Power information system security management method and system based on PoC vulnerability verification, medium and processor

Abstract

The invention discloses an electric power information system security management method and system based on PoC vulnerability verification, a medium and a processor. The method comprises the following steps: acquiring a PoC vulnerability verification script which is preset according to vulnerability information of an electric power information system; acquiring a preset Docker mirror image containing the key component of the electric power information system; the PoC vulnerability verification script and the Docker mirror image file are stored in a private Docker warehouse; the method comprises the following steps: executing a Docker command on a target drone, and pulling a Docker mirror image of an electric power information system from a private Docker warehouse; if the Docker mirror image is successfully pulled, starting a Docker container of the target machine, and running the PoC vulnerability verification script on the target machine to obtain a script running result; judging whether vulnerabilities exist or not according to script running results. By simulating the attack behavior on the electric power information system, security vulnerabilities are found in time, and stable operation and data security of the system are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of system vulnerability verification, and in particular to a power information system security management method, system, medium and processor based on PoC vulnerability verification. Background Art

[0002] The power industry is a basic industry for the development of the national economy. The application of information technology has not only promoted the informatization of the power industry, but also improved the operating efficiency of power companies.

[0003] The operational security of power information systems is a focus of attention for power companies and even the entire industry. In the current Internet era, the network environment is full of many unsafe factors, which increases the risk of power information system operation. Therefore, it is particularly important to study key technologies that can ensure the information security of power information systems. Given the real-time data transmission characteristics of power information systems and the diversity of information security vulnerabilities, the security management of their data information interaction process is more difficult, and more advanced and effective security management methods are needed.

[0004] In view of this, a power information system security management method, system, medium and processor based on PoC vulnerability verification are needed. Summary of the invention

[0005] In view of the real-time data transmission characteristics and diversity of information security vulnerabilities of the power information system in the prior art, and the difficulty of security management of the power information system, the present invention provides a power information system security management method, system, medium and processor based on PoC vulnerability verification, which can timely discover the security vulnerabilities in the power information system by simulating the attack behavior of the power information system, and meet the stable operation and data security of the power information system. The specific technical solution is as follows:

[0006] A power information system security management method based on PoC vulnerability verification, comprising:

[0007] Obtain a PoC vulnerability verification script preset according to the vulnerability information of the power information system;

[0008] Obtain a preset Docker image containing key components of the power information system, and configure the Docker image to include the environment required by the target machine;

[0009] Storing the PoC vulnerability verification script and the Docker image file in a private Docker warehouse;

[0010] Pulling the Docker image of the power information system from the private Docker repository by executing a Docker command on the target machine;

[0011] If the Docker image is successfully pulled, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine to obtain the script running result of the PoC vulnerability verification;

[0012] Determine whether a vulnerability exists based on the script running result.

[0013] Preferably, a power information system security management method based on PoC vulnerability verification also includes:

[0014] If the image pull fails, the target machine's Docker container will not be started, and the pull failure information will be recorded, including error messages, timestamps, and related system logs.

[0015] Preferably, the obtaining of a PoC vulnerability verification script preset according to vulnerability information of the power information system includes:

[0016] Obtain detailed information about vulnerabilities in the power information system, including vulnerability description, impact scope, attack vector, and vulnerability exploitation method;

[0017] A PoC vulnerability verification script is obtained according to the characteristics of the power information system vulnerability and the detailed information of the power information system vulnerability. The PoC vulnerability verification script includes the logic and steps of vulnerability verification.

[0018] Preferably, the step of pulling the Docker image of the power information system from the private Docker repository by executing a Docker command on the target machine includes:

[0019] Obtaining Docker execution script information stored in the private Docker repository;

[0020] According to the Docker image pulling script of the Docker execution script information, the Docker command is executed on the target machine to pull the Docker image of the power information system from the private Docker warehouse.

[0021] Preferably, if the Docker image is pulled successfully, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine, and the script running result of the PoC vulnerability verification is obtained, including:

[0022] When the Docker image is successfully pulled, the Docker run script of the Docker execution script information is executed to start the Docker container of the target machine;

[0023] The PoC vulnerability verification script is run on the target machine, the vulnerability of the power information system is verified according to the predetermined logic and steps, the simulated attack behavior is recorded, and the script running result of the PoC vulnerability verification is obtained.

[0024] Preferably, judging whether a vulnerability exists according to the script running result includes:

[0025] If the script runs successfully and returns the expected results, it is confirmed that the vulnerability in the power information system exists; if the script fails to run or returns unexpected results, the script needs to be checked or optimized.

[0026] A power information system security management system based on PoC vulnerability verification is applied to the aforementioned power information system security management method based on PoC vulnerability verification, comprising:

[0027] A management unit is used to obtain a preset PoC vulnerability verification script according to the vulnerability information of the power information system; obtain a preset Docker image containing key components of the power information system, and configure the Docker image to include the environment required by the target machine;

[0028] A private Docker warehouse, used to receive, store and manage the PoC vulnerability verification script and the Docker image file;

[0029] The detection unit is used to pull the Docker image of the power information system from the private Docker warehouse by executing the Docker command on the target machine; if the Docker image is pulled successfully, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine to obtain the script running result of the PoC vulnerability verification; and whether the vulnerability exists is determined according to the script running result.

[0030] A computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the aforementioned power information system security management method based on PoC vulnerability verification.

[0031] A processor is used to run a program, wherein the program executes the aforementioned power information system security management method based on PoC vulnerability verification when running.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention discloses a method for managing the security of an electric information system based on PoC vulnerability verification, which obtains a preset PoC vulnerability verification script according to the vulnerability information of the electric information system; obtains a preset Docker image containing key components of the electric information system, and configures the Docker image to include the environment required by the target machine; stores the PoC vulnerability verification script and the Docker image file in a private Docker warehouse; pulls the Docker image of the electric information system from the private Docker warehouse by executing the Docker command on the target machine; if the Docker image is successfully pulled, starts the Docker container of the target machine, and runs the PoC vulnerability verification script on the target machine to obtain the script running result of the PoC vulnerability verification; and determines whether a vulnerability exists according to the script running result. The present invention can timely discover security vulnerabilities in the electric information system by simulating the attack behavior of the electric information system. The vulnerability verification method not only improves the efficiency and accuracy of vulnerability verification, but also helps electric power companies to timely discover and repair potential security risks, and meet the stable operation and data security of the electric information system. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0035] Figure 1 The present invention is a flow chart of a method for security management of a power information system based on PoC vulnerability verification.

[0036] Figure 2 The present invention is a schematic diagram of a power information system security management system based on PoC vulnerability verification. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0039] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0040] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0041] In order to better explain the principles of the present application, the corresponding professional terms are explained below to facilitate understanding of the solutions of the present application.

[0042] Python is an interpreted, object-oriented, interactive computer programming language. Python's design philosophy emphasizes code readability and allows developers to express ideas with a small amount of code, while supporting multiple programming paradigms, including procedural, object-oriented, and functional programming.

[0043] PoC: In the field of vulnerabilities, PoC (Proof of Concept) specifically refers to vulnerability verification scripts or tools, which are used to detect whether a specific security vulnerability exists, how the vulnerability is exploited, and the scope of harm. These PoC scripts or tools can help security researchers detect vulnerabilities quickly and easily without having to manually reproduce the vulnerability, thus reducing the difficulty of work.

[0044] Docker: Docker is an open source application container engine that allows developers to package their applications and dependent packages into a portable image and then publish it to any popular Linux or Windows operating system machine to achieve virtualization. Docker's underlying layer uses Linux's cgroup and namespace technologies to achieve application isolation.

[0045] Private Docker repository: contains a large number of images that can be used to download and build containers. Local private Docker repository mainly refers to building your own Docker image repository within an enterprise or organization to store, manage and distribute Docker images. This can better control the access rights of the image, ensure the security of the image, and reduce the dependence on network bandwidth.

[0046] Target machine: A target machine (also called a honeypot or honeynet) is a key tool. It is usually a virtual machine or physical machine that is specially designed to be attacked by attackers in network security drills to verify the effectiveness of network security protection measures and the existence of vulnerabilities. The target machine can simulate external attack behaviors and help enterprises detect possible security vulnerabilities through audits and reports so that they can be repaired in a timely manner and effectively prevent possible security threats. In addition, the target machine can also be used for information security training and drills, providing a safe environment for new employees to simulate security attacks and technical operations, helping them quickly master security skills and technologies.

[0047] See the following examples Figure 1 and Figure 2 .

[0048] Example 1

[0049] The present application embodiment provides a power information system security management method based on PoC vulnerability verification, including:

[0050] Step S1, obtaining a PoC vulnerability verification script preset according to vulnerability information of the power information system;

[0051] In this embodiment, the user needs to customize the PoC vulnerability verification strategy according to the characteristics of the target system and the known vulnerability information. For example, to prevent common security vulnerabilities such as XSS and SQL injection, a PoC vulnerability verification script is written to execute the logic of vulnerability verification. This script should clearly specify how to exploit a specific vulnerability and give the corresponding execution steps. At the same time, the user also needs to choose the written version of the running script to ensure that the script can run correctly on the target machine.

[0052] The obtaining of the PoC vulnerability verification script preset according to the vulnerability information of the power information system includes:

[0053] Obtain detailed information about vulnerabilities in the power information system, including vulnerability description, impact scope, attack vector, and vulnerability exploitation method;

[0054] A PoC vulnerability verification script is obtained according to the characteristics of the power information system vulnerability and the detailed information of the power information system vulnerability. The PoC vulnerability verification script includes the logic and steps of vulnerability verification.

[0055] Step S2, obtaining a preset Docker image containing key components of the electric power information system, and configuring the Docker image to include the environment required by the target machine;

[0056] The preset Docker image file ensures the simulation of the actual system's operating environment. The Docker image file contains all the environments and dependencies required to build the target machine, including selecting a suitable operating system base image, such as Ubuntu, CentOS, or Debian; installing necessary software packages and dependencies, using apt-get, yum, or the corresponding package manager to install all software packages and dependencies required to build the target machine, including web servers, databases, development libraries, programming language interpreters, etc.; configuring the target machine's environment as needed, including network settings, firewall rules, user permissions, service configuration, etc.; introducing known vulnerabilities or configuration errors in the installed software packages; setting default credentials and access permissions, setting default usernames, passwords, and other credentials in the Docker image; writing the above content into a Dockerfile, which contains commands and instructions for building Docker images. By running the dockerbuild command and specifying the path to the Dockerfile.

[0057] Step S3: storing the PoC vulnerability verification script and the Docker image file in a private Docker repository;

[0058] Import the PoC vulnerability verification script into a private Docker repository and persist it for use in subsequent steps; store the Docker image file in a private Docker repository. The private Docker repository provides image storage and management functions to ensure the security and reliability of the image. By storing it in a private Docker repository, these images can be easily managed and distributed for use in subsequent steps.

[0059] Step S4, by executing the Docker command on the target machine, pulling the Docker image of the power information system from the private Docker warehouse;

[0060] Obtaining Docker execution script information stored in the private Docker repository;

[0061] According to the Docker image pulling script of the Docker execution script information, the Docker command is executed on the target machine to pull the Docker image of the power information system from the private Docker warehouse.

[0062] Step S5: If the Docker image is successfully pulled, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine to obtain the script running result of the PoC vulnerability verification;

[0063] When the Docker image is successfully pulled, the Docker run script of the Docker execution script information is executed to start the Docker container of the target machine; the PoC vulnerability verification script is run on the target machine, the vulnerability of the power information system is verified according to the predetermined logic and steps, the simulated attack behavior is recorded, and the script running result of the PoC vulnerability verification is obtained.

[0064] If the image pull fails, the Docker container of the target machine will not be started, and the pull failure information will be recorded, including error messages, timestamps, and related system logs. This allows you to trace the problem and find a solution. At the same time, you can set up monitoring and alarm mechanisms, and pull failures may trigger alarms.

[0065] Step S6: Determine whether a vulnerability exists based on the script running result.

[0066] If the script runs successfully and returns the expected results, the existence of a vulnerability in the power information system is confirmed. For the discovered security vulnerability, corresponding repair measures are formulated and repaired in the power information system.

[0067] If the script fails to run or returns unexpected results, it is necessary to check or optimize the script, optimize and improve the security strategy of the power information system, and improve the security protection capabilities of the system.

[0068] It should be noted that according to the actual situation, the latest Docker image of the power information system can be obtained regularly and the test environment can be updated to ensure the consistency between the test environment and the actual environment. The security of the power information system should be continuously monitored and evaluated to timely discover and resolve new security threats. At the same time, the PoC verification script needs to be continuously updated to adapt to new security testing requirements.

[0069] In this embodiment, the PoC vulnerability verification script is implemented using a Python script. Python is often used for such tasks due to its ease of use, rich library support, and cross-platform features. However, since the purpose of PoC (Proof of Concept) verification is to demonstrate the existence of a security vulnerability and its potential impact, it can be implemented through a variety of programming languages ​​and technologies. For example, in other embodiments, scripting languages ​​such as Ruby, Perl, and Shell can be selected to write PoC vulnerability verification scripts. Regardless of the programming language used, the PoC vulnerability verification script needs to be run in a specific environment, and the operating system and configuration of the appropriate target machine must be selected. Python can usually run on a variety of operating systems, including Linux, Windows, macOS, etc. If the target machine already has the Python interpreter installed, the Python script can be run directly on the target machine;

[0070] Ruby is also a cross-platform programming language that can run on multiple operating systems. If the target machine has a Ruby interpreter installed, Ruby scripts can be run directly on the target machine; Perl is also a cross-platform scripting language that is particularly popular in system administration and network programming. If the target machine has a Perl interpreter installed, Perl scripts can be run directly on the target machine; Shell scripts, especially Bash (on Linux and macOS) and PowerShell (on Windows), are sequences of commands that run directly at the operating system level. Therefore, as long as the target machine supports the corresponding Shell environment, Shell scripts can be run directly on the target machine.

[0071] In this embodiment, a private Docker repository is used to store the PoC vulnerability verification script and the Docker image file. The private Docker repository refers to building its own Docker image repository within an enterprise or organization for storing, managing and distributing Docker images. This can better control the access rights of the image, ensure the security of the image, and reduce the dependence on network bandwidth. In other embodiments, the PoC vulnerability verification script and the Docker image file can be stored in a public Docker repository. The public Docker repository is open, and anyone can access the image therein without identity authentication or payment. For example, the public Docker repository is Docker Hub, which contains a large number of public images. Users can store and share their own images in the cloud through Docker Hub. However, users should pay attention to the possibility of security vulnerabilities and malicious code. Private Docker repositories are suitable for organizations that need to strictly control image access rights, protect sensitive data or proprietary technologies. The public Docker repository is an open platform that allows developers to share and collaborate, but it is necessary to pay attention to the security and source reliability of the image. According to specific needs and scenarios, a suitable Docker repository type can be selected to store and manage Docker images.

[0072] The present invention discloses a method for managing the security of an electric information system based on PoC vulnerability verification, which obtains a preset PoC vulnerability verification script according to the vulnerability information of the electric information system; obtains a preset Docker image containing key components of the electric information system, and configures the Docker image to include the environment required by the target machine; stores the PoC vulnerability verification script and the Docker image file in a private Docker warehouse; pulls the Docker image of the electric information system from the private Docker warehouse by executing the Docker command on the target machine; if the Docker image is successfully pulled, starts the Docker container of the target machine, and runs the PoC vulnerability verification script on the target machine to obtain the script running result of the PoC vulnerability verification; and determines whether a vulnerability exists according to the script running result. The present invention can timely discover security vulnerabilities in the electric information system by simulating the attack behavior of the electric information system. The vulnerability verification method not only improves the efficiency and accuracy of vulnerability verification, but also helps electric power companies to timely discover and repair potential security risks, and meet the stable operation and data security of the electric information system.

[0073] Example 2

[0074] This embodiment takes the common XSS attack and verification vulnerabilities in the power information system as an example for demonstration and explanation:

[0075] Step 1: Get the user-defined POC vulnerability strategy Python script

[0076] The user writes a Python script to automate the XSS attack and verify the vulnerability. The script contains the logic of constructing a malicious XSS payload and sends it to the target web application via an HTTP request.

[0077] Define the python script as follows:

[0078] import requests

[0079] #Define XSS payload

[0080] xss_payload=" <script>alert('XSS')；< / script> "

[0081] #Define the target URL

[0082] target_url="http: / / example.com / search"

[0083] #Send an HTTP request containing an XSS payload

[0084] params = {'q':xss_payload}

[0085] response=requests.get(target_url,params=params)

[0086] #Check if the response contains the expected XSS payload

[0087] if xss_payload in response.text:

[0088] print("XSS vulnerability verification successful!")

[0089] else:

[0090] print("XSS vulnerability verification failed.")

[0091] Step 2: Upload the Docker image file to the private Docker repository

[0092] The user prepares a Docker image file containing a web browser environment to simulate the user's web browsing behavior on the target machine. Then the Docker image file is stored in a private Docker repository so that it can be pulled and run on the target machine later.

[0093] Step 3: Get the POC vulnerability execution script and Docker execution script information

[0094] Get the POC vulnerability execution script and Docker execution script information in step 1.

[0095] Step 4: Pull and run the Docker image on the target machine

[0096] The system executes the pull command of the Docker image on the target machine according to the configuration information. After the pull is successful, the Docker container is started and a web browser is run inside the container.

[0097] Step 5: Execute Python script to verify XSS vulnerability

[0098] After the Docker container runs successfully, the system executes the Python script written in step 1. The script constructs an HTTP request containing an XSS payload and sends it to the target web application through the web browser on the target machine. If the target web application has an XSS vulnerability, the browser will execute the XSS payload and pop up a warning box. Based on the execution result of the Python script, it can be determined whether the XSS vulnerability exists.

[0099] If the execution result shows "XSS vulnerability verification succeeded!", it means that the target web application has an XSS vulnerability. On the contrary, if the execution result shows "XSS vulnerability verification failed.", it means that the vulnerability may not exist, or further checking of the script and verification strategy is required.

[0100] Through the above five steps, users can customize POC vulnerability verification strategies and use local private Docker repositories and target machine environments for vulnerability verification. This process-based approach not only improves the efficiency and accuracy of vulnerability verification, but also helps enterprises to discover and fix potential security risks in a timely manner.

[0101] Example 3

[0102] The embodiment of the present application further provides a power information system security management system based on PoC vulnerability verification, which is applied to the aforementioned power information system security management method based on PoC vulnerability verification, including:

[0103] A management unit is used to obtain a preset PoC vulnerability verification script according to the vulnerability information of the power information system; obtain a preset Docker image containing key components of the power information system, and configure the Docker image to include the environment required by the target machine;

[0104] A private Docker warehouse, used to receive, store and manage the PoC vulnerability verification script and the Docker image file;

[0105] The detection unit is used to pull the Docker image of the power information system from the private Docker warehouse by executing the Docker command on the target machine; if the Docker image is pulled successfully, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine to obtain the script running result of the PoC vulnerability verification; and whether the vulnerability exists is determined according to the script running result.

[0106] The explanation of each unit in this embodiment is the same as that in Embodiment 1 and will not be repeated here.

[0107] The present invention discloses a power information system security management system based on PoC vulnerability verification, which obtains a PoC vulnerability verification script preset according to the vulnerability information of the power information system through a management unit; obtains a preset Docker image containing key components of the power information system, and configures the Docker image to include the environment required by the target machine; stores the PoC vulnerability verification script and the Docker image file in a private Docker warehouse; executes a Docker command on the target machine through a detection unit, and pulls the Docker image of the power information system from the private Docker warehouse; if the Docker image is successfully pulled, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine to obtain the script running result of the PoC vulnerability verification; and determines whether a vulnerability exists according to the script running result. The present invention can timely discover security vulnerabilities in the power information system by simulating the attack behavior of the power information system. The vulnerability verification method not only improves the efficiency and accuracy of vulnerability verification, but also helps power companies to timely discover and repair potential security risks, and meet the stable operation and data security of the power information system.

[0108] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the aforementioned power information system security management method based on PoC vulnerability verification.

[0109] The technical effect of this embodiment is the same as the technical effect of the power information system security management method based on PoC vulnerability verification in Embodiment 1, and will not be repeated here.

[0110] The present invention can be used in many general or special computer system environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like.

[0111] An embodiment of the present application further provides a processor, which is used to run a program, wherein the program executes the aforementioned power information system security management method based on PoC vulnerability verification when running.

[0112] The technical effect of this embodiment is the same as the technical effect of the power information system security management method based on PoC vulnerability verification in Embodiment 1, and will not be repeated here.

[0113] The processor in this embodiment may be a central processing unit (CPU), a controller, a microcontroller, or other data processing chips.

[0114] Those of ordinary skill in the art will appreciate that the units of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition of each example has been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0115] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored, etc.

[0116] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0117] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-0nlyMemory), random access memory (RAM, RandomAccessMemory), mobile hard disk, magnetic disk or optical disk, etc., which can store program code.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A power information system security management method based on PoC vulnerability verification, characterized in that: include: Obtain a PoC vulnerability verification script preset according to the vulnerability information of the power information system; Obtain a preset Docker image containing key components of the power information system, and configure the Docker image to include the environment required by the target machine; Storing the PoC vulnerability verification script and the Docker image file in a private Docker warehouse; Pulling the Docker image of the power information system from the private Docker repository by executing a Docker command on the target machine; If the Docker image is successfully pulled, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine to obtain the script running result of the PoC vulnerability verification; Determine whether a vulnerability exists based on the script running result.

2. According to claim 1, a power information system security management method based on PoC vulnerability verification is characterized in that: Also includes: If the image pull fails, the target machine's Docker container will not be started, and the pull failure information will be recorded, including error messages, timestamps, and related system logs.

3. According to claim 1, a power information system security management method based on PoC vulnerability verification is characterized in that: The obtaining of the PoC vulnerability verification script preset according to the vulnerability information of the power information system includes: Obtain detailed information about vulnerabilities in the power information system, including vulnerability description, impact scope, attack vector, and vulnerability exploitation method; A PoC vulnerability verification script is obtained according to the characteristics of the power information system vulnerability and the detailed information of the power information system vulnerability. The PoC vulnerability verification script includes the logic and steps of vulnerability verification.

4. According to claim 1, a power information system security management method based on PoC vulnerability verification is characterized in that: The method of pulling the Docker image of the power information system from the private Docker warehouse by executing the Docker command on the target machine includes: Obtaining Docker execution script information stored in the private Docker repository; According to the Docker image pulling script of the Docker execution script information, the Docker command is executed on the target machine to pull the Docker image of the power information system from the private Docker warehouse.

5. A method for power information system security management based on PoC vulnerability verification according to claim 4, characterized in that: If the Docker image is successfully pulled, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine. The script running results of the PoC vulnerability verification include: When the Docker image is successfully pulled, the Docker run script of the Docker execution script information is executed to start the Docker container of the target machine; The PoC vulnerability verification script is run on the target machine, the vulnerability of the power information system is verified according to the predetermined logic and steps, the simulated attack behavior is recorded, and the script running result of the PoC vulnerability verification is obtained.

6. The method for power information system security management based on PoC vulnerability verification according to claim 1 is characterized in that: The determining whether a vulnerability exists according to the script running result includes: If the script runs successfully and returns the expected results, it is confirmed that the vulnerability in the power information system exists; if the script fails to run or returns unexpected results, the script needs to be checked or optimized.

7. A power information system security management system based on PoC vulnerability verification, characterized in that: The power information system security management method based on PoC vulnerability verification applied to any one of claims 1 to 6 comprises: A management unit is used to obtain a preset PoC vulnerability verification script according to the vulnerability information of the power information system; obtain a preset Docker image containing key components of the power information system, and configure the Docker image to include the environment required by the target machine; a private Docker warehouse is used to receive the PoC vulnerability verification script and the Docker image file and store and manage them; The detection unit is used to pull the Docker image of the power information system from the private Docker warehouse by executing the Docker command on the target machine; if the Docker image is pulled successfully, the Docker container of the target machine is started, and the PoC vulnerability verification script is run on the target machine to obtain the script running result of the PoC vulnerability verification; and whether the vulnerability exists is determined according to the script running result.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the power information system security management method based on PoC vulnerability verification according to any one of claims 1 to 6.

9. A processor, characterized in that: The processor is used to run a program, wherein the program, when running, executes the power information system security management method based on PoC vulnerability verification as described in any one of claims 1 to 6.

Images