Vulnerability early-warning and emergency response automatic warning system

Abstract

The invention relates to a vulnerability early-warning and emergency response automatic warning system, comprising an asset recognition engine, an asset information processing engine, a vulnerability intelligence collection engine, a vulnerability analysis engine, a vulnerability detection engine and a warning engine. According to the vulnerability early-warning and emergency response automatic warning system provided by the invention, the emergency response of an enterprise can be handled, an emergency response complete process of obtaining vulnerability early-warning in the first time, intelligently verifying and recognizing influencing ranges and carrying out automatic warning is realized, the vigor and time of information security personnel are saved, and the vulnerability early-warning and emergency response efficiency is improved.

Description

technical field [0001] The invention relates to an automatic alarm system, in particular to an automatic alarm system for loophole early warning and emergency response. Background technique [0002] Current vulnerability scanning devices are based on two traditional scanning technologies: [0003] 1. Scanning Technology for Asset Identification Engine [0004] 1. Ping / ICMP scanning technology, the purpose of ping scanning is to confirm the IP address of the target host, that is, whether the scanned IP address is assigned to the host. Ping scanning is based on the ICMP protocol, so a type of scanning based on the ICMP protocol for discovering the destination network or host is called ping scanning. The main idea is to construct an ICMP packet, send it to the target host, and judge from the response generated by the target host. [0005] 2. Port scanning technology, divided into TCP port scanning and UDP port scanning. [0006] (1) UDP scanning technology, the UDP protocol...

AI Technical Summary

Problems solved by technology

[0024] However, the existing mainstream vulnerability scanning equipment products cannot obtain the latest vulnerability update package in a timely manner. If the device is deployed on the company's intranet and isolated from the external network, the vulnerability update package can only be updated manually, and it is even more difficult to obtain the update in the first time. As a result, it is impossible to achieve the first response to the vulnerability warning and miss the best time to patch the vulnerability

[0025] The vulnerability scanning system cannot customize the specified vulnerabilities to scan each time it scans, and the loaded rules must be run for each scan, resulting in many interference items such as previously scanned vulnerabilities in the report, which becomes a pile of information and poses a threat to security operation and maintenance personnel. It's a time-consuming job

[0026] When manually obtaining vulnerability warnings, the channel source for obtaining information usually only reports the affected system version and scope in the vulnerability bulletin. Specifically, which assets are affected in the company scope, security operation and maintenance personnel still need to check one by one system. When the company's system structure When complex and huge, this work becomes energy-consuming and cannot be automated and intelligent

Images