4. 补丁信息收集

4.1 权威漏洞情报来源

4.2 威胁情报订阅策略

威胁情报订阅是补丁信息收集的主动防御手段。通过订阅高质量威胁情报源，可以在漏洞被大规模利用前获得预警。

4.3 补丁信息库的建立与维护

补丁信息库是补丁管理的核心资产。一个完善的信息库应包含以下维度：

信息库维护最佳实践

4.4 实战：信息库自动化采集脚本示例

以下是一个使用Python编写的简易漏洞情报采集脚本，用于从NVD API获取最新漏洞信息并存入本地数据库：

import requests
import json
import sqlite3
from datetime import datetime

# NVD API 配置
NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"
API_KEY = "your-api-key-here"  # 建议从环境变量读取

def fetch_latest_cves(start_index=0, results_per_page=20):
    """从NVD获取最新CVE列表"""
    params = {
        "startIndex": start_index,
        "resultsPerPage": results_per_page,
        "pubStartDate": "2024-01-01T00:00:00.000",
        "pubEndDate": datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.000")
    }
    headers = {"apiKey": API_KEY}
    
    try:
        response = requests.get(NVD_API_URL, params=params, headers=headers, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"[ERROR] 请求NVD API失败: {e}")
        return None

def store_cve_to_db(cve_data, db_path="patch_info.db"):
    """将CVE数据存入SQLite数据库"""
    conn = sqlite3.connect(db_path)
    cursor = conn.cursor()
    
    # 创建表（如果不存在）
    cursor.execute('''
        CREATE TABLE IF NOT EXISTS cve_records (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            cve_id TEXT UNIQUE NOT NULL,
            description TEXT,
            cvss_score REAL,
            severity TEXT,
            published_date TEXT,
            last_modified TEXT,
            affected_products TEXT,
            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
        )
    ''')
    
    for vuln in cve_data.get("vulnerabilities", []):
        cve = vuln.get("cve", {})
        cve_id = cve.get("id", "")
        descriptions = cve.get("descriptions", [])
        description = next((d["value"] for d in descriptions if d["lang"] == "en"), "")
        
        metrics = cve.get("metrics", {})
        cvss_v31 = metrics.get("cvssMetricV31", [{}])[0].get("cvssData", {})
        cvss_score = cvss_v31.get("baseScore", 0.0)
        severity = cvss_v31.get("baseSeverity", "NONE")
        
        published = cve.get("published", "")
        modified = cve.get("lastModified", "")
        
        # 提取受影响产品（简化处理）
        configurations = cve.get("configurations", [])
        products = "; ".join([
            node.get("criteria", "") 
            for config in configurations 
            for node in config.get("nodes", [])
        ])
        
        try:
            cursor.execute('''
                INSERT OR REPLACE INTO cve_records 
                (cve_id, description, cvss_score, severity, published_date, last_modified, affected_products)
                VALUES (?, ?, ?, ?, ?, ?, ?)
            ''', (cve_id, description, cvss_score, severity, published, modified, products))
        except sqlite3.Error as e:
            print(f"[ERROR] 数据库写入失败 {cve_id}: {e}")
    
    conn.commit()
    conn.close()
    print(f"[INFO] 成功写入 {len(cve_data.get('vulnerabilities', []))} 条CVE记录")

if __name__ == "__main__":
    print("[INFO] 开始同步NVD漏洞数据...")
    data = fetch_latest_cves()
    if data:
        store_cve_to_db(data)
        print("[INFO] 数据同步完成")
    else:
        print("[ERROR] 数据同步失败")