjected to security vulnerability analysis. The AI machine learning model can obtain the distribution difference result of each interactive service item of the application program to be subjected to the security vulnerability analysis, and the distribution difference result is integrated with the corresponding distribution label of the item to be processed, so that the updated item distribution label of each interactive service item can be determined.

In order to further understand the vulnerability risk analysis method based on the digital cloud provided by the embodiment of the present invention, the following contents are exemplarily and further described.

For the application program to be subjected to security vulnerability analysis under the to-be-processed security vulnerability analysis indexes, to-be-processed item distribution labels of a plurality of interactive service items in a target intrusion attack simulation scene can be determined based on the to-be-processed security vulnerability analysis indexes, the to-be-processed item distribution labels are mapped to target user interaction information under the running states of the three programs, and corresponding visual descriptions are determined. After the determination of the visual description is completed, optimization of the interactive service item risk description of the interactive service item in different program running states may be performed, where feature optimization may be specifically implemented using LSTM. Besides, the splicing of the running state characteristics of the multiple programs can be completed based on the pool layer.

The service item splicing risk description obtained by splicing can be optimized by using a pre-generated upstream and downstream influence record of the service item corresponding to the application program to be subjected to security vulnerability analysis, the optimized service item splicing risk description is transmitted to a description correction model (such as a regression network), a correction instruction for estimating the security vulnerability analysis index to be processed is predicted, the correction instruction is weighted with the security vulnerability analysis index to be processed, and an updated global security vulnerability analysis result can be determined.

On the basis of the above contents, for some design ideas that can be implemented independently, after determining a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis, the method may further include the following contents: if the global security vulnerability analysis result represents that the application program to be subjected to security vulnerability analysis has a first vulnerability risk, sending prompt information to an application terminal corresponding to the application program; if the global security vulnerability analysis result represents that a second vulnerability risk exists in the application program to be subjected to the security vulnerability analysis, a repair patch aiming at the second vulnerability risk is generated and is issued to the application terminal so that the application terminal can install the repair patch; the risk level of the first vulnerability risk is located in a first grade interval, the risk level of the second vulnerability risk is equal to the risk level located in a second grade interval, and the grade of the first grade interval is lower than that of the second grade interval.

Due to the design, different counter measures can be determined based on different vulnerability risks, and therefore targeted vulnerability processing of the APP is achieved.

On the basis of the above content, for some design ideas that can be implemented independently, generating a repair patch for the second vulnerability risk may be implemented by the following implementation manners: determining a stage vulnerability visual description and a derivative vulnerability visual description in a global security vulnerability analysis result; matching the staged vulnerability visual description and the derivative vulnerability visual description in the global security vulnerability analysis result based on the visual description correlation between the staged vulnerability visual description and the derivative vulnerability visual description in the global security vulnerability analysis result to obtain a visual description matching result; determining the derivative vulnerability visual description which is not successfully paired as a standby derivative vulnerability visual description, and determining vulnerability hazard characteristics matched with the standby derivative vulnerability visual description according to visual description common evaluation between the derivative vulnerability visual description and the standby derivative vulnerability visual description in the visual description pairing result; matching the vulnerability hazard characteristics matched with the standby derivative vulnerability visual description to obtain a hazard characteristic matching result; according to the harm feature pairing result and the visual description pairing result, determining privacy information in the global security vulnerability analysis result and vulnerability harm features corresponding to the privacy information; and generating a repair patch for anonymization protection according to the privacy information and the vulnerability hazard characteristics corresponding to the privacy information.

By means of the design, the privacy information and the vulnerability hazard characteristics corresponding to the privacy information can be accurately determined by considering the pairing condition between the stage vulnerability visual description and the derived vulnerability visual description, so that the repair patch for anonymization protection can be generated in a targeted manner, and the privacy information of the related users is protected from being leaked.

Based on the same inventive concept, there is also provided a vulnerability risk analysis device 20 based on digital cloud, which is applied to the cloud computing server 10, and the device includes:

a distribution label determining module 21, configured to determine a to-be-processed item distribution label of a plurality of interactive service items of an application program to be subjected to security vulnerability analysis in a target intrusion attack simulation scene;

a risk description obtaining module 22, configured to determine, based on the to-be-processed item distribution labels, interactive service item risk descriptions obtained by mapping a plurality of interactive service items in a plurality of sets of target user interaction information, respectively; the multi-group target user interaction information is obtained by detecting the application program to be subjected to security vulnerability analysis in the running state of a plurality of programs;

the security vulnerability analysis module 23 is configured to determine a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis based on a pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to security vulnerability analysis and an interactive service item risk description of target user interaction information corresponding to a plurality of program running states of a plurality of interactive service items, respectively.

In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus and method embodiments described above are illustrative only, as the flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, the functional modules in the embodiments of the present invention may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention or a part of the technical solution that substantially contributes to the prior art may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a cloud computing server 10, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes. It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising a … …" does not exclude the presence of another identical element in a process, method, article, or apparatus that comprises the element.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A vulnerability risk analysis method based on a digital cloud is characterized by being applied to a cloud computing server and comprising the following steps:

if the global security vulnerability analysis result represents that the application program to be subjected to security vulnerability analysis has a first vulnerability risk, sending prompt information to an application terminal corresponding to the application program;

if the global security vulnerability analysis result represents that the application program to be subjected to security vulnerability analysis has a second vulnerability risk, generating a repair patch aiming at the second vulnerability risk and issuing the repair patch to the application terminal so as to enable the application terminal to install the repair patch; the risk level of the first vulnerability risk is located in a first grade interval, the risk level of the second vulnerability risk is equal to the risk level located in a second grade interval, and the grade of the first grade interval is lower than that of the second grade interval.

2. The method of claim 1, wherein generating the fix patch for the second vulnerability risk comprises:

determining a staged vulnerability visual description and a derivative vulnerability visual description in a global security vulnerability analysis result;

matching the stage vulnerability visual description and the derivative vulnerability visual description in the global security vulnerability analysis result based on the visual description correlation between the stage vulnerability visual description and the derivative vulnerability visual description in the global security vulnerability analysis result to obtain a visual description matching result;

determining the derivative vulnerability visual description which is not successfully paired as a standby derivative vulnerability visual description, and determining vulnerability hazard characteristics matched with the standby derivative vulnerability visual description according to visual description common evaluation between the derivative vulnerability visual description and the standby derivative vulnerability visual description in the visual description pairing result;

pairing the vulnerability hazard characteristics matched with the standby derivative vulnerability visual description to obtain a hazard characteristic pairing result;

according to the harm feature pairing result and the visual description pairing result, determining privacy information in the global security vulnerability analysis result and vulnerability harm features corresponding to the privacy information;

and generating a repair patch for anonymization protection according to the privacy information and the vulnerability hazard characteristics corresponding to the privacy information.

3. The method of claim 1, further comprising:

determining a to-be-processed item distribution label of a plurality of interactive service items of an application program to be subjected to security vulnerability analysis in a target intrusion attack simulation scene; determining interactive service item risk descriptions obtained by mapping the interactive service items in a plurality of groups of target user interactive information respectively through the to-be-processed item distribution labels; the multiple groups of target user interaction information are target user interaction information obtained by detecting the application program to be subjected to security vulnerability analysis in the running state of a plurality of programs;

and determining a global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis through the upstream and downstream influence records of the pre-generated service items corresponding to the application program to be subjected to security vulnerability analysis and the interactive service item risk descriptions of the target user interaction information corresponding to the running states of the plurality of programs of the plurality of interactive service items.

4. The method according to claim 3, wherein the determining the backlog distribution label of the backlog of the interactive service backlogs of the application to be subjected to the security vulnerability analysis in the target intrusion attack simulation scenario includes any one of:

determining a plurality of groups of target user interaction information obtained by detecting the application program to be subjected to the security vulnerability analysis in a plurality of program running states, and determining a to-be-processed item distribution label of a plurality of interaction service items of the application program to be subjected to the security vulnerability analysis in the target intrusion attack simulation scene according to the plurality of groups of target user interaction information;

determining item positioning feedbacks corresponding to a plurality of groups of positioning requests issued by a service item positioning thread respectively, and determining a to-be-processed item distribution label of a plurality of interactive service items of the application program to be subjected to security vulnerability analysis in the target intrusion attack simulation scene through the item positioning feedbacks; each group of target user interaction information in the multiple groups of determined target user interaction information is used as first target user interaction information, and each group of target user interaction information in the multiple groups of target user interaction information used for interactive service item mapping is used as second target user interaction information; at least part of the user interaction information in the first target user interaction information is consistent with at least part of the user interaction information in the second target user interaction information; or the first target user interaction information and the second target user interaction information do not have the same user interaction information.

5. The method according to claim 3, wherein the determining the global security vulnerability analysis result of the application program to be subjected to security vulnerability analysis through a pre-generated service item upstream and downstream influence record corresponding to the application program to be subjected to security vulnerability analysis and an interactive service item risk description of target user interaction information corresponding to a plurality of program running states of a plurality of interactive service items respectively comprises:

for each interactive service item in the interactive service items, determining optimized interactive service item risk description of the interactive service item in different program running states through interactive service item risk description of the interactive service item in different program running states and interactive service item risk description of the remaining interactive service items which are in contact with the interactive service item;

and determining a global security vulnerability analysis result of the application program to be subjected to the security vulnerability analysis according to the optimized interactive service item risk description corresponding to the interactive service items respectively and the pre-generated service item upstream and downstream influence records corresponding to the application program to be subjected to the security vulnerability analysis.

6. The method of claim 5, wherein the determining the optimized risk profile of the interactive service item in different program operation states by using the risk profiles of the interactive service item in different program operation states and the risk profiles of the interactive service items of the remaining interactive service items associated with the interactive service item comprises: taking each program running state in the program running states as a target program running state, and sequentially implementing the following steps:

performing first optimization on the interactive service item risk description of the interactive service item in different program running states through the interactive service item risk description of the interactive service item in different program running states and first upstream and downstream influence conditions among local mapping units of the interactive service item in different program running states to obtain first optimized interactive service item risk description;

performing second optimization on the interactive service item risk description of the interactive service item in the target program running state through the interactive service item risk description of the interactive service item in the target program running state and the interactive service item risk description of the remaining interactive service item which is matched with the interactive service item in the target program running state and has a second upstream and downstream influence condition with the interactive service item, so as to obtain second optimized interactive service item risk description;

and determining the optimized interactive service item risk description of the interactive service item in the running state of the target program according to the first optimized interactive service item risk description and the second optimized interactive service item risk description.

7. A cloud computing server, comprising a processor, a network module, and a memory; the processor and the memory communicate through the network module, the processor reading a computer program from the memory and operating to perform the method of any of claims 1-6.