Distributed security vulnerability scanning method and system

Abstract

An embodiment of the present invention provides a distributed vulnerability scanning method and system, comprising: obtaining the execution time of each current vulnerability scanning task, dividing the execution time of all current vulnerability scanning tasks by a preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks; grouping the current vulnerability scanning tasks according to the average execution time; and assigning each group of current vulnerability scanning tasks to one of a plurality of scanning engines for execution. This embodiment of the present invention not only improves the efficiency of task assignment, but also enables batch scanning by grouping current vulnerability scanning tasks, thereby reducing the total number of scans. When an exception occurs during the execution of a vulnerability scanning task, the execution of all tasks can be avoided by repeatedly executing the scanning task group containing the task that encountered the exception, thereby improving the fault tolerance of vulnerability scanning and the execution efficiency of vulnerability scanning tasks.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability scanning, and in particular to a distributed vulnerability scanning method and system. Background Art

[0002] While the Internet and computer networks provide convenience to humanity, they also pose potential information security risks. Hacker groups or individuals, seeking to profit from their activities, constantly use various attack techniques to illegally break into or damage other people's network systems. These attacks often originate from vulnerabilities in network systems.

[0003] Vulnerabilities typically refer to potential flaws in system software and hardware, or administrator misconfigurations, that can allow unauthorized users to gain access and escalate system privileges, potentially damaging or controlling the system and exposing network systems to significant risks. Rapidly identifying vulnerabilities in network systems has become a pressing challenge in the current field of network security. Vulnerability scanning technology is a preventative measure for vulnerability prevention and security. It provides valuable insights for system developers, proactively identifying and remediating system vulnerabilities to ensure continued secure operation.

[0004] Complex systems require a large number of vulnerability scanning tasks, and traditional single scanning engines are no longer sufficient. To improve vulnerability scanning efficiency, these tasks are distributed to multiple distributed scanning engines for concurrent execution. Task allocation is typically based on the idle state of each scanning engine. Vulnerability scanning tasks are assigned to idle scanning engines, significantly increasing the number of task assignments and scans, resulting in lower vulnerability scanning efficiency. Summary of the Invention

[0005] The embodiments of the present invention provide a distributed vulnerability scanning method and system to solve the defect of low efficiency of vulnerability scanning in the prior art and achieve rapid and effective vulnerability scanning.

[0006] An embodiment of the present invention provides a distributed vulnerability scanning method, comprising:

[0007] Obtain the execution time of each current vulnerability scanning task, and divide the execution time of all current vulnerability scanning tasks by the preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks;

[0008] Grouping the current vulnerability scanning tasks according to the average execution time;

[0009] Each group of current vulnerability scanning tasks is assigned to one of the multiple scanning engines for execution.

[0010] According to a distributed vulnerability scanning method according to an embodiment of the present invention, the step of obtaining the execution time of each current vulnerability scanning task includes:

[0011] The execution time of each current vulnerability scanning task is obtained by multiplying the vulnerability database size used by each current vulnerability scanning task and the system and service of the scanned object by the corresponding weights and adding them together.

[0012] According to an embodiment of the present invention, the distributed vulnerability scanning method further includes, before the step of obtaining the execution time of each current vulnerability scanning task, multiplying the vulnerability database size used by each current vulnerability scanning task, and the system and service to be scanned by corresponding weights and adding the two together:

[0013] Obtaining an initial value of the weight based on a least squares method according to the size of the vulnerability database used by each historical vulnerability scanning task, the system and service of the scanned object, and the execution time;

[0014] Calculate the similarity between each current vulnerability scanning task and each historical vulnerability scanning task based on the vulnerability database size, the system and service of the scanned object used by each current vulnerability scanning task and the vulnerability database size, the system and service of the scanned object used by each historical vulnerability scanning task;

[0015] A first preset number of historical vulnerability scanning tasks with the highest similarity to each current vulnerability scanning task are selected, and the initial value of the weight is adjusted based on the gradient descent method according to the size of the vulnerability database used by the selected historical vulnerability scanning tasks, the system and service of the scanned object, and the execution time to obtain the final value of the weight.

[0016] According to an embodiment of the present invention, the distributed vulnerability scanning method includes the following steps: assigning each group of current vulnerability scanning tasks to one of the multiple scanning engines for execution:

[0017] Get the number and idleness of CPU cores of the device where each scanning engine is located;

[0018] Multiplying the number of CPU cores by the idleness level, and determining the number of groups of current vulnerability scanning tasks allocated to each scanning engine according to the product;

[0019] Distribute the current vulnerability scan tasks to the scan engines based on the number of groups assigned to each scan engine.

[0020] According to an embodiment of the present invention, the distributed vulnerability scanning method includes the following steps: assigning each group of current vulnerability scanning tasks to one of the multiple scanning engines for execution:

[0021] For any set of current vulnerability scanning tasks, each scanning engine is scored based on its maximum number of connections, the number of vulnerability scanning tasks to be executed, and the number of times the current vulnerability scanning task has been executed in the past.

[0022] Sorting all scanning engines according to the scores of each scanning engine, and determining the probability of the second preset number of scanning engines being assigned the current vulnerability scanning task according to the sorting results;

[0023] The group of current vulnerability scanning tasks is allocated according to the probability of allocating the group of current vulnerability scanning tasks to the second preset number of scanning engines.

[0024] According to an embodiment of the present invention, the distributed vulnerability scanning method further includes, for any group of current vulnerability scanning tasks, before the step of scoring each scanning engine based on the maximum number of connections that each scanning engine can make, the number of vulnerability scanning tasks to be executed, and the number of times the group of current vulnerability scanning tasks has been executed in the past:

[0025] Multiply the number of CPU cores, RAM capacity, and network bandwidth of each scanning engine by the corresponding weights and add them together to obtain the maximum number of connections for each scanning engine.

[0026] According to an embodiment of the present invention, the distributed vulnerability scanning method further includes, before the step of multiplying the number of CPU cores, RAM capacity, and network bandwidth of each scanning engine by corresponding weights and adding the sums, and obtaining the maximum number of connectable scan engines of each scanning engine:

[0027] If the network bandwidth of any scanning engine is greater than or equal to the preset network bandwidth threshold, the CPU and RAM capacity occupancy change rate and the network bandwidth change rate are obtained by continuously increasing the number of connections of the scanning engine;

[0028] Obtain weights of the number of CPU cores, RAM capacity, and network bandwidth based on the CPU and RAM capacity occupancy change rates and the network bandwidth change rate;

[0029] If the network bandwidth of any scanning engine is greater than 0 and less than the preset network bandwidth threshold, the weights of the number of CPU cores, RAM capacity and network bandwidth are determined according to the ratio between the network bandwidth of the scanning engine and the preset network bandwidth threshold.

[0030] According to an embodiment of the present invention, a distributed vulnerability scanning method includes the following steps: scoring each scanning engine based on the maximum number of connections that each scanning engine can make, the number of vulnerability scanning tasks to be executed, and the number of times the group of current vulnerability scanning tasks has been executed in the past:

[0031] Each scanning engine is scored based on the maximum number of connections that can be made to it, the weight corresponding to the maximum number of connections, the number of vulnerability scanning tasks to be executed, the weight corresponding to the number of vulnerability scanning tasks to be executed, the number of historical executions of the current vulnerability scanning task in the group, and the weight corresponding to the number of executions.

[0032] An embodiment of the present invention further provides a distributed vulnerability scanning system, including a scanning task management component, wherein the scanning task management component includes:

[0033] A calculation module is used to obtain the execution time of each current vulnerability scanning task, and divide the execution time of all current vulnerability scanning tasks by a preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks;

[0034] a grouping module, configured to group the current vulnerability scanning tasks according to the average execution time;

[0035] The allocation module is used to allocate each group of current vulnerability scanning tasks to one of the multiple scanning engines for execution.

[0036] The distributed vulnerability scanning system according to one embodiment of the present invention further includes a scanning control center, a vulnerability database, a scanning result database, and a message distribution server;

[0037] The scanning control center includes a scanning engine management component, a scanning task management component, a vulnerability library management component and a scanning result management component;

[0038] The scanning engine management component is used to scan and detect the operating status and load level of each scanning engine;

[0039] The scanning task management component is used to formulate and assign scanning tasks, and scan and detect the status and progress of vulnerability scanning tasks executed by each scanning engine;

[0040] The vulnerability database management component is used to obtain vulnerability data from the vulnerability database to perform scanning tasks and add new vulnerabilities;

[0041] The scan result management component is used to record and summarize the completion of vulnerability scanning tasks and vulnerabilities, and generate a scan result report;

[0042] The message distribution server is used to communicate and forward messages when performing scanning engine management, scanning task management and scanning result management;

[0043] The distributed vulnerability scanning system is deployed in an NFV environment.

[0044] An embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-described distributed vulnerability scanning methods are implemented.

[0045] An embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of any of the above-described distributed vulnerability scanning methods are implemented.

[0046] The distributed vulnerability scanning method and system provided by the embodiments of the present invention calculate the average execution time of each group of current vulnerability scanning tasks, automatically group the current vulnerability scanning tasks according to the average execution time, and automatically assign each group of current vulnerability scanning tasks to one of multiple scanning engines for execution. This not only improves the efficiency of task allocation, but also realizes batch scanning by grouping the current vulnerability scanning tasks, thereby reducing the total number of scans and improving the execution efficiency of vulnerability scanning tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 This is a flow chart of a distributed vulnerability scanning method provided by an embodiment of the present invention;

[0049] Figure 2 This is a schematic diagram of the structure of a distributed vulnerability scanning system provided by an embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of the overall structure of a distributed vulnerability scanning system provided by an embodiment of the present invention;

[0051] Figure 4 This is a structural diagram of NFV deployment in a distributed vulnerability scanning system provided by an embodiment of the present invention;

[0052] Figure 5 This is a schematic diagram of a process flow for managing a scanning engine in a distributed vulnerability scanning system provided by an embodiment of the present invention;

[0053] Figure 6 This is a schematic diagram of a process for vulnerability scanning task management in a distributed vulnerability scanning system provided by an embodiment of the present invention;

[0054] Figure 7 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0056] The following combination Figure 1 The distributed vulnerability scanning method according to an embodiment of the present invention includes: S101, obtaining the execution time of each current vulnerability scanning task, dividing the execution time of all current vulnerability scanning tasks by a preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks;

[0057] Specifically, multiple current vulnerability scanning tasks are obtained. Vulnerability scanning tasks with different task attributes may have different execution times. For example, the system corresponding to the vulnerability scanning task may be a Windows system or a Linux system. The execution time of each vulnerability scanning task is calculated based on the task attributes of each vulnerability scanning task, but is not limited to this calculation method. The total execution time of the current vulnerability scanning task is obtained by adding the execution time of each current vulnerability scanning task, and the execution time of each group of current vulnerability scanning tasks is obtained by dividing the total execution time by the preset number of groups. By allocating the same execution time to each group of current vulnerability scanning tasks, a fair distribution of vulnerability scanning tasks is achieved.

[0058] S102, grouping the current vulnerability scanning tasks according to the average execution time;

[0059] Specifically, after obtaining the average execution time of each group of vulnerability scanning tasks, the current vulnerability scanning tasks are grouped according to the average execution time, so that the sum of the execution time of each group of current vulnerability scanning tasks is equal to the average execution time. When grouping, the target address of the current vulnerability scanning task is taken into consideration, and the current vulnerability scanning tasks with the same target address are grouped as much as possible. The target address can be an IP (Internet Protocol) address or a domain name. When an exception occurs during the execution of a vulnerability scanning task, the execution of all tasks can be avoided by repeatedly executing the scanning task group where the exception occurs, thereby improving the fault tolerance of vulnerability scanning and the execution efficiency of the current vulnerability scanning task.

[0060] S103: Allocate each group of current vulnerability scanning tasks to one of the multiple scanning engines for execution.

[0061] Specifically, after the current vulnerability scanning tasks are grouped, they need to be assigned to the corresponding scanning engines, and the scanning engines are used to scan each group of current vulnerability scanning tasks to see if there are any vulnerabilities. Tasks can be evenly distributed to each scanning engine based on the number of available scanning engines, and the evenly distributed tasks include at least one group of vulnerability scanning tasks. Tasks can also be assigned to each scanning engine based on its status. For example, the number of available scanning engines and the number of CPU (central processing unit) cores of each scanning engine are obtained, and a corresponding proportion of scanning tasks are assigned to each scanning engine based on the number of its CPU cores. This embodiment is not limited to the method of assigning tasks to scanning engines.

[0062] After assigning each set of current vulnerability scanning tasks to a scanning engine, each scanning engine performs concurrent scanning on each set of tasks. Furthermore, the Scan Task Management Center monitors the status of the scanning engines in real time, including the number of CPU cores, RAM (Random Access Memory) capacity, network bandwidth, number of pending scan tasks, and previously executed scan tasks.

[0063] To ensure the normal execution of each vulnerability scanning task, an automatic fault-tolerance and error-correction mechanism is implemented for device and task anomalies. The status of the scanning engine is regularly scanned and monitored using a state-aware mechanism. If a target address in any vulnerability scanning task fails to complete the scheduled scan after multiple retries, for example, due to an inaccessible IP address, the target address can be automatically skipped and the scan can continue with the remaining target addresses in the vulnerability scanning task. Alternatively, the vulnerability scanning task can be marked as abnormal, pending assignment to another scanning engine by the scanning task management center.

[0064] If the scanning task management center does not receive a response from the scanning engine for a long time, or if the execution progress of any group of vulnerability scanning tasks remains unchanged for a long time, it is considered an anomaly and an anomaly alarm is issued. If an anomaly occurs in a vulnerability scanning task, the group task in which the vulnerability scanning task is located will be preferentially assigned to an idle scanning engine for rescanning. If the group of vulnerability scanning tasks is still judged to be abnormal after l rescans, the scanning task management center will mark the group execution as failed, for example, l = 3. If an anomaly occurs in a scanning engine, the unexecuted tasks in the faulty scanning engine will be assigned to other online available scanning engines for re-run, and the scanning engine can be restarted and recovered. This automatic fault-tolerant and error-correcting mechanism can improve the scanning performance of the scanning engine.

[0065] During vulnerability scanning, each scanning engine sends confirmation messages via the asynchronous message queue service, reporting scan results to the scan results database. Reports include the target address, system description, vulnerability name, vulnerability level, discovery time, and vulnerability description.

[0066] This embodiment calculates the average execution time of each group of current vulnerability scanning tasks, automatically groups the current vulnerability scanning tasks according to the average execution time, and automatically assigns each group of current vulnerability scanning tasks to one of multiple scanning engines for execution. This not only improves the efficiency of task allocation, but also enables batch scanning by grouping the current vulnerability scanning tasks, thereby reducing the total number of scans. When an exception occurs during the execution of a vulnerability scanning task, the execution of all tasks can be avoided by repeatedly executing the scanning task group where the exception occurs, thereby improving the fault tolerance of vulnerability scanning and the execution efficiency of vulnerability scanning tasks.

[0067] Based on the above embodiment, the step of obtaining the execution time of each current vulnerability scanning task in this embodiment includes: multiplying the vulnerability database size used by each current vulnerability scanning task and the system and service of the scanned object by the corresponding weights and adding them together to obtain the execution time of each current vulnerability scanning task.

[0068] Among them, the vulnerability database refers to the database that the scanning engine relies on to detect vulnerabilities, and is used to store the vulnerability data that has been discovered. According to the vulnerability database, it is judged whether there are the same or similar vulnerabilities in the current vulnerability scanning task as those in the vulnerability database, so as to confirm whether there are vulnerabilities in the current vulnerability scanning task. Therefore, the more vulnerabilities stored in the vulnerability database, the more vulnerabilities need to be compared and judged, and the longer the vulnerability scanning task will take to execute. The system of the scan object refers to the operating system, such as the Linux system or the Windows system. Since different operating systems have different versions, the time to execute the scanning task under different versions is also different. The service of the scan object refers to service systems such as Web (webpages), Ftp (File Transfer Protocol, file transfer protocol) and email. The number of connections, vulnerability types and scanning methods of different service systems are different. Therefore, the execution time is different when scanning different service systems.

[0069] Taking all of the above into consideration, the execution time of each current vulnerability scanning task is related to the size of the vulnerability database used and the system and services being scanned. The execution time of each current vulnerability scanning task is calculated as follows:

[0070] T=w o O+w s S+w n N;

[0071] Among them, T refers to the execution time of the task; O represents the type of system of the scanned object, and different types of operating systems can be represented by different numbers, such as number 1 represents the Linux operating system and number 2 represents the Windows operating system; S represents the type of service, and different types of services can be represented by different numbers, such as number 1 represents the Web service and number 2 represents the Ftp service; N represents the number of vulnerabilities stored in the vulnerability database. o 、w s and w n They are the size of the vulnerability database used, the weight of the system and service being scanned.

[0072] Based on the above embodiment, in this embodiment, the size of the vulnerability database used by each current vulnerability scanning task and the system and service of the scanned object are multiplied by corresponding weights and then added together. Before the step of obtaining the execution time of each current vulnerability scanning task, the method further includes: obtaining an initial value of the weight based on the size of the vulnerability database used by each historical vulnerability scanning task, the system and service of the scanned object, and the execution time of the task;

[0073] Specifically, m historical vulnerability scanning tasks are selected, and the sizes of the vulnerability databases used by them, N'1, N'2, ..., N', can be obtained according to the historical analysis report. m , the system type of the scanned object O'1, O'2, ..., O' m and the types of services are S'1, S'2, ..., S' m , the time to execute the scanning task is T'1, T'1, ..., T' m The number of historical vulnerability scanning tasks selected can be determined based on actual conditions, for example, m = 50. The formula for determining the initial weight value based on the analysis report of m historical vulnerability scanning tasks and the least squares method is as follows:

[0074]

[0075] Based on the vulnerability database size used by each current vulnerability scanning task, the system and services of the scanned object, and the vulnerability database size used by each historical vulnerability scanning task, the similarity between each current vulnerability scanning task and each historical vulnerability scanning task is calculated; a first preset number of historical vulnerability scanning tasks with the highest similarity to each current vulnerability scanning task are selected, and based on the vulnerability database size used by the selected historical vulnerability scanning tasks, the system and services of the scanned object, and the execution time, the initial value of the weight is adjusted based on the gradient descent method to obtain the final value of the weight.

[0076] The vulnerability database size used by each current scan task, the system and services scanned are combined into a vector. The vulnerability database size used by each historical scan task, the system and services scanned are combined into a vector. The similarity between the two vectors is then calculated. The weights are dynamically adjusted based on the k historical scan tasks with the highest similarity and the gradient descent method to obtain the weight value corresponding to the current scan task. The calculation formula for dynamic weight adjustment is as follows:

[0077]

[0078] Among them, w o 、w s and w n are the size of the vulnerability database used, the initial weight values ​​of the scanned system and services, and w' o , w′ s and w' n is the final value of the weight after dynamic adjustment, ρ is the dynamically adjusted learning rate, O' i 、S' i 、N' i and T' i where are the vulnerability database size, the scanned system, the service, and the execution time of the i-th historical scan task, respectively. The number of historical scan tasks with the highest similarity, k, and the learning rate, ρ, can be adjusted based on actual conditions; for example, k = 15 and ρ = 0.3. The similarity between two vectors can be calculated using Euclidean distance.

[0079] Based on the above embodiment, the steps of allocating each group of current vulnerability scanning tasks to one of multiple scanning engines for execution in this embodiment include: obtaining the number and idleness of CPU cores of the device where each scanning engine is located; multiplying the number of CPU cores by the idleness, and determining the number of groups of current vulnerability scanning tasks allocated to each scanning engine based on the product; and allocating the current vulnerability scanning tasks to the scanning engines based on the number of groups of current vulnerability scanning tasks allocated to each scanning engine.

[0080] Based on the above embodiment, the steps of allocating each group of current vulnerability scanning tasks to one of multiple scanning engines for execution in this embodiment include: for any group of current vulnerability scanning tasks, scoring each scanning engine based on the maximum number of connections that can be made to each scanning engine, the number of vulnerability scanning tasks to be executed, and the number of times the group of current vulnerability scanning tasks has been executed historically; sorting all scanning engines according to the score value of each scanning engine, and determining the probability of the second preset number of scanning engines being allocated to the group of current vulnerability scanning tasks based on the sorting result; and allocating the group of current vulnerability scanning tasks based on the probability of the second preset number of scanning engines being allocated to the group of current vulnerability scanning tasks.

[0081] Specifically, after vulnerability scanning tasks are grouped, they are assigned to various scanning engines. In addition to the allocation strategy mentioned in the above embodiment, it is also possible to score each scanning engine, sort all scanning engines according to their scores, and then assign the group of tasks to the second preset number of scanning engines in the sorting order with a preset probability. For example, according to the sorting result, the group of vulnerability scanning tasks is assigned to the second preset number of scanning engines in the sorting order. The probability of being assigned to the top n scanning engines is . The preset probability can be adjusted according to actual conditions.

[0082] Based on the above embodiment, in this embodiment, for any group of current vulnerability scanning tasks, the step of scoring each scanning engine according to the maximum connectable number of each scanning engine, the number of vulnerability scanning tasks to be executed, and the number of historical executions of the group of current vulnerability scanning tasks also includes: multiplying the number of CPU cores, RAM capacity, and network bandwidth of each scanning engine by the corresponding weights and adding them together to obtain the maximum connectable number of each scanning engine.

[0083] The maximum number of connections that can be connected refers to the number of connections that the scanning engine can accept. The CPU is primarily used for processing and computing data, while the RAM is primarily used for storing and computing data. The more CPU cores there are, the faster the scanning engine processes and computes; the larger the RAM capacity, the more data the scanning engine can store and compute. Therefore, the more CPU cores there are and the larger the RAM capacity, the greater the maximum number of connections that can be connected. Network bandwidth refers to the maximum rate at which network data is transmitted between the scanning engine and the control center. When the network bandwidth is low, the probability of data packet loss is high, and data may need to be sent repeatedly during transmission. Therefore, when the network bandwidth is low, new tasks cannot be temporarily assigned to the scanning engine. New tasks should be preferentially assigned to scanning engines with large network bandwidth.

[0084] Taking all the above into consideration, the relationship between the maximum number of connections and the number of CPU cores, RAM capacity, and network bandwidth can be expressed as follows:

[0085] N = αC + βR + γM;

[0086] Where C represents the number of CPU cores, R represents the RAM capacity, M represents the network bandwidth, α, β, and γ represent the corresponding weights, and α+β+γ=1.

[0087] Based on the above embodiment, in this embodiment, the number of CPU cores, RAM capacity and network bandwidth of each scanning engine are multiplied by the corresponding weights and then added together. Before the step of obtaining the maximum connectible number of each scanning engine, the following is also included: if the network bandwidth of any scanning engine is greater than or equal to the preset network bandwidth threshold, then by continuously increasing the number of connections of the scanning engine, the occupancy change rate of the CPU and RAM capacity and the network bandwidth change rate are obtained; according to the occupancy change rate of the CPU and RAM capacity and the network bandwidth change rate, the weights of the number of CPU cores, RAM capacity and network bandwidth are obtained; if the network bandwidth of any scanning engine is greater than 0 and less than the preset network bandwidth threshold, then according to the ratio between the network bandwidth of the scanning engine and the preset network bandwidth threshold, the weights of the number of CPU cores, RAM capacity and network bandwidth are determined.

[0088] Specifically, α, β, and γ are related to the size of the network bandwidth. When the network bandwidth is 0, the network is disconnected, and the scanning engine cannot continue to execute the task. That is, when M=0, γ=1, α=β=0; when M>>0, it can be obtained based on the occupancy change rate of the CPU and RAM capacity and the network bandwidth change rate. For example, γ=0.2, α=β=0.4. The weight calculation formula for the number of CPU cores, RAM capacity, and network bandwidth is as follows:

[0089]

[0090]

[0091] Among them, M mea Indicates the preset network bandwidth threshold. The average value of historical network bandwidth can be used as the preset network bandwidth threshold.

[0092] Based on the above embodiment, in this embodiment, the step of scoring each scanning engine according to the maximum connectable number of each scanning engine, the number of vulnerability scanning tasks to be executed, and the number of historical executions of the current vulnerability scanning tasks of this group includes: scoring each scanning engine according to the maximum connectable number of each scanning engine, the weight corresponding to the maximum connectable number, the number of vulnerability scanning tasks to be executed, the weight corresponding to the number of vulnerability scanning tasks to be executed, the number of historical executions of the current vulnerability scanning tasks of this group, and the weight corresponding to the number.

[0093] The number of vulnerability scanning tasks to be executed refers to the number of vulnerability scanning tasks that the scanning engine has not yet completed. If there are a large number of unfinished vulnerability scanning tasks, no new tasks can be assigned to the scanning engine to avoid overloading. Vulnerability scanning tasks to be executed should be assigned to scanning engines with less load as much as possible. The number of historical executions of the current vulnerability scanning task in this group refers to the number of times the scanning engine has scanned the target addresses in the current vulnerability scanning task in this group. Scanning engines with different attributes have different scanning methods and scanning characteristics. If a scanning engine has scanned a target address before, and if the scanning engine cannot detect the existence of a vulnerability in the target address in the historical scan, then when a scanning task containing the target address is assigned to the scanning engine again, the scanning engine still cannot detect the existence of a vulnerability in the target address. In order to avoid the influence of the scanning engine's own attributes on the scanning results, when the scanning engine is assigned a scanning task containing the target address again, the scanning engine should be avoided.

[0094] The calculation formula for scoring each scanning engine is as follows based on the maximum number of connected scanning engines, the number of vulnerability scanning tasks to be executed, and the number of times the current vulnerability scanning task of the group has been executed in the past:

[0095]

[0096] Where S is the score of each scanning engine, N, L, and P are the maximum number of scanning engines that can be connected, the number of vulnerability scanning tasks to be executed, and the number of times the current vulnerability scanning task of this group has been executed in history, respectively. λ, μ, and σ are their corresponding weights, and λ+μ+σ=1.

[0097] When different scanning tasks are assigned to the scanning engine, the corresponding λ, μ, and σ values ​​are different. Usually, the weight value of the maximum number of connections is set equal to the number of vulnerability scanning tasks to be executed. The weight of the number of times the current vulnerability scanning task of this group has been executed in history is relatively large, and the more times, the greater the weight. For example, λ=μ=0.2, σ=0.6. The values ​​of λ, μ, and σ change with the change of P. If the number of times the current vulnerability scanning task of this group has been executed in history is too many, the current vulnerability scanning task of this group cannot be assigned to the scanning engine, that is, P≥P max When, σ=1, λ=μ=0; where P max Sets the threshold for the number of times the current vulnerability scan task is executed in the preset history.

[0098] If the number of times any scanning engine has historically executed the current set of vulnerability scanning tasks is greater than 0 and less than the preset threshold for the number of times the current set of vulnerability scanning tasks has been executed historically, a standard simulated vulnerability database is scanned to analyze the impact of different N, L, and P values ​​on the scanning engine's score, and the weight value is determined based on the magnitude of the impact. As P increases, the rate of increase of σ becomes faster and faster, which can be approximated as an exponential change. The weight corresponding to the maximum number of connections, the weight corresponding to the number of vulnerability scanning tasks to be executed, and the weight corresponding to the historical execution of the current set of vulnerability scanning tasks are calculated as follows:

[0099]

[0100]

[0101] This embodiment provides a variety of task allocation strategies. By scheduling scans and monitoring the status of scanning engines, scanning tasks can be dynamically added according to the CPU usage of each scanning engine. Each scanning engine can also be scored and ranked according to its performance and historical scanning tasks, and scanning tasks can be dynamically added based on the ranking results, thereby greatly improving the execution efficiency of vulnerability scanning tasks.

[0102] The distributed vulnerability scanning system provided by an embodiment of the present invention is described below. The distributed vulnerability scanning system described below and the distributed vulnerability scanning method described above can be referenced to each other.

[0103] like Figure 2 As shown, this embodiment provides a distributed vulnerability scanning system, which includes a scanning task management component, and the scanning task management component includes: a calculation module 201, a grouping module 202 and an allocation module 203;

[0104] The calculation module 201 is used to obtain the execution time of each current vulnerability scanning task, and divide the execution time of all current vulnerability scanning tasks by the preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks;

[0105] Specifically, multiple current vulnerability scanning tasks are obtained. Vulnerability scanning tasks with different task attributes may have different execution times. For example, the system corresponding to the vulnerability scanning task may be a Windows system or a Linux system. The execution time of each vulnerability scanning task is calculated based on the task attributes of each vulnerability scanning task, but is not limited to this calculation method. The total execution time of the current vulnerability scanning task is obtained by adding the execution time of each current vulnerability scanning task, and the execution time of each group of current vulnerability scanning tasks is obtained by dividing the total execution time by the preset number of groups. By allocating the same execution time to each group of current vulnerability scanning tasks, a fair distribution of vulnerability scanning tasks is achieved.

[0106] A grouping module 202 is configured to group the current vulnerability scanning tasks according to the average execution time;

[0107] Specifically, after obtaining the average execution time of each group of vulnerability scanning tasks, the current vulnerability scanning tasks are grouped according to the average execution time, so that the sum of the execution time of each group of current vulnerability scanning tasks is equal to the average execution time. When grouping, the target address of the current vulnerability scanning task is taken into consideration, and the current vulnerability scanning tasks with the same target address are grouped as much as possible. The target address can be an IP (Internet Protocol) address or a domain name. When an exception occurs during the execution of a vulnerability scanning task, the execution of all tasks can be avoided by repeatedly executing the scanning task group where the exception occurs, thereby improving the fault tolerance of vulnerability scanning and the execution efficiency of the current vulnerability scanning task.

[0108] The allocation module 203 is configured to allocate each group of current vulnerability scanning tasks to one of the multiple scanning engines for execution.

[0109] Specifically, after grouping the current vulnerability scanning tasks, they need to be assigned to corresponding scanning engines. Each group of current vulnerability scanning tasks will be scanned by the scanning engines to determine if there are any vulnerabilities. Tasks can be evenly distributed to each scanning engine based on the number of available scanning engines, with the evenly distributed tasks containing at least one group of vulnerability scanning tasks. Alternatively, tasks can be assigned to each scanning engine based on its status.

[0110] After each set of current vulnerability scanning tasks is assigned to a scanning engine, each scanning engine concurrently scans the target addresses of each scanning task. In addition, the scanning task management center monitors the status of the scanning engines in real time.

[0111] To ensure the normal progress of each vulnerability scanning task, an automatic fault tolerance and error correction mechanism is implemented for device and task anomalies. A state-aware mechanism is used to periodically scan and monitor the status of the scanning engine. If a target address in any vulnerability scanning task fails to complete the scheduled scan after multiple retries, the target address can be automatically skipped and the scan can continue with the remaining targets in the task. Alternatively, the task can be marked as abnormal and the task can be assigned to another scanning engine by the scanning task management center.

[0112] If the scanning task management center does not receive a response from the scanning engine for an extended period of time, or if the execution progress of any group of vulnerability scanning tasks remains unchanged for an extended period of time, it is considered an anomaly and an anomaly alarm is issued. If an anomaly occurs in a vulnerability scanning task, the group of tasks containing the vulnerability scanning task will be preferentially assigned to an idle scanning engine for rescanning. If the group of vulnerability scanning tasks is still deemed an anomaly after one rescan, the scanning task management center will mark the group as having failed. If an anomaly occurs in a scanning engine, the unexecuted tasks in the failed scanning engine will be assigned to other online available scanning engines for rerun, and the scanning engine can be restarted and recovered. This automatic fault-tolerant and error-correcting mechanism can improve the scanning performance of the scanning engine.

[0113] During vulnerability scanning, each scanning engine sends a confirmation message via the asynchronous message queue service, reporting the scan results to the scan results database. The report includes the target address, system description, vulnerability name, vulnerability level, vulnerability discovery time, and vulnerability description.

[0114] This embodiment calculates the average execution time of each group of current vulnerability scanning tasks, automatically groups the current vulnerability scanning tasks according to the average execution time, and automatically assigns each group of current vulnerability scanning tasks to one of multiple scanning engines for execution. This not only improves the efficiency of task allocation, but also enables batch scanning by grouping the current vulnerability scanning tasks, thereby reducing the total number of scans. When an exception occurs during the execution of a vulnerability scanning task, the execution of all tasks can be avoided by repeatedly executing the scanning task group where the exception occurs, thereby improving the fault tolerance of vulnerability scanning and the execution efficiency of vulnerability scanning tasks.

[0115] Based on the above embodiment, this embodiment further includes a scan control center, a vulnerability database, a scan result database, and a message distribution server; the scan control center includes a scan engine management component, the scan task management component, a vulnerability library management component, and a scan result management component; wherein the scan engine management component is used to scan and detect the operating status and load level of each scan engine; the scan task management component is used to formulate and allocate scan tasks, and scan and detect the status and progress of each scan engine performing vulnerability scan tasks; the vulnerability library management component is used to obtain vulnerability data from the vulnerability database to execute scan tasks and add new vulnerabilities; the scan result management component is used to record and summarize the completion degree and vulnerabilities of vulnerability scan tasks and generate scan result reports; the message distribution server is used to convey and forward messages when performing scan engine management, scan task management, and scan result management;

[0116] Among them, the vulnerability database is used to store the vulnerability data that has been discovered; the scan result database uses a distributed NoSQL database to store the scan results, which is convenient for searching and analyzing the scan results. The message distribution server uses a distributed asynchronous message mechanism to achieve reliable transmission of scan status information and control instructions. The message distribution server supports message types including delivery messages, confirmation messages, and unique messages. Delivery messages refer to messages that do not require confirmation after being sent, such as device heartbeat information. Confirmation messages mean that the receiving end of the message needs to reply to the confirmation message, otherwise the sending end of the message will regard the message as not received and resend the message. Unique messages mean that both the sending and receiving devices need to store the serial number of the message and confirm whether the message is received for the first time. In addition, the system also includes many scanning engines, all of which form a scanning engine pool, and each scanning engine has a different model. The scanning engines in the scanning engine pool are uniformly managed and controlled by the scanning control center. Among them, the number and type of scanning engines in the scanning engine pool can change dynamically. The overall structural diagram of the distributed vulnerability scanning system is shown as follows: Figure 3 shown.

[0117] The distributed vulnerability scanning system is deployed in an NFV environment.

[0118] Specifically, the scanning control center and management interface are integrated into the OSS (Operation Support System) and BSS (Business Support System) modules of the NFV (Network Function Virtualization) architecture. Scan engine management and scan task management functions are implemented through the Os-Ma (OSS / BSS-NFV Management and Orchestration) interface. In the distributed vulnerability scanning system, the interface adapter connects to the scanning engine in EM (Network-element Management) mode, and manages the scanning engine, issues scan tasks, and controls them through the Ve-Vnfm (VNF / EM-VNF Manager) interface. The distributed vulnerability scanning system uses the NFVI (Network Functions Virtualization Infrastructure) cloud environment in NFV to host the computing, storage, and network resources required for operation, and implements the function of adding and deleting scanning engines through the Nf-Vi (NFVI-Virtualised Infrastructure Manager) interface. Figure 4 The figure shows the structural diagram of NFV deployment.

[0119] The NFV environment can be considered a telecom equipment virtualization method based on cloud computing. It unifies various access interfaces through standardized formats, enabling unified control. The OSS and BSS modules generally implement service provider management functions, exchanging data with the NFVO (Network Functions Virtualization Orchestration) through the OS-Ma interface. The EM system configures and manages VNF functions and has a one-to-one correspondence with each VNF. The VNFM (Network Functions Virtualization Manager) VNF management module primarily controls the VNF lifecycle, including instantiation, configuration, and shutdown, and typically has a one-to-one correspondence with each VNF. The VNFM exchanges data with the EM through the Ve-Vnfm interface to control the VNF. NFVI provides the VNF's operating environment, including the required hardware and software. Hardware includes compute, network, and storage resources; software primarily includes tools such as the hypervisor, network controller, and storage manager. NFVI virtualizes physical resources into virtual resources for use by the VNF. VIM (Virtualized Infrastructure Manager) controls the allocation of virtual resources of VNF, such as virtual computing, virtual storage, and virtual network. VIM manages NFVI through the Nf-Vi interface.

[0120] NFVO, VNFM, and VIM are key modules provided by NFV, implementing core operational functions. The OSS / BSS module is the interaction system provided by NFV. EM is the network element management system provided by NFV for managing VNF functions. NFVI is the operating environment provided by NFV. The Os-Ma interface, Ve-Vnfm interface, and Nf-Vi interface are all standard interfaces used for data exchange in NFV.

[0121] Taking all of the above into consideration, a distributed vulnerability scanning system can implement both scan engine management and scan task management. Scan engine management involves controlling and managing the scan engine through a software-defined approach within the scan control center. This involves presenting the controllable parameters of the scan engine as services within the scan control center. Programmatically, various scan engine parameters, including usernames, passwords, IP addresses, management ports, interface components, and extended parameters, can be manually configured and adjusted. Scan engines can also be deactivated and deleted, tasks assigned, task aborted, and status checked programmatically.

[0122] The scanning engine management component runs in the scanning control center and is responsible for packaging the manually configured parameters and operations into unified instructions and issuing them to the management interface. The instructions are then encapsulated in JSON format and sent via an asynchronous message queue. Because the instructions and data formats of each scanning engine vary, a management interface is required to achieve centralized and unified management of the scanning engines. Each scanning engine forwards instructions and transfers data with the scanning engine management component through the corresponding management interface. The management interface is responsible for receiving unified instructions from the scanning engine management component, translating the instructions into instructions that the scanning engine can understand, and issuing them to the corresponding scanning engine, thus achieving unified management and direct control of the scanning engine. The instructions for each scanning engine are different. The management interface is also responsible for converting the scanning engine's status data information and task execution data into the same data format before reporting them to the scanning control center, making the status perception of the scanning engine more centralized and convenient.

[0123] like Figure 5 The figure shows a schematic diagram of the scanning engine management process, including adding a scanning engine, configuring and controlling the scanning engine, and viewing and summarizing the scanning engine status. Adding a new scanning engine to a distributed system requires software-defined functionality. Ensure that the new scanning engine can be implemented in the distributed system as actual hardware, a virtual machine, or a virtualized functional network (VNF), and that the scanning control center can connect to it via a physical or virtual network. The new scanning engine's parameters are then configured in the scanning engine management component. The connection to the scanning engine is tested based on the configured parameters by sending confirmation messages via an asynchronous messaging service. Once the test is working properly, the scanning engine can be managed and assigned tasks. The scanning engine management component can also reset the scanning engine's password, IP address, port, and other configuration parameters. Changing parameters can signal a scanning engine restart via a unique message. The scanning engine management component can also deactivate and delete scanning engines by modifying their status and sending messages, as well as assign and terminate tasks through the management interface. A deactivated scanning engine will no longer receive scanning tasks unless the scanning engine management component sends a message to restore it to a usable state. In addition, the scanning engine management component detects scanning engine devices that are in normal operation, abnormal state, or cannot be sensed by performing regular scanning and monitoring on the scanning engines connected to the system, and displays them as abnormal states on the operation interface. The detection interval can be manually configured, such as an interval of 1 hour.

[0124] The scanning task management component of the scanning control center is responsible for allocating, managing and fault-tolerant scanning tasks. The flowchart of scanning task management is as follows: Figure 6The vulnerability scanning task definition and task attributes include: task name, target system range list to be scanned, scanning strategy, task priority, and grouping strategy.

[0125] This embodiment deploys the vulnerability scanning system using NFV, enabling 24 / 7 access to the scanning engine. It supports various models of scanning engines, whether they are standalone hardware or virtual machines. This software-defined approach to scanning engine management allows for manual configuration of various engine information through programmatic means, by adding an agent service to the scanning engine. This allows for operations such as adding, controlling, and viewing the status of the scanning engine, making management and control of the scanning engine more convenient and flexible.

[0126] Figure 7 An example of a physical structure diagram of an electronic device is shown below. Figure 7 As shown, the electronic device may include: a processor 701, a communications interface 702, a memory 703, and a communication bus 704, wherein the processor 701, the communications interface 702, and the memory 703 communicate with each other via the communication bus 704. The processor 701 may call logic instructions in the memory 703 to execute a distributed vulnerability scanning method, which includes: obtaining the execution time of each current vulnerability scanning task, dividing the execution time of all current vulnerability scanning tasks by a preset number of groups to obtain an average execution time of each group of current vulnerability scanning tasks; grouping the current vulnerability scanning tasks according to the average execution time; and assigning each group of current vulnerability scanning tasks to one of a plurality of scanning engines for execution.

[0127] In addition, the logic instructions in the above-mentioned memory 703 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0128] On the other hand, an embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the distributed vulnerability scanning method provided by the above-mentioned method embodiments, the method including: obtaining the execution time of each current vulnerability scanning task, dividing the execution time of all current vulnerability scanning tasks by a preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks; grouping the current vulnerability scanning tasks according to the average execution time; and assigning each group of current vulnerability scanning tasks to one of multiple scanning engines for execution.

[0129] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the distributed vulnerability scanning method provided by the above-mentioned embodiments. The method includes: obtaining the execution time of each current vulnerability scanning task, dividing the execution time of all current vulnerability scanning tasks by a preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks; grouping the current vulnerability scanning tasks according to the average execution time; and assigning each group of current vulnerability scanning tasks to one of multiple scanning engines for execution.

[0130] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0131] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A distributed vulnerability scanning method, characterized in that: include: Obtain the execution time of each current vulnerability scanning task, and divide the execution time of all current vulnerability scanning tasks by the preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks; Grouping the current vulnerability scanning tasks according to the average execution time; Allocate each set of current vulnerability scanning tasks to one of the multiple scanning engines for execution; The steps of obtaining the execution time of each current vulnerability scanning task include: The execution time of each current vulnerability scanning task is obtained by multiplying the vulnerability database size used by each current vulnerability scanning task, the system and service of the scanned object by the corresponding weights and adding them together; The step of multiplying the size of the vulnerability database used by each current vulnerability scanning task, the system and service of the scanned object by corresponding weights and then adding them together, and obtaining the execution time of each current vulnerability scanning task also includes: Obtaining an initial value of the weight based on a least squares method according to the size of the vulnerability database used by each historical vulnerability scanning task, the system and service of the scanned object, and the execution time; Calculate the similarity between each current vulnerability scanning task and each historical vulnerability scanning task based on the vulnerability database size, the system and service of the scanned object used by each current vulnerability scanning task and the vulnerability database size, the system and service of the scanned object used by each historical vulnerability scanning task; A first preset number of historical vulnerability scanning tasks with the highest similarity to each current vulnerability scanning task are selected, and the initial value of the weight is adjusted based on the gradient descent method according to the size of the vulnerability database used by the selected historical vulnerability scanning tasks, the system and service of the scanned object, and the execution time to obtain the final value of the weight.

2. The distributed vulnerability scanning method according to claim 1, characterized in that: The steps of assigning each set of current vulnerability scanning tasks to one of the multiple scanning engines for execution include: Get the number and idleness of CPU cores of the device where each scanning engine is located; Multiplying the number of CPU cores by the idleness level, and determining the number of groups of current vulnerability scanning tasks allocated to each scanning engine according to the product; Distribute the current vulnerability scan tasks to the scan engines based on the number of groups assigned to each scan engine.

3. The distributed vulnerability scanning method according to claim 1, wherein: The steps of assigning each set of current vulnerability scanning tasks to one of the multiple scanning engines for execution include: For any set of current vulnerability scanning tasks, each scanning engine is scored based on its maximum number of connections, the number of vulnerability scanning tasks to be executed, and the number of times the current vulnerability scanning task has been executed in the past. Sorting all scanning engines according to the scores of each scanning engine, and determining the probability of the second preset number of scanning engines being assigned the current vulnerability scanning task according to the sorting results; The group of current vulnerability scanning tasks is allocated according to the probability of allocating the group of current vulnerability scanning tasks to the second preset number of scanning engines.

4. The distributed vulnerability scanning method according to claim 3, characterized in that: For any set of current vulnerability scanning tasks, the scoring step for each scanning engine includes the following steps: Multiply the number of CPU cores, RAM capacity, and network bandwidth of each scanning engine by the corresponding weights and add them together to obtain the maximum number of connections for each scanning engine.

5. The distributed vulnerability scanning method according to claim 4, characterized in that: The number of CPU cores, RAM capacity, and network bandwidth of each scanning engine are multiplied by their corresponding weights and then added together. Before obtaining the maximum number of connections for each scanning engine, the following steps are also included: If the network bandwidth of any scanning engine is greater than or equal to the preset network bandwidth threshold, the CPU and RAM capacity occupancy change rate and the network bandwidth change rate are obtained by continuously increasing the number of connections of the scanning engine; Obtain weights of the number of CPU cores, RAM capacity, and network bandwidth based on the CPU and RAM capacity occupancy change rates and the network bandwidth change rate; If the network bandwidth of any scanning engine is greater than 0 and less than the preset network bandwidth threshold, the weights of the number of CPU cores, RAM capacity and network bandwidth are determined according to the ratio between the network bandwidth of the scanning engine and the preset network bandwidth threshold.

6. The distributed vulnerability scanning method according to claim 3, characterized in that: The steps for scoring each scanning engine include: Each scanning engine is scored based on the maximum number of connections that can be made to it, the weight corresponding to the maximum number of connections, the number of vulnerability scanning tasks to be executed, the weight corresponding to the number of vulnerability scanning tasks to be executed, the number of historical executions of the current vulnerability scanning task in the group, and the weight corresponding to the number of executions.

7. A distributed vulnerability scanning system, characterized in that: The scanning task management component includes: A calculation module is used to obtain the execution time of each current vulnerability scanning task, and divide the execution time of all current vulnerability scanning tasks by a preset number of groups to obtain the average execution time of each group of current vulnerability scanning tasks; a grouping module, configured to group the current vulnerability scanning tasks according to the average execution time; an allocation module for allocating each set of current vulnerability scanning tasks to one of the plurality of scanning engines for execution; The step of obtaining the execution time of each current vulnerability scanning task includes: multiplying the size of the vulnerability database used by each current vulnerability scanning task, the system and service of the scanned object by corresponding weights, and then adding them together to obtain the execution time of each current vulnerability scanning task; The step of multiplying the size of the vulnerability database used by each current vulnerability scanning task, the system and service of the scanned object by corresponding weights and then adding them together, and obtaining the execution time of each current vulnerability scanning task also includes: Obtaining an initial value of the weight based on a least squares method according to the size of the vulnerability database used by each historical vulnerability scanning task, the system and service of the scanned object, and the execution time; Calculate the similarity between each current vulnerability scanning task and each historical vulnerability scanning task based on the vulnerability database size, the system and service of the scanned object used by each current vulnerability scanning task and the vulnerability database size, the system and service of the scanned object used by each historical vulnerability scanning task; A first preset number of historical vulnerability scanning tasks with the highest similarity to each current vulnerability scanning task are selected, and the initial value of the weight is adjusted based on the gradient descent method according to the size of the vulnerability database used by the selected historical vulnerability scanning tasks, the system and service of the scanned object, and the execution time to obtain the final value of the weight.

8. The distributed vulnerability scanning system according to claim 7, characterized in that: It also includes a scan control center, vulnerability database, scan result database, and message distribution server; The scanning control center includes a scanning engine management component, a scanning task management component, a vulnerability library management component and a scanning result management component; The scanning engine management component is used to scan and detect the operating status and load level of each scanning engine; The scanning task management component is used to formulate and assign scanning tasks, and scan and detect the status and progress of vulnerability scanning tasks executed by each scanning engine; The vulnerability database management component is used to obtain vulnerability data from the vulnerability database to perform scanning tasks and add new vulnerabilities; The scan result management component is used to record and summarize the completion of vulnerability scanning tasks and vulnerabilities, and generate a scan result report; The message distribution server is used to communicate and forward messages when performing scanning engine management, scanning task management and scanning result management; The distributed vulnerability scanning system is deployed in an NFV environment.

Images