Vulnerability scanning method, device, electronic device, medium and product
By comparing the changes in system environment parameters, and directly using the previous vulnerability scan results, the problem of vulnerability scan consumes too much CPU resources, improving user experience and ensuring system security.
Patent Information
- Application Number
- CN202111564943.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-20
- Publication Date
- 2024-12-06
- Estimated Expiration
- 2041-12-20
AI Technical Summary
Existing vulnerability scanning methods consume a large amount of CPU resources, resulting in poor user experience, especially on old devices, which may cause machine lag and affect normal use.
By comparing whether the system environment parameters of the preset monitoring point change with the parameters during the previous scan, if it does not change, use the previous scan results directly to avoid repeated scans and save CPU resources.
It effectively alleviates the excessive use of CPU resources by vulnerability scanning, improves user experience, avoids machine lag, and ensures system security.
Smart Images
Figure CN114491545B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability scanning method, device, electronic equipment, medium and product. Background Art
[0002] Vulnerabilities are defects in the specific implementation of hardware, software, protocols, or system security policies. Attackers can use these defects to access or damage the system without authorization. Therefore, it is necessary to perform vulnerability scans on the system in real time to discover vulnerabilities, and then use patches to repair the scanned vulnerabilities.
[0003] Among them, the basic principle of vulnerability scanning is to load a vulnerability library through a program. The vulnerability library contains many rules (the rules include but are not limited to the version number of the operating system, the version number of a file inside the system, and a certain software installed on the computer). Each rule is a logical operation. When the operation result of a rule is TRUE, it indicates that the computer has this vulnerability. If no rule's operation result is TRUE, it indicates that the system has no vulnerability.
[0004] The vulnerability library generally contains a large number of rules, and a large amount of CPU resources will be consumed when calculating these rules, which will bring users a bad product experience such as computer lag. If the user's machine is old, the scanning process will directly cause the machine to lag severely or even become unusable, affecting the normal use of the computer and causing an extremely poor user experience. Summary of the invention
[0005] The present invention provides a vulnerability scanning method, device, electronic device, medium and product to solve the above-mentioned defects.
[0006] The present invention provides a vulnerability scanning method, comprising: obtaining the system environment parameters corresponding to the preset monitoring point in the target system at the current moment; judging whether the system environment parameters corresponding to the preset monitoring point at the current moment are changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment; wherein the previous moment is the moment of the previous vulnerability scanning of the target system; when the system environment parameters corresponding to the preset monitoring point at the current moment are not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, taking the vulnerability scanning result of the target system at the previous moment as the vulnerability scanning result of the target system at the current moment.
[0007] According to a vulnerability scanning method provided by the present invention, the method also includes: when the system environment parameters corresponding to the preset monitoring point at the current moment are changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, a vulnerability scan is performed on the target system to obtain the vulnerability scanning result of the target system at the current moment.
[0008] According to a vulnerability scanning method provided by the present invention, the method further includes: storing the vulnerability scanning result of the target system at the current moment.
[0009] According to a vulnerability scanning method provided by the present invention, before obtaining the system environment parameters corresponding to the preset monitoring point in the target system at the current moment, the method also includes: setting the monitoring point in at least one of the following components: a timer for recording the cache time of the vulnerability scanning result of the target system at the previous moment, a system software component list, a patch library, and a storage unit for recording the operating system version number of the target system.
[0010] According to a vulnerability scanning method provided by the present invention, it is determined whether the system environment parameters corresponding to the preset monitoring point at the current moment have changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, including: determining whether the storage duration of the vulnerability scanning result of the target system at the previous moment in the cache exceeds a predetermined time threshold; and / or determining whether the system software component list of the target system at the current moment has changed compared with the system software component list of the target system at the previous moment; and / or determining whether the patch library in the target system at the current moment has changed compared with the patch library in the target system at the previous moment; and / or determining whether the operating system version number of the target system at the current moment has changed compared with the operating system version number of the target system at the previous moment.
[0011] The present invention also provides a vulnerability scanning device, including: a parameter acquisition module, used to obtain the system environment parameters corresponding to the preset monitoring point in the target system at the current moment; a parameter judgment module, used to judge whether the system environment parameters corresponding to the preset monitoring point at the current moment are changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment; wherein the previous moment is the moment when the target system was last scanned for vulnerabilities; a vulnerability result acquisition module, used to use the vulnerability scanning result of the target system at the previous moment as the vulnerability scanning result of the target system at the current moment when the system environment parameters corresponding to the preset monitoring point at the current moment are not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment.
[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned vulnerability scanning methods are implemented.
[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned vulnerability scanning methods are implemented.
[0014] The present invention also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned vulnerability scanning methods when executed by a processor.
[0015] The vulnerability scanning method, device, electronic device, medium and product provided by the present invention, wherein the vulnerability scanning method determines whether two vulnerabilities have changed by judging whether the system environment parameters corresponding to the preset monitoring point at the current moment have changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment. If no change has occurred, the vulnerability scanning result at the previous moment is directly used as the vulnerability scanning result of the target system at the current moment. Therefore, in the process of real-time vulnerability scanning of the system, the system environment parameters corresponding to all preset monitoring points do not change, and the vulnerability scanning result will not change, so as to solve the problem of excessive occupation of CPU resources by vulnerability scanning, alleviate machine freezes and improve user experience. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0017] Figure 1 The following is a schematic diagram of the vulnerability scanning method provided by the embodiment of the present invention. Figure 1 ;
[0018] Figure 2 Schematic diagram of the vulnerability scanning method provided by the embodiment of the present invention Figure 2 ;
[0019] Figure 3 A schematic diagram of the structure of a vulnerability scanning device provided by an embodiment of the present invention;
[0020] Figure 4 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0021] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0022] Figure 1The following is a schematic diagram of the vulnerability scanning method provided by the embodiment of the present invention. Figure 1 ;like Figure 1 As shown, the vulnerability scanning method provided by the embodiment of the present invention includes the following steps:
[0023] Step 101, obtaining the system environment parameters corresponding to the preset monitoring points in the target system at the current moment.
[0024] In this step, the system that needs real-time vulnerability scanning is taken as the target system. The objects monitored by the monitoring point are multiple system components that affect the scanning results, which are obtained by analyzing the vulnerability scanning results obtained at different times of different systems. When the system environment corresponding to the system component changes, the vulnerability scanning result will change. If the system environment has not changed, the vulnerability will not change during the scanning process. For example: after the system software component list (indicating whether the number of system software has changed or whether the system software version has been updated), the operating system version number (whether the operating system has been updated), etc., the corresponding vulnerability will be different, resulting in a change in the vulnerability scanning result. Determine whether the vulnerability scanning result has changed by obtaining the system environment parameters corresponding to the preset monitoring point in real time.
[0025] Step 102, determining whether the system environment parameter corresponding to the preset monitoring point at the current moment has changed compared with the system environment parameter corresponding to the preset monitoring point at the previous moment.
[0026] The previous moment is the moment when the target system was previously scanned for vulnerabilities.
[0027] In this step, by comparing the system environment parameters corresponding to the current moment with the system environment parameters corresponding to the previous moment, it is determined whether the preset monitoring point has changed. If the system environment parameters corresponding to the current moment are different from the system environment parameters corresponding to the previous moment, it means that the preset monitoring point has changed, and the current vulnerability will be different from the vulnerability found in the previous scanning process. The system needs to be re-scanned to determine the new vulnerability; if the system environment parameters at the current moment are the same as the system environment parameters at the previous moment, then the current vulnerability is the same as the vulnerability obtained in the previous scan and will not change. For example: if the system version number is updated, the vulnerability that can be scanned at the current moment is exclusive to the latest system, which is different from the vulnerability obtained in the previous scan and belongs to the old system; if the system environment parameters including the system version number and other preset monitoring points have not changed, then the vulnerability scan at the current moment is no different from the vulnerability scan of the previous scan.
[0028] Step 103, when the system environment parameters corresponding to the preset monitoring point at the current moment are not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, the vulnerability scanning result of the target system at the previous moment is used as the vulnerability scanning result of the target system at the current moment.
[0029] In this step, if the system environment parameters of all preset monitoring points at the current moment have not changed compared with the system environment parameters at the previous moment, the vulnerability scan result at the previous moment is directly used as the vulnerability scan result at the current moment, and the target system does not need to be scanned from the beginning. If the system environment parameters at the current moment have changed compared with the system environment parameters at the previous moment, the target system needs to be re-scanned to update the vulnerability; or if the scan at the current moment is the first scan and there is no previous scan (i.e., the system environment parameters at the previous moment are no, and the system environment parameters at the current moment are yes), then a complete scan of the target system is required.
[0030] The vulnerability scanning method provided by the embodiment of the present invention determines whether the two vulnerabilities have changed by judging whether the system environment parameters corresponding to the preset monitoring point at the current moment have changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment. If no change has occurred, the vulnerability scanning result at the previous moment is directly used as the vulnerability scanning result of the target system at the current moment. In this way, during the real-time vulnerability scanning of the system, the system environment parameters corresponding to all preset monitoring points do not change, and the vulnerability scanning results will not change, so as to solve the problem of excessive CPU resource occupation by vulnerability scanning, alleviate machine freezes, and improve user experience.
[0031] Furthermore, the method also includes: when the system environment parameters corresponding to the preset monitoring point at the current moment are changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, performing a vulnerability scan on the target system to obtain the vulnerability scanning result of the target system at the current moment.
[0032] Specifically, if the current system environment parameter corresponding to a preset monitoring point changes compared with the system environment parameter at the previous moment, and the corresponding vulnerability changes, a complete vulnerability scan of the system is required to obtain the vulnerability scan result at the current moment.
[0033] It should be noted that the change in system environment parameters also includes the situation where the system environment parameters were absent at the previous moment and are present at the current moment, that is, the first vulnerability scan requires a complete and comprehensive scan of the target system.
[0034] The vulnerability scanning method provided by the embodiment of the present invention performs a vulnerability scan on the target system when the system environment parameters corresponding to the current moment are changed compared with the system environment parameters corresponding to the previous moment, and obtains the vulnerability scanning result at the current moment, so as to discover vulnerabilities in the new system environment in real time and improve the security of the system.
[0035] Furthermore, the method also includes: storing the vulnerability scanning result of the target system at the current moment.
[0036] Specifically, the vulnerability scanning results at each moment are saved in real time. If the current system environment parameters of all preset monitoring points have not changed compared with the system environment parameters at the previous moment, the latest vulnerability scanning result (that is, the vulnerability scanning result at the previous moment) is obtained from the stored vulnerability scanning results as the vulnerability scanning result at the current moment.
[0037] The vulnerability scanning method provided by the embodiment of the present invention stores the vulnerability scanning results of the target system at the current moment, so that when the system environment parameters at the current moment corresponding to all preset monitoring points have not changed compared with the system environment parameters at the previous moment, the vulnerability scanning results at the current moment are directly obtained from the stored vulnerability scanning results, without the need to perform a complete vulnerability scan on the system, reducing the occupancy of CPU resources, improving user experience while ensuring the security of the system.
[0038] Furthermore, before obtaining the system environment parameters corresponding to the preset monitoring points in the target system at the current moment, the method further includes:
[0039] Set monitoring points in at least one of the following components:
[0040] A timer for recording the cache time of the vulnerability scan result of the target system at the previous moment, a list of system software components, a patch library, and a storage unit for recording the operating system version number of the target system.
[0041] Specifically, the system components that need to be monitored include a timer that records the cache time of vulnerability scan results, a list of system software components, a patch library, and a storage unit that records the operating system version number. The longer the cache time recorded by the timer, the lower the validity of the corresponding vulnerability scan result, and the system needs to rescan to determine the vulnerability; changes in the system software component list can reflect whether there is a change in the number of software in the system or whether the software version is updated. If there is a change, the corresponding vulnerability will also change and need to be rescanned; the patch library is a variety of patch strategies for vulnerabilities. If the patch library changes, the patch strategy for existing vulnerabilities will change or a new vulnerability patch strategy will be added, which requires rescanning; when the operating system version (such as win7, win10, etc.) changes, the corresponding vulnerability will also change, and the system needs to be rescanned.
[0042] The vulnerability scanning method provided by the embodiment of the present invention monitors the system components that affect the vulnerability scanning results in real time by setting monitoring points under multiple system components such as a timer for recording the cache time of the vulnerability scanning results of the target system at the previous moment, a system software component list, a patch library, and a storage unit for recording the operating system version number of the target system, and then determines whether a complete scan of the system is required based on the monitoring results, which can save CPU resource usage, improve user experience, and ensure system security.
[0043] Further, determining whether the system environment parameter corresponding to the preset monitoring point at the current moment has changed compared with the system environment parameter corresponding to the preset monitoring point at the previous moment includes:
[0044] Determine whether the storage duration of the vulnerability scan result of the target system at the previous moment in the cache exceeds a predetermined time threshold; and / or
[0045] Determine whether the system software component list of the target system at the current moment has changed compared to the system software component list of the target system at the previous moment; and / or
[0046] Determine whether the patch library in the target system at the current moment has changed compared to the patch library in the target system at the previous moment; and / or
[0047] It is determined whether the operating system version number of the target system at the current moment has changed compared with the operating system version number of the target system at the previous moment.
[0048] In this embodiment, the predetermined time threshold is set to 2 days. If the storage duration of the vulnerability scan result at the previous moment in the cache exceeds 2 days, it indicates that the accuracy of the vulnerability scan result at the previous moment is reduced. It cannot be used as the vulnerability scan result at the current moment when the system environment parameters of all preset monitoring points have not changed, and the system needs to be rescanned.
[0049] If software components are added or removed from the system software component list, a rescan is also required; if the patch library is updated, a rescan is also required; if the operating system is upgraded or reinstalled to an old version, the system also needs to be rescanned for vulnerabilities.
[0050] The vulnerability scanning method provided by the embodiment of the present invention determines whether the system needs to be re-scanned for vulnerabilities by real-time monitoring the storage duration of the vulnerability scanning result at the previous moment, the system software component list, the patch library, the operating system version number and other system components, thereby improving the problem of lag caused by excessive CPU resource usage caused by each vulnerability scan.
[0051] Figure 2Schematic diagram of the vulnerability scanning method provided by the embodiment of the present invention Figure 2 ;like Figure 2 As shown, a vulnerability scanning method includes:
[0052] Step 201, determine whether the system stores the vulnerability scan result of the previous moment, if it is determined to be yes, proceed to step 202, if it is determined to be no, proceed to step 207;
[0053] Step 202, determining whether the storage time of the vulnerability scan result at the previous moment exceeds a threshold, if it exceeds, it is determined to be invalid, and the process goes to step 207, if it does not exceed the threshold, it is determined to be valid, and the process goes to step 203;
[0054] Step 203, determining whether the system software component list has changed, if so, proceeding to step 207, if not, proceeding to step 204;
[0055] Step 204, determine whether the patch library has been changed, if so, proceed to step 207, if not, proceed to step 205;
[0056] Step 205, determine whether the operating system version number has changed, if it has changed, go to step 207, if it has not changed, go to step 206;
[0057] Step 206, obtaining the vulnerability scan result of the previous moment from the stored vulnerability scan results as the vulnerability scan result of the current moment, and the vulnerability scan is terminated;
[0058] Step 207, re-scan the system for vulnerabilities to obtain the vulnerability scan results at the current moment, and the vulnerability scan is completed.
[0059] The vulnerability scanning method provided by the embodiment of the present invention determines whether the two vulnerabilities have changed by judging whether the system environment parameters corresponding to the preset monitoring point at the current moment have changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment. If no change has occurred, the vulnerability scanning result at the previous moment is directly used as the vulnerability scanning result of the target system at the current moment. In this way, during the real-time vulnerability scanning of the system, the system environment parameters corresponding to all preset monitoring points do not change, and the vulnerability scanning results will not change. The characteristic is that the system environment parameters corresponding to all preset monitoring points do not change, so as to solve the problem of excessive occupation of CPU resources by vulnerability scanning, alleviate machine freezes, and improve user experience.
[0060] The vulnerability scanning device provided by the present invention is described below. The vulnerability scanning device described below and the vulnerability scanning method described above can be referenced to each other.
[0061] Figure 3 A schematic diagram of the structure of a vulnerability scanning device provided by an embodiment of the present invention; Figure 3As shown, a vulnerability scanning device includes:
[0062] The parameter acquisition module 401 is used to acquire the system environment parameters corresponding to the preset monitoring points in the target system at the current moment.
[0063] In the parameter acquisition module 401, the system that needs real-time vulnerability scanning is taken as the target system. The object monitored by the monitoring point is a plurality of system components that affect the scanning results, which are obtained by analyzing the vulnerability scanning results obtained at different times of different systems. When the system environment corresponding to the system component changes, the vulnerability scanning result will change. If the system environment has not changed, the vulnerability will not change during the scanning process. For example: after the system software component list (indicating whether the number of system software has changed or whether the system software version has been updated), the operating system version number (whether the operating system has been updated), etc., changes, the corresponding vulnerability will be different, resulting in changes in the vulnerability scanning results. Whether the vulnerability scanning results have changed is determined by obtaining the system environment parameters corresponding to the preset monitoring point in real time.
[0064] The parameter determination module 402 is used to determine whether the system environment parameter corresponding to the preset monitoring point at the current moment has changed compared with the system environment parameter corresponding to the preset monitoring point at the previous moment.
[0065] The previous moment is the moment when the target system was previously scanned for vulnerabilities.
[0066] In parameter judgment module 402, by comparing the system environment parameters corresponding to the current moment with the system environment parameters corresponding to the previous moment, it is determined whether the preset monitoring point has changed. If the system environment parameters corresponding to the current moment are different from the system environment parameters corresponding to the previous moment, it means that the preset monitoring point has changed, and the current vulnerability will be different from the vulnerability found in the previous scanning process. The system needs to be re-scanned to determine the new vulnerability; if the system environment parameters at the current moment are the same as the system environment parameters at the previous moment, then the current vulnerability is the same as the vulnerability obtained in the previous scan and will not change. For example: if the system version number is updated, the vulnerability that can be scanned at the current moment is exclusive to the latest system, and is different from the vulnerability that belongs to the old system obtained in the previous scan; if the system environment parameters including the system version number and other preset monitoring points have not changed, then the vulnerability scan at the current moment is no different from the vulnerability scan of the previous scan.
[0067] The vulnerability result acquisition module 403 is used to use the vulnerability scanning result of the target system at the previous moment as the vulnerability scanning result of the target system at the current moment when the system environment parameters corresponding to the preset monitoring point at the current moment have not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment.
[0068] In the vulnerability result acquisition module 403, if the system environment parameters of all preset monitoring points at the current moment have not changed compared with the system environment parameters at the previous moment, the vulnerability scan result at the previous moment is directly used as the vulnerability scan result at the current moment, and the target system does not need to be scanned from the beginning. If the system environment parameters at the current moment have changed compared with the system environment parameters at the previous moment, the target system needs to be re-scanned to update the vulnerability; or if the scan at the current moment is the first scan and there is no previous moment (i.e., the system environment parameters at the previous moment are no, and the system environment parameters at the current moment are yes), then a complete scan of the target system is required.
[0069] The vulnerability scanning device provided by the embodiment of the present invention determines whether two vulnerabilities have changed by judging whether the system environment parameters corresponding to the preset monitoring point at the current moment have changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment. If no change has occurred, the vulnerability scanning result at the previous moment is directly used as the vulnerability scanning result of the target system at the current moment. In this way, during the real-time vulnerability scanning of the system, the system environment parameters corresponding to all preset monitoring points do not change, and the vulnerability scanning result does not change, so as to solve the problem of excessive occupation of CPU resources by vulnerability scanning, alleviate machine freezes, and improve user experience.
[0070] Furthermore, the device also includes: a vulnerability scanning module, which is used to perform a vulnerability scan on the target system when the system environment parameters corresponding to the preset monitoring point at the current moment change compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, and obtain the vulnerability scanning result of the target system at the current moment.
[0071] Specifically, if the current system environment parameter corresponding to a preset monitoring point changes compared with the system environment parameter at the previous moment, and the corresponding vulnerability changes, a complete vulnerability scan of the system is required to obtain the vulnerability scan result at the current moment.
[0072] It should be noted that the change in system environment parameters also includes the situation where the system environment parameters were absent at the previous moment and are present at the current moment, that is, the first vulnerability scan requires a complete and comprehensive scan of the target system.
[0073] The vulnerability scanning device provided by the embodiment of the present invention performs a vulnerability scan on the target system when the system environment parameters corresponding to the current moment are changed compared with the system environment parameters corresponding to the previous moment, and obtains the vulnerability scanning results at the current moment, so as to discover vulnerabilities in the new system environment in real time and improve the security of the system.
[0074] Figure 4 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 4 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the vulnerability scanning method, which includes: obtaining the system environment parameters corresponding to the preset monitoring point in the target system at the current moment; judging whether the system environment parameters corresponding to the preset monitoring point at the current moment are changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment; wherein the previous moment is the moment of the previous vulnerability scanning of the target system; when the system environment parameters corresponding to the preset monitoring point at the current moment are not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, the vulnerability scanning result of the target system at the previous moment is used as the vulnerability scanning result of the target system at the current moment.
[0075] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.
[0076] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the vulnerability scanning method provided by the above-mentioned methods, which includes: obtaining the system environment parameters corresponding to the preset monitoring point in the target system at the current moment; judging whether the system environment parameters corresponding to the preset monitoring point at the current moment are changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment; wherein the previous moment is the moment of the previous vulnerability scan of the target system; when the system environment parameters corresponding to the preset monitoring point at the current moment are not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, the vulnerability scanning result of the target system at the previous moment is used as the vulnerability scanning result of the target system at the current moment.
[0077] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the vulnerability scanning method provided by the above-mentioned methods, the method comprising: obtaining the system environment parameters corresponding to the preset monitoring point in the target system at the current moment; determining whether the system environment parameters corresponding to the preset monitoring point at the current moment have changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment; wherein the previous moment is the moment of the previous vulnerability scan of the target system; when the system environment parameters corresponding to the preset monitoring point at the current moment have not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, the vulnerability scanning result of the target system at the previous moment is used as the vulnerability scanning result of the target system at the current moment.
[0078] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.
[0079] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.
[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A vulnerability scanning method, characterized in that: include: Obtain the system environment parameters corresponding to the preset monitoring points in the target system at the current moment; Determine whether the system environment parameter corresponding to the preset monitoring point at the current moment has changed compared with the system environment parameter corresponding to the preset monitoring point at the previous moment; wherein the previous moment is the moment of the previous vulnerability scan on the target system; When the system environment parameters corresponding to the preset monitoring point at the current moment are unchanged compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, the vulnerability scanning result of the target system at the previous moment is used as the vulnerability scanning result of the target system at the current moment.
2. The vulnerability scanning method according to claim 1, characterized in that: The method also includes: When the system environment parameters corresponding to the preset monitoring point at the current moment are changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment, a vulnerability scan is performed on the target system to obtain the vulnerability scan result of the target system at the current moment.
3. The vulnerability scanning method according to claim 2, characterized in that: The method also includes: Stores the vulnerability scan results of the target system at the current moment.
4. The vulnerability scanning method according to any one of claims 1 to 3, characterized in that: Before obtaining the system environment parameters corresponding to the preset monitoring points in the target system at the current moment, the method further includes: Set monitoring points in at least one of the following components: A timer for recording the cache time of the vulnerability scan result of the target system at the previous moment, a list of system software components, a patch library, and a storage unit for recording the operating system version number of the target system.
5. The vulnerability scanning method according to claim 4, characterized in that: Determining whether the system environment parameter corresponding to the preset monitoring point at the current moment has changed compared with the system environment parameter corresponding to the preset monitoring point at the previous moment, includes: Determine whether the storage duration of the vulnerability scan result of the target system at the previous moment in the cache exceeds a predetermined time threshold; and / or Determine whether the system software component list of the target system at the current moment has changed compared to the system software component list of the target system at the previous moment; and / or Determine whether the patch library in the target system at the current moment has changed compared to the patch library in the target system at the previous moment; and / or It is determined whether the operating system version number of the target system at the current moment has changed compared with the operating system version number of the target system at the previous moment.
6. A vulnerability scanning device, characterized in that: include: The parameter acquisition module is used to obtain the system environment parameters corresponding to the preset monitoring points in the target system at the current moment; The parameter judgment module is used to judge whether the system environment parameter corresponding to the preset monitoring point at the current moment has changed compared with the system environment parameter corresponding to the preset monitoring point at the previous moment; wherein the previous moment is the moment of the previous vulnerability scan on the target system; The vulnerability result acquisition module is used to use the vulnerability scanning result of the target system at the previous moment as the vulnerability scanning result of the target system at the current moment when the system environment parameters corresponding to the preset monitoring point at the current moment have not changed compared with the system environment parameters corresponding to the preset monitoring point at the previous moment.
7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the vulnerability scanning method according to any one of claims 1 to 5 are implemented.
8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the vulnerability scanning method according to any one of claims 1 to 5 are implemented.
9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the vulnerability scanning method according to any one of claims 1 to 5 are implemented.