Method, device, terminal device and storage medium for obtaining vulnerability data

Abstract

The present invention discloses a method for obtaining vulnerability data, including: obtaining task requirements and target network information of a target network; dividing multiple target vulnerability scanning devices into multiple device groups based on the task requirements; obtaining multiple vulnerability scanning methods corresponding to the multiple device groups; sending the target network information and the multiple vulnerability scanning methods to the multiple device groups, so that the multiple device groups use the multiple vulnerability scanning methods and the target network information to detect the target network and obtain multiple vulnerability data corresponding to the multiple device groups; receiving multiple vulnerability data fed back by the multiple device groups, and performing deduplication and fusion operations on the multiple vulnerability data to obtain result vulnerability data. The present invention also discloses a device for obtaining vulnerability data, a terminal device, and a computer-readable storage medium. By using the method of the present invention, the accuracy of multiple vulnerability data is improved, and the technical effect of improving the accuracy of the final result vulnerability data is achieved.

Description

Technical Field

[0001] The present invention relates to the field of vulnerability management technology, and in particular to a method, apparatus, terminal device, and computer-readable storage medium for obtaining vulnerability data. Background Art

[0002] The network technology simulation and verification platform situational awareness model is the process of conducting situational awareness of experiments conducted on the platform, including data collection, security situation assessment, and security situation data display. In the network technology simulation and verification platform situational assessment model, vulnerability scanning devices are connected to detect vulnerabilities in hosts, network device nodes, security device nodes, and application software in the target network. The detected vulnerability data serves as the basis for situational assessment.

[0003] However, the existing methods have low accuracy in obtaining vulnerability data of vulnerability scanning devices. Summary of the Invention

[0004] The main purpose of the present invention is to provide a method, apparatus, terminal device and computer-readable storage medium for obtaining vulnerability data, aiming to solve the technical problem of low accuracy of vulnerability data obtained by vulnerability scanning devices using existing methods in the prior art.

[0005] To achieve the above objectives, the present invention proposes a method for obtaining vulnerability data, which includes the following steps:

[0006] Obtaining the task requirements and target network information of the target network;

[0007] Based on the task requirements, multiple target vulnerability scanning devices are divided into multiple device groups;

[0008] Obtaining multiple vulnerability scanning methods corresponding to the multiple device groups, where each device group corresponds to one vulnerability scanning method;

[0009] Sending the target network information and the plurality of vulnerability scanning methods to the plurality of device groups, so that the plurality of device groups detect the target network corresponding to the target network information using the plurality of vulnerability scanning methods and the target network information, and obtain a plurality of vulnerability data corresponding to the plurality of device groups;

[0010] A plurality of vulnerability data fed back by a plurality of the device groups is received, and duplication removal and fusion operations are performed on the plurality of vulnerability data to obtain result vulnerability data.

[0011] Optionally, before the step of dividing the plurality of target vulnerability scanning devices into a plurality of device groups based on the task requirements, the method further includes:

[0012] When multiple preset vulnerability scanning devices are successfully connected, obtaining multiple basic device information of the multiple preset vulnerability scanning devices;

[0013] Registering a plurality of the preset vulnerability scanning devices using the plurality of the basic device information;

[0014] When the plurality of preset vulnerability scanning devices are successfully registered, the plurality of preset vulnerability scanning devices are determined as the plurality of target vulnerability scanning devices.

[0015] Optionally, before the step of obtaining multiple vulnerability scanning methods corresponding to the multiple device groups, the method further includes:

[0016] Acquire multiple device status information of multiple target vulnerability scanning devices corresponding to multiple device groups;

[0017] The step of obtaining multiple vulnerability scanning methods corresponding to the multiple device groups includes:

[0018] If the plurality of device status information are all available, then a plurality of vulnerability scanning methods corresponding to the plurality of device groups are obtained.

[0019] Optionally, after the step of obtaining multiple device status information of multiple target vulnerability scanning devices corresponding to multiple device groups, the method further includes:

[0020] If there is a target vulnerability scanning device with device status information indicating that the device is unavailable in the plurality of device groups, determining the target vulnerability scanning device with device status information indicating that the device is unavailable as an offline vulnerability scanning device;

[0021] Performing a registration operation using basic device information of the offline vulnerability scanning device, and / or classifying the offline vulnerability scanning device into a corresponding device group based on task requirements;

[0022] Obtaining new device status information of the offline vulnerability scanning device;

[0023] If the new device status information is unavailable, return to the step of performing the registration operation using the basic device information of the offline vulnerability scanning device, and / or divide the offline vulnerability scanning device into corresponding device groups based on task requirements, until the new device status information of the offline vulnerability scanning device is available, and then execute the step of obtaining the target network information and multiple vulnerability scanning methods corresponding to the multiple device groups.

[0024] Optionally, before the step of obtaining the task requirements and target network information of the target network, the method further includes:

[0025] Obtain detection instructions from the target network technology simulation verification platform;

[0026] Parsing the detection instruction to obtain the target network information;

[0027] Determine vulnerability scanning tasks based on the task requirements;

[0028] A plurality of vulnerability scanning modes are determined by utilizing the basic device information of each target vulnerability scanning device in the plurality of device groups and the vulnerability scanning tasks.

[0029] Optionally, after the step of performing deduplication and fusion operations on the plurality of vulnerability data to obtain result vulnerability data, the method further includes:

[0030] Sending the result vulnerability data to the target network technology simulation verification platform, so that the target network technology simulation verification platform performs situation analysis on the result vulnerability data to obtain analysis results;

[0031] Receive the analysis result fed back by the target network technology simulation verification platform.

[0032] Optionally, after the step of dividing the plurality of target vulnerability scanning devices into a plurality of device groups based on the task requirements, the method further includes:

[0033] When a new vulnerability scanning device is detected to be connected, new basic device information of the new vulnerability scanning device is obtained;

[0034] Registering the new vulnerability scanning device using the new device basic information;

[0035] When the new vulnerability scanning device is successfully registered, determining the new vulnerability scanning device as a new target vulnerability scanning device;

[0036] The new target vulnerability scanning devices are divided into corresponding device groups using the task requirements.

[0037] In addition, to achieve the above-mentioned purpose, the present invention also proposes a device for obtaining vulnerability data, the device comprising:

[0038] A first acquisition module is used to obtain task requirements and target network information of the target network;

[0039] A division module, configured to divide a plurality of target vulnerability scanning devices into a plurality of device groups based on the task requirements;

[0040] A second acquisition module is used to acquire multiple vulnerability scanning methods corresponding to the multiple device groups, where one device group corresponds to one vulnerability scanning method;

[0041] a detection module, configured to send the target network information and the plurality of vulnerability scanning methods to the plurality of device groups, so that the plurality of device groups detect the target network corresponding to the target network information using the plurality of vulnerability scanning methods and the target network information, and obtain a plurality of vulnerability data corresponding to the plurality of device groups;

[0042] The acquisition module is used to receive the plurality of vulnerability data fed back by the plurality of device groups, and perform deduplication and fusion operations on the plurality of vulnerability data to obtain result vulnerability data.

[0043] In addition, to achieve the above-mentioned purpose, the present invention also proposes a terminal device, which includes: a memory, a processor, and a vulnerability data acquisition program stored on the memory and running on the processor, and when the vulnerability data acquisition program is executed by the processor, the steps of the vulnerability data acquisition method as described in any one of the above items are implemented.

[0044] In addition, to achieve the above-mentioned purpose, the present invention also proposes a computer-readable storage medium, on which a program for obtaining vulnerability data is stored. When the program for obtaining vulnerability data is executed by a processor, the steps of the method for obtaining vulnerability data as described in any of the above-mentioned items are implemented.

[0045] The technical solution of the present invention proposes a method for obtaining vulnerability data, including: obtaining task requirements and target network information of a target network; dividing multiple target vulnerability scanning devices into multiple device groups based on the task requirements; obtaining multiple vulnerability scanning methods corresponding to the multiple device groups, one device group corresponding to one vulnerability scanning method; sending the target network information and the multiple vulnerability scanning methods to the multiple device groups, so that the multiple device groups use the multiple vulnerability scanning methods and the target network information to detect the target network corresponding to the target network information, and obtain multiple vulnerability data corresponding to the multiple device groups; receiving the multiple vulnerability data fed back by the multiple device groups, and performing deduplication and fusion operations on the multiple vulnerability data to obtain result vulnerability data.

[0046] Because, in existing methods, multiple target vulnerability scanning devices perform the same vulnerability scanning method, the vulnerability data obtained by the same vulnerability scanning method cannot accurately reflect the vulnerability status of the target network, resulting in a low accuracy rate of the multiple vulnerability data obtained, and thus a low accuracy rate of the final vulnerability data obtained. However, using the method of the present invention, multiple target vulnerability scanning devices are divided into multiple device groups, and different device groups correspond to different vulnerability scanning methods. This allows the corresponding multiple vulnerability data to accurately reflect the vulnerability status of the target network, improves the accuracy rate of the multiple vulnerability data, and achieves the technical effect of improving the accuracy rate of the final vulnerability data. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0048] Figure 1 A schematic diagram of the terminal device structure of the hardware operating environment involved in the embodiment of the present invention;

[0049] Figure 2 This is a flow chart of a first embodiment of a method for obtaining vulnerability data according to the present invention;

[0050] Figure 3 This is a structural block diagram of the first embodiment of the vulnerability data acquisition device of the present invention.

[0051] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0053] Reference Figure 1 , Figure 1 This is a schematic diagram of the terminal device structure of the hardware operating environment involved in the embodiment of the present invention.

[0054] Typically, the terminal device includes: at least one processor 301, a memory 302, and a vulnerability data acquisition program stored in the memory and executable on the processor, wherein the vulnerability data acquisition program is configured to implement the steps of the vulnerability data acquisition method as described above.

[0055] Processor 301 may include one or more processing cores, such as a quad-core processor or an octa-core processor. Processor 301 may be implemented in at least one of the following hardware forms: a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), or a PLA (Programmable Logic Array). Processor 301 may also include a main processor and a coprocessor. The main processor is a processor used to process data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 301 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content required to be displayed on the display screen. Processor 301 may also include an AI (Artificial Intelligence) processor, which is used to process operations related to the vulnerability data acquisition method, so that the vulnerability data acquisition method model can be autonomously trained and learned to improve efficiency and accuracy.

[0056] Memory 302 may include one or more computer-readable storage media, which may be non-transitory. Memory 302 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in memory 302 is used to store at least one instruction, which is executed by processor 301 to implement the vulnerability data acquisition method provided in the method embodiment of the present invention.

[0057] In some embodiments, the terminal may optionally include a communication interface 303 and at least one peripheral device. The processor 301, memory 302, and communication interface 303 may be connected via a bus or signal lines. Each peripheral device may be connected to the communication interface 303 via a bus, signal lines, or circuit boards. Specifically, the peripheral device may include at least one of a radio frequency circuit 304, a display screen 305, and a power supply 306.

[0058] The communication interface 303 can be used to connect at least one I / O (Input / Output)-related peripheral device to the processor 301 and the memory 302. In some embodiments, the processor 301, the memory 302, and the communication interface 303 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 301, the memory 302, and the communication interface 303 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0059] The RF circuit 304 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF circuit 304 communicates with communication networks and other communication devices via electromagnetic signals. The RF circuit 304 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. Optionally, the RF circuit 304 includes an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. The RF circuit 304 can communicate with other terminals via at least one wireless communication protocol. Such wireless communication protocols include, but are not limited to, metropolitan area networks (MANs), various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks (WLANs), and / or WiFi (Wireless Fidelity) networks. In some embodiments, the RF circuit 304 may also include circuits related to Near Field Communication (NFC), which is not limited in the present invention.

[0060] Display screen 305 is used to display a UI (User Interface). This UI may include graphics, text, icons, videos, or any combination thereof. When display screen 305 is a touch screen display, it is also capable of collecting touch signals on or above the surface of display screen 305. This touch signal can be input as a control signal to processor 301 for processing. In this case, display screen 305 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, display screen 305 can be a single display screen, the front panel of the electronic device; in other embodiments, display screen 305 can be at least two, each disposed on different surfaces of the electronic device or in a foldable design; in still other embodiments, display screen 305 can be a flexible display screen, disposed on a curved or foldable surface of the electronic device. Display screen 305 can also be configured as a non-rectangular irregular shape, i.e., a special-shaped screen. Display screen 305 can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0061] The power supply 306 is used to power various components in the electronic device. The power supply 306 can be AC ​​power, DC power, disposable batteries, or rechargeable batteries. When the power supply 306 includes a rechargeable battery, the rechargeable battery can support wired charging or wireless charging. The rechargeable battery can also be used to support fast charging technology. It will be understood by those skilled in the art that Figure 1 The structure shown in the figure does not constitute a limitation on the terminal device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0062] In addition, an embodiment of the present invention further proposes a computer-readable storage medium, on which a program for obtaining vulnerability data is stored, and when the program for obtaining vulnerability data is executed by a processor, the steps of the method for obtaining vulnerability data as described above are implemented. Therefore, no further description will be given here. In addition, the description of the beneficial effects of adopting the same method will not be repeated. For technical details not disclosed in the embodiment of the computer-readable storage medium involved in the present invention, please refer to the description of the embodiment of the method of the present invention. As an example, the program instructions can be deployed to be executed on one terminal device, or on multiple terminal devices located at one location, or on multiple terminal devices distributed at multiple locations and interconnected by a communication network.

[0063] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The above-described program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-described method embodiments. The above-described computer-readable storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0064] Based on the above hardware structure, an embodiment of a method for obtaining vulnerability data of the present invention is proposed.

[0065] Reference Figure 2 , Figure 2 This is a flow chart of a first embodiment of a method for obtaining vulnerability data according to the present invention. The method is applied to a terminal device and includes the following steps:

[0066] Step S11: Obtain task requirements and target network information of the target network.

[0067] Step S12: Based on the task requirements, multiple target vulnerability scanning devices are divided into multiple device groups.

[0068] It should be noted that the execution subject of the present invention is a terminal device, and the terminal device is installed with a vulnerability data acquisition program. When the terminal device executes the vulnerability data acquisition program, the steps of the vulnerability data acquisition method of the present invention are implemented.

[0069] In specific applications, the task requirements are user-defined task requirements, such as high vulnerability detection efficiency or high vulnerability detection accuracy. Multiple target vulnerability scanning devices may be any type of scanning device, even if they are required to perform the vulnerability data acquisition method of the present invention. The structural information of the multiple target vulnerability scanning devices refers to the structure of the terminal device described above.

[0070] Among them, the task requirements can also include vulnerability scanning tasks set by the user. The vulnerability scanning tasks can be directly obtained in the task requirements. For a detection process, the corresponding task requirements are the same, and the vulnerability scanning tasks in the task requirements are also the same.

[0071] Specifically, the method of obtaining multiple target vulnerability scanning devices is as follows: when multiple preset vulnerability scanning devices are successfully connected, multiple basic device information of the multiple preset vulnerability scanning devices is obtained; the multiple preset vulnerability scanning devices are registered using the multiple basic device information; when the multiple preset vulnerability scanning devices are successfully registered, the multiple preset vulnerability scanning devices are determined as the multiple target vulnerability scanning devices.

[0072] Among them, the preset vulnerability scanning device is a vulnerability scanning device that is obtained in the initial state and has not been registered. The basic device information of the preset vulnerability scanning device may include the name of the device, the manufacturer of the device, the protocol type used by the device, the IP address of the device, the account number of the device, and other information.

[0073] When all preset vulnerability scanning devices are successfully registered, they constitute multiple target vulnerability scanning devices. If some preset vulnerability scanning devices are successfully registered, the successfully registered preset vulnerability scanning devices constitute multiple target vulnerability scanning devices. Preset vulnerability scanning devices that fail to register can be repaired or maintained and then registered. If registration is successful, they are identified as target vulnerability scanning devices. If registration fails again, the preset vulnerability scanning device is discarded.

[0074] In specific applications, multiple target vulnerability scanning devices are divided into multiple device groups based on task requirements. For example, there are 20 target vulnerability scanning devices in total. Based on the task requirement - high vulnerability detection accuracy, the 20 target vulnerability scanning devices are divided into 4 device groups, each of which includes 5 target vulnerability scanning devices.

[0075] Step S13: Acquire multiple vulnerability scanning methods corresponding to the multiple device groups, where one device group corresponds to one vulnerability scanning method.

[0076] Step S14: Send the target network information and the multiple vulnerability scanning methods to the multiple device groups, so that the multiple device groups use the multiple vulnerability scanning methods and the target network information to detect the target network corresponding to the target network information and obtain multiple vulnerability data corresponding to the multiple device groups.

[0077] In the present invention, each device group corresponds to a vulnerability scanning method, different device groups execute different vulnerability scanning methods, each device group executes a vulnerability scanning method to obtain corresponding vulnerability data, multiple device groups respectively execute corresponding vulnerability scanning methods to obtain multiple vulnerability data, and one device group corresponds to one vulnerability data.

[0078] The target network is the network that needs to be detected for vulnerabilities. The information of the target network is the target network information, which includes the target network ID, experiment ID, and task ID.

[0079] Furthermore, before the step of obtaining the task requirements and the target network information of the target network, the method also includes: obtaining a detection instruction from the target network technology simulation verification platform; parsing the detection instruction to obtain the target network information; determining a vulnerability scanning task based on the task requirements; and determining a plurality of vulnerability scanning methods using the basic device information of each target vulnerability scanning device in the plurality of device groups and the vulnerability scanning task.

[0080] In the present invention, a network technology simulation and verification platform is used to detect vulnerabilities. The network technology simulation and verification platform used to send detection instructions is the target network technology simulation and verification platform. The target network technology simulation and verification platform can be any form of network technology simulation and verification platform.

[0081] Based on the above description, each execution of the method of the present invention corresponds to a task requirement, each task requirement including a vulnerability scanning task. Therefore, during each execution of the method of the present invention, vulnerability scanning methods are determined for each device group based on the vulnerability scanning task. In other words, multiple vulnerability scanning methods correspond to the same vulnerability scanning task. Specifically, the detection instructions are automatically parsed to obtain target network information.

[0082] Furthermore, before the step of obtaining multiple vulnerability scanning methods corresponding to multiple device groups, the method also includes: obtaining multiple device status information of multiple target vulnerability scanning devices corresponding to multiple device groups; the step of obtaining multiple vulnerability scanning methods corresponding to multiple device groups includes: if multiple device status information are all available, then obtaining multiple vulnerability scanning methods corresponding to multiple device groups.

[0083] After obtaining device status information for the target vulnerability scanning devices corresponding to the device groups, the method further includes: if any target vulnerability scanning device in the device groups has unavailable device status information, determining the target vulnerability scanning device with unavailable device status information as an offline vulnerability scanning device; performing a registration operation using the basic device information of the offline vulnerability scanning device, and / or assigning the offline vulnerability scanning device to a corresponding device group based on task requirements; obtaining new device status information for the offline vulnerability scanning device; and if the new device status information is unavailable, returning to the step of performing a registration operation using the basic device information of the offline vulnerability scanning device, and / or assigning the offline vulnerability scanning device to a corresponding device group based on task requirements, until the new device status information of the offline vulnerability scanning device is available, performing the step of obtaining device status information for the target vulnerability scanning devices corresponding to the device groups. Available device status information can also be represented as online, and unavailable device status information can also be represented as offline.

[0084] Step S15: receiving a plurality of vulnerability data fed back by a plurality of the device groups, and performing deduplication and fusion operations on the plurality of vulnerability data to obtain result vulnerability data.

[0085] For multiple vulnerability data, duplicate vulnerability data are removed and the vulnerability data of the same type are merged. Finally, the deduplication and fusion data are the result vulnerability data.

[0086] Furthermore, after the step of deduplicating and fusing the multiple vulnerability data to obtain the result vulnerability data, the method also includes: sending the result vulnerability data to the target network technology simulation and verification platform, so that the target network technology simulation and verification platform performs a situation analysis on the result vulnerability data to obtain the analysis results; and receiving the analysis results fed back by the target network technology simulation and verification platform.

[0087] In this invention, network detection is performed using a target network technology simulation and verification platform. This platform sends detection instructions, registers vulnerability scanning devices, and performs situation analysis. The analysis results and vulnerability counts obtained can be managed (add, delete, modify, and query) and stored to facilitate further situation analysis.

[0088] Furthermore, after the step of dividing multiple target vulnerability scanning devices into multiple device groups based on the task requirements, the method also includes: when a new vulnerability scanning device is detected to be connected, obtaining new device basic information of the new vulnerability scanning device; using the new device basic information to register the new vulnerability scanning device; when the new vulnerability scanning device is successfully registered, determining the new vulnerability scanning device as a new target vulnerability scanning device; using the task requirements, dividing the new target vulnerability scanning device into the corresponding device group.

[0089] For a newly connected vulnerability scanning device, multiple target vulnerability scanning devices can be incorporated in the above manner, so that a new member is added to the multiple target vulnerability scanning devices.

[0090] It should be noted that in the present invention, to improve vulnerability data accuracy—where the task requirement includes high vulnerability detection accuracy—multiple target vulnerability scanning devices can be divided into multiple groups, with each group utilizing a unique vulnerability scanning method to perform vulnerability detection, ensuring that the vulnerability data from each group is highly comprehensive. To improve vulnerability detection efficiency—where the task requirement includes high vulnerability detection efficiency—multiple target vulnerability scanning devices can be grouped into a single group to ensure high vulnerability data acquisition efficiency. When multiple target vulnerability scanning devices are grouped into a single group, each target vulnerability scanning device can achieve a scanning speed of approximately 1000 ip / h, increasing vulnerability detection speed by at least half.

[0091] The technical solution of the present invention proposes a method for obtaining vulnerability data, including: obtaining task requirements and target network information of a target network; dividing multiple target vulnerability scanning devices into multiple device groups based on the task requirements; obtaining multiple vulnerability scanning methods corresponding to the multiple device groups, one device group corresponding to one vulnerability scanning method; sending the target network information and the multiple vulnerability scanning methods to the multiple device groups, so that the multiple device groups use the multiple vulnerability scanning methods and the target network information to detect the target network corresponding to the target network information, and obtain multiple vulnerability data corresponding to the multiple device groups; receiving the multiple vulnerability data fed back by the multiple device groups, and performing deduplication and fusion operations on the multiple vulnerability data to obtain result vulnerability data.

[0092] Because, in existing methods, multiple target vulnerability scanning devices perform the same vulnerability scanning method, the vulnerability data obtained by the same vulnerability scanning method cannot accurately reflect the vulnerability status of the target network, resulting in a low accuracy rate of the multiple vulnerability data obtained, and thus a low accuracy rate of the final vulnerability data obtained. However, using the method of the present invention, multiple target vulnerability scanning devices are divided into multiple device groups, and different device groups correspond to different vulnerability scanning methods. This allows the corresponding multiple vulnerability data to accurately reflect the vulnerability status of the target network, improves the accuracy rate of the multiple vulnerability data, and achieves the technical effect of improving the accuracy rate of the final vulnerability data.

[0093] The network technology simulation and verification platform is compatible with vulnerability scanning devices from multiple or multiple security vendors, and provides the function of flexibly configuring the vulnerability scanning method of the vulnerability scanning device, thereby improving the utilization rate of the equipment and ensuring the scalability of the platform. At the same time, it can effectively reduce the false alarm rate and missed alarm rate of the security situation assessment model of the network technology simulation and verification platform and shorten the detection time of the target network vulnerability scan.

[0094] Reference Figure 3 , Figure 3 This is a structural block diagram of a first embodiment of a device for obtaining vulnerability data of the present invention. The device is used in a terminal device and is based on the same inventive concept as the previous embodiment. The device includes:

[0095] A first acquisition module 10 is used to obtain task requirements and target network information of the target network;

[0096] A division module 20 is used to divide the plurality of target vulnerability scanning devices into a plurality of device groups based on the task requirements;

[0097] A second acquisition module 30 is configured to acquire a plurality of vulnerability scanning methods corresponding to the plurality of device groups, where one device group corresponds to one vulnerability scanning method;

[0098] The detection module 40 is configured to send the target network information and the plurality of vulnerability scanning methods to the plurality of device groups, so that the plurality of device groups detect the target network corresponding to the target network information using the plurality of vulnerability scanning methods and the target network information, and obtain a plurality of vulnerability data corresponding to the plurality of device groups;

[0099] The obtaining module 50 is configured to receive a plurality of vulnerability data fed back by a plurality of the device groups, and perform deduplication and fusion operations on the plurality of vulnerability data to obtain result vulnerability data.

[0100] It should be noted that, since the steps executed by the device of this embodiment are the same as those of the aforementioned method embodiment, its specific implementation methods and achievable technical effects can refer to the aforementioned embodiments and will not be repeated here.

[0101] The above descriptions are merely optional embodiments of the present invention and do not limit the patent scope of the present invention. All equivalent structural transformations made using the contents of the present description and drawings under the inventive concept of the present invention, or direct / indirect applications in other related technical fields, are included in the patent protection scope of the present invention.

Claims

1. A method for obtaining vulnerability data, It is characterized in that The method comprises the following steps: Obtaining task requirements and target network information of the target network; When multiple preset vulnerability scanning devices are successfully connected, multiple basic device information of the multiple preset vulnerability scanning devices is obtained; Using the multiple basic device information, registering the multiple preset vulnerability scanning devices; When the plurality of preset vulnerability scanning devices are successfully registered, determining the plurality of preset vulnerability scanning devices as a plurality of target vulnerability scanning devices; Based on the task requirements, multiple target vulnerability scanning devices are divided into multiple device groups; Acquire multiple device status information of multiple target vulnerability scanning devices corresponding to multiple device groups; If there is a target vulnerability scanning device whose device status information is unavailable in the multiple device groups, the target vulnerability scanning device whose device status information is unavailable is determined as an offline vulnerability scanning device; the basic device information of the offline vulnerability scanning device is used to perform a registration operation, and / or the offline vulnerability scanning device is divided into a corresponding device group according to the task requirements; new device status information of the offline vulnerability scanning device is obtained; if the new device status information is unavailable, the step of returning to perform the step of performing a registration operation using the basic device information of the offline vulnerability scanning device, and / or the step of dividing the offline vulnerability scanning device into a corresponding device group according to the task requirements is performed, until the new device status information of the offline vulnerability scanning device is available, and then the step of obtaining multiple device status information of multiple target vulnerability scanning devices corresponding to multiple device groups is performed; If the plurality of device status information are all available, then obtaining a plurality of vulnerability scanning methods corresponding to the plurality of device groups, where one device group corresponds to one vulnerability scanning method; Sending the target network information and the plurality of vulnerability scanning methods to the plurality of device groups, so that the plurality of device groups detect the target network corresponding to the target network information using the plurality of vulnerability scanning methods and the target network information, and obtaining a plurality of vulnerability data corresponding to the plurality of device groups; A plurality of the vulnerability data fed back by the plurality of the device groups is received, and a deduplication and fusion operation is performed on the plurality of the vulnerability data to obtain result vulnerability data.

2. The method according to claim 1, It is characterized in that Before the step of obtaining the task requirements and the target network information of the target network, the method further includes: Obtain detection instructions from the target network technology simulation verification platform; Parsing the detection instruction to obtain the target network information; Based on the task requirements, determine the vulnerability scanning task; A plurality of vulnerability scanning modes are determined by using the basic device information of each target vulnerability scanning device in the plurality of device groups and the vulnerability scanning tasks.

3. The method according to claim 2, It is characterized in that After the step of performing deduplication and fusion operations on the plurality of vulnerability data to obtain result vulnerability data, the method further includes: Sending the result vulnerability data to the target network technology simulation verification platform, so that the target network technology simulation verification platform performs situation analysis on the result vulnerability data to obtain analysis results; Receive the analysis result fed back by the target network technology simulation verification platform.

4. The method according to claim 3, It is characterized in that After the step of dividing the plurality of target vulnerability scanning devices into a plurality of device groups based on the task requirements, the method further comprises: When a new vulnerability scanning device is detected to be connected, new basic device information of the new vulnerability scanning device is obtained; Registering the new vulnerability scanning device using the new device basic information; When the new vulnerability scanning device is successfully registered, determining the new vulnerability scanning device as a new target vulnerability scanning device; The new target vulnerability scanning devices are divided into corresponding device groups using the task requirements.

5. A device for obtaining vulnerability data, It is characterized in that The device comprises: The first acquisition module is used to obtain the task requirements and the target network information of the target network; and is also used to obtain multiple basic device information of multiple preset vulnerability scanning devices when multiple preset vulnerability scanning devices are successfully connected; register the multiple preset vulnerability scanning devices using the multiple basic device information; and when the multiple preset vulnerability scanning devices are successfully registered, determine the multiple preset vulnerability scanning devices as multiple target vulnerability scanning devices; A division module, used for dividing a plurality of target vulnerability scanning devices into a plurality of device groups based on the task requirements; A second acquisition module is used to obtain multiple device status information of multiple target vulnerability scanning devices corresponding to multiple device groups; if there is a target vulnerability scanning device with unavailable device status information in the multiple device groups, the target vulnerability scanning device with unavailable device status information is determined as an offline vulnerability scanning device; registering operation is performed using basic device information of the offline vulnerability scanning device, and / or, the offline vulnerability scanning device is divided into corresponding device groups according to task requirements; new device status information of the offline vulnerability scanning device is obtained; if the new device status information is unavailable, the step of performing registration operation using basic device information of the offline vulnerability scanning device and / or, dividing the offline vulnerability scanning device into corresponding device groups according to task requirements is returned to, until the new device status information of the offline vulnerability scanning device is available, the step of obtaining multiple device status information of multiple target vulnerability scanning devices corresponding to multiple device groups is performed; if multiple device status information are all available, multiple vulnerability scanning modes corresponding to multiple device groups are obtained, and one device group corresponds to one vulnerability scanning mode; A detection module, used for sending the target network information and the plurality of vulnerability scanning methods to the plurality of device groups, so that the plurality of device groups detect the target network corresponding to the target network information by using the plurality of vulnerability scanning methods and the target network information, and obtain a plurality of vulnerability data corresponding to the plurality of device groups; The acquisition module is used to receive the plurality of vulnerability data fed back by the plurality of device groups, and perform deduplication and fusion operations on the plurality of vulnerability data to obtain result vulnerability data.

6. A terminal device, It is characterized in that The terminal device includes: a memory, a processor, and a vulnerability data acquisition program stored in the memory and running on the processor, and when the vulnerability data acquisition program is executed by the processor, the steps of the vulnerability data acquisition method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a vulnerability data acquisition program, and when the vulnerability data acquisition program is executed by a processor, the steps of the vulnerability data acquisition method according to any one of claims 1 to 4 are implemented.

Images