多源漏洞数据智能分析和漏洞智能利用与挖掘研究

安全漏洞是网络攻防最重要的知识资源，现存多渠道、多层次的漏洞数据源，如何发扬和提升海量漏洞数据的能量和潜力是业界近年来的研究热点。.目前漏洞数据分析和特征提取多依赖人工完成，且不同漏洞数据源的描述存在差异和不一致性，同时基于漏洞数据的自动化利用研究刚刚起步。为此，本项目将研究基于自然语言处理和深度学习技术对漏洞库、安全论坛以及博客等多漏洞数据源进行信息智能提取和分析，测量现存漏洞信息源的差异，规范漏洞数据。同时，研究基于符号执行和可达路径分析的漏洞智能利用方案，采用深度学习和动静态混合分析相结合的方式，在漏洞智能利用的基础上，对安全漏洞进行智能挖掘。项目特色：基于人工智能技术，将漏洞数据分析、自动利用与挖掘有效集成与一体化。.本项目成果将高效提升多源漏洞数据分析能力、利用代码自动构造能力以及漏洞智能挖掘能力，为我国网络空间安全保障有效技术支撑。

Security vulnerabilities are the most important knowledge source in network attacks and defense. There exist multi-channel and multi-hierarchy vulnerability data sources currently, how to expand and improve the energy and potential of massive vulnerability data have received much attention in the community in recent years..Currently, vulnerability data analysis and feature extraction rely on manual labor, and descriptions of different vulnerability are different and inconsistent, the research on the automatic exploit of vulnerability data has just started. Therefore, this project proposes a scheme of intelligent extraction of vulnerability information, using deep learning and natural language processing to analyze multiple information sources such as security forums, blogs, and so on, measuring the different vulnerability description of existing vulnerability database, and standardizing vulnerability data. Based on symbol execution and reachable path analysis, we develop an intelligent vulnerability exploitation methodology. Based on the intelligent vulnerability exploitation, we will study the intelligent vulnerability mining method, which combines deep learning, dynamic testing, and static analysis. The feature of the project: based on artificial intelligence, effectively integrating and ensembling vulnerability data analysis, automatic exploit, and mining..The achievements of this research will efficiently improve the ability to analyze multi-source vulnerability data, the ability of automatic exploit construction and the ability of intelligent vulnerability mining. It can also provide technical support for the standardization of vulnerability database and the exploit prevention, to guarantee cyberspace security in China.