A method, device and storage medium for software vulnerability detection

Abstract

The present application provides a method, device and storage medium for software vulnerability detection, which are used to improve the accuracy and detection efficiency of software vulnerability detection. In this method, if the vulnerability library contains the target software in the vulnerability detection instruction, the version information corresponding to the target software is obtained in the vulnerability library; the target version information carried in the vulnerability detection instruction is matched with the obtained version information corresponding to the target software; and according to the matching result, it is determined whether the target software has a vulnerability. In the process of vulnerability detection, the target software name and the version information corresponding to the target software name are obtained in the vulnerability library according to the target software name, the target version information is matched with the obtained version information, and it is determined whether the target software has a vulnerability according to the matching result, and the detection result is directly output without manual confirmation of multiple fuzzy detection results, thereby improving the accuracy and detection efficiency of software vulnerability detection.

Description

Background Art

[0002] When detecting whether a certain software or a certain software version has a vulnerability, the search is mainly based on the keywords in the software name, so many of the query results are fuzzy query results.

[0003] Currently, it is necessary to manually check the fuzzy query results to analyze one by one whether the vulnerability information of the fuzzy query results has an impact on the queried software and the software version. This is inefficient and prone to manual screening errors. Summary of the invention

[0004] The present application provides a method and device for software vulnerability detection, so as to improve the accuracy and detection efficiency of software vulnerability detection.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting a software vulnerability, the method comprising:

[0006] If the vulnerability database contains the target software corresponding to the target software name in the vulnerability detection instruction, then obtain the version information corresponding to the target software in the vulnerability database;

[0007] Match the target version information carried in the vulnerability detection instruction with the obtained version information corresponding to the target software;

[0008] Based on the matching results, determine whether the target software has vulnerabilities.

[0009] In this method, when vulnerability detection is performed on software and software versions, the target software name and the corresponding target version information are input as vulnerability detection instructions. Therefore, during the vulnerability detection process, the target software name and the version information corresponding to the target software name can be obtained in the vulnerability library according to the target software name, and then the target version information is matched with the obtained version information. According to the matching result, it is determined whether the target software has a vulnerability. In this process, the detection result is directly output without manual confirmation of multiple fuzzy detection results, which improves the accuracy and efficiency of software vulnerability detection and saves manpower.

[0010] In a possible implementation, if the vulnerability library does not contain the target software corresponding to the target software name in the vulnerability detection instruction, it is determined that the target software does not have a vulnerability.

[0011] In this method, it is first determined whether there is software corresponding to the software name in the vulnerability library according to the software name. If it is determined that the target software is not stored in the vulnerability library, it is determined that the target software has no vulnerability, thereby improving efficiency.

[0012] In a possible implementation, after obtaining the version information corresponding to the target software in the vulnerability database, if it is determined that the version information corresponding to the target software is not obtained, it is determined that the target software has a vulnerability.

[0013] In a possible implementation, if the obtained version information corresponding to the target software has a version range;

[0014] Match the target version information carried in the vulnerability detection instruction with the obtained version information of the target software, including:

[0015] Match the target version information with the maximum value and / or minimum value of the version range to determine whether the target version information is within the version range;

[0016] Based on the matching results, determine whether the target software has vulnerabilities, including:

[0017] If the target version information is within the version range, it is determined that the target software has a vulnerability and a prompt message is issued; otherwise, it is determined that the target software does not have a vulnerability.

[0018] In a possible implementation, if the obtained version information of the target software is at least one specific version;

[0019] Match the target version information carried in the vulnerability detection instruction with the obtained version information of the target software, including:

[0020] Match the target version information with the specific version to determine whether the acquired specific version contains the target version information carried in the vulnerability detection instruction;

[0021] Based on the matching results, determine whether the target software has vulnerabilities, including:

[0022] If the specific version contains the target version information, it is determined that the target software has a vulnerability and a prompt message is issued; otherwise, it is determined that the target software does not have a vulnerability.

[0023] In this method, when it is determined that the target software in the vulnerability detection instruction is stored in the vulnerability library, the version information corresponding to the target software is further obtained in the vulnerability library, that is, which versions of the target software have vulnerabilities. When the version information of the target software is obtained in the vulnerability library, there are two situations: the version information of the target software is obtained and the version information of the target software is not obtained. When the version information of the target software is obtained, it is determined whether the obtained version is a version range or a specific version, and the target version information is matched with the obtained version range or specific version. After the match is successful, it is determined that there is a vulnerability and a prompt message is issued; when the version information of the target software is not obtained, it is determined that the target version information of the target software has a vulnerability and a prompt message is issued, directly prompting that the target software and the corresponding target version information have vulnerabilities, without manually determining whether the target software and the corresponding target version information have vulnerabilities in multiple query results, thereby improving the accuracy of software vulnerability detection and detection efficiency.

[0024] In a possible implementation, before matching the target version information carried in the vulnerability detection instruction with the acquired version information corresponding to the target software, the method further includes:

[0025] Convert the non-digits of the version number corresponding to the target version information and the version information corresponding to the acquired target software into dot characters, and replace multiple consecutive dot characters with one dot character;

[0026] Cut the version information by points to obtain each target number in each version number in the version information;

[0027] The target number is expanded in the form of retaining the numerical value but replacing the number of digits with the preset number of digits, and each expanded target number is transformed into a numerical number by concatenating them.

[0028] In this method, when matching the target version information with the version information corresponding to the target software obtained from the vulnerability library, the version number of the target version information is compared with the version number of the obtained version information. However, since one software can correspond to multiple versions, and the version can be divided into a main version and a precise version, the number of digits is different during the comparison, resulting in errors in the comparison result. The present application provides a method for expanding the version number to ensure the accuracy of the version number comparison and ultimately ensure the accuracy of vulnerability detection.

[0029] In a possible implementation, matching the target version information carried in the vulnerability detection instruction with the acquired version information corresponding to the target software includes:

[0030] If it is determined that the target version information carried in the vulnerability detection instruction is the main version, it is matched with the main version information in the obtained version information, otherwise it is matched with the precise version information in the version information.

[0031] In this method, during the process of matching version information, that is, comparing version numbers, it is possible to first determine whether it is a major version or a precise version. Because the major version has fewer bits than the precise version, its matching speed is faster than that of the precise version during the matching process. Therefore, first determine which version form it is and then determine how to match it, which can improve matching efficiency and ultimately improve detection efficiency.

[0032] In a second aspect, an embodiment of the present application provides a device for detecting a software vulnerability, the device comprising: an acquisition module, a matching module and a determination module, wherein:

[0033] The acquisition module is used to obtain the version information corresponding to the target software in the vulnerability library if the vulnerability library contains the target software corresponding to the target software name in the vulnerability detection instruction;

[0034] A matching module, used to match the target version information carried in the vulnerability detection instruction with the obtained version information corresponding to the target software;

[0035] The determination module is used to determine whether the target software has a vulnerability based on the matching results.

[0036] In a third aspect, an embodiment of the present application provides a device for software vulnerability detection, the device comprising: at least one processor and at least one memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor is specifically used to execute the above-mentioned software vulnerability detection method.

[0037] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed by a processor, the method for software vulnerability detection provided by the embodiment of the present application is implemented.

[0038] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A schematic diagram of fuzzy query results for software vulnerability detection in the related art;

[0041] Figure 2 A schematic diagram of vulnerability information corresponding to a vulnerability title in a vulnerability title list in the related technology;

[0042] Figure 3 A schematic diagram of a software vulnerability detection scenario provided in an embodiment of the present application;

[0043] Figure 4 A flowchart of a method for detecting software vulnerabilities provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of an interface for performing software vulnerability detection provided in an embodiment of the present application;

[0045] Figure 6 A schematic diagram of another interface for performing software vulnerability detection provided in an embodiment of the present application;

[0046] Figure 7 A flowchart of an overall method for software vulnerability detection provided by an embodiment of the present application;

[0047] Figure 8 A schematic diagram of the structure of a software vulnerability detection device provided in an embodiment of the present application;

[0048] Fig. 9 A schematic diagram of the structure of a device for software vulnerability detection provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0050] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0051] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0052] The following is a brief introduction to the design concept of the embodiments of the present application.

[0053] Currently, when performing vulnerability detection on software or a version of the software, only the keywords in the software name can be used as vulnerability detection instructions, that is, vulnerability detection can only be performed based on the keywords in the vulnerability detection instructions. The detection result obtained at this time is a fuzzy detection result, that is, the vulnerability detection result of the software containing the keywords.

[0054] The fuzzy detection results are displayed to the user in the form of a list. At this time, only the vulnerability titles containing keywords are displayed. The version number and vulnerability information corresponding to each vulnerability title cannot be directly displayed. Figure 1 As shown in FIG. 1 , it is a schematic diagram of the fuzzy query results of software vulnerability detection in the related art. The user needs to check the vulnerability information corresponding to each vulnerability title in the fuzzy query result, and filter to determine whether the software to be searched and the corresponding version information have vulnerabilities, such as Figure 2 As shown, it is a schematic diagram of vulnerability information corresponding to a vulnerability title in the vulnerability title list in the related technology.

[0055] Yes, currently, when searching for vulnerabilities in a certain software and its corresponding version, the skill performs fuzzy search, and further manual screening is required to determine whether the required software and its corresponding version information have vulnerabilities. However, during the manual screening process, due to the large amount of information, eye fatigue leads to insufficient data browsing, so the detection results are not accurate and the time is long.

[0056] In view of this, embodiments of the present application provide a method, device, and storage medium for software vulnerability detection.

[0057] In this method, the target software name and the corresponding target version information are used as input parameters in the vulnerability detection instruction. Therefore, in the vulnerability detection process, it is first determined whether the target software corresponding to the target software name is stored in the vulnerability library. After determining that the target software is stored in the vulnerability library, the version information corresponding to the target software is determined in the vulnerability library. After obtaining the version information corresponding to the target software from the vulnerability library, the target version information in the vulnerability detection instruction is matched with the obtained version information, and according to the matching result, it is determined whether the target software has a vulnerability. If the match is successful, it means that the target software has a vulnerability, and a prompt message is issued. According to the target software name and the corresponding target version information, it is determined whether the target software and the corresponding version are stored in the vulnerability library. After determining that the target software and the corresponding version are stored, it is determined that there is a vulnerability and a prompt message is issued, without the need for manual screening, thereby improving detection efficiency and accuracy and saving human resources.

[0058] After introducing the design concept of the embodiment of the present application, the application scenario set by the present application is briefly described below.

[0059] like Figure 3 As shown, it is a schematic diagram of a scenario of software vulnerability detection provided by an embodiment of the present application, in which a plurality of terminal devices 31 and a server 32 are included.

[0060] Among them, the terminal device 31 is a device installed with various application software and a detection platform for software vulnerability detection, or a device that does not install a detection platform for software vulnerability detection but can access the detection platform for software vulnerability detection through a website; the server 32 can be any device that can provide Internet services, and the server can store a vulnerability library, which stores a large amount of version information of software with vulnerabilities.

[0061] In actual applications, the server 32 is connected to the terminal device 31 through a network for communication. The network may be, but is not limited to, a local area network, a metropolitan area network, or a wide area network.

[0062] In a possible application scenario, in order to reduce communication latency, servers 32 can be deployed in various regions; or for load balancing, different servers 32 can serve each terminal device 31 to perform software vulnerability detection. Multiple servers 32 can share data through blockchain, for example, multiple servers 32 can share vulnerable software and corresponding version information through blockchain.

[0063] In the present application, the user opens a detection platform for software vulnerability detection in the terminal device 31, and inputs the target software name and the corresponding target version information in the detection platform. After the search instruction is triggered, it is determined that the vulnerability detection instruction containing the target version information corresponding to the target software name is triggered. After receiving the vulnerability detection instruction, the server 32 obtains the target software name in the vulnerability detection instruction, and determines whether the target software corresponding to the target software name is stored in the stored vulnerability library. After determining that the target software corresponding to the target software name is stored in the vulnerability library, the version information of the target software is further obtained in the vulnerability library, and the obtained version information is matched with the target version information carried in the vulnerability detection instruction to determine whether there is a vulnerability. After determining that the match is successful, it is determined that the target software and the corresponding version have vulnerabilities, and a prompt message is issued to prompt the user that the current software version has vulnerabilities, and the user is actively prompted without manual screening, thereby improving detection efficiency and accuracy.

[0064] In a possible implementation, in order to ensure the accuracy of the matching, the version numbers in the version information corresponding to the target software obtained from the vulnerability database and the version number of the target version information in the vulnerability detection instruction are processed. The specific processing process is as follows:

[0065] Convert the non-digits of the version number corresponding to the target version information and the version information corresponding to the acquired target software into dot characters, and replace multiple consecutive dot characters with one dot character;

[0066] Cut the version information by points to obtain each target number in each version number in the version information;

[0067] The target number is expanded by keeping the numerical value unchanged and replacing the number of digits with the preset number of digits, and the expanded target numbers are concatenated and converted into numerical numbers.

[0068] In one possible implementation, the software vulnerability detection method provided in the present application can be applied to a subscription scenario, that is, the user triggers the subscription function in the display interface of the detection platform used for software vulnerability detection, and then the server performs periodic or irregular vulnerability detection on the target software name or target version information in the vulnerability detection instruction, and sends a prompt message when a vulnerability is detected, eliminating the need for the user to input multiple times for the same software, thereby simplifying the operation.

[0069] It should be noted that the vulnerability library in this application can be updated periodically, or updated in a timely manner when vulnerability issues are detected through crawler software, etc.

[0070] It should be noted that the software vulnerability detection method provided in the present application can be executed in the terminal device 31 or in the server 32, and the same steps will not be repeated.

[0071] The following describes the software vulnerability detection method provided by the exemplary implementation of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this regard.

[0072] like Figure 4 As shown, a flowchart of a method for software vulnerability detection provided by an embodiment of the present application includes the following steps:

[0073] Step 400: If the vulnerability database contains target software corresponding to the target software name in the vulnerability detection instruction, obtain version information corresponding to the target software.

[0074] In this application, after the user inputs the target software name and the corresponding target version information and triggers the vulnerability detection instruction, vulnerability detection is performed on the target software corresponding to the target software name and the corresponding target version information to detect whether there are vulnerabilities in the target software and the corresponding target version information.

[0075] like Figure 5 As shown, it is a schematic diagram of an interface for performing software vulnerability detection provided in an embodiment of the present application. The display interface includes an input box for the target software name and an input box for the corresponding target version information, and also includes a button for triggering a search.

[0076] After determining that the user has triggered the vulnerability detection instruction, the target software name and / or target version information carried in the vulnerability detection instruction is obtained.

[0077] It should be noted that the user may only test a certain software and will not test whether a certain version of the software has vulnerabilities. Therefore, you can only enter the name of the software; you can also test whether a certain version of the software has vulnerabilities. The target version information can be the main version or the precise version.

[0078] After obtaining the target software name in the vulnerability detection instruction, it is determined whether there is a target software corresponding to the target software name in the vulnerability library according to the target software name.

[0079] In a possible implementation manner, if the vulnerability library does not contain the target software corresponding to the target software name in the vulnerability detection instruction, it is determined that the target software does not have a vulnerability.

[0080] In a possible implementation manner, the vulnerability library contains target software corresponding to the target software name in the vulnerability detection instruction, and version information corresponding to the target software is further obtained in the vulnerability library.

[0081] When obtaining the version information corresponding to the target software from the vulnerability, there are two situations: obtaining the version information corresponding to the target software from the vulnerability library and not obtaining the version information corresponding to the target software.

[0082] When it is situation 1: when the version information corresponding to the target software is not obtained from the vulnerability database, the target version information cannot be matched, and it indicates that the target software has a vulnerability.

[0083] In case 2: when the version information corresponding to the target software is obtained from the vulnerability, the target version information is matched with the obtained version information, as shown in the implementation of step 402 for details.

[0084] It should be noted that the vulnerability database stores the names of software with vulnerabilities and the version information corresponding to the software names with vulnerabilities. For example, if the vulnerability database stores software name A and the corresponding version information is 1.1.01, it means that version 1.1.01 of software A has a vulnerability.

[0085] In a possible implementation, the software vulnerability detection method of the present application can also be used in a subscription scenario, that is, vulnerability detection is performed regularly on the target software name and the corresponding target version information in the vulnerability detection instruction.

[0086] Specifically, when the user enters the target software name and the corresponding target version information, he or she can also select the subscription function. Figure 6 As shown, it is a schematic diagram of another interface of software vulnerability detection provided by the embodiment of the present application. Figure 6 It can be seen that the interface not only contains the input box for the target software name and the input box for the target version information, but also contains the option "Subscribe". When the user selects the "Subscribe" option, the vulnerability detection instruction also contains the instruction for scheduled detection. The specific time for scheduled detection can be selected by the user, or it can be a pre-set detection cycle, or it can be detected when the target software corresponding to the target software name has a version update.

[0087] Step 401, matching the target version information carried in the vulnerability detection instruction with the acquired version information corresponding to the target software.

[0088] After obtaining the version information corresponding to the target software in the vulnerability database, the obtained version information corresponding to the target software is matched with the target version information carried in the vulnerability detection instruction.

[0089] Before matching, it is first determined whether the version information corresponding to the acquired target software has a version range, such as greater than the first version, or less than the second version, or greater than the third version and less than the fourth version.

[0090] Case A: When it is determined that the version information corresponding to the acquired target software exists within a version range, the target version information is matched with the version range to determine whether the target version information is within the version range. If the target version information is within the version range, the match is determined to be successful, otherwise the match is determined to fail.

[0091] Specifically, when matching the target version information with the version range corresponding to the acquired target software, the version number corresponding to the target version information is mainly matched with the upper limit version number and / or lower limit version number of the version range corresponding to the acquired target software.

[0092] For example, the version range corresponding to the acquired target software is: greater than or equal to m and less than or equal to n. At this time, the version number corresponding to the target version information is compared with m and with n to determine whether the version number corresponding to the target version information is within the range greater than or equal to m and less than or equal to n; or

[0093] The version range is: less than or equal to n, in which case the version number corresponding to the target version information is compared with n to determine whether the version number of the target version information is less than or equal to n; or

[0094] The version range is: greater than or equal to m. At this time, the version number corresponding to the target version information is compared with m to determine whether the version number of the target version information is greater than or equal to m.

[0095] In this application, in the process of matching the version number of the target version information with the version number of the version information corresponding to the acquired target software, in order to ensure the accuracy of the match, the version number of the target version information and each version number in the version information corresponding to the acquired target software are processed, and the specific processing process is as follows:

[0096] Convert non-digits in the version number to dots, and replace multiple consecutive dots with one dot.

[0097] Cut the replaced version number by dots to get each target number in the version number;

[0098] The target number is expanded by replacing the number of digits with the preset number of digits while keeping the numerical value unchanged, and the expanded target numbers are concatenated.

[0099] Take the version information of the target software obtained as the version range, and explain how to process the version number of the version range. When processing the version number of the version range, only the upper limit and / or lower limit of the version range is processed. For example, the version range corresponding to the version information of the target software is: greater than or equal to 9.0.0.M1, less than or equal to 9.0.0.M11; at this time, only the version numbers 9.0.0.M1 and 9.0.0.M11 are processed.

[0100] Replace "M" in 9.0.0.M1 and 9.0.0.M11 with "." to convert them into 9.0.0..1 and 9.0.0..11;

[0101] Replace multiple consecutive dots with one dot, converting to 9.0.0.1 and 9.0.0.11;

[0102] Split 9.0.0.1 by dots to obtain the target numbers in the version number, which are 9, 0, 0 and 1 respectively; then expand the target number by replacing the number of digits with the preset number of digits while keeping the numerical value unchanged. In this application, the preset number of digits is set to 8, because less than 8 digits will affect the accuracy of the match, and more than 8 digits will cause a large amount of calculation in the matching process. Therefore, after expansion, they are: 00000009, 00000000, 000000000, 000000001, and finally the expanded ones are concatenated and converted into a numerical number 9000000000000000000000001; similarly, 9.0.0.11 is processed and converted into a numerical number 9000000000000000000000011; at this time, the version range corresponding to the version information of the target software is [90000000000000000000000001,900000000000000000000011].

[0103] In this application, if the version range corresponding to the version information of the target software has only an upper limit value, for example, it is less than or equal to 9.0.0.M11, then only 9.0.0.M11 is processed, and the lower limit value of the version range corresponding to the version information of the target software is 0. Therefore, the version range corresponding to the version information of the target software is [0,90000000000000000000000011]; or

[0104] If the version range corresponding to the target software's version information has only a lower limit value, for example, it is greater than or equal to 9.0.0.M1, only 9.0.0.M1 will be processed, and each digit in the upper limit value of the version range corresponding to the target software's version information will be filled with "9". Therefore, the version range corresponding to the target software's version information is [900000000000000000000001,99999999999999999999999999999999999999].

[0105] In one possible implementation, when the version range corresponding to the version information of the target software is greater than 9.0.0.M1 and less than 9.0.0.M11, 9.0.0.M1 and 9.0.0.M11 are first processed to form 9000000000000000000000000001 and 900000000000000000000000011 respectively, because the version range corresponding to the version information of the target software does not include 9.0.0.M1 and 9.0.0.M11, that is, it does not include 900000000000000000000000001 and 900000000000000000000011. Therefore, we add 1 to 90000000000000000000000001 and get 900000000000000000000000002; we subtract 1 from 9000000000000000000000011 and get 900000000000000000000000010; the version range corresponding to the version information of the final target software is [9000000000000000000000002,90000000000000000000010].

[0106] Similarly, the version number in the target version information is processed, and the processed version number is matched with the version number in the version range corresponding to the version information of the target software obtained by the above processing.

[0107] For example, the version range of the target software's version information after processing is [90000000000000000000000001,90000000000000000000000011], and the version number of the target version information is 9.0.0.M3, which after processing becomes 90000000000000000000000003, which is within the range of [9000000000000000000000001,900000000000000000000011], indicating that there is a vulnerability.

[0108] Case B: When the version information of the acquired target software does not contain a version range, it is determined that the version information corresponding to the acquired target software is at least one specific version. At this time, the target version information is matched one-to-one with at least one specific version corresponding to the acquired target software, that is, the version number of the target version information is matched with the version number of the specific version corresponding to the acquired target software, and it is determined whether the version number of the acquired specific version corresponding to the target software contains the version number of the target version information.

[0109] It should be noted that the version needs to be processed during the matching process, and the processing process is similar to that in situation A, which will not be repeated here.

[0110] In a possible implementation, when matching the target version information with the acquired version information corresponding to the target software, it is determined whether the target version information is a major version or an exact version. If it is a major version, a major version match is performed; otherwise, an exact version match is performed.

[0111] Take the target version information as the main version, and the version range corresponding to the target software in the vulnerability library as an example: for example, the main version is 9.2; the version range corresponding to the target software is greater than or equal to 9.0.0.M1 and less than or equal to 9.10.0.M11, then the corresponding version search range is [900000000,900000010], that is, determine whether 900000002 is greater than or equal to 90000000, and less than or equal to 900000010. If so, it means that there is a vulnerability. At this time, there is no need to process all the target numbers obtained by dividing the version number in the version information corresponding to the target software by dot, but only the target number corresponding to the main version needs to be processed to reduce the calculation pressure.

[0112] Step 402: Determine whether the target software has a vulnerability based on the matching result.

[0113] In this application, if the match is successful, it is determined that there is a vulnerability and a prompt message is issued; if the match fails, it is determined that there is no vulnerability.

[0114] Prompt information includes but is not limited to: SMS prompts, email prompts, and voice prompts.

[0115] It should be noted that the prompt information also includes the existing vulnerability issues and the corresponding solutions.

[0116] like Figure 7 As shown, it is a flowchart of an overall method for software vulnerability detection provided by an embodiment of the present application, including the following steps:

[0117] Step 700, receiving a vulnerability detection instruction, and determining the target software name and corresponding target version information carried in the vulnerability detection instruction;

[0118] Step 701, determine whether there is a target software corresponding to the target software name in the vulnerability database, if yes, execute step 702, otherwise execute step 706;

[0119] Step 702, determining whether the vulnerability database stores the version information corresponding to the target software, if yes, executing step 703, otherwise executing step 705;

[0120] Step 703, matching the target version information with the version information corresponding to the target software stored in the vulnerability database;

[0121] Step 704, determine whether the match is successful, if successful, execute step 705, otherwise execute step 706;

[0122] Step 705, determine that there is a vulnerability and issue a prompt message;

[0123] Step 706, determine that no vulnerability exists.

[0124] Based on the same inventive concept, a device for software vulnerability detection is also provided in an embodiment of the present application. The device is used to implement the method for software vulnerability detection in the present application, and the principle of solving the problem by the device is similar to that of the method. Therefore, the implementation of the device can refer to the implementation of the method in the present application, and the repeated parts will not be repeated.

[0125] like Figure 8 As shown, it is a structural diagram of a software vulnerability detection device 800 provided in an embodiment of the present application, and the device 800 includes: an acquisition module 801, a matching module 802 and a determination module 803, wherein:

[0126] The acquisition module 801 is used to acquire the version information corresponding to the target software if the vulnerability library contains the target software corresponding to the target software name in the vulnerability detection instruction;

[0127] A matching module 802 is used to match the target version information carried in the vulnerability detection instruction with the obtained version information corresponding to the target software;

[0128] The determination module 803 is used to determine whether the target software has a vulnerability according to the matching result.

[0129] In a possible implementation, the acquisition module 801 is further configured to:

[0130] If the vulnerability library does not contain the target software corresponding to the target software name in the vulnerability detection instruction, it is determined that the target software does not have a vulnerability.

[0131] In a possible implementation, the acquisition module 801 is further configured to:

[0132] After obtaining the version information corresponding to the target software in the vulnerability database, if it is determined that the version information corresponding to the target software is not obtained in the vulnerability database, it is determined that the target software has a vulnerability, and a prompt message is issued.

[0133] In a possible implementation, if the obtained version information corresponding to the target software has a version range;

[0134] The matching module 802 is specifically used to: match the target version information with the maximum value and / or the minimum value of the version range, and determine whether the target version information is within the version range;

[0135] The determination module 803 is specifically used to: if the target version information is within the version range, determine that the target software has a vulnerability and issue a prompt message; otherwise, determine that the target software does not have a vulnerability.

[0136] In a possible implementation, if the obtained version information of the target software is at least one specific version;

[0137] The matching module 802 is specifically used to: match the target version information with the specific version, and determine whether the acquired specific version contains the target version information carried in the vulnerability detection instruction;

[0138] The determination module 803 is specifically used for: if the specific version contains the target version information, determining that the target software has a vulnerability and issuing a prompt message; otherwise, determining that the target software does not have a vulnerability.

[0139] In a possible implementation, the matching module 802 is further configured to:

[0140] Before matching the target version information carried in the vulnerability detection instruction with the obtained version information corresponding to the target software, convert the non-digits in the version numbers corresponding to the target version information and the obtained version information corresponding to the target software into dot characters, and replace multiple consecutive dot characters with one dot character;

[0141] Cut the version information by points to obtain each target number in each version number in the version information;

[0142] The target number is expanded by keeping the numerical value unchanged and replacing the number of digits with the preset number of digits, and the expanded target numbers are concatenated and converted into numerical numbers.

[0143] In a possible implementation, the matching module 802 is specifically configured to:

[0144] If it is determined that the target version information carried in the vulnerability detection instruction is the main version, it is matched with the main version information in the obtained version information, otherwise it is matched with the precise version information in the version information.

[0145] For the convenience of description, the above parts are divided into units (or modules) according to their functions and described separately. Of course, when implementing this application, the functions of each unit (or module) can be implemented in the same or multiple software or hardware.

[0146] After introducing the software vulnerability detection method and apparatus according to the exemplary embodiment of the present application, next, a software vulnerability detection device according to another exemplary embodiment of the present application is introduced.

[0147] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0148] In a possible implementation, the present application embodiment also provides a device for software vulnerability detection. Fig. 9 900 is a block diagram of a device for detecting software vulnerabilities provided in an embodiment of the present application. The device may include at least a memory 901 , a processor 902 , and a bus 903 .

[0149] The memory 901 and the processor 902 are connected via a bus 903, and the bus 903 is used to transmit data between the memory 901 and the processor 902;

[0150] The memory 901 stores program codes. When the program codes are executed by the processor 902 , the processor 902 executes any step of the software vulnerability detection method of various exemplary embodiments of the present application.

[0151] Specifically, the method steps for executing software vulnerability detection can be found in the above method embodiment, which will not be repeated here.

[0152] An embodiment of the present application provides a readable storage medium, which is a non-volatile storage medium. The readable storage medium is a non-volatile readable storage medium, including program code. When the program code is run on a computing device, the program code is used to enable the computing device to execute any step in the above-mentioned software vulnerability detection method.

[0153] An embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computing device to execute any step in the above-mentioned method for detecting software vulnerabilities.

[0154] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0155] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0156] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0157] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0158] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting software vulnerabilities, characterized in that: The method includes: Receive a vulnerability detection instruction, the vulnerability detection instruction carrying: a target software name, target version information, and a timing detection instruction; the timing detection instruction is used to indicate a vulnerability detection cycle or detection time, the detection cycle or detection time is determined based on a subscription function selected in a software vulnerability detection interface; When determining to perform vulnerability detection based on the timing detection instruction, if the vulnerability library contains the target software corresponding to the target software name in the vulnerability detection instruction, obtaining version information corresponding to the target software in the vulnerability library; When the target version information carried by the vulnerability detection instruction is a major version number, and the version information corresponding to the target software has a version range of an exact version, the following operations are performed: For the main version number corresponding to the target version information and the upper and lower limit version numbers of each precise version in the version range, the following operations are performed respectively: non-digits in the version number are converted into dot characters, multiple consecutive dot characters are replaced with one dot character, and the version number is cut by dots to obtain each target digit in the version number; the numerical value of each target digit remains unchanged, and the number of digits of each target digit is expanded in the form of a preset number of digits, and the expanded target digits are spliced ​​to obtain the numerical digits corresponding to the version number; Matching the numerical digits of the major version number in the target version information with the numerical digits of the upper limit version number and / or the numerical digits of the lower limit version number of the precise version in the version range to determine whether the target software has a vulnerability; When the target version information carried by the vulnerability detection instruction is a main version number, and the version information corresponding to the target software is at least one specific precise version number, by processing the version number into a numerical number, matching the at least one precise version number with the target number of the main version number of the target version information, to determine whether the target software has a vulnerability; After obtaining the version information corresponding to the target software in the vulnerability database, the method further includes: If it is determined that the version information corresponding to the target software is not obtained in the vulnerability database, it is determined that the target software has a vulnerability, and a prompt message is issued.

2. The method according to claim 1, characterized in that The method further includes: If the vulnerability library does not contain the target software corresponding to the target software name in the vulnerability detection instruction, it is determined that the target software does not have a vulnerability.

3. A software vulnerability detection device, characterized in that: The device includes: an acquisition module, a matching module and a determination module, wherein: The acquisition module is used to receive a vulnerability detection instruction, wherein the vulnerability detection instruction carries: a target software name, target version information, and a timing detection instruction; the timing detection instruction is used to indicate a vulnerability detection period or detection time; when determining to perform vulnerability detection based on the timing detection instruction, if the vulnerability library contains a target software corresponding to the target software name in the vulnerability detection instruction, then the version information corresponding to the target software is obtained in the vulnerability library, and the detection period or detection time is determined based on the subscription function selected in the software vulnerability detection interface; The matching module is configured to perform the following operations when the target version information carried by the vulnerability detection instruction is a main version number and the version information corresponding to the target software has a version range of an exact version: For the main version number corresponding to the target version information and the upper and lower limit version numbers of each precise version in the version range, the following operations are performed respectively: non-digits in the version number are converted into dot characters, multiple consecutive dot characters are replaced with one dot character, and the version number is cut by dots to obtain each target digit in the version number; the numerical value of each target digit remains unchanged, and the number of digits of each target digit is expanded in the form of a preset number of digits, and the expanded target digits are spliced ​​to obtain the numerical digits corresponding to the version number; Matching the numerical digits of the major version number in the target version information with the numerical digits of the upper limit version number and / or the numerical digits of the lower limit version number of the precise version in the version range to determine whether the target software has a vulnerability; When the target version information carried by the vulnerability detection instruction is a main version number, and the version information corresponding to the target software is at least one specific precise version number, by processing the version number into a numerical number, matching the at least one precise version number with the target number of the main version number of the target version information, to determine whether the target software has a vulnerability; After obtaining the version information corresponding to the target software in the vulnerability database, if it is determined that the version information corresponding to the target software is not obtained in the vulnerability database, it is determined that the target software has a vulnerability, and prompt information is issued.

4. A software vulnerability detection device, characterized in that: The device comprises: at least one processor and at least one memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor is specifically used to execute any one of the methods according to claims 1 to 2.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the method according to any one of claims 1 to 2 is implemented.

Images