Network asset and vulnerability association method and device based on fingerprints

Abstract

The invention provides a fingerprint-based network asset and vulnerability association method and device, and the method comprises the steps: carrying out the detection of a network asset, and obtaining a return message of the network asset; generating a network asset CPE fingerprint; establishing association between the extracted CPE information and the CVE number; the obtained corresponding relation between the CPE and the CVE is stored in a CPE-CVE association database; the data in the CPE-CVE association database is stored in a CPE-CVE cache database; and querying the cache database based on a time value, if the network asset CPE fingerprint is matched with the fingerprint in the CPE-CVE cache database, adding a corresponding CVE number to the network asset identified by the network asset CPE fingerprint, and storing the network asset in a network asset database. According to the scheme of the invention, the real-time performance and accuracy of association are improved; rapid association query of asset vulnerabilities can be realized, and the query speed is improved.

Description

technical field [0001] The invention relates to the field of data security, in particular to a fingerprint-based method and device for associating network assets and vulnerabilities. Background technique [0002] A specific vulnerability will affect one or more products and their versions. After common vulnerabilities are exposed, a verification Poc can be written for the details of the vulnerability. This Poc can be used to remotely verify whether the system under test has corresponding vulnerabilities. However, there are many limitations in this step. For example, it needs to interact with the peer server, it is easy to be traced, and the large-scale verification system resources are expensive. [0003] At present, network assets are abundant, and there are more and more network asset detection platforms, such as Shodan, ZoomEye, and Fofa. middle. These platforms will process the detected data before storing the detected assets. One of the steps is to associate the asset...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the above technical problems, the present invention proposes a method and device for associating network assets and vulnerabilities based on fingerprints to solve the technical problem of low efficiency in the association between network assets and vulnerabilities in the prior art. Existing loopholes are verified, the resource overhead is large, and the speed is low

Images