System vulnerability assessment method, device and system based on open vulnerability assessment language

Abstract

The invention provides an open vulnerability assessment language based system vulnerability assessment method, device and system. The open vulnerability assessment language based system vulnerability assessment method comprises collecting the vulnerability information and the version information of an operating system updated in a vulnerability knowledge base; updating a configuration database of the operating system according to open vulnerability assessment language rules and the vulnerability information and the version updating information; performing vulnerability scanning on a device to be detected and with the operating system through the configuration database and saving a vulnerability scanning result. According to the open vulnerability assessment language based system vulnerability assessment method, device and system, the latest vulnerability information and system version information can be timely collected and accordingly the real-time performance of the utilized knowledge base in the vulnerability assessment is ensured, the harm of vulnerabilities can be timely analyzed, the safety of the device is improved, and the standardization and the normalization of the vulnerability description, the vulnerability monitoring process and the vulnerability assessment are implemented through the inherent vulnerability description language of the OVAL (Open Vulnerability Assessment Language).

Description

technical field [0001] The invention relates to the field of network security, in particular to a system vulnerability assessment method, device and system based on an open vulnerability assessment language. Background technique [0002] System vulnerabilities refer to flaws in the logical design of operating system software or errors in writing. These flaws or errors can be exploited by criminals or computer hackers to attack or control the operation of the above operations by implanting Trojan horses, viruses, etc. system equipment, bringing information security risks to users. [0003] Android system (Android) is a semi-open source operating system based on Linux. Due to its open source and free features, it is more and more widely used. On the other hand, it has also become the target of many malicious attacks. Although Android itself has its own security mechanisms such as permission management, application signatures, and sandboxes, there are still various problems an...

AI Technical Summary

Problems solved by technology

[0007] However, the vulnerability information in the existing technical knowledge base is not real-time, and the update cycle is long, and the vulnerability information is defined by the knowledge base itself, which is too chaotic to realize the sharing of community vulnerability information, resulting in low accuracy of vulnerability assessment, which cannot meet the requirements of the system. Frequent updates and high real-time vulnerability assessment requirements

Images