Vulnerability automatic classification method supporting vulnerability correlation mining

Abstract

The invention relates to a vulnerability automatic classification method supporting vulnerability correlation mining, and belongs to the technical field of information security. The method comprises the specific steps of 1, establishing a vulnerability database, and collecting vulnerability records; 2, determining a category of a privilege set; 3, training a classifier; and 4, testing data. Compared with an existing method, the vulnerability automatic classification method supporting the vulnerability correlation mining has the following advantages that (1) a vulnerability classification result is suitable for the vulnerability correlation mining; (2) categories have mutual exclusiveness and the classification is remarkable; and (3) vulnerability automatic classification is realized, so that the classification efficiency is improved and the labor cost is reduced.

Description

Technical field [0001] The invention relates to a method for automatically classifying vulnerabilities supporting vulnerabilities association mining, and belongs to the technical field of information security. Background technique [0002] Network security vulnerability refers to the existence of certain security vulnerabilities in the computer system that may be exploited by malicious subjects (attackers or attack programs), which may cause unauthorized access to system resources or cause other damage to the system. In recent years, mature vulnerability scanning technology and CVE (Common Vulnerabilities&Exposures) standards and Common Vulnerability Scoring System (CVSS) vulnerability rating methods have gradually developed, which can detect and discover vulnerabilities in the network, But it is impossible to analyze the correlation and mutual utilization of the vulnerabilities. The means of attack in network risk is often through related vulnerabilities, cut from one vulnerabi...

AI Technical Summary

Problems solved by technology

[0004] The current vulnerability classification mainly includes the Unix operating system classification method proposed by Aslam of Purdue University’s COAST Laboratory, which is divided into operational failure, environmental failure and coding failure. However, due to the lack of specific quantitative indicators, it is impossible to evaluate the harm level of vulnerabilities; The software vulnerability classification method proposed by Wang Lidong of Harbin Institute of Technology describes the impact of vulnerabilities on security such as confidentiality, integrity, and availability. The generalized classification method proposed by Knight et al. There are four types of vulnerabilities. Due to a certain degree of conceptual ambiguity, there is no mutual exclusion between classes

[0005] The above classification methods all analyze the vulnerability as a single defect. Zhang Yongzheng emphasized the correlation between the vulnerabilities, and proposed that the premise of judging the relevance of the vulnerability is that the vulnerability can be accurately determined according to the "premise privilege set" and "result privilege set". Classification, implements a novel multi-dimensional quantitative attribute vulnerability classification method that supports correlation mining, but does not clearly point out the specific characteristics of each category, and cannot be automatically classified

Images