Rule engine-based security scanning result inspection method and device
Through the security scan result inspection method based on the rules engine, the problems of long inspection cycles and dissatisfaction with differentiated inspection requirements in traditional methods are solved, and faster and more accurate security scan result inspection is achieved.
Patent Information
- Application Number
- CN202510260071.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-06
- Publication Date
- 2025-06-27
AI Technical Summary
Traditional security scan result inspection methods require frequent code development and adaptation transformation, resulting in too long inspection cycle and cannot meet the differentiated inspection needs of security scan results, resulting in a high missed rate of security vulnerabilities and a low accuracy rate of inspection results.
The security scan result inspection method based on the rules engine is adopted. By receiving the security scan results of the system to be inspected, integrity inspection and normative inspection are performed, and hierarchical inspections (system level, task level, vulnerability level) are carried out for non-scanning-free results to adapt to different types of security scan results.
The inspection cycle is shortened, the differentiated inspection needs of security scan results are met, the omission rate of security vulnerabilities is reduced, and the accuracy of inspection results is improved.
Smart Images
Figure CN120217377A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of security scanning detection, and particularly to a method and device for verifying security scanning results based on a rule engine. Background Art
[0002] This section aims to provide background or context for the embodiments of the present invention described in the claims. The description herein is not admitted to be prior art merely by virtue of being included in this section.
[0003] Security test verification is an important part of production inspection, mainly for verifying various security scanning results after security testing. Currently, the security scanning process is updated rapidly, and security scanning results and security inspection rules need to be continuously adjusted and improved. Traditional security scanning result verification methods require frequent code development and adaptation, resulting in too long inspection cycles. In addition, existing technologies cannot meet the differentiated verification requirements of security scanning results, leading to a high false negative rate of security vulnerabilities and a low accuracy rate of verification results. Summary of the Invention
[0004] Embodiments of the present invention provide a method for verifying security scanning results based on a rule engine, which is used to shorten the inspection cycle, meet the differentiated verification requirements of security scanning results, reduce the false negative rate of security vulnerabilities, and improve the accuracy rate of verification results. The method includes:
[0005] Receiving the security scanning results of the system to be verified, and performing integrity verification on the security scanning results: verifying whether the security scanning results contain all the scanning types required to be delivered for the system to be verified. When the security scanning results contain all the scanning types, it is confirmed that the security scanning results pass the integrity verification; the scanning types include at least one of code security scanning, plaintext password scanning of configuration files, open source component scanning, App static security test scanning, and WAF verification test;
[0006] Performing normalization verification on the security scanning results that pass the integrity verification: based on the normalization verification rules, verifying the verification types of the security scanning results. When the verification type of the security scanning results is non-exempt from scanning, performing hierarchical verification on the security scanning results; the normalization verification rules include at least one of mandatory item verification, uniqueness verification, field value legality verification, field value constraint verification between fields, and consistency matching verification of key information and production information;
[0007] Performing hierarchical verification: sequentially performing the verification rules of each level on the non-exempt security scanning results according to system-level verification, task-level verification, and vulnerability-level verification;
[0008] If any level of verification fails, marking that the security scanning results verification fails; if all levels of verification pass, marking that the security scanning results verification passes.
[0009] An embodiment of the present invention further provides a security scan result verification device based on a rule engine, which is used to shorten the verification cycle, meet the differentiated verification requirements of security scan results, reduce the false negative rate of security vulnerabilities, and improve the accuracy rate of verification results. The device includes:
[0010] An integrity verification module, which is used to receive the security scan results of the system to be verified and perform integrity verification on the security scan results: verify whether the security scan results contain all the scan types required to be delivered by the system to be verified. When the security scan results contain all the scan types, it is confirmed that the security scan results pass the integrity verification; the scan types include at least one of code security scan, plaintext password scan of configuration files, open source component scan, App static security test scan, and WAF verification test;
[0011] A standardization verification module, which is used to perform standardization verification on the security scan results that have passed the integrity verification: based on the standardization verification rules, verify the verification types of the security scan results. When the verification type of the security scan results is non-exempt from scanning, perform hierarchical verification on the security scan results; the standardization verification rules include at least one of mandatory item verification, uniqueness verification, field value legality verification, value constraint verification between fields, and consistency matching verification of key information and production information;
[0012] A hierarchical verification module, which is used to perform hierarchical verification: sequentially perform the verification rules of each level on the non-exempt security scan results according to system-level verification, task-level verification, and vulnerability-level verification;
[0013] A security scan result marking module, which is used to mark that the security scan result verification fails if any level of verification fails; if all levels of verification pass, mark that the security scan result verification passes.
[0014] An embodiment of the present invention further provides a computer device for verifying security scan results based on a rule engine, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the above-mentioned method for verifying security scan results based on a rule engine is implemented.
[0015] An embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned method for verifying security scan results based on a rule engine is implemented.
[0016] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned method for verifying security scan results based on a rule engine is implemented.
[0017] In an embodiment of the present invention, by receiving the security scan results of the system to be inspected, integrity inspection is performed on the security scan results: checking whether the security scan results include all the scan types required to be delivered by the system to be inspected. When the security scan results include all the scan types, it is confirmed that the security scan results pass the integrity inspection; the scan types include at least one of code security scan, plaintext password scan of configuration files, open-source component scan, App static security test scan, and WAF verification test; for the security scan results that pass the integrity inspection, compliance inspection is performed: based on the compliance inspection rules, the inspection types of the security scan results are checked. When the inspection type of the security scan results is non-exempt from scanning, hierarchical inspection is performed on the security scan results; the compliance inspection rules include at least one of mandatory item verification, uniqueness verification, legal value verification of fields, value constraint verification between fields, and consistency matching verification of key information and production information; performing hierarchical inspection: for the security scan results that are non-exempt from scanning, the inspection rules of each level are sequentially executed according to system-level inspection, task-level inspection, and vulnerability-level inspection; if any level of inspection fails, it is marked that the security scan results fail the inspection; if all levels of inspection pass, it is marked that the security scan results pass the inspection. In the above process, in an embodiment of the present invention, by confirming the inspection type of the security scan results, corresponding inspections are performed on the security scan results, adapting to the differentiated inspection requirements of the security scan results, reducing the amount of code development, and shortening the adaptation cycle. Through hierarchical inspection, the single mode of the traditional inspection method is solved, and multiple levels are combined for in-depth inspection to improve the accuracy of the inspection results. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings. In the drawings:
[0019] Figure 1 It is a flowchart of the method for inspecting security scan results based on a rule engine in an embodiment of the present invention;
[0020] Figure 2 It is a flowchart of the inspection of security scan results in an embodiment of the present invention;
[0021] Figure 3 It is a flowchart of hierarchical inspection in an embodiment of the present invention;
[0022] Figure 4 It is a flowchart of vulnerability-level inspection in an embodiment of the present invention;
[0023] Figure 5Schematic diagram of the security scan result verification device based on a rule engine in an embodiment of the present invention;
[0024] Figure 6 Overall architecture diagram of the rule engine in an embodiment of the present invention. Detailed implementation manners
[0025] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer and more understandable, the following further describes the embodiments of the present invention in detail with reference to the accompanying drawings. Herein, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but not to limit the present invention.
[0026] In the technical solution of the present application, the acquisition, transmission, storage, use, processing, etc. of data all comply with the relevant provisions of national laws and regulations.
[0027] It should be noted that in the embodiments of the present application, some industry-existing solutions such as certain software, components, models, etc. may be mentioned. They should be regarded as exemplary. The purpose is only to illustrate the feasibility in the implementation of the technical solution of the present application, but it does not mean that the applicant has already or necessarily used this solution.
[0028] Figure 1 Flowchart of the security scan result verification method based on a rule engine in an embodiment of the present invention. The method includes:
[0029] Step 101: Receive the security scan result of the system to be verified, and perform integrity verification on the security scan result: Verify whether the security scan result contains all the scan types required to be delivered by the system to be verified. When the security scan result contains all the scan types, confirm that the security scan result passes the integrity verification; the scan types include at least one of code security scan, plaintext password scan of configuration files, open source component scan, App static security test scan, and WAF verification test.
[0030] Step 102: Perform standardization verification on the security scan result that has passed the integrity verification: Based on the standardization verification rules, verify the verification type of the security scan result. When the verification type of the security scan result is non-exempt from scanning, perform hierarchical verification on the security scan result; the standardization verification rules include at least one of mandatory item verification, uniqueness verification, legal value verification of fields, value constraint verification between fields, and consistency matching verification of key information and production information.
[0031] Step 103: Perform hierarchical verification: Sequentially perform the verification rules of each level on the non-exempt security scan result according to system-level verification, task-level verification, and vulnerability-level verification.
[0032] Step 104, if any level of inspection fails, mark that the security scan result inspection fails; if all levels of inspection pass, mark that the security scan result inspection passes.
[0033] The following specifically describes each step.
[0034] In step 101, receive the security scan result of the system to be inspected, and perform integrity inspection on the security scan result: check whether the security scan result includes all the scan types required to be delivered by the system to be inspected. When the security scan result includes all the scan types, confirm that the security scan result passes the integrity inspection; the scan types include at least one of code security scan, plaintext password scan of configuration files, open source component scan, App static security test scan, and WAF verification test.
[0035] In a specific embodiment, based on the security scan result list required to be delivered for each or each type of system, check whether the security scan results of the system are delivered completely.
[0036] In step 102, perform a standardization inspection on the security scan result that has passed the integrity inspection: based on the standardization inspection rules, check the inspection type of the security scan result. When the inspection type of the security scan result is non-exempt from scanning, perform hierarchical inspection on the security scan result; the standardization inspection rules include at least one of mandatory item verification, uniqueness verification, field value legality verification, inter-field value constraint verification, and consistency matching verification between key information and production information.
[0037] In an embodiment, the standardization inspection rules: mandatory item verification is used to verify whether the predefined key fields in the security scan result exist; uniqueness verification is used to verify the uniqueness of the scan task ID or field combination; field value legality verification is used to verify whether the field value conforms to the preset range or format; inter-field constraint verification is used to verify whether the logical dependency relationship between fields holds; consistency matching verification between key information and production information is used to verify the consistency of the system name, production point, and production information.
[0038] In specific embodiments, the mandatory field verification rules are rules formulated for verifying mandatory fields in the security scan results. For example, system name, production point, whether to scan, whether to exempt from scanning, scanning process, scanning target, scanning time, test environment, source of scan results, etc. are all mandatory fields. The uniqueness verification rules are rules formulated for ensuring that the values of certain fields or a group of fields in the security scan results must be unique. For example, the ID of each scan task needs to be unique. The legal value verification rules for fields are rules formulated for the value range of certain fields in the security scan results. For example, the number of scan tasks must be greater than or equal to 0; the task ID has a fixed number of digits; the value of the exemption from scanning type is system exemption from scanning or version exemption from scanning. The inter-field constraint verification rules are rules formulated for the value constraints between fields in the security scan results. If "whether to scan" is "yes", then the scan task ID cannot be empty; if "whether to exempt from scanning" is "yes", then the exemption from scanning type and the reason for exemption from scanning cannot be empty; when "whether countermeasures have been taken" is "yes", "description of countermeasures" cannot be empty, etc. The consistency matching verification between key information and production information is a rule formulated for ensuring that certain fields in the security scan results are consistent with the production information. For example, the system name, production point, and production type in the scan results should be consistent with those in the production information.
[0039] In one embodiment, performing hierarchical verification on the security scan results further includes:
[0040] During the process of performing hierarchical verification on the security scan results, the newly added or modified verification rules for each level are loaded in real time.
[0041] Figure 2 This is the verification flowchart of the security scan results in the embodiments of the present invention. In specific embodiments, if the system to be verified is not exempt from scanning for this security scan result, the non-exempt from scanning verification process is followed. If the system to be verified is exempt from scanning for this security scan result, the version exemption from scanning verification process or the system exemption from scanning verification process is followed according to the verification type of the security scan result.
[0042] In one embodiment, after verifying the verification type of the security scan results based on the normative verification rules, it further includes: Among them,
[0043] The verification types of the security scan results also include version exemption from scanning and system exemption from scanning;
[0044] When the verification type of the security scan results is version exemption from scanning, the following version exemption from scanning rules are executed for the security scan results of the system to be verified: Obtain the version exemption from scanning white list. If the version number of the system to be verified is in the version exemption from scanning white list, mark that the verification of the security scan results of the system to be verified passes;
[0045] When the inspection type of the security scan result is system exemption from scanning, the following system exemption from scanning rules are executed for the security scan result of the system to be inspected: Obtain the system exemption from scanning whitelist. If the model of the system to be inspected is in the system exemption from scanning whitelist, mark that the inspection of the security scan result of the system to be inspected passes.
[0046] In a specific embodiment, the version exemption from scanning inspection process. Version exemption from scanning means that the system to be inspected is not required to perform such inspection of the security scan result only in the version put into production this time. If the exemption from scanning type of the system to be detected for this security scan result is version exemption from scanning, obtain the version exemption from scanning whitelist based on the security scan type. If the system to be detected is in the version exemption from scanning whitelist for this production version, the reason for exemption from scanning of this security scan result must be consistent with the reason for exemption from scanning in the version exemption from scanning whitelist, otherwise the inspection conclusion of this security scan result is not passed; if the system to be detected is not in the version exemption from scanning whitelist for this production version, the system to be detected needs to have information indicating approval of version exemption from scanning for this security scan type, otherwise the inspection conclusion of this security scan result is not passed. Through the dual verification mechanism of the exemption from scanning whitelist and approval records, the defect that the exemption from scanning process in the traditional solution is prone to be abused is solved.
[0047] The system exemption from scanning inspection process. System exemption from scanning means that the system to be inspected is not required to perform such inspection of the security scan result in all versions put into production. If the exemption from scanning type of the system to be detected for this security scan result is system exemption from scanning, obtain the system exemption from scanning whitelist based on the security scan result type. If the system to be detected is in the system exemption from scanning whitelist, the reason for exemption from scanning of this security scan result must be consistent with the reason for exemption from scanning in the system exemption from scanning whitelist, otherwise the inspection conclusion of this security scan result is not passed; if the system to be detected is not in the system exemption from scanning whitelist, the system to be detected needs to have information indicating approval of system exemption from scanning for this security scan type, otherwise the inspection conclusion of this security scan result is not passed.
[0048] In step 103, hierarchical inspection is performed: For the security scan results that are not exempt from scanning, the inspection rules of each level are executed successively according to system-level inspection, task-level inspection, and vulnerability-level inspection.
[0049] Figure 3 This is the flowchart of the hierarchical inspection in the embodiment of the present invention. In an embodiment, for the security scan results that are not exempt from scanning, the inspection rules of each level are executed successively according to system-level inspection, task-level inspection, and vulnerability-level inspection, including:
[0050] Step 301, perform system-level inspection on the security scan result: Inspect the legality of the system information in the security scan result; the system information includes public information and approval information;
[0051] Step 302, when the security scan result passes the system-level inspection, perform a task-level inspection on the security scan result: check the compliance of the task information in the security scan result; the task information includes the task scan code, the number of inspection and evaluation items, the number of inspection and evaluation risk items, and the inspection and test coverage area.
[0052] Step 303, when the security scan result passes the task-level inspection, perform a vulnerability-level inspection on the security scan result: check the vulnerability information of different types and levels in the security scan result.
[0053] In a specific embodiment, the task-level inspection of the security scan result: check the security scan task information of the system delivery, including the task scan type, task scan code, number of inspection and evaluation items, number of high-risk items in inspection and evaluation, number of medium-risk items in inspection and evaluation, number of low-risk items in inspection and evaluation, inspection and test coverage area, etc. at the task level. If the check fails, the inspection conclusion of the security scan result fails; for the scan task that passes the check, if no security vulnerabilities are scanned in this scan task, the vulnerability inspection passes directly; if security vulnerabilities are scanned in this scan task, perform the vulnerability-level rule inspection.
[0054] The vulnerability-level inspection of the security scan result: check the security vulnerabilities of different risk levels and types under the scan task. Figure 4 The flow chart of the vulnerability-level inspection in the embodiment of the present invention is as follows:
[0055] (1) For security vulnerabilities with a rectification status of rectified, the vulnerability inspection passes;
[0056] (2) For security vulnerabilities with a rectification status of false positive or no rectification required, there must be approval passed information for the false positive or no rectification required of this vulnerability in the approval system, otherwise the vulnerability inspection fails;
[0057] (3) For security vulnerabilities with a rectification status of to be processed or to be rectified, if the vulnerability risk level is low risk, only give a risk prompt. If the vulnerability risk level is high risk or medium risk, conduct a review based on the vulnerability type:
[0058] a) If it is a general knowledge type of vulnerability, the unrectified reason of this vulnerability needs to match the unrectified reason in the general knowledge vulnerability configuration information, and there must be approval passed information for this vulnerability in the approval system, otherwise the vulnerability inspection fails;
[0059] b) If it is a mitigation and downgrade type of vulnerability, the required risk level after downgrading of this vulnerability is medium risk or low risk, the risk mitigation type needs to match the mitigation and downgrade vulnerability configuration information, and there must be risk mitigation rectification measures, and there must be approval passed information for this vulnerability in the approval system, otherwise the vulnerability inspection fails;
[0060] c) If it is a vulnerability of other types, that is, a vulnerability under non - special circumstances, if there are still issues to be processed and rectified, the vulnerability inspection fails.
[0061] In step 104, if any level of inspection fails, mark that the security scan result inspection fails; if all levels of inspection pass, mark that the security scan result inspection passes.
[0062] In a specific embodiment, for each security scan result, if there is a problem in any inspection step, the inspection result of this security scan result is considered to fail.
[0063] In an embodiment of the present invention, there is also provided a security scan result inspection device based on a rule engine, as described in the following embodiments. Since the principle of this device for solving problems is similar to that of the security scan result inspection method based on a rule engine, the implementation of this device can refer to the implementation of the security scan result inspection method based on a rule engine, and the repeated parts will not be elaborated.
[0064] Figure 5 It is a schematic diagram of the security scan result inspection device based on a rule engine in an embodiment of the present invention. This device includes:
[0065] An integrity inspection module 501, configured to receive the security scan result of the system to be inspected, and perform integrity inspection on the security scan result: check whether the security scan result contains all the scan types required to be delivered by the system to be inspected. When the security scan result contains all the scan types, confirm that the security scan result passes the integrity inspection; the scan types include at least one of code security scan, plain - text password scan of configuration files, open - source component scan, App static security test scan, and WAF verification test.
[0066] A standardization inspection module 502, configured to perform standardization inspection on the security scan result that has passed the integrity inspection: based on the standardization inspection rules, check the inspection type of the security scan result. When the inspection type of the security scan result is non - exempt from scanning, perform hierarchical inspection on the security scan result; the standardization inspection rules include at least one of mandatory item verification, uniqueness verification, legal value verification of fields, value constraint verification between fields, and consistency matching verification of key information and production information.
[0067] A hierarchical inspection module 503, configured to perform hierarchical inspection: sequentially perform the inspection rules of each level on the non - exempt security scan result according to system - level inspection, task - level inspection, and vulnerability - level inspection.
[0068] A security scan result marking module 504, configured to mark that the security scan result inspection fails if any level of inspection fails; mark that the security scan result inspection passes if all levels of inspection pass.
[0069] In one embodiment, the regulatory inspection rules are as follows: The required item check is used to verify the existence of predefined keyword fields in the security scan results; the uniqueness check is used to verify the uniqueness of the scan task ID or field combination; the legal value check of fields is used to verify whether the field values conform to the preset range or format; the constraint check between fields is used to verify whether the logical dependency between fields holds; the consistency matching check between key information and production information is used to verify the consistency of the system name, production point, and production information.
[0070] In one embodiment, the hierarchical inspection module 503 is further configured to:
[0071] During the process of performing hierarchical inspection on the security scan results, the inspection rules newly added or modified at each level are loaded in real time.
[0072] In one embodiment, it further includes an inspection type confirmation module, which is specifically configured to:
[0073] The inspection types of the security scan results further include version exemption from scanning and system exemption from scanning;
[0074] When the inspection type of the security scan result is version exemption from scanning, the following version exemption from scanning rules are executed for the security scan result of the system to be inspected: Obtain the version exemption from scanning white list. If the version number of the system to be inspected is in the version exemption from scanning white list, mark that the security scan result of the system to be inspected passes the inspection;
[0075] When the inspection type of the security scan result is system exemption from scanning, the following system exemption from scanning rules are executed for the security scan result of the system to be inspected: Obtain the system exemption from scanning white list. If the model of the system to be inspected is in the system exemption from scanning white list, mark that the security scan result of the system to be inspected passes the inspection.
[0076] In one embodiment, the hierarchical inspection module 503 is specifically configured to:
[0077] Perform system-level inspection on the security scan results: Verify the legality of the system information in the security scan results; the system information includes public information and approval information;
[0078] When the security scan results pass the system-level inspection, perform task-level inspection on the security scan results: Verify the compliance of the task information in the security scan results; the task information includes task scan code, number of inspection and evaluation items, number of inspection and evaluation risk items, and inspection and test coverage areas;
[0079] When the security scan results pass the task-level inspection, perform vulnerability-level inspection on the security scan results: Verify the vulnerability information of different types and levels in the security scan results.
[0080] Figure 6This is the overall architecture diagram of the rule engine in the embodiments of the present invention. In specific embodiments, after the security scan results of the system to be inspected are delivered and pass the integrity check, the rule engine creates corresponding inspection tasks for each security scan result of the system. For the security scan result object associated with the task, it parses the data based on the security scan result template, and according to the rule set associated with the task, sequentially executes the rules under each rule set. When a rule is hit, it generates specific inspection questions based on the problem data template associated with the rule, and finally generates corresponding security inspection conclusions based on the questions. By replacing hard-coded logic with a rule engine and based on configuration templates, the amount of code development is reduced. As Figure 6 shown, the rule engine in the present invention mainly includes: a security scan result template configuration module, an operation factor configuration module, a problem template configuration module, a problem data configuration module, a rule configuration module, a rule set configuration module, and an inspection task configuration module.
[0081] Among them, the functions of each module are as follows:
[0082] (1) Security scan result template configuration module
[0083] When the type of the security scan result has new, modified, or deleted, it is necessary to synchronously maintain the configuration information of the security scan result in this module. The configuration information of the security scan result includes: scan result ID, scan result name, scan process, scan result source, importance level, scan result JSON format, configuration enable status, etc.
[0084] Among them, the scan result names include code security scan results, configuration file plaintext password scan results, open source component scan results, App static security test scan results, WAF verification test results, etc.; the scan result JSON format includes the hierarchical structure of the security scan result, the Chinese name of the field, the English name of the field, the field type, etc. The rule engine will parse the scan result data of each security test platform based on the configured JSON format.
[0085] (2) Operation factor configuration module
[0086] The operation factor is the data item involved in the rule expression. This module mainly configures the operation factors used in the rule expression, including operation factor ID, operation factor name, execution engine, execution content, value type, input parameter information, etc.
[0087] The execution engine includes a deliverable JSON parsing engine, an expression engine, various database engines, a SHELL engine, an interface service engine, etc.
[0088] The deliverable JSON parsing engine refers to using the specific fields parsed according to the security scan result template in step S301 as operation factors, and the execution content is the English name of the corresponding field in the scan result template;
[0089] The expression engine refers to using the execution result of the expression as an operation factor, and the execution content is the specific expression;
[0090] The database engine has pre-configured information about various databases. You can select the database engine and obtain information from the database through SQL statements. The execution content is the specific SQL statement;
[0091] The SHELL engine refers to using the execution result of the SHELL script as an operation factor, and the execution content is the specific SHELL script;
[0092] The interface service engine refers to using the result returned by calling the interface service as an operation factor, and the execution content is the specific interface service.
[0093] When generating operation factors by the above various execution engines, input parameters can be not set, or can be set as input parameters or query conditions for expressions, SQL statements, SHELL scripts, and interfaces.
[0094] (3) Problem template configuration module
[0095] After the rule engine executes, the hit rules will generate various types of problems. This module is used to configure various problem templates, and the configuration information includes problem template ID, template name, template description, fields included in the template, etc. Among them, the field information includes field name, English name of the field, field default value, whether it is a business unique identifier, etc. The business unique identifier is used to deduplicate the generated problems.
[0096] (4) Problem data configuration module
[0097] Rules are not directly associated with problem templates, but with the problem data under the problem templates. The problem module configures which fields the problem contains, while the problem data configures the specific values of each field. When configuring problem data, the field value can be a specific value, can be a variable, or can be composed of a fixed value and a variable. The variables come from the fields parsed from the security scan results, operation factors in the rules, etc., which can make the description information, assessment information, etc. of the problem more flexible.
[0098] (5) Rule configuration module
[0099] The rule configuration information includes rule ID, rule name, rule description, rule usage scenario, rule level, rule risk level, security scan result object, automation processor, output processor, rule script or rule expression configuration, etc.
[0100] If the automation processor is an expression, the rule expression needs to be configured. The rule expression consists of multiple operation factors, expression identifiers, and data values. The rule expression identifiers include && (AND), || (OR),! (NOT), => (deduction), etc., which can be configured in the identifier configuration item according to the actual situation.
[0101] For complex verification scenarios, the automation processor can also be a regular expression, formula, script, etc. Just configure the specific regular expression content, formula content, and script content. The system will perform different forms of verification according to different automation processors. If the above methods still cannot meet the data verification requirements, code modification can be carried out to meet the requirements.
[0102] (6) Rule set configuration module
[0103] Rules with the same rule nature or rules configured for the same type of security scan results can be placed under the same rule set for easy viewing and unified management of the rules.
[0104] The same rule can be associated with different rule sets according to actual needs, so as to improve the reuse rate of the rules and avoid duplicate rule configuration work.
[0105] (7) Verification task configuration module
[0106] For each type of security scan report, configure the corresponding verification task information, including task ID, task name, task description, rule set associated with the task, security scan result object associated with the task, execution environment of the task, etc. After the rule engine finishes execution, the execution status of the rules in the task, the original security scan result data, the generated problems, the start and end times of task execution, etc. can be viewed at the task level.
[0107] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the above-mentioned method for verifying security scan results based on a rule engine is implemented.
[0108] An embodiment of the present invention also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned method for verifying security scan results based on a rule engine is implemented.
[0109] An embodiment of the present invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-mentioned method for verifying the security scan results based on a rule engine.
[0110] In an embodiment of the present invention, by receiving the security scan results of the system to be verified, integrity verification is performed on the security scan results: verifying whether the security scan results include all the scan types required to be delivered by the system to be verified. When the security scan results include all the scan types, it is confirmed that the security scan results pass the integrity verification; the scan types include at least one of code security scan, plaintext password scan of configuration files, open source component scan, App static security test scan, and WAF verification test; for the security scan results that pass the integrity verification, normative verification is performed: based on the normative verification rules, the verification types of the security scan results are verified. When the verification type of the security scan results is non-exempt from scanning, hierarchical verification is performed on the security scan results; the normative verification rules include at least one of mandatory item verification, uniqueness verification, field value legality verification, value constraint verification between fields, and consistency matching verification of key information and production information; performing hierarchical verification: for the non-exempt security scan results, the verification rules of each level are sequentially executed according to system-level verification, task-level verification, and vulnerability-level verification; if any level of verification fails, it is marked that the security scan results verification fails; if all levels of verification pass, it is marked that the security scan results verification passes. In the above process, in an embodiment of the present invention, by confirming the verification type of the security scan results, corresponding verification is performed on the security scan results, adapting to the differentiated verification requirements of the security scan results, reducing the code development volume, and shortening the adaptation cycle. Through hierarchical verification, the single mode of the traditional verification method is solved, and multiple levels are combined for in-depth verification to improve the accuracy of the verification results.
[0111] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0112] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the functions specified in one or more flows and / or one or more blocks in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or one or more blocks Figure 1 means for implementing the functions specified in one or more blocks.
[0113] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including instruction means for implementing the functions specified in one or more flows and / or one or more blocks in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or one or more blocks Figure 1 means for implementing the functions specified in one or more blocks.
[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more flows and / or one or more blocks in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or one or more blocks Figure 1 steps for implementing the functions specified in one or more blocks.
[0115] The specific embodiments described above further elaborate on the purpose, technical solutions, and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not used to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A security scanning result verification method based on a rule engine, characterized in that: include: Receive the security scan results of the system to be inspected, and perform integrity check on the security scan results: check whether the security scan results include all scan types required to be delivered by the system to be inspected. When the security scan results include all scan types, confirm that the security scan results pass the integrity check; The scanning type includes at least one of code security scanning, configuration file plain text password scanning, open source component scanning, App static security test scanning, and WAF verification testing; Performing a normative inspection on the security scan results that pass the integrity inspection: Based on the normative inspection rules, the security scan results are inspected. When the inspection type of the security scan results is non-scan-free, a hierarchical inspection is performed on the security scan results. The normative inspection rules include: at least one of the following: mandatory item inspection, uniqueness inspection, field value legality inspection, field value constraint inspection, and consistency matching inspection between key information and production information; Perform hierarchical inspection: For non-exempt security scan results, perform system-level inspection, task-level inspection, and vulnerability-level inspection in turn, and execute the inspection rules of each level step by step; If any level fails the inspection, the security scan result is marked as failed. If all levels pass the inspection, the security scan result is marked as passed.
2. The method according to claim 1, characterized in that The regulatory verification rules are as follows: the mandatory item check is used to verify whether the predefined key fields in the security scan results exist; the uniqueness check is used to verify the uniqueness of the scan task ID or field combination; the field value legitimacy check is used to verify whether the field value conforms to the preset range or format; the field constraint check is used to verify whether the logical dependency relationship between the fields holds; the consistency matching check between key information and production information is used to verify the consistency of the system name, production point and production information.
3. The method according to claim 1, characterized in that Performs a hierarchical review of security scan results, including: During the hierarchical inspection process of security scan results, newly added or modified inspection rules at each level are loaded in real time.
4. The method according to claim 1, characterized in that After checking the inspection type of the security scan result based on the normative inspection rules, it also includes: wherein, The security scan result verification types also include version-free scanning and system-free scanning; When the inspection type of the security scan result is version-free scanning, the following version-free scanning rules are executed for the security scan result of the system to be inspected: a version-free scanning whitelist is obtained, and if the version number of the system to be inspected is in the version-free scanning whitelist, the security scan result of the system to be inspected is marked as passed; When the inspection type of the security scan result is system-free scanning, the following system-free scanning rules are executed on the security scan result of the system to be inspected: obtain the system-free scanning whitelist, and if the model of the system to be inspected is in the system-free scanning whitelist, mark the security scan result of the system to be inspected as passed.
5. The method according to claim 1, characterized in that The non-free scanning security scan results are tested in the following order: system-level test, task-level test, and vulnerability-level test. The test rules of each level are executed step by step, including: Perform system-level inspection on security scan results: inspect the legitimacy of system information in security scan results; system information includes public information and approval information; When the security scan results pass the system-level inspection, perform task-level inspection on the security scan results: inspect the compliance of the task information in the security scan results; the task information includes the task scan code, the number of inspection and assessment items, the number of inspection and assessment risk items, and the inspection and test coverage areas; When the security scan result passes the task-level inspection, a vulnerability-level inspection is performed on the security scan result: inspecting vulnerability information of different types and levels in the security scan result.
6. A security scanning result verification device based on a rule engine, characterized in that: include: The integrity check module is used to receive the security scan results of the system to be checked and perform integrity check on the security scan results: check whether the security scan results contain all the scan types required to be delivered by the system to be checked, and when the security scan results contain all the scan types, confirm that the security scan results pass the integrity check; The scanning type includes at least one of code security scanning, configuration file plain text password scanning, open source component scanning, App static security test scanning, and WAF verification testing; A normative inspection module is used to perform normative inspection on the security scan results that have passed the integrity inspection: based on the normative inspection rules, the inspection type of the security scan results is inspected, and when the inspection type of the security scan results is non-scan-free, a hierarchical inspection is performed on the security scan results; The normative inspection rules include: at least one of the following: mandatory item inspection, uniqueness inspection, field value legality inspection, field value constraint inspection, and consistency matching inspection between key information and production information; The hierarchical inspection module is used to perform hierarchical inspection: for non-scan-free security scan results, the inspection rules of each level are executed step by step according to the system level inspection, task level inspection, and vulnerability level inspection; The security scan result marking module is used to mark the security scan result as failed if any level of inspection fails; if all levels of inspection pass, mark the security scan result as passed.
7. The device according to claim 6, characterized in that The regulatory verification rules are as follows: the mandatory item check is used to verify whether the predefined key fields in the security scan results exist; the uniqueness check is used to verify the uniqueness of the scan task ID or field combination; the field value legitimacy check is used to verify whether the field value conforms to the preset range or format; the field constraint check is used to verify whether the logical dependency relationship between the fields holds; the consistency matching check between key information and production information is used to verify the consistency of the system name, production point and production information.
8. The device according to claim 6, characterized in that The hierarchical inspection module is also used to: During the hierarchical inspection process of security scan results, newly added or modified inspection rules at each level are loaded in real time.
9. The device according to claim 6, characterized in that It also includes an inspection type confirmation module, which is specifically used to: The security scan result verification types also include version-free scanning and system-free scanning; When the inspection type of the security scan result is version-free scanning, the following version-free scanning rules are executed for the security scan result of the system to be inspected: a version-free scanning whitelist is obtained, and if the version number of the system to be inspected is in the version-free scanning whitelist, the security scan result of the system to be inspected is marked as passed; When the inspection type of the security scan result is system-free scanning, the following system-free scanning rules are executed on the security scan result of the system to be inspected: obtain the system-free scanning whitelist, and if the model of the system to be inspected is in the system-free scanning whitelist, mark the security scan result of the system to be inspected as passed.
10. The device according to claim 6, characterized in that The hierarchical inspection module is specifically used for: Perform system-level inspection on security scan results: inspect the legitimacy of system information in security scan results; system information includes public information and approval information; When the security scan results pass the system-level inspection, perform task-level inspection on the security scan results: inspect the compliance of the task information in the security scan results; the task information includes the task scan code, the number of inspection and assessment items, the number of inspection and assessment risk items, and the inspection and test coverage areas; When the security scan result passes the task-level inspection, a vulnerability-level inspection is performed on the security scan result: inspecting vulnerability information of different types and levels in the security scan result.
11. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.
12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.
13. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.