A vulnerability detection method and device

Abstract

The embodiment of the present invention relates to financial technology, and discloses a vulnerability detection method and device, wherein the method includes: after receiving a vulnerability detection instruction triggered by a user, obtaining the identifier of at least one vulnerability control stored in a preset vulnerability library, and if it is determined that there is a first target project using the first vulnerability control in the preset database, then displaying the first target project to the user. In the embodiment of the present invention, by performing code detection on the project to obtain the controls used by the project, it can be ensured that the obtained controls are the latest controls used during the execution of the project. In this way, vulnerability detection based on the latest controls used by the project can improve the accuracy of the detected project vulnerabilities; and, the controls used by the project can be obtained through the preset database, so there is no need to re-perform code detection on the project, thereby improving the detection efficiency of project vulnerabilities, and further improving the efficiency of repairing project vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of financial technology (Fintech), and in particular to a vulnerability detection method and device. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field. The traditional financial industry is gradually transforming to financial technology (Fintech). However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology. The financial industry (such as banks, insurance, and securities institutions) generally involves transaction processing operations. Due to the nature of the financial industry, it is necessary to ensure the accuracy, security, and non-loss of the transaction processing process as much as possible. This requires real-time monitoring of the security status of network information during the transaction processing process. If it is determined that a control used in a project in the current system has a vulnerability, the vulnerability can be repaired in time to ensure the normal operation of the transaction processing process.

[0003] The database-based vulnerability scanning method is a common method for detecting vulnerabilities in the system. Taking a bank as an example, a configuration management database (CMDB) can usually be set up in the bank. The CMDB can store various configuration information related to the bank's management information technology industry (IT) architecture, such as project component information, service information, framework information, etc. Generally speaking, project personnel can add project-related configuration information to the CMDB when creating a new project. Based on this, when using this method for vulnerability detection, if a certain control is determined to be a vulnerability control, the CMDB can be used to find multiple projects and related configuration information of multiple projects when the system is registered, so as to determine which projects use the vulnerability control. However, using the above method, since the configuration information in the CMDB is added when the project is created, the configuration information in the CMDB may not be accurate; for example, taking a component as an example, if the component of the project is updated or upgraded after the project goes online, the component actually used by the project is inconsistent with the component of the project in the CMDB. It can be seen that the above method for vulnerability detection cannot accurately locate the project using the vulnerability control, which makes the accuracy of vulnerability detection low.

[0004] In summary, there is an urgent need for a vulnerability detection method to accurately locate projects that use vulnerable controls, thereby improving the accuracy of vulnerability detection. Summary of the invention

[0005] The embodiments of the present invention provide a vulnerability detection method and device for accurately locating projects using vulnerability controls, thereby improving the accuracy of vulnerability detection.

[0006] In a first aspect, an embodiment of the present invention provides a vulnerability detection method, the method comprising:

[0007] After receiving a vulnerability detection instruction triggered by the user, the identifier of at least one vulnerability control stored in a preset vulnerability library is obtained; further, for a first vulnerability control among the at least one vulnerability control, if it is determined that there is a first target project using the first vulnerability control in the preset database, the first target project is displayed to the user; the preset database is detected by executing code on at least one project, and the preset database stores the identifier of the at least one project and the controls used by the at least one project.

[0008] In the above design, since the code of the project is the basic unit for executing the project, by performing code detection on the project to obtain the controls used by the project, it can be ensured that the controls obtained are the latest controls used in the project execution process. In this way, vulnerability detection based on the latest controls used by the project can improve the accuracy of the detected project vulnerabilities; and, by storing the results of the code detection corresponding to the project in a preset database, the controls used by the project can be obtained through the preset database without re-performing code detection on the project, thereby improving the efficiency of detecting project vulnerabilities, and then improving the efficiency of repairing project vulnerabilities.

[0009] In one possible design, the controls used by the at least one project include any one or more of the frameworks, third-party components, and services used by the at least one project; the third-party components used by the at least one project are dependent libraries and / or plug-ins used by the at least one project.

[0010] In the above design, by detecting the code of the project, one or more information of the framework, dependent library, plug-in, and service used by the project can be accurately identified, such as the name and / or version of the framework, dependent library, plug-in, and service; that is, the above design can quickly and accurately locate the project to which the vulnerability control belongs, thereby reducing the possibility of the system exposing weaknesses or being attacked, and improving the security of the system.

[0011] In a possible design, the preset database is detected for executing code on at least one project, including: according to the identification of the at least one project, obtaining the code files corresponding to the at least one project respectively; further, for the first project of the at least one project, determining the programming language used by the first project according to the suffix name of the code file corresponding to the first project, and determining the project type of the first project according to the directory structure of the code file corresponding to the first project and / or the programming language used by the first project; according to the project type of the first project, obtaining the file to be detected from the code file corresponding to the first project, and detecting the file to be detected to determine the control used by the first project; using the identification of the at least one project and the control used by the at least one project to generate the preset database.

[0012] In the above design, projects are divided into multiple types by using the directory structure and / or programming language of the code files corresponding to the projects, and the scanning methods corresponding to the project types can be used to obtain the files to be detected, thereby improving the efficiency and accuracy of detecting project vulnerabilities; and, by determining multiple project types and the scanning methods corresponding to each project type, the process of detecting project vulnerabilities can be made more in line with the actual situation, making the scenarios of project vulnerability detection more extensive.

[0013] In a possible design, the method of obtaining the file to be detected from the code file corresponding to the first project according to the project type of the first project includes: if it is determined that the first project is built using a first preset tool, obtaining the contents corresponding to the properties tag, the dependencies tag and / or the plugins tag from the pom.xml data packet of the code file corresponding to the first project; or, if it is determined that the first project is not built using the first preset tool, obtaining the programming language used by the first project; if the programming language used by the first project is Java, obtaining the jar data packet file of the code file, or, if the programming language used by the first project is Javescript type, obtaining the package.json data packet file and / or package-lock.json data packet file of the code file, or, if the programming language used by the first project is Python type, obtaining the header file of the code file.

[0014] In the above design, by setting a corresponding scanning method for each project type, the to-be-detected file corresponding to the project type can be quickly acquired based on the corresponding scanning method, thereby improving the efficiency of detecting project vulnerabilities.

[0015] In one possible design, the method also includes: if there is no target project using the first vulnerability control in the preset database, determining one or more projects that are currently in operation, and obtaining the project addresses of the one or more projects based on the identifiers of the one or more projects; further, based on the project addresses of the one or more projects, calling an application programming API interface to obtain one or more files to be detected corresponding to the one or more projects, respectively, and performing code detection on the one or more files to be detected to determine the controls used by the one or more projects, and if there is a second target project using the first vulnerability control among the one or more projects, displaying the second target project to the user.

[0016] In the above technology, when there is no project using the first vulnerability control in the preset database, the project using the first vulnerability control can be accurately located by performing code analysis on the currently running project, thereby improving the accuracy of vulnerability detection.

[0017] In a second aspect, an embodiment of the present invention provides a vulnerability detection device, the device comprising:

[0018] The transceiver module is used to obtain the identifier of at least one vulnerability control stored in a preset vulnerability library after receiving a vulnerability detection instruction triggered by a user;

[0019] A processing module is used to display a first vulnerability control among the at least one vulnerability control to the user if it is determined that a first target project using the first vulnerability control exists in a preset database; the preset database is detected by executing code on at least one project, and the preset database stores an identifier of the at least one project and a control used by the at least one project.

[0020] In one possible design, the controls used by the at least one project include any one or more of the frameworks, third-party components, and services used by the at least one project; the third-party components used by the at least one project are dependent libraries and / or plug-ins used by the at least one project.

[0021] In one possible design, the processing module is also used to: obtain code files corresponding to the at least one project respectively according to the identification of the at least one project; further, for the first project of the at least one project, determine the programming language used by the first project according to the suffix of the code file corresponding to the first project, and determine the project type of the first project according to the directory structure of the code file corresponding to the first project and / or the programming language used by the first project; according to the project type of the first project, obtain the file to be detected from the code file corresponding to the first project, and detect the file to be detected to determine the control used by the first project; use the identification of the at least one project and the control used by the at least one project to generate the preset database.

[0022] In a possible design, the processing module is specifically used to: if it is determined that the first project is built using a first preset tool, then obtain the contents corresponding to the properties tag, the dependencies tag and / or the plugins tag from the pom.xml data packet of the code file corresponding to the first project; or, if it is determined that the first project is not built using the first preset tool, then obtain the programming language used by the first project; if the programming language used by the first project is Java, then obtain the jar data packet file of the code file, or, if the programming language used by the first project is Javescript type, then obtain the package.json data packet file and / or package-lock.json data packet file of the code file, or, if the programming language used by the first project is Python type, then obtain the header file of the code file.

[0023] In a possible design, the processing module is also used to: if there is no target project using the first vulnerability control in the preset database, determine one or more projects that are currently in operation, and obtain the project addresses of the one or more projects based on the identifiers of the one or more projects; further, based on the project addresses of the one or more projects, call an application programming API interface to obtain one or more files to be detected corresponding to the one or more projects, and perform code detection on the one or more files to be detected to determine the controls used by the one or more projects; if there is a second target project using the first vulnerability control among the one or more projects, display the second target project to the user.

[0024] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, comprising instructions, which, when executed on a processor of a computer, enables the processor of the computer to execute the method described in the first aspect or any of the methods described in the first aspect.

[0025] In a fourth aspect, an embodiment of the present invention provides a computer program product, which, when executed on a computer, enables the computer to execute the method described in the first aspect or any of the methods described in the first aspect.

[0026] These and other designs of the present invention will be more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0028] Figure 1 A schematic diagram of the architecture of a network information security system provided by an embodiment of the present invention;

[0029] Figure 2 A schematic diagram of a flow chart of a vulnerability detection method provided by an embodiment of the present invention;

[0030] Figure 3 A schematic diagram of the structure of a vulnerability detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] Fintech refers to a new innovative technology brought to the financial field after the integration of information technology into the financial field. By using advanced information technology to assist in financial operations, transaction execution and financial system improvement, it can improve the processing efficiency and business scale of the financial system and reduce costs and financial risks.

[0033] The financial technology industry involves a variety of operations, such as transaction processing, office processing, monitoring processing, etc. Taking transaction processing as an example, transaction processing is a common operation in the financial technology industry. Since transaction processing involves information such as transaction accounts and transaction amounts, it is usually necessary to ensure that the transactions processed by transaction processing are accurate, secure, and cannot be lost. Generally speaking, the execution subjects of transaction processing operations are various network devices. If there are problems with the current network information security (for example, a project running on a certain network device uses a vulnerability control), the entire transaction processing process may be seriously affected.

[0034] Based on this, there is an urgent need for a vulnerability detection method to accurately locate projects that use vulnerable controls, thereby improving the accuracy of vulnerability detection.

[0035] Figure 1 A schematic diagram of the architecture of a network information security system provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the network information security system may include a client device 100, a vulnerability detection server 200, a central server 300, and at least one network server (such as Figure 1 The central server 300 and at least one network server may constitute a cluster server, and at least one network server may be connected to the central server 300 by wire, or may be connected to the central server 300 by wireless, without limitation.

[0036] like Figure 1As shown, at least one network server may include various servers in the network information security system, such as a Domain Name Server (DNS) 410, a World Wide Web (web) server 420, a database server 430, a file server 440, a mail server 450, and a File Transfer Protocol (FTP) server 460. Among them, the DNS server 410 can be used to provide a domain name function, such as a network administrator can query the domain name information of other servers through the DNS server 410, or can also respond to the domain name information of its own server through the DNS server 410. The web server 420 can be used to provide a network function, such as a network administrator can obtain a web page through the web server 420, and then search for data on the web page. The database server 430 can be used to provide a database function. Specifically, the database server 430 can be provided with a variety of database software, and can use a variety of database software to generate different databases; for example, an Oracle server, a MySQL server, and a Microsoft SQL Server server can all be database servers. The file server 440 can be used to provide sharing functions. For example, the file server 440 can store shared files, so that other servers can obtain shared files by communicating with the file server 440. For example, a Windows Server 2003 server can be a file server. The mail server 450 can be used to provide mail functions. For example, a network administrator can send and receive mails, edit mails, etc. through the mail server 450. Generally speaking, the mail server 450 can be provided with one or more software related to the mail function, such as WebEasyMail software, Sendmail software, Postfix software, Qmail software, Microsoft Exchange software, etc. The FTP server 460 can also be called a proxy server. The FTP server 460 can be used to provide extended access rights. For example, a network administrator can change the IP address of the client device 100 to the IP address of other servers through the Internet Protocol Address (IP) of the FTP server 460, so that the client device 100 can access other servers and obtain resources on other servers.

[0037] It should be noted that Figure 1 This is only an exemplary and simple description, and the network servers listed are only for the convenience of explaining the solution and do not constitute a limitation on the solution. It can be understood that the network information security system can also include other network servers, such as office servers, financial servers, etc., which are not specifically limited.

[0038] based on Figure 1 The system architecture shown is Figure 2 A schematic diagram of a process flow corresponding to a vulnerability detection method provided in an embodiment of the present invention, the method comprising:

[0039] Step 201, receiving a vulnerability detection instruction triggered by a user.

[0040] In a possible implementation, a World Wide Web (web) browser may be provided on the client device 100, and the user may obtain a vulnerability management interface by inputting a preset link on the web browser; the vulnerability management interface may be provided with a variety of function icons, such as a "vulnerability detection" function icon, a "display vulnerability information" function icon, etc. In a specific implementation, if the user wants to perform vulnerability detection on at least one network server in the network information security system, a vulnerability detection instruction may be generated by triggering the "vulnerability detection" function icon on the vulnerability management interface; in this way, the client device 100 may send the vulnerability detection instruction to the vulnerability detection server 200; accordingly, after receiving the vulnerability detection instruction triggered by the user, the vulnerability detection server 200 may perform vulnerability detection on at least one network server based on the vulnerability detection instruction.

[0041] Step 202: Obtain an identifier of at least one vulnerability control stored in a preset vulnerability library.

[0042] In a specific implementation, after the vulnerability detection server 200 receives the vulnerability detection instruction triggered by the user, it can obtain one or more preset vulnerability databases. Among them, the one or more preset vulnerability databases can be any one or more vulnerability databases among multiple vulnerability databases in the global information security field, such as the China National Vulnerability Database of Information Security (CNNVD), the US National Information Security Vulnerability Database, the Symantec Vulnerability Database, etc.

[0043] In the embodiment of the present invention, each of the one or more preset vulnerability libraries may store at least one vulnerability control that has been determined to have a vulnerability. For example, CNNVD may store hundreds of thousands or even millions of vulnerability controls that have been determined to have vulnerabilities worldwide. In this way, the vulnerability detection server 200 may obtain the identifier of at least one vulnerability control stored in one or more preset vulnerability libraries, and may perform vulnerability detection based on the identifier of at least one vulnerability control.

[0044] In the following embodiments of the present invention, the process of using the first vulnerability control to perform vulnerability detection is described by taking the first vulnerability control as an example. The first vulnerability control can be any vulnerability control stored in one or more preset vulnerability libraries. It can be understood that the process of using other vulnerability controls to perform vulnerability detection can be implemented by referring to this method, and the details will not be repeated here.

[0045] Step 203, determine whether there is an item using the vulnerability control in the preset database.

[0046] In a specific implementation, a preset database can be obtained in advance. The preset database can be obtained by performing code detection on at least one project. The preset database can store the identification of at least one project and the controls used by at least one project. In this way, if it is determined that there is a project using the first vulnerability control in the preset database (such as project a), it can be determined that project a is a project that uses the vulnerability control, so that project a can be displayed to the user.

[0047] In the embodiment of the present invention, since the code of the project is the basic unit for executing the project, by performing code detection on the project to obtain the controls used by the project, it can be ensured that the controls obtained are the latest controls used in the project execution process. In this way, vulnerability detection based on the latest controls used by the project can improve the accuracy of the detected project vulnerabilities; and, by storing the results of the code detection corresponding to the project in a preset database, the controls used by the project can be obtained through the preset database without re-performing code detection on the project, thereby improving the efficiency of detecting project vulnerabilities, and then improving the efficiency of repairing project vulnerabilities.

[0048] In one example, the controls used by the project may include any one or more of the frameworks, third-party components, and services called by the project, and the third-party components may be dependent libraries and / or plug-ins. Specifically, the controls used by the project may be open source controls, and the code of the open source controls may be partially or completely incompatible with the project. Therefore, if incompatible open source controls are called during the execution of the project, vulnerabilities may occur in the project execution process.

[0049] In the embodiment of the present invention, by detecting the code of the project, one or more information in the framework, dependent library, plug-in, and service used by the project can be accurately identified, such as the name and / or version of the framework, dependent library, plug-in, and service; that is, the solution in the embodiment of the present invention can quickly and accurately locate the project to which the vulnerability control belongs, thereby reducing the possibility of the system exposing weaknesses or being attacked, and improving the security of the system.

[0050] In a possible implementation, the preset database may be obtained through the following steps a to c:

[0051] Step a: acquiring a code file of at least one project according to an identifier of at least one project.

[0052] In the embodiment of the present invention, a code warehouse may be provided on the central server 300, and the code warehouse may store the project codes and project information of all projects used by the network servers 410 to 460. The code warehouse may store the project code of each project in a code file, so that the project codes of different projects may be stored in different project files, thereby improving the flexibility of managing project codes; accordingly, a preset configuration table may be provided in the code warehouse, and the preset configuration table may store the project information of all projects used by the network servers 410 to 460, such as project name, project start time, etc.

[0053] In an embodiment of the present invention, the code repository may be a code repository generated based on an open source tool, such as a gitlab code repository. In the following embodiments of the present invention, the process of obtaining code files is described by taking the gitlab code repository as an example.

[0054] In one example, a preset key can be set on the vulnerability detection server 200, and the preset key can be used to successfully unlock the code repository set on the central server 300, and the vulnerability detection server 200 and the client device 100 are relatively isolated, that is, the client device 100 cannot obtain the code file pulled by the vulnerability detection server 200; in this way, the vulnerability detection server 200 can successfully obtain the code file and ensure the security of the code file.

[0055] In a specific implementation, the vulnerability detection server 200 can obtain the code files of the projects executed in the network servers 410 to 460 from the code repository according to a preset period; for example, taking the example that 10 projects are respectively set on the network servers 410 to 460, the central server 300 can store the code files of these 60 projects. If the preset period is 5 minutes, the vulnerability detection server 200 can obtain the code files of these 60 projects from the central server 300 every 5 minutes; in this way, the vulnerability detection server 200 can detect the controls used by these 60 projects based on the code files of these 60 projects, and obtain the controls used by each of the 60 projects.

[0056] In a specific implementation, the vulnerability detection server 200 can obtain the code files of all projects from the code repository in a variety of ways, such as obtaining the code files through a network administrator, or automatically obtaining the code files, without specific limitation. The specific implementation process of obtaining the code files is described below from these two examples.

[0057] Example 1

[0058] In example one, the vulnerability detection server 200 can automatically obtain the code file.

[0059] In a specific implementation, the vulnerability detection server 200 may send a code acquisition instruction to the central server 300. The code acquisition instruction may be used to obtain the project information of all projects stored in the code repository; the code acquisition instruction may include a preset key. Accordingly, after receiving the code acquisition instruction, the central server 300 may authenticate the vulnerability detection server 200; if it is determined that the preset key matches the key of the code repository, then it is determined that the identity of the vulnerability detection server 200 is legal, so the central server 300 may send the project information of all projects to the vulnerability detection server 200.

[0060] In one example, after acquiring the project information of all projects, the vulnerability detection server 200 may display the project information of all projects to the user through the client device 100, so that the user can determine the target project; further, if the vulnerability detection server 200 receives the identifier of the target project sent by the client device 100, it may send a code acquisition instruction to the central server 300, so that after receiving the code acquisition instruction, the central server may send the code file of the target project to the vulnerability detection server 200. In another example, after acquiring the project information of all projects, the vulnerability detection server 200 may send a code acquisition instruction to the central server 300, so that after receiving the code acquisition instruction, the central server may send the code files of all projects to the vulnerability detection server 200. In yet another example, after acquiring the project information of all projects, the vulnerability detection server 200 may send a partial code acquisition instruction to the central server 300, so that after receiving the partial code acquisition instruction, the central server may send partial code content in the code files of all projects to the vulnerability detection server 200.

[0061] Example 2

[0062] In Example 2, the vulnerability detection server 200 can obtain the code file through a network administrator.

[0063] In a specific implementation, the network administrator can send a code acquisition instruction to the vulnerability detection server 200 through the client device 100. For example, the network administrator can obtain the management interface of the gitlab code repository through the web browser on the client device 100, and can log in to the management interface of the gitlab code repository through a preset URL and the network administrator's account information and preset key, and then trigger the "Get Code" function icon on the management interface to generate a code acquisition instruction; or, the network administrator can obtain the command line of the gitlab code repository, and can enter the network administrator's account information and preset key in the command line to generate a code acquisition instruction.

[0064] Accordingly, after receiving the code acquisition instruction, the central server 300 can authenticate the network administrator; if it is determined that the network administrator's account information is legitimate, the project information of all projects in the code repository can be displayed to the user. 1 ~Project w 3 , the central server 300 can display the project w on the management interface of the gitlab code repository of the client device 100 1 ~Project w 3 Project information, or you can also 1 ~Project w 3 The project information is displayed in the command line, or you can also use the project w 1 ~Project w 3 The project information is voice broadcast to the user, without any specific limitation.

[0065] In an embodiment of the present invention, the project information of a project may include any one or more of the project address of the project and / or the project number, project name, project description, project members, and project address of the project. The project address of the project may be the location information of the code files of the project stored in the gitlab code repository, so that the network administrator can obtain the code files of the project from the gitlab code repository through the project address of the project.

[0066] Step b: according to the code files of each project, obtain the files to be detected of each project, and perform code detection on the files to be detected to determine the controls used by each project.

[0067] To convert the project 1 ~Project w 3 Items in 1 For example, in the specific implementation, get the project w 1 After the code file is created, the directory structure of the code file can be analyzed, and the project w can be determined based on the suffix of the code file. 1The programming language used determines the file type of the code file, and the directory structure and file type of the code file can then be used to determine the project w 1 The project type can be determined based on the directory structure of the code file. 1 The execution subject, for example, the execution subject is a server or a terminal (Android type). 1 For example, if the execution subject of project w is the server, 1 If the object model is built using Maven, the project w can be determined by the first method. 1 The project type; if the project w 1 If it is not built using Maven, you can use the second method to determine the project w 1 Specifically, if the project w 1 If it is not built using POM, you can use the project w 1 The programming language used determines the project w 1 The project type, for example, if the project w 1 The code file is a php file, then you can determine the project w 1 The project type is php; if the project w 1 The code file is a php file, then the project w 1 The project type can be a java type; if the project w 1 The code file is a Javescript file, then the project w 1 The project type can be a Javescript type; if the project w 1 The code file is python, then the project w 1 The project type can be python type.

[0068] Furthermore, in determining the project w 1 After the project type is determined, the scanning method corresponding to the project type can be used to obtain the file to be detected, and the code detection of the file to be detected can be performed to determine the project type. 1 The following describes the control used to determine the project w 1 Several possible scenarios for using the control.

[0069] Scenario 1

[0070] In case 1, item w 1 This is a project built using Maven.

[0071] In the embodiment of the present invention, if the item w 1 For a project built using POM, the project w 1The directory structure of the code file can include a pom.xml package, which stores the instructions for creating and running the project w 1 Specifically, the pom.xml data package may include properties tags, dependencies tags, and / or plugins tags, where the content corresponding to the properties tag is used to define the project w 1 The name and version of the framework used. The content corresponding to the dependencies tag is used to define the project w 1 The name and version of the dependent library used. The content corresponding to the plugins tag is used to define the project w 1 The name and version of the plugin being used.

[0072] As an example, if the vulnerability detection server 200 determines that the item w 1 For projects built using POM, you can obtain the properties tag, dependencies tag, and plugins tag under the pom.xml data package, and determine the project by analyzing the properties tag. 1 The name and version of the framework used, determined by analyzing the dependencies tag of the project. 1 The name and version of the dependent library used is determined by analyzing the plugins tag of the project. 1 The name and version of the plugin to use. 1 The used control may include the name and version of the framework, the name and version of the dependent library, and the name and version of the plug-in determined above.

[0073] The following describes how to determine the project w based on the properties tag, dependencies tag, and plugins tag. 1 The specific implementation of the control used.

[0074] properties tag

[0075] In the embodiment of the present invention, the properties tag can be used to define the project w 1 The public version variables used, such as the name and version of the framework. For example, if the name and version of the framework are defined in the properties tag, the vulnerability detection server 200 can obtain the project w by analyzing the code structure of the properties tag. 1 The name and version of the framework used.

[0076] In an example, the structure of the properties tag can be:

[0077] <***version>${***.version}< / ***version>

[0078] The properties tag can be set with a version identifier, and the content before the version identifier (i.e. "***") can be used to define the project w 1 The name of the framework used, the content after the version identifier (i.e. "***.version") can be used to define the project w 1 The version of the framework used.

[0079] For example, if the properties tag is<spring.version> 1.2.6< / spring.version> , we can determine the project w 1 The spring framework is used, and the version of the spring framework is 1.2.6.

[0080] dependencies tag

[0081] In this embodiment of the present invention, the dependencies tag can be used to define the project w 1 The name and version of the dependent library used; accordingly, the project w can be obtained by analyzing the code structure of the dependencies tag 1 The names and versions of the dependencies used.

[0082] In one example, one or more public variables may be defined in the dependencies tag, and the name and version of the dependent library may be obtained by assigning values ​​to the one or more public variables. In this example, the structure of the dependencies tag may be:

[0083]

[0084] In this example, the dependencies tag may be set with a groupId identifier, an artifactId identifier, and a version identifier; the content after the groupId identifier and the artifactId identifier (i.e., "***") may be used to define the project w 1 The name of the public variable used, the content after the version identifier (i.e. "***.version") can be used to define the project w 1 The version of the public variable used.

[0085] Accordingly, if the variable "***" is assigned the value of spring and the variable "***.version" is assigned the value of 1.2, then the project w 1 The name of the framework used may be spring, and the version of the framework may be 1.2.

[0086] In another example, the dependencies tag can also directly define the name and version of the dependent library. In this example, the structure of the dependencies tag can be:

[0087]

[0088] In this example, the dependencies tag defines <groupid> org.springframework< / groupid> "It is possible to determine the project w 1 The name of the framework used is spring; the " <version> 1.2.6< / version> "It is possible to determine the project w 1 The version of the framework used is 1.2.

[0089] plugins tag

[0090] In the embodiment of the present invention, the plugins tag can be used to define the project w 1 Information about the plugins used, such as the name and version of the plugin. If the name and version of the plugin are defined in the plugins tag, the project w 1 The name and version of the plugin being used.

[0091] In an example, the structure of the plugins tag can be:

[0092]

[0093] In this example, the plugins tag can set the groupId, artifactId, and version identifiers; the groupId identifier can be used to define the project. 1 The project type (i.e. Maven type), artifactId can be used to define the project w 1 The plugin used (ie, jar plugin), version identifier can be used to define the project w 1 The version of the plugin used (i.e. version 3.0.2).

[0094] In summary, the properties tag can be set with a version identifier, and the dependencies tag and plugins tag can be set with a groupId identifier, an artifactId identifier, and a version identifier. 1 For projects built using the Maven tool, you can 1 Get the properties tag, dependencies tag, and plugins tag from the code file, and analyze the groupId, artifactId, and version identifiers in the properties tag, dependencies tag, and plugins tag to get the project w 1 The names and versions of the controls used (such as services, dependent libraries, plugins, and frameworks).

[0095] Scenario 2

[0096] In case 2, item w 1 It is not obtained by construction, so it can be executed according to the following sub-situations.

[0097] Sub-case 1

[0098] In subcase 1, item w 1 The project type is java type.

[0099] In the embodiment of the present invention, if the item w 1 If the project type is Java, then the project w 1 The directory structure of the code files can include a jar data package, which stores the code to create and run the project w 1 The name and version of the control required when the vulnerability detection server 200 determines the project w 1 If the project type is Java type, you can 1 Get the jar data package from the code file. By analyzing the jar data package, you can get the project w 1 The names and versions of the controls used (such as frameworks, dependent libraries, and third-party components).

[0100] Sub-case 2

[0101] In subcase 2, item w 1 The project type is Javescript type.

[0102] In the embodiment of the present invention, if the item w1 If the project type is a JavaScript type, then the project w 1 The directory structure of the code files may include a package.json data package file and / or a package-lock.json data package file, which stores the instructions for creating and running the project w 1 The name and version of the control required when the vulnerability detection server 200 determines the project w 1 If the project type is JavaScript, you can 1 Get the package.json data package file and / or package-lock.json data package file from the code file. By analyzing the package.json data package file and / or package-lock.json data package, you can get the project w 1 The names and versions of the controls used (such as frameworks, dependent libraries, and third-party components).

[0103] Sub-case 3

[0104] In subcase 3, item w 1 The project type is Python type.

[0105] Generally speaking, controls (such as third-party components) in Python projects usually need to import the starting position of the code file through the import identifier; therefore, if the vulnerability detection server 200 determines that the project is w 1 If the project type is Python, you can 1 Get the file header from the code file, and analyze the import identifier in the header file to get the project w 1 The names and versions of third-party components used.

[0106] Scenario 3

[0107] In case 3, item w 1 The project types are other than the above-mentioned situations 1 and 2.

[0108] Generally speaking, the code files of a project will have a requirements.txt file, which can be used to record the names and versions of the third-party components used in the project. 1 If the project type is other than the above four types, you can select the project from 1Get the requirements.txt file from the code file. By analyzing the requirements.txt file, you can get the project w 1 The names and versions of third-party components used.

[0109] In an embodiment of the present invention, by using the directory structure and programming language of the code files corresponding to the projects to divide the projects into multiple types, and setting the corresponding scanning method for each project type, the client device can use the scanning method corresponding to the project type to obtain the file to be detected, thereby improving the efficiency and accuracy of detecting project vulnerabilities; and, by determining multiple project types and the scanning method corresponding to each project type, the process of detecting vulnerabilities can be made more in line with the actual situation, making the vulnerability detection scenario more extensive.

[0110] Step c: generating a preset database according to the identification of at least one project and the controls used by at least one project.

[0111] In the specific implementation, through the method in step b, the vulnerability detection server 200 can obtain the identification of all projects executed by network servers 410 to 460 and the controls used by all projects; in this way, the vulnerability detection server 200 can generate a preset database based on the identification of all projects and the controls used by all projects.

[0112] Table 1 is a schematic diagram of a preset database generated by steps a to c.

[0113] Table 1: Schematic diagram of a preset database

[0114]

[0115]

[0116] As shown in Table 1, the projects executed by the network server 410 include project w 1 ~Project w 3 , project w 1 The control used is the 1.2.6 version of the Spring framework, project w 2 The control used is the 4.2 version of the Guice plug-in, project w 3 The control used is the Beta version of the Jar dependency library; the projects executed by the network server 420 include project w 4 , project w 4 The control used is the recyclerview dependency library of version 24.0.0; the projects executed by the network server 430 include project w 5 , project w 5 The control used is the 4.0.1 version of the Spring framework.

[0117] Based on the preset database shown in Table 1, if the identifier of the first vulnerability control is Spring, the project w can be determined by viewing the preset database. 5 and project w 1 All use Spring controls, so the vulnerability detection server 200 can execute step 204a; if the first vulnerability control is identified as ocx, it can be determined by checking the preset database that there is no project using the ocx control, so the vulnerability detection server 300 can execute step 204b.

[0118] Step 204a, obtaining the target project using the vulnerability control from the preset database.

[0119] Based on the preset database shown in Table 1, if the identifier of the first vulnerability control is Guice, the project w can be determined by checking the preset database. 2 As the target project, the vulnerability detection server 200 can 2 The project information is sent to the client device 100.

[0120] Step 204b, obtain the codes of all projects in the code repository, and determine the target project that uses the vulnerability control in all projects.

[0121] In one example, if the identifier of the first vulnerability control is ocx, there is no vulnerability control matching the identifier of the first vulnerability control in the preset database, that is, there is no project using the ocx control in the preset database; in this way, the vulnerability detection server 200 can obtain the code files of all projects running on network servers 410 to 460 from the code warehouse according to the method in step b, and then use the scanning method corresponding to the project type to which each project belongs to perform code detection on the code files of each project, so as to determine the control used by each project. Further, query whether there is a project using the ocx control among all projects. If there is a project (such as project w 6 ) If you use the ocx control, you can use the project w 6 The project information is sent to the client device 100.

[0122] In an embodiment of the present invention, by storing the results of code detection corresponding to the project in a preset database, the controls used by the project can be obtained through the preset database without re-detecting the code of the project, thereby improving the efficiency of detecting project vulnerabilities and further improving the efficiency of repairing project vulnerabilities; accordingly, when there are no projects using vulnerable controls in the preset database, by performing code analysis on all projects in the code repository, the controls currently used by each project can be determined, thereby improving the accuracy of detecting project vulnerabilities.

[0123] Step 205: Display the target project using the first vulnerability control to the user.

[0124] In a specific implementation, the client device 100 receives the project w sent by the vulnerability detection server 200. 6 After you have the project information, you can 6 The project information is displayed to the user, for example, it can be displayed to the user through the vulnerability management interface on the client device 100, or it can also be displayed to the user through the command line of the client device 100, without specific limitation.

[0125] In a possible implementation, the client device 100 may also generate an item w 6 The corresponding warning information can be obtained from the project w 6 Get the project information from the project w 6 project members, so that the warning information can be pushed to the project w 6 For example, the client device 100 can push the alarm information to the project members in real time through WeChat, DingTalk, etc. 6 You can also send alerts to project members via email. 6 The project members are not specifically limited. 6 After receiving the alarm information sent by the client device 100, the project members can 6 The vulnerable controls in the project can be repaired, for example, the version of the vulnerable control can be upgraded, or the code of the vulnerable control can be modified. In this way, by sending the warning information to the project members in real time, the vulnerable controls in the project can be repaired in time, so as to avoid running the project that uses the vulnerable controls, reduce the risk of the system being attacked, and improve the security of the system.

[0126] In the above-mentioned embodiment of the present invention, after receiving the vulnerability detection instruction triggered by the user, the identifier of at least one vulnerability control stored in the preset vulnerability library is obtained, and then for the first vulnerability control in the at least one vulnerability control, if it is determined that there is a first target project using the first vulnerability control in the preset database, the first target project is displayed to the user; the preset database is detected by executing the code of at least one project, and the preset database stores the identifier of the at least one project and the controls used by the at least one project. In the embodiment of the present invention, since the code of the project is the basic unit for executing the project, the controls used by the project can be obtained by performing code detection on the project, which can ensure that the controls obtained are the latest controls used during the execution of the project. In this way, vulnerability detection based on the latest controls used by the project can improve the accuracy of the detected project vulnerabilities; and, by storing the results of the code detection corresponding to the project in the preset database, the controls used by the project can be obtained through the preset database without re-detecting the code of the project, thereby improving the detection efficiency of the project vulnerabilities and thus improving the efficiency of repairing the project vulnerabilities.

[0127] In view of the above method flow, an embodiment of the present invention further provides a vulnerability detection device, and the specific content of the device can be implemented with reference to the above method.

[0128] Figure 3 A schematic diagram of the structure of a vulnerability detection device provided by an embodiment of the present invention includes:

[0129] The transceiver module 301 is used to obtain the identifier of at least one vulnerability control stored in a preset vulnerability library after receiving a vulnerability detection instruction triggered by a user;

[0130] The processing module 302 is used to display the first vulnerability control among the at least one vulnerability control to the user if it is determined that there is a first target project using the first vulnerability control in a preset database; the preset database is detected by executing code on at least one project, and the preset database stores the identifier of the at least one project and the control used by the at least one project.

[0131] Optionally, the controls used by the at least one project include any one or more of the frameworks, third-party components and services used by the at least one project; the third-party components used by the at least one project are dependent libraries and / or plug-ins used by the at least one project.

[0132] Optionally, the processing module 302 is further configured to:

[0133] According to the identifier of the at least one project, obtaining code files corresponding to the at least one project respectively;

[0134] For a first project among the at least one project, a programming language used by the first project is determined according to a suffix of a code file corresponding to the first project, and a project type of the first project is determined according to a directory structure of the code file corresponding to the first project and / or the programming language used by the first project; according to the project type of the first project, a file to be detected is obtained from the code file corresponding to the first project, and the file to be detected is detected to determine a control used by the first project;

[0135] The preset database is generated using the identifier of the at least one project and the controls used by the at least one project.

[0136] Optionally, the processing module 302 is specifically configured to:

[0137] If it is determined that the first project is built using a first preset tool, then obtaining contents corresponding to the properties tag, the dependencies tag and / or the plugins tag from a pom.xml data packet of a code file corresponding to the first project; or,

[0138] If it is determined that the first project is not built using the first preset tool, obtain the programming language used by the first project; if the programming language used by the first project is Java, obtain the jar data package file of the code file, or, if the programming language used by the first project is Javescript type, obtain the package.json data package file and / or package-lock.json data package file of the code file, or, if the programming language used by the first project is Python type, obtain the header file of the code file.

[0139] Optionally, the processing module 302 is further configured to:

[0140] If the target project using the first vulnerability control does not exist in the preset database, determining one or more projects currently in operation, and obtaining project addresses of the one or more projects according to the identifiers of the one or more projects;

[0141] According to the project addresses of the one or more projects, an application programming API interface is called to obtain one or more files to be detected corresponding to the one or more projects respectively, and code detection is performed on the one or more files to be detected to determine the controls used by the one or more projects;

[0142] If there is a second target project using the first vulnerability control among the one or more projects, the second target project is displayed to the user.

[0143] It can be seen from the above content that: in the above embodiment of the present invention, after receiving the vulnerability detection instruction triggered by the user, the identifier of at least one vulnerability control stored in the preset vulnerability library is obtained, and then for the first vulnerability control in the at least one vulnerability control, if it is determined that there is a first target project using the first vulnerability control in the preset database, the first target project is displayed to the user; the preset database is detected by executing the code of at least one project, and the preset database stores the identifier of the at least one project and the controls used by the at least one project. In the embodiment of the present invention, since the code of the project is the basic unit for executing the project, by performing code detection on the project to obtain the controls used by the project, it can be ensured that the controls obtained are the latest controls used during the execution of the project. In this way, vulnerability detection based on the latest controls used by the project can improve the accuracy of the detected project vulnerabilities; and, by storing the results of the code detection corresponding to the project in the preset database, the controls used by the project can be obtained through the preset database without re-detecting the code of the project, thereby improving the detection efficiency of the project vulnerabilities and thus improving the efficiency of repairing the project vulnerabilities.

[0144] Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium, including instructions, which, when executed on a processor of a computer, causes the processor of the computer to execute the above-mentioned Figure 2 or Figure 2 Any vulnerability detection method described above.

[0145] Based on the same inventive concept, an embodiment of the present invention further provides a computer program product, which, when executed on a computer, enables the computer to execute the above Figure 2 or Figure 2 Any vulnerability detection method described above.

[0146] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0147] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0150] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0151] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A vulnerability detection method, characterized in that: The method comprises: After receiving the vulnerability detection instruction triggered by the user, obtaining the identifier of at least one vulnerability control stored in the preset vulnerability library; For a first vulnerability control among the at least one vulnerability control, if it is determined that a first target project using the first vulnerability control exists in a preset database, the first target project is displayed to the user; the preset database stores an identifier of at least one project and a control used by the at least one project; The preset database is obtained in the following manner: according to the identification of the at least one project, the code files corresponding to the at least one project are obtained; for the first project of the at least one project, the programming language used by the first project is determined according to the suffix of the code file corresponding to the first project, and the project type of the first project is determined according to the directory structure of the code file corresponding to the first project and / or the programming language used by the first project; according to the project type of the first project, the file to be detected is obtained from the code file corresponding to the first project, and the file to be detected is detected to determine the control used by the first project; the preset database is generated using the identification of the at least one project and the control used by the at least one project.

2. The method according to claim 1, characterized in that The controls used by the at least one project include any one or more of the framework, third-party components and services used by the at least one project; the third-party components used by the at least one project are dependent libraries and / or plug-ins used by the at least one project.

3. The method according to claim 1, characterized in that The acquiring the file to be detected from the code file corresponding to the first project according to the project type of the first project includes: If it is determined that the first project is built using a first preset tool, then obtaining contents corresponding to the properties tag, the dependencies tag and / or the plugins tag from a pom.xml data packet of a code file corresponding to the first project; or, If it is determined that the first project is not built using the first preset tool, obtain the programming language used by the first project; if the programming language used by the first project is Java, obtain the jar data package file of the code file, or, if the programming language used by the first project is Javescript type, obtain the package.json data package file and / or package-lock.json data package file of the code file, or, if the programming language used by the first project is Python type, obtain the header file of the code file.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: If the target project using the first vulnerability control does not exist in the preset database, determining one or more projects currently in operation, and obtaining project addresses of the one or more projects according to the identifiers of the one or more projects; According to the project addresses of the one or more projects, an application programming API interface is called to obtain one or more files to be detected corresponding to the one or more projects respectively, and code detection is performed on the one or more files to be detected to determine the controls used by the one or more projects; If there is a second target project using the first vulnerability control among the one or more projects, the second target project is displayed to the user.

5. A vulnerability detection device, characterized in that: The device comprises: The transceiver module is used to obtain the identifier of at least one vulnerability control stored in a preset vulnerability library after receiving a vulnerability detection instruction triggered by a user; a processing module, for displaying, for a first vulnerability control among the at least one vulnerability control, the first target project to the user if it is determined that there is a first target project using the first vulnerability control in a preset database; the preset database stores an identifier of at least one project and a control used by the at least one project; The processing module is also used to: obtain code files corresponding to the at least one project respectively according to the identification of the at least one project; for a first project among the at least one project, determine the programming language used by the first project according to the suffix of the code file corresponding to the first project, and determine the project type of the first project according to the directory structure of the code file corresponding to the first project and / or the programming language used by the first project; according to the project type of the first project, obtain a file to be detected from the code file corresponding to the first project, detect the file to be detected, and determine the control used by the first project; generate the preset database using the identification of the at least one project and the control used by the at least one project.

6. The device according to claim 5, characterized in that The controls used by the at least one project include any one or more of the framework, third-party components and services used by the at least one project; the third-party components used by the at least one project are dependent libraries and / or plug-ins used by the at least one project.

7. The device according to claim 5, characterized in that The processing module is specifically used for: If it is determined that the first project is built using a first preset tool, then obtaining contents corresponding to the properties tag, the dependencies tag and / or the plugins tag from a pom.xml data packet of a code file corresponding to the first project; or, If it is determined that the first project is not built using the first preset tool, obtain the programming language used by the first project; if the programming language used by the first project is Java, obtain the jar data package file of the code file, or, if the programming language used by the first project is Javescript type, obtain the package.json data package file and / or package-lock.json data package file of the code file, or, if the programming language used by the first project is Python type, obtain the header file of the code file.

8. The device according to any one of claims 5 to 7, characterized in that The processing module is also used for: If the target project using the first vulnerability control does not exist in the preset database, determining one or more projects currently in operation, and obtaining project addresses of the one or more projects according to the identifiers of the one or more projects; According to the project addresses of the one or more projects, an application programming API interface is called to obtain one or more files to be detected corresponding to the one or more projects respectively, and code detection is performed on the one or more files to be detected to determine the controls used by the one or more projects; If there is a second target project using the first vulnerability control among the one or more projects, the second target project is displayed to the user.

9. A computer-readable storage medium, characterized in that: The method comprises instructions which, when executed on a processor of a computer, cause the processor of the computer to execute the method according to any one of claims 1 to 4.

10. A computer program product, characterized in that When the method is executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 4.

Images