漏洞修复优先级排序#

public class CVSSCalculator {
    
    // 典型 SQL 注入漏洞的评分
    public CVSSScore calculateSqlInjectionScore() {
        // 攻击向量：网络
        // 攻击复杂度：低
        // 所需权限：无
        // 用户交互：无
        // 影响：机密性高、完整性高、可用性高
        // 范围：未改变
        
        return new CVSSScore()
            .av(CVSSVector.N)
            .ac(CVSSVector.L)
            .pr(CVSSVector.N)
            .ui(CVSSVector.N)
            .c(CVSSVector.H)
            .i(CVSSVector.H)
            .a(CVSSVector.H)
            .scope(CVSSVector.U);
        
        // 计算结果：9.8（严重）
    }
    
    // 存储型 XSS 漏洞的评分
    public CVSSScore calculateStoredXssScore() {
        return new CVSSScore()
            .av(CVSSVector.N)
            .ac(CVSSVector.L)
            .pr(CVSSVector.L)  // 需要低权限（发布内容）
            .ui(CVSSVector.R)  // 需要用户交互（浏览页面）
            .c(CVSSVector.L)
            .i(CVSSVector.L)
            .a(CVSSVector.N)
            .scope(CVSSVector.U);
        
        // 计算结果：6.1（中）
    }
    
    // 信息泄露漏洞的评分
    public CVSSScore calculateInfoDisclosureScore() {
        return new CVSSScore()
            .av(CVSSVector.N)
            .ac(CVSSVector.L)
            .pr(CVSSVector.N)
            .ui(CVSSVector.N)
            .c(CVSSVector.L)  // 低机密性影响
            .i(CVSSVector.N)
            .a(CVSSVector.N)
            .scope(CVSSVector.U);
        
        // 计算结果：5.3（中等）
    }
}

public class EPSSIntegration {
    
    // EPSS API 端点
    private static final String EPSS_API = 
        "https://epss.first.org/data/current/epss_scores.csv";
    
    // 查询漏洞的 EPSS 评分
    public double queryEPSS(String cveId) {
        // 从 EPSS API 获取评分
        EPSSResponse response = httpClient.get(EPSS_API, 
            Map.of("cve", cveId));
        
        return response.epss;
    }
    
    // 综合评分计算
    public PriorityScore calculatePriority(
            double cvssScore, 
            double epssScore,
            boolean isExploited) {
        
        // 调整因子
        double adjustedScore = cvssScore;
        
        // 如果已经被利用，增加优先级
        if (isExploited) {
            adjustedScore = Math.min(10.0, cvssScore * 1.2);
        }
        
        // EPSS > 0.5 表示高利用可能性
        if (epssScore > 0.5) {
            adjustedScore = Math.min(10.0, adjustedScore * 1.3);
        }
        
        // EPSS > 0.1 表示中等利用可能性
        if (epssScore > 0.1) {
            adjustedScore = Math.min(10.0, adjustedScore * 1.1);
        }
        
        return new PriorityScore(adjustedScore);
    }
}

public class OWASPRiskRating {
    
    public RiskLevel calculateRisk(
            String threatAgent,    // 威胁代理
            String vulnerability, // 漏洞类型
            String impact,         // 影响
            String likelihood      // 利用可能性
    ) {
        // 威胁代理因素
        Factor skillLevel = assessSkillLevel(threatAgent);      // 低/中/高
        Factor motivation = assessMotivation(threatAgent);        // 低/高
        Factor opportunity = assessOpportunity(threatAgent);      // 无/低/中/高
        
        // 漏洞因素
        Factor easeOfDiscovery = assessDiscovery(vulnerability); // 低/中/高
        Factor easeOfExploit = assessExploit(vulnerability);      // 低/中/高
        Factor awareness = assessAwareness(threatAgent);          // 低/高
        
        // 影响因素
        Factor technicalImpact = assessTechImpact(impact);        // 低/中/高
        Factor businessImpact = assessBusinessImpact(impact);     // 低/中/高
        
        // 计算总体风险
        double overallLikelihood = calculateLikelihood(
            easeOfDiscovery, easeOfExploit, awareness, 
            skillLevel, motivation, opportunity);
        
        double overallImpact = calculateImpact(
            technicalImpact, businessImpact);
        
        return mapToRiskLevel(overallLikelihood, overallImpact);
    }
}

public class RiskFactors {
    
    // 威胁代理评估
    public enum ThreatAgent {
        SKILL_LEVEL_LOW("脚本小子，无技术背景", 1.0),
        SKILL_LEVEL_MEDIUM("熟悉漏洞利用工具的开发者", 5.0),
        SKILL_LEVEL_HIGH("安全专家，能发现新漏洞", 9.0);
        
        // 动机评估
        MOTIVATION_LOW("可能没有动机", 1.0),
        MOTIVATION_HIGH("有强烈动机（金钱/政治/报复）", 9.0);
        
        // 机会评估
        OPPORTUNITY_NONE("完全无机会", 0.0),
        OPPORTUNITY_LOW("有一些限制", 4.0),
        OPPORTUNITY_MEDIUM("有一些资源", 7.0),
        OPPORTUNITY_HIGH("无限制访问", 9.0);
    }
    
    // 漏洞评估
    public enum Vulnerability {
        EASE_OF_DISCOVERY_IMPOSSIBLE("难以发现", 1.0),
        EASE_OF_DISCOVERY_DIFFICULT("需要大量资源", 3.0),
        EASE_OF_DISCOVERY_EASY("常见工具可发现", 6.0),
        EASE_OF_DISCOVERY_OBVIOUS("公开暴露", 9.0);
        
        EASE_OF_EXPLOIT_DIFFICULT("需要罕见的条件", 1.0),
        EASE_OF_EXPLOIT_EASY("常见工具可利用", 6.0),
        EASE_OF_EXPLOIT_TRIVIAL("一键利用", 9.0);
    }
}

public class BusinessImpactAssessment {
    
    public BusinessImpact evaluate(String assetType, 
                                   String vulnerabilityType) {
        BusinessImpact impact = new BusinessImpact();
        
        // 资产重要性
        impact.assetValue = assessAssetValue(assetType);
        
        // 数据敏感性
        impact.dataSensitivity = assessDataSensitivity(
            assetType, vulnerabilityType);
        
        // 业务连续性影响
        impact.availabilityImpact = assessAvailabilityImpact(
            assetType, vulnerabilityType);
        
        // 声誉影响
        impact.reputationalImpact = assessReputationImpact(
            assetType, vulnerabilityType);
        
        // 合规影响
        impact.complianceImpact = assessComplianceImpact(
            assetType, vulnerabilityType);
        
        return impact;
    }
    
    private double assessAssetValue(String assetType) {
        // 用户认证系统：价值最高
        if (assetType.contains("auth") || assetType.contains("login")) {
            return 10.0;
        }
        // 支付系统
        if (assetType.contains("payment") || assetType.contains("transaction")) {
            return 10.0;
        }
        // 客户数据
        if (assetType.contains("customer") || assetType.contains("user")) {
            return 8.0;
        }
        // 内部系统
        if (assetType.contains("internal") || assetType.contains("admin")) {
            return 5.0;
        }
        // 公开内容
        return 2.0;
    }
    
    private DataSensitivity assessDataSensitivity(
            String assetType, String vulnType) {
        
        // 涉及个人信息的漏洞
        if (vulnType.contains("PII") || vulnType.contains("privacy")) {
            return DataSensitivity.VERY_HIGH;
        }
        // 涉及金融信息的漏洞
        if (vulnType.contains("payment") || vulnType.contains("credit")) {
            return DataSensitivity.VERY_HIGH;
        }
        // 涉及医疗信息的漏洞
        if (vulnType.contains("health") || vulnType.contains("medical")) {
            return DataSensitivity.VERY_HIGH;
        }
        // 一般业务数据
        return DataSensitivity.MEDIUM;
    }
}

public class VulnerabilityPriorityCalculator {
    
    public Priority calculatePriority(Vulnerability vuln, 
                                       Context context) {
        // 各维度权重配置
        Weights weights = new Weights()
            .cvss(0.25)        // CVSS 权重
            .epss(0.20)        // EPSS 权重
            .assetValue(0.25)  // 资产价值权重
            .exposure(0.15)   // 暴露面权重
            .remediation(0.15);// 修复难度权重
        
        // 基础评分（CVSS）
        double cvssScore = vuln.getCvssScore();
        
        // 利用可能性（EPSS）
        double epssScore = context.getEPSS(vuln.getCveId());
        
        // 业务影响
        double businessImpact = calculateBusinessImpact(vuln, context);
        
        // 暴露程度
        double exposure = calculateExposure(vuln, context);
        
        // 修复难度
        double remediationEffort = calculateRemediationEffort(vuln);
        
        // 综合评分
        double finalScore = 
            cvssScore * weights.cvss +
            epssScore * 10 * weights.epss +  // EPSS 归一化
            businessImpact * weights.assetValue +
            exposure * weights.exposure +
            (10 - remediationEffort) * weights.remediation;  // 修复难度取反
        
        return new Priority(finalScore, calculateTier(finalScore));
    }
}

public class SLATrigger {
    
    public SLALevel determineSLA(Vulnerability vuln, Context ctx) {
        // P0：紧急
        if (vuln.getCvss() >= 9.0 || ctx.isExploited()) {
            return SLALevel.P0;
        }
        
        // P0：严重 + 高利用可能
        if (vuln.getCvss() >= 9.0 && ctx.getEPSS() >= 0.5) {
            return SLALevel.P0;
        }
        
        // P1：高危
        if (vuln.getCvss() >= 7.0) {
            if (ctx.getEPSS() >= 0.2) {
                return SLALevel.P1;
            }
            if (ctx.isInternetFacing()) {
                return SLALevel.P1;
            }
        }
        
        // P2：中危
        if (vuln.getCvss() >= 4.0) {
            return SLALevel.P2;
        }
        
        // P3：低危
        return SLALevel.P3;
    }
}

public class VulnerabilityKanban {
    
    // 漏洞状态
    public enum Status {
        NEW("新增", Color.RED),
        CONFIRMED("已确认", Color.ORANGE),
        ASSIGNED("已分配", Color.YELLOW),
        IN_PROGRESS("修复中", Color.BLUE),
        CODE_REVIEW("代码审查", Color.PURPLE),
        TESTING("测试中", Color.CYAN),
        DEPLOYED("已部署", Color.GREEN),
        VERIFIED("已验证", Color.GREEN),
        CLOSED("已关闭", Color.GRAY),
        FALSE_POSITIVE("误报", Color.GRAY),
        RISK_ACCEPTED("风险接受", Color.GRAY);
        
        // 状态转移规则
        public Set<Status> canTransitionTo() {
            return switch (this) {
                case NEW -> Set.of(CONFIRMED, FALSE_POSITIVE);
                case CONFIRMED -> Set.of(ASSIGNED, RISK_ACCEPTED);
                case ASSIGNED -> Set.of(IN_PROGRESS);
                case IN_PROGRESS -> Set.of(CODE_REVIEW);
                case CODE_REVIEW -> Set.of(TESTING);
                case TESTING -> Set.of(DEPLOYED);
                case DEPLOYED -> Set.of(VERIFIED);
                case VERIFIED -> Set.of(CLOSED);
                default -> Set.of();
            };
        }
    }
    
    // 升级规则
    public void checkEscalation(Vulnerability vuln) {
        // 检查 SLA 违反
        if (vuln.isSLAViolated()) {
            escalate(vuln, EscalationReason.SLA_VIOLATION);
        }
        
        // 检查漏洞被利用
        if (vuln.isExploitedInWild()) {
            escalate(vuln, EscalationReason.ACTIVE_EXPLOITATION);
        }
        
        // 检查公开披露
        if (vuln.isPubliclyDisclosed() && vuln.getStatus() != DEPLOYED) {
            escalate(vuln, EscalationReason.PUBLIC_DISCLOSURE);
        }
    }
}

public class KEVIntegration {
    
    private static final String CISA_KEV_URL = 
        "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
    
    // KEV 中的漏洞必须优先处理
    public Priority recalculatePriority(Vulnerability vuln) {
        boolean isInKEV = checkKEV(vuln.getCveId());
        
        if (isInKEV) {
            // KEV 漏洞：至少提升到 P0
            Priority priority = vuln.getCurrentPriority();
            if (priority.getTier() > 0) {  // 不是 P0
                return new Priority(
                    10.0,  // 强制设为最高
                    SLALevel.P0,
                    "KEV 漏洞：已被 CISA 确认在野利用"
                );
            }
        }
        
        return vuln.getCurrentPriority();
    }
    
    // 定期同步 KEV 数据
    public void syncKEVData() {
        String kevJson = httpClient.get(KEV_URL);
        KEVData kevData = parseJSON(kevJson);
        
        for (KEVEntry entry : kevData.vulnerabilities) {
            String cveId = entry.cveID;
            LocalDate dateAdded = entry.dateAdded;
            String shortDescription = entry.shortDescription;
            String requiredAction = entry.requiredAction;
            
            // 更新本地漏洞数据库
            updateLocalKEVRecord(cveId, entry);
        }
    }
}

public class VulnerabilityIntelligence {
    
    public IntelligenceReport gatherIntelligence(String cveId) {
        IntelligenceReport report = new IntelligenceReport();
        report.cveId = cveId;
        
        // 1. NVD 数据
        NVDData nvd = nvdClient.get(cveId);
        report.cvss = nvd.cvssScore;
        report.cvssVector = nvd.cvssVector;
        report.cwe = nvd.cweIds;
        report.references = nvd.references;
        
        // 2. EPSS 数据
        EPSSData epss = epssClient.get(cveId);
        report.epss = epss.score;
        report.epssPercentile = epss.percentile;
        
        // 3. CISA KEV
        boolean inKEV = cisaKEV.contains(cveId);
        report.isKEV = inKEV;
        if (inKEV) {
            report.kevDetails = cisaKEV.getDetails(cveId);
        }
        
        // 4. 威胁情报
        List<ThreatIntel> intel = threatIntelClient.query(cveId);
        report.threatIntel = intel;
        
        // 5. 漏洞利用工具
        List<Exploit> exploits = exploitDB.query(cveId);
        report.exploits = exploits;
        
        // 6. 计算综合风险
        report.combinedRisk = calculateCombinedRisk(report);
        
        return report;
    }
}