Automatic vulnerability validation method

Abstract

The invention provides an automatic vulnerability validation method. The method comprises the steps that firstly, validation information is collected, wherein an active detection way is adopted for carrying out information detection, topological detection, vulnerability detection and website directory structure detection on a target; secondly, the validation information is packaged, wherein suspicious vulnerability key information in vulnerability detection results is extracted, uniform-interface modularized packaging is carried out on the data; thirdly, a validation strategy is searched for, wherein according to the suspicious vulnerability identity and variety information, an appropriate attack script template and a vulnerability utilizing tool are selected; vulnerability validation is carried out, wherein scripts are called to be loaded into the packaged vulnerability information to carry out validation attack, and an utilization voucher is obtained and stored; fifthly, validation traces are removed, wherein validation attack traces are removed, sessions are recycled; finally, a scanning report is generated. The automatic vulnerability validation method solves the problem that an existing vulnerability scanning system is high in false alarm rate and cannot carry out effective validation, is automatic and procedural, can automatically recognize and validate vulnerabilities, lowers the requirement for the ability of non-professional staff and improves the vulnerability validation efficiency.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method for automatic vulnerability verification. Background technique [0002] Thousands of network security vulnerabilities are discovered and published every year, coupled with the constant changes and updates of attackers’ methods, the network security situation is also becoming increasingly severe with the increase of security vulnerabilities; it has been proved that 99% of the attacks All exploit unpatched loopholes, so that many enterprises that have deployed firewalls, intrusion detection systems, and antivirus software are still suffering from vulnerability attacks and suffering huge economic losses. [0003] Tracing back to the source, the vast majority of users lack a complete and effective workflow for vulnerability discovery and verification, and fail to implement regular assessment and vulnerability repair work; only by knowing their own network security vulnera...

AI Technical Summary

Problems solved by technology

[0004] The present invention proposes a method for automatic vulnerability verification, which realizes the automatic verification of network security vulnerabilities, and solves the problem that the existing vulnerability scanning system cannot provide evidence of the existence of vulnerabilities and cannot perform verification vulnerability utilization

Images