A security vulnerability processing method, system, computing device and storage medium

Abstract

The present invention discloses a method for processing security vulnerabilities, which is suitable for execution in a security server, wherein the security server is connected to a data server and one or more clients in communication, and the method comprises the steps of: receiving a vulnerability acquisition request sent by a client; parsing the vulnerability acquisition request and generating a vulnerability query statement; sending the vulnerability query statement to a data server so that the data server performs a vulnerability query according to the vulnerability query statement; receiving a vulnerability data file returned by the data server; parsing the vulnerability data file to generate a vulnerability query result, and sending the vulnerability query result to the client. The present invention also discloses a security vulnerability processing system, a computing device, and a computer-readable storage medium.

Description

Technical Field

[0001] The present invention relates to the field of system security, and in particular to a security vulnerability processing method, system, computing device and storage medium. Background Art

[0002] In the existing Linux system, in order to make the system run more safely, it is necessary to frequently patch the security holes of the system. Currently, an application program for scanning security holes is installed on the client, and the program is used to scan the security holes of the system, and the scanned security holes are repaired to complete the patching of the security holes of the system.

[0003] However, in the above solution, in order to install the application program for scanning security vulnerabilities, a dedicated installation package needs to be downloaded on the client, and the application program is installed and deployed through the installation package, so the security vulnerabilities cannot be repaired quickly. In addition, the multiple security vulnerabilities obtained through the application program scanning cannot be classified, queried and repaired.

[0004] Therefore, a new method and system for handling security vulnerabilities is needed. Summary of the invention

[0005] To this end, the present invention provides a security vulnerability processing method and system to try to solve or at least alleviate the above problems.

[0006] According to one aspect of the present invention, there is provided a method for handling security vulnerabilities, which is suitable for execution in a security server, wherein the security server is in communication with a data server and one or more clients, and the method comprises the steps of: receiving a vulnerability acquisition request sent by a client; parsing the vulnerability acquisition request and generating a vulnerability query statement; sending the vulnerability query statement to a data server so that the data server performs a vulnerability query according to the vulnerability query statement; receiving a vulnerability data file returned by the data server; parsing the vulnerability data file to generate a vulnerability query result, and sending the vulnerability query result to the client.

[0007] Optionally, in the method according to the present invention, receiving a vulnerability acquisition request sent by a client includes the steps of: setting an IP address so that the client can query a security server; establishing a long link with the client that queries the IP address; and receiving a vulnerability acquisition request based on a communication interface with the client.

[0008] Optionally, in the method according to the present invention, parsing the vulnerability acquisition request and generating a vulnerability query statement includes the steps of: determining the vulnerability category and one or more keywords to be queried according to the vulnerability acquisition request; and generating a vulnerability query statement according to the vulnerability category and the keywords.

[0009] Optionally, in the method according to the present invention, generating a vulnerability query statement according to the vulnerability category and the search term includes the steps of: converting the vulnerability acquisition request to obtain a template of the vulnerability query statement; combining the vulnerability category and the search term with the template to obtain the vulnerability query statement.

[0010] Optionally, in the method according to the present invention, receiving the vulnerability data file returned by the data server includes the steps of: verifying the data integrity of the vulnerability data file; if the vulnerability data file is incomplete according to the verification result, re-sending the vulnerability query statement to the data server and querying again.

[0011] Optionally, in the method according to the present invention, parsing the vulnerability data file to generate vulnerability query results includes the steps of: parsing the vulnerability data file to obtain data of multiple security vulnerabilities; classifying the multiple security vulnerabilities according to vulnerability categories to obtain security vulnerabilities under multiple vulnerability categories; and sorting the security vulnerabilities under each vulnerability category to obtain vulnerability query results.

[0012] Optionally, in the method according to the present invention, sending the vulnerability query result to the client includes the steps of: rendering and loading a vulnerability web page file according to the vulnerability query result, and sending the vulnerability web page file to the client to facilitate the client to display the vulnerability web page file.

[0013] According to another aspect of the present invention, a security vulnerability processing system is provided, the system comprising: a security server, a data server communicatively connected to the security server, and one or more clients, wherein the client is suitable for sending a vulnerability query request to the security server, and receiving a vulnerability query result returned by the security server; the security server is suitable for receiving a vulnerability acquisition request, parsing the vulnerability acquisition request, and generating a vulnerability query statement, and sending the vulnerability query statement to the data server; the data server is suitable for performing a vulnerability query according to the vulnerability query statement; the security server is also suitable for receiving a returned vulnerability data file, parsing the vulnerability data file to generate a vulnerability query result, and sending the vulnerability query result to the client.

[0014] According to another aspect of the present invention, a computing device is provided, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for executing any method of a security vulnerability handling method according to the present invention.

[0015] According to another aspect of the present invention, a computer-readable storage medium storing one or more programs is provided, wherein the one or more programs include instructions that, when executed by a computing device, cause the computing device to execute any one of the security vulnerability processing methods according to the present invention.

[0016] The security vulnerability processing method in the present invention deploys a security server connected to multiple clients for communication. The security server receives the vulnerability acquisition request sent by the client, obtains the vulnerability data file from the data server according to the vulnerability acquisition request, and generates a vulnerability query result and returns it to the client. In this way, the client does not rely on installing any application program, but directly obtains the vulnerability query result from the data server through the security server, batch acquires and processes security vulnerabilities, and improves the efficiency of patching security vulnerabilities.

[0017] Furthermore, after receiving the vulnerability acquisition request sent by the client, the security server parses the vulnerability acquisition request and generates a vulnerability query statement that can operate the data server, thereby eliminating the need for developers to rewrite the code for operating the data server, increasing the speed of obtaining vulnerability data files, and further improving the efficiency of patching system security vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other purposes, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0019] Figure 1 A schematic diagram of a security vulnerability processing system according to an exemplary embodiment of the present invention is shown;

[0020] Figure 2 shows a block diagram of a computing device 200 according to an exemplary embodiment of the present invention; and

[0021] Figure 3 A schematic flow chart of a security vulnerability processing method 300 according to an exemplary embodiment of the present invention is shown. DETAILED DESCRIPTION

[0022] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to enable the scope of the present disclosure to be fully conveyed to those skilled in the art. The same reference numerals generally refer to the same components or elements.

[0023] Figure 1FIG. 2 shows a schematic diagram of a security vulnerability processing system according to an exemplary embodiment of the present invention. Figure 1 As shown, the security vulnerability processing system includes a security server 120 , and clients 111 ˜ 113 and a data server 130 that are communicatively connected to the security server 120 . Figure 1 The connection method shown is only exemplary, and the present invention does not limit the number of clients connected to the security server 120 in the security vulnerability processing system.

[0024] The clients 111 to 113 include a URL input interface for inputting a URL to access the security server 120. The URL includes a domain name and the adopted protocol. Taking the client 111 as an example, after receiving the URL to access the security server 120, the client 111 first searches the DNS cache in the memory of the client 111 to see if there is an IP address corresponding to the domain name. After the client 111 successfully accesses the website, the IP address of the security server 120 corresponding to the domain name in the URL is stored in the DNS cache. If it exists, the IP address in the local DNS cache is directly used to access the security server 120.

[0025] If not, continue to search the system file for the IP address of the security server 120. According to one embodiment of the present invention, the system file is a host file. If the IP address corresponding to the domain name exists in the system file, the IP address is directly used to access the security server 120.

[0026] If the corresponding IP address does not exist in the system file, the client 111 accesses the DNS server (not shown in the figure) to find the IP address corresponding to the URL. The security server 120 will set its own IP address and write it into the DNS server, so that the client 111 can access the DNS server for query. After the client 111 finds the corresponding IP address through the DNS server, it establishes a long connection with the security server 120 through the IP address and sends a vulnerability acquisition request to the security server 120 through the communication interface. According to one embodiment of the present invention, the communication interface between the client 111 and the security server 120 is port 80, and a data acquisition request is sent to the security server 120 in the form of a request message according to the HTTP protocol.

[0027] The security server 120 can be implemented as a server using the gin framework. The gin framework is a JSON-API framework. By building a server using the gin framework, rapid deployment can be achieved, allowing a large number of clients to access the data server 130 through the security server 120 to complete the security vulnerability processing work. The security server 120 includes an engine (Engine), a route (HandlerFunc), a processing function (RouterGroup) and a context structure (Context). Engine is a framework object of the gin framework. When deploying the security server 120, first instantiate the engine object and initialize the route. After instantiating the engine object, register the route in the security server 120. Finally, initialize the processing function and context structure. Through the above steps, the security server 120 can be quickly deployed, so that the client 111 can connect to the security server 120, that is, it can process the security vulnerability.

[0028] The security server 120 then starts listening for the vulnerability acquisition request. When receiving the vulnerability acquisition request from the client 111, the service is started to respond to the vulnerability acquisition request. The processing function provides an interface for the engine in the security server 120 to receive the vulnerability acquisition request. After the engine in the security server 120 receives the vulnerability acquisition request via the processing function, the vulnerability acquisition request is processed by the routing specified context structure. When the context structure processes the vulnerability acquisition request, the vulnerability acquisition request is parsed, and a vulnerability query statement is generated, and the vulnerability query statement is sent to the data server 130. The security server 120 also receives the returned vulnerability data file, parses the vulnerability data file to generate a vulnerability query result, and sends the vulnerability query result to the client 111.

[0029] The data server 130 can be implemented as any server capable of storing system common vulnerability data files, and the present invention does not limit the server type of the data server 130. The data server 130 stores vulnerability data files and provides a function of querying by vulnerability category and keyword. The vulnerability data files stored in the data server 130 are collected on the Internet or uploaded by system security developers.

[0030] Figure 1 The clients 111 - 113 , the security server 120 and the data server 130 are all suitable for being implemented as a computing device. Figure 2 FIG. 2 shows a block diagram of a computing device 200 according to an exemplary embodiment of the present invention. Figure 2 As shown, in a basic configuration 202, computing device 200 typically includes a system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between processor 204 and system memory 206.

[0031] Depending on the desired configuration, the processor 204 can be any type of processor, including but not limited to: a microprocessor (μP), a microcontroller (μC), a digital information processor (DSP), or any combination thereof. The processor 204 can include one or more levels of cache such as a primary cache 210 and a secondary cache 212, a processor core 214, and registers 216. An example processor core 214 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 218 can be used with the processor 204, or in some implementations, the memory controller 218 can be an internal part of the processor 204.

[0032] Depending on the desired configuration, the system memory 206 may be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 206 may include an operating system 220, one or more programs 222, and program data 224. In some embodiments, the program 222 may be arranged to be executed by one or more processors 204 on the operating system using the program data 224 to execute instructions 223 according to the method 300 of the present invention.

[0033] The computing device 200 may also include a storage interface bus 234. The storage interface bus 234 enables communication from storage devices 232 (e.g., removable storage 236 and non-removable storage 238) to the basic configuration 202 via the bus / interface controller 230. At least a portion of the operating system 220, the application 222, and the data 224 may be stored on the removable storage 236 and / or the non-removable storage 238, and when the computing device 200 is powered on or the application 222 is to be executed, it is loaded into the system memory 206 via the storage interface bus 234 and executed by the one or more processors 204.

[0034] The computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to the basic configuration 202 via the bus / interface controller 230. Example output devices 242 include a graphics processing unit 248 and an audio processing unit 250. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 252. Example peripheral interfaces 244 may include a serial interface controller 254 and a parallel interface controller 256, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 258. Example communication devices 246 may include a network controller 260, which may be arranged to facilitate communication with one or more other computing devices 262 via a network communication link via one or more communication ports 264.

[0035] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or its changes can be carried out in a manner that encodes information in the signal. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein can include both storage media and communication media.

[0036] In the computing device 200 according to the present invention, the application 222 includes multiple program instructions for executing the security vulnerability processing method 300. These program instructions can instruct the processor 204 to execute some steps in the application update method 300 running in the computing device 200 of the present invention, so that each part in the computing device 200 can implement security vulnerability processing by executing the security vulnerability processing method 300 of the present invention.

[0037] The computing device 200 can be implemented as a server, such as a file server, a database, a server, an application server, etc. These electronic devices can be such as personal digital assistants (PDAs), wireless network browsing devices, application-specific devices, or hybrid devices that can include any of the above functions. It can be implemented as a personal computer including desktop computers and notebook computer configurations. In some embodiments, the computing device 200 is configured to execute the security vulnerability processing method 300.

[0038] Figure 3 The flowchart of a security vulnerability processing method 300 according to an exemplary embodiment of the present invention is shown. The method 300 is suitable for execution in the security server 120, and the execution of the method 300 is further described by taking the client 111, the security server 120 and the data server 130 as examples.

[0039] like Figure 3 As shown, the security vulnerability processing method 300 starts at step S310, in which the security server 120 receives a vulnerability acquisition request sent by the client 111. First, the security server 120 sets an IP address and writes it into the DNS server so that the client 111 can query the security server 120. After the client 111 queries the corresponding IP address through the DNS server, the security server 120 establishes a long link with the client 111 that queries the IP address. Finally, the vulnerability acquisition request is received according to the communication interface with the client 111.

[0040] Subsequently, step S320 is executed to parse the vulnerability acquisition request and generate a vulnerability query statement. When parsing the vulnerability acquisition request, the security server 120 determines the vulnerability category and one or more keywords to be queried according to the vulnerability acquisition request. Security vulnerabilities can be classified according to a variety of vulnerability categories, including: score (SCORE), status (STATUS) and software package (PACKAGE). Among them, the score can evaluate the danger level of the security vulnerability, and the more dangerous the security vulnerability is at a higher score level; the status of the security vulnerability includes fixed and unfixed; the software package of the security vulnerability includes display vulnerability, input vulnerability and output vulnerability, etc. Keywords are keywords for retrieving the name of the security vulnerability.

[0041] The vulnerability acquisition request is sent in the form of a request message, including the vulnerability category of the security vulnerability and the search keyword. The vulnerability acquisition request can search for security vulnerabilities of a certain vulnerability category, thereby querying security vulnerabilities of a specific category; or search for multiple keywords to retrieve multiple security vulnerabilities. In the vulnerability acquisition request, multiple vulnerability categories of security vulnerabilities or multiple search keywords can be arranged by regular expressions, and the present invention does not limit the specific form of the vulnerability acquisition request content.

[0042] Subsequently, a vulnerability query statement is generated according to the vulnerability category and the keyword: the vulnerability acquisition request is transformed to obtain a template of the vulnerability query statement, and the vulnerability category and the search term are combined with the template to obtain the vulnerability query statement. Since the security server 120 of the gin framework cannot directly operate the data in the data server 130, the security server 120 needs to construct a vulnerability query statement that can operate the data server 130. According to an embodiment of the present invention, when the data server 130 is a mySQL type database, the vulnerability query statement is a sql statement so as to operate the data server 130.

[0043] In order to obtain a vulnerability query statement from a vulnerability query request, object relational mapping (ORM) is required. ORM will automatically convert a vulnerability query request into a vulnerability query statement after receiving it by constructing a model correspondence between the vulnerability query request and the vulnerability query statement. The template of the vulnerability query statement obtained by converting the vulnerability acquisition request is the model correspondence between the vulnerability query request and the vulnerability query statement. In the template of the vulnerability query statement, fill in the key information to be queried, that is, the vulnerability category and search terms to be queried, and then you can get the vulnerability query statement.

[0044] Subsequently, step S330 and step S340 are executed to send the vulnerability query statement to the data server 130, so that the data server 130 performs a vulnerability query according to the vulnerability query statement, and receives the vulnerability data file returned by the data server 130. After receiving the vulnerability query statement, the data server 130 searches for security vulnerabilities according to the vulnerability category and keywords in the vulnerability query statement, and sends the vulnerability data file of the retrieved security vulnerability to the data server 130. The vulnerability data file includes configuration information of multiple security vulnerabilities, such as the name, score, status, and installation package of the security vulnerability.

[0045] When the security server 120 receives the vulnerability data file returned by the data server 130, it verifies the data integrity of the vulnerability data file. If the vulnerability data file is incomplete according to the verification result, the vulnerability query statement is resent to the data server 130 for query again. The integrity of the vulnerability data file refers to whether the configuration information of the security vulnerability included is complete. If the missing data file of the queried security vulnerability lacks the corresponding configuration information, the vulnerability query statement sent last time is sent to the data server 130 again for query.

[0046] Finally, step S350 is executed to parse the vulnerability data file to generate a vulnerability query result, and the vulnerability query result is sent to the client 111. When parsing the vulnerability data file to generate the vulnerability query result, first, the vulnerability data file is parsed to obtain data of multiple security vulnerabilities. A vulnerability data file contains configuration information of multiple security vulnerabilities. Subsequently, multiple security vulnerabilities are classified according to vulnerability categories to obtain security vulnerabilities under multiple vulnerability categories, for example, security vulnerabilities are classified into fixed and unfixed according to the status of security vulnerabilities. The security vulnerabilities under each vulnerability category are sorted to obtain the vulnerability query result, that is, the security vulnerabilities under each vulnerability category are sorted from high to low according to the scores of the security vulnerabilities.

[0047] Sending the vulnerability query result to the client 111 includes the following steps: the security server 120 renders and loads a vulnerability web page file according to the vulnerability query result, and sends the vulnerability web page file to the client 111, so that the client 111 can display the vulnerability web page file. The vulnerability web page file displayed by the client 111 includes information such as the names, states, and scores of multiple vulnerabilities, and the person who queries the security vulnerabilities on the client 111 can patch the security vulnerabilities in batches according to the displayed information.

[0048] The security vulnerability processing method in the present invention deploys a security server connected to multiple clients for communication. The security server receives the vulnerability acquisition request sent by the client, obtains the vulnerability data file from the data server according to the vulnerability acquisition request, and generates a vulnerability query result and returns it to the client. In this way, the client does not rely on installing any application program, but directly obtains the vulnerability query result from the data server through the security server, batch acquires and processes security vulnerabilities, and improves the efficiency of patching security vulnerabilities.

[0049] Furthermore, after receiving the vulnerability acquisition request sent by the client, the security server parses the vulnerability acquisition request and generates a vulnerability query statement that can operate the data server, thereby eliminating the need for developers to rewrite the code for operating the data server, increasing the speed of obtaining vulnerability data files, and further improving the efficiency of patching system security vulnerabilities.

[0050] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0051] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0052] Those skilled in the art will appreciate that the modules or units or groups of the devices in the examples disclosed herein may be arranged in the device as described in the embodiment, or alternatively may be located in one or more devices different from the devices in the example. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.

[0053] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or groups in the embodiments may be combined into one module or unit or group, and in addition they may be divided into a plurality of submodules or subunits or subgroups. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device so disclosed may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0054] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0055] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions. Therefore, a processor with necessary instructions for implementing the method or method elements forms a device for implementing the method or method elements. In addition, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0056] The various techniques described herein may be implemented in combination with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or portions of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a floppy disk, a CD-ROM, a hard disk drive, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0057] In the case where the program code is executed on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the method for determining the shutdown state of the device of the present invention according to the instructions in the program code stored in the memory.

[0058] By way of example and not limitation, computer readable media include computer storage media and communication media. Computer readable media include computer storage media and communication media. Computer storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and includes any information delivery medium. Any combination of the above is also included within the scope of computer readable media.

[0059] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.

[0060] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative, not restrictive, with respect to the scope of the present invention, which is defined by the appended claims.

Claims

1. A method for handling security vulnerabilities, suitable for execution in a security server, wherein the security server is in communication with a data server and one or more clients, the method comprising the steps of: Receiving a vulnerability acquisition request sent by the client; Parsing the vulnerability acquisition request and generating a vulnerability query statement; Sending the vulnerability query statement to the data server so that the data server performs vulnerability query according to the vulnerability query statement; Receiving the vulnerability data file returned by the data server; Parsing the vulnerability data file to generate a vulnerability query result, and sending the vulnerability query result to the client; The step of parsing the vulnerability acquisition request and generating a vulnerability query statement includes the following steps: According to the vulnerability acquisition request, determine the vulnerability category and one or more keywords to be queried, the security vulnerability is classified according to multiple vulnerability categories, including: score, status and software package, the score evaluates the danger level of the security vulnerability, and the more dangerous the security vulnerability is, the higher the score level, the status of the security vulnerability includes fixed and unfixed, and the software package of the security vulnerability includes display vulnerability, input vulnerability and output vulnerability; Generate a vulnerability query statement according to the vulnerability category and keywords, including: According to the pre-built model correspondence between the vulnerability query request and the vulnerability query statement, the vulnerability acquisition request is transformed to obtain a template of the vulnerability query statement; Combining the vulnerability category and the search term with the template to obtain a vulnerability query statement; The step of parsing the vulnerability data file to generate vulnerability query results comprises the following steps: Parsing the vulnerability data file to obtain data of multiple security vulnerabilities; Classifying multiple security vulnerabilities according to the vulnerability categories to obtain security vulnerabilities under multiple vulnerability categories; Sort the security vulnerabilities under each vulnerability category according to the security vulnerability scores to obtain vulnerability query results; Sending the vulnerability query result to the client comprises the steps of: According to the vulnerability query results, a vulnerability web page file is rendered and loaded, and the vulnerability web page file is sent to a client so that the client can display the vulnerability web page file. The vulnerability web page file includes the names, statuses and scores of multiple vulnerabilities so that security vulnerabilities can be patched in batches according to the displayed information.

2. The method of claim 1, wherein: The receiving of the vulnerability acquisition request sent by the client comprises the steps of: Setting an IP address so that the client can query the security server; Establish a long link with the client that queries the IP address; A vulnerability acquisition request is received according to a communication interface with the client.

3. The method of claim 1, wherein: The receiving of the vulnerability data file returned by the data server comprises the steps of: Verifying the data integrity of the vulnerability data file; If the vulnerability data file is incomplete according to the verification result, the vulnerability query statement is resent to the data server to query again.

4. A security vulnerability processing system, the system comprising: A security server, a data server in communication with the security server, and one or more clients, wherein the client is adapted to send a vulnerability query request to the security server and receive a vulnerability query result returned by the security server; The security server is adapted to receive a vulnerability acquisition request, parse the vulnerability acquisition request, generate a vulnerability query statement, and send the vulnerability query statement to the data server; The data server is suitable for performing vulnerability query according to the vulnerability query statement; The security server is also adapted to receive the returned vulnerability data file, parse the vulnerability data file to generate a vulnerability query result, and send the vulnerability query result to the client; The security server is further adapted to determine, according to the vulnerability acquisition request, a vulnerability category and one or more keywords to be queried, the security vulnerability being classified according to a plurality of vulnerability categories, including: score, status and software package, the score evaluating the danger level of the security vulnerability, the more dangerous the security vulnerability is at a higher score level, the status of the security vulnerability including fixed and unfixed, the software package of the security vulnerability including display vulnerability, input vulnerability and output vulnerability; According to the pre-built model correspondence between the vulnerability query request and the vulnerability query statement, the vulnerability acquisition request is transformed to obtain a template of the vulnerability query statement; Combining the vulnerability category and the search term with the template to obtain a vulnerability query statement; Parsing the vulnerability data file to obtain data of multiple security vulnerabilities; Classifying multiple security vulnerabilities according to the vulnerability categories to obtain security vulnerabilities under multiple vulnerability categories; Sort the security vulnerabilities under each vulnerability category according to the security vulnerability scores to obtain vulnerability query results; According to the vulnerability query results, a vulnerability web page file is rendered and loaded, and the vulnerability web page file is sent to a client so that the client can display the vulnerability web page file. The vulnerability web page file includes the names, statuses and scores of multiple vulnerabilities so that security vulnerabilities can be patched in batches according to the displayed information.

5. A computing device comprising: one or more processors; Memory; as well as One or more devices, the one or more devices comprising instructions for executing the method according to any one of claims 1 to 3.

6. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by a computing device, cause the computing device to perform the method according to any one of claims 1 to 3.

Images