Network security scanning method, device, computer equipment and storage medium

Abstract

The present invention discloses a network security scanning method, which is applied to the field of computer security technology and is used to solve the technical problem of low scanning efficiency when a host is scanned securely by the current network security scanning method. The method provided by the present invention comprises: obtaining an IP address and a service port from a pre-written configuration file, combining the IP address and the service port to obtain multiple IP address arrays; performing a host survival detection on each host corresponding to the IP address array; when the host survival detection is successful, saving the corresponding IP address array in an array set to be scanned; performing at least one security scan on the host corresponding to the IP address array in the array set; updating the IP address array included in the array set according to the result of the security scan, and outputting the result of the security scan.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a network security scanning method, device, computer equipment and storage medium. Background Art

[0002] Traditional network security scanners can only perform security scans on specific hosts based on known host addresses when scanning. They are unable to intelligently respond to and handle duplicate target systems and do not have the ability to automatically acquire scanning targets.

[0003] When a security scan needs to be performed on a host through an existing security scanner, the network address of the target host needs to be manually added, and the start of the scan needs to be manually triggered, which makes the working efficiency of the scanner low. Summary of the invention

[0004] The embodiments of the present invention provide a network security scanning method, device, computer equipment and storage medium to solve the technical problem of low scanning efficiency when performing security scanning on a host through the current network security scanning method.

[0005] A network security scanning method, the method comprising:

[0006] Obtain an IP address and a service port from a pre-written configuration file, and combine the IP address and the service port to obtain an array of multiple IP addresses;

[0007] Perform host survival detection on each host corresponding to the IP address array;

[0008] When the host survival detection is successful, the corresponding IP address array is saved in the array set to be scanned;

[0009] Perform at least one security scan on the host corresponding to the IP address array in the array set;

[0010] The IP address array included in the array set is updated according to the result of the security scan, and the result of the security scan is output.

[0011] A network security scanning device, the device comprising:

[0012] An address combination module is used to obtain an IP address and a service port from a pre-written configuration file, and to combine the IP address and the service port to obtain an array of multiple IP addresses;

[0013] A survival detection module is used to perform host survival detection on each host corresponding to the IP address array;

[0014] The saving module is used to save the corresponding IP address array in the array set to be scanned when the host survival detection is successful;

[0015] A security scanning module, used for performing at least one security scan on the host corresponding to the IP address array in the array set;

[0016] The output module is used to update the IP address array included in the array set according to the result of the security scan and output the result of the security scan.

[0017] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned network security scanning method when executing the computer program.

[0018] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned network security scanning method are implemented.

[0019] The network security scanning method, device, computer equipment and storage medium proposed in the present application first obtain the IP address and service port from a pre-written configuration file, combine the IP address and the service port to obtain multiple IP address arrays, and then perform host survival detection on the host corresponding to each IP address array. When the host survival detection is successful, the corresponding IP address array is saved in the array set to be scanned, and then at least one security scan is performed on the host corresponding to the IP address array in the array set. Finally, the IP address array included in the array set is updated according to the result of the security scan, and the result of the security scan is output. The present application can realize automatic acquisition of scanning targets by performing survival detection on the corresponding hosts according to the self-combined IP address array and performing security scans on the hosts that succeeded the survival detection, eliminating the step of manually adding scanning addresses and improving the scanning efficiency of the scanner. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0021] Figure 1 is a schematic diagram of an application environment of a network security scanning method according to an embodiment of the present invention;

[0022] Figure 2is a flow chart of a network security scanning method according to an embodiment of the present invention;

[0023] Figure 3 is a flow chart of a network security scanning method according to another embodiment of the present invention;

[0024] Figure 4 is a schematic diagram of the structure of a network security scanning device in one embodiment of the present invention;

[0025] Figure 5 is a schematic diagram of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] The network security scanning method provided by this application can be applied to Figure 1 In an application environment, the computer device can communicate with the server through a network. The computer device can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices. The server can be implemented as an independent server or a server cluster consisting of multiple servers.

[0028] In one embodiment, if Figure 2 As shown, a network security scanning method is provided, and the method is applied in Figure 1 The computer device in is taken as an example to illustrate, including the following steps S101 to S105.

[0029] S101. Obtain an IP address and a service port from a pre-written configuration file, and combine the IP address and the service port to obtain a plurality of IP address arrays.

[0030] In one embodiment, the IP address and the service port are combined to obtain multiple IP address arrays, including:

[0031] Select each of the predefined IP addresses one by one;

[0032] Each selected IP address is combined with each predefined service port to obtain multiple IP address arrays.

[0033] S102: Perform host survival detection on each host corresponding to the IP address array.

[0034] In one embodiment, performing host survival detection on each host corresponding to the IP address array includes:

[0035] Start multi-threading and send request messages to each IP address array through TCP layer 4 protocol;

[0036] According to the response result of the request message, it is determined whether the addresses corresponding to the IP address array are reachable. If so, it is determined whether the corresponding host is alive.

[0037] Furthermore, the multithreading is started and a request message is sent to each of the IP address arrays through the TCP layer 4 protocol, including:

[0038] Obtaining a first number of IP address arrays that need to be security scanned in the array set;

[0039] The first number of threads are started, and a request message is sent to a corresponding IP address array through each of the threads.

[0040] After determining that the corresponding host is alive, the method further includes:

[0041] Perform a security scan on the host corresponding to the IP address array using a scan type that matches the address port in the IP address array.

[0042] It is understandable that when a host does not return the response result according to the request message, it means that the corresponding host survival detection has failed, that is, the host corresponding to the corresponding IP address array does not exist.

[0043] This embodiment opens a new thread for each IP address array that needs to be scanned, and performs corresponding scanning operations by matching the scanning type through the address port, thereby further improving the scanning efficiency through multi-threading technology.

[0044] S103: When the host survival detection is successful, the corresponding IP address array is saved in the array set to be scanned.

[0045] This step allows the user to write the IP addresses and ports that need to be scanned into the configuration file. The scanning task will combine the IP addresses and ports one by one and perform host survival detection. The addresses that have been successfully detected will then be subjected to security scans, which can save server resources.

[0046] S104: Perform at least one security scan on the host corresponding to the IP address array in the array set.

[0047] In one embodiment, performing at least one security scan on the host corresponding to the IP address array in the array set includes:

[0048] Enable multithreading and scheduled tasks;

[0049] When the scheduled task is finished, a security scan is performed on the hosts corresponding to the IP address array in the array set through the multithreading.

[0050] It can be understood that the number of multi-threads enabled in this embodiment depends on the hardware performance of the computer device that implements the network security scanning method. When the hardware performance of the computer device that implements the network security scanning method is relatively good, as many threads as possible can be enabled to further improve the scanning efficiency of the network security scanning method.

[0051] The network security scanning method proposed in this embodiment starts scanning at a scheduled time through a scheduled task. The scanning period can be set by an online Cron expression rule, and the user can customize the scanning period according to the rule. The program sets that the next round of scanning can only be started after the previous round of scheduled task scanning is completed. Otherwise, when the scheduled scanning is started, it is detected that the previous round of scanning tasks is not completed, and the current round of scanning tasks will not be started.

[0052] This embodiment starts a scheduled task, and when the scheduled task ends, the multi-threaded scan is performed on the host corresponding to the IP address array in the array set, so that the intelligent network security scanning system can execute the scanning task regularly through the scheduled task after startup, without the need for subsequent manual operations, thereby achieving the effect of automatic scanning.

[0053] In one embodiment, the types of security scans include brute force detection, vulnerability scanning, webtitle detection, web fingerprinting, and vulnerability exploitation.

[0054] Among them, the brute force detection type means that a security scan is performed on the host through a weak password brute force cracking check tool.

[0055] When traversing the IP address array in the address array set to be scanned and starting a new thread for scanning, this embodiment can match the type of scanning through the port in the address, such as performing brute force detection on service ports such as 3306 and 6379 to determine whether there is information such as weak passwords. Other port scanning types include high-risk vulnerability scanning (ms17010, etc.), web vulnerability scanning (such as weblogic, st2, etc. that support xray poc scanning), webtitle detection, web fingerprint recognition (common cms, oa frameworks, etc.), vulnerability exploitation (redis writes public keys or writes scheduled tasks, ssh command execution), etc.

[0056] S105. Update the IP address array included in the array set according to the result of the security scan, and output the result of the security scan.

[0057] In one embodiment, the scan result includes but is not limited to risk type, risk details, corresponding address, scan time, etc. In this embodiment, the scanned risk information can be saved in a local log file, and the risk information includes risk type, risk details, corresponding address, and scan time, and the result can be sent to other systems by requesting other system APIs to assist other systems in processing.

[0058] In one embodiment, the security result may be outputted by displaying the security scan result on a display screen of the computer device, or by requesting an API (Application Programming Interface) of a third-party system to send the security scan result to other systems.

[0059] As an option, the scan result can be saved in a local log file, and the result can be sent to other systems by requesting a third-party system API, so that the scan result can be shared.

[0060] The network security scanning method proposed in this embodiment realizes convenient loading in the Internet of Things device and one-click intelligent scanning by changing the ARM architecture of the network scanner. From acquiring the target in the business process, loading the scan, to uploading the scan result report, the entire scanning process does not require human operation, which saves human operation time and improves the working efficiency of the scanner.

[0061] In one embodiment, the updating of the IP address array included in the array set according to the result of the security scan includes:

[0062] According to the number of security scans performed on the hosts corresponding to the IP address array in the array set, the number of scans of the array set is updated;

[0063] After performing at least one security scan on the host corresponding to the IP address array in the array set, the method further includes:

[0064] Determine whether the scan count is greater than a preset count, and if so, reset the scan count of the array set to 0;

[0065] The steps of performing at least one security scan on the hosts corresponding to the IP address array in the array set and outputting the result of the security scan are looped until an instruction to stop the security scan is received.

[0066] In one embodiment, performing at least one security scan on the host corresponding to the IP address array in the array set includes:

[0067] When performing at least one security scan on the hosts corresponding to the IP address array in the array set in a loop, if the hosts corresponding to the IP address array have completed the security scan in the previous round of security scan and are not back online, then the security scan on the hosts corresponding to the corresponding IP address array will not be performed in this loop; if the hosts corresponding to the IP address array have completed the security scan in the previous round of security scan and are back online, then the security scan on the hosts corresponding to the corresponding IP address array will be performed in this loop.

[0068] The network security scanning method proposed in this embodiment first combines the user-defined IP and port one by one to generate an IP address array with port information to be scanned, and then performs host survival detection, that is, starts multi-threading to request the address using the TCP4 protocol to determine whether it is reachable, saves the successfully requested address in a new array, and then filters out the addresses that have been scanned in the previous round through an algorithm to prevent repeated scanning. Figure 3 is a flow chart of a network security scanning method in another embodiment of the present invention. Figure 3 As shown, the idea of ​​the algorithm to prevent repeated scanning is as follows:

[0069] (1) After the intelligent network security scanning system is started, a map collection is created. The collection initialization save keys are count (current scanning round) and lastcount (previous scanning round), and the corresponding initial values ​​are 0

[0070] (2) When filtering the scanned address array, check whether the map set has a key with the address value. If not, it means that the address has not been scanned before. Add the address to the address array to be scanned and set the key in the map set to the address value, and set the value to the value corresponding to count. If the map set has a key with the address value, get its corresponding value and compare it with the value of lastcount. If they are equal, it means that the address has been scanned in the previous round of scanning tasks. This round of scanning tasks will not repeat the scan and update its corresponding value to the value corresponding to count. If they are not equal, it means that the address has been scanned in the previous round, but was not detected by the host survival in the previous round of scanning tasks. Therefore, the address is back online. This round of scanning tasks will rescan it, save the address to the address array to be scanned, and update the corresponding value of the map set to the value corresponding to count.

[0071] (3) After filtering, the generated array of addresses to be scanned is handed over to the next step for the corresponding scanning operation and the values ​​corresponding to count and lastcount in the map set are updated. The value corresponding to lastcount is updated to the value corresponding to count, and the value corresponding to count is incremented by 1.

[0072] (4) Finally, the value of count is judged. If the value of count is greater than or equal to 12, it means that the scanning task has been carried out for 12 rounds. It is necessary to clear the key-value pairs in the map set and reset the corresponding values ​​of count and lastcount to 0. In this way, when the scanning task reaches 12 rounds, all addresses detected by the host survival need to be scanned.

[0073] This embodiment filters the successfully detected addresses through an anti-duplicate scanning algorithm to prevent the same address from being scanned twice. At the same time, the hosts corresponding to the newly-connected IP address array can be scanned again, which can further save server resources while ensuring that every host that needs to be scanned for security is not missed.

[0074] The network security scanning method proposed in this embodiment first obtains the IP address and service port from a pre-written configuration file, combines the IP address and the service port to obtain multiple IP address arrays, and then performs host survival detection on the host corresponding to each IP address array. When the host survival detection is successful, the corresponding IP address array is saved in the array set to be scanned, and then at least one security scan is performed on the host corresponding to the IP address array in the array set. Finally, the IP address array included in the array set is updated according to the result of the security scan, and the result of the security scan is output. The present application performs survival detection on the corresponding host according to the self-combined IP address array, and performs security scan on the host with successful survival detection, so as to realize automatic acquisition of scanning targets, eliminate the step of manually adding scanning addresses, and improve the scanning efficiency of the scanner.

[0075] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0076] In one embodiment, a network security scanning device is provided, and the network security scanning device corresponds one-to-one to the network security scanning method in the above embodiment. Figure 4 As shown, the network security scanning device 100 includes an address combination module 11, a survival detection module 12, a storage module 13, a security scanning module 14 and an output module 15. The detailed description of each functional module is as follows:

[0077] An address combination module 11 is used to obtain an IP address and a service port from a pre-written configuration file, and combine the IP address and the service port to obtain a plurality of IP address arrays;

[0078] A survival detection module 12 is used to perform host survival detection on each host corresponding to the IP address array;

[0079] The storage module 13 is used to store the corresponding IP address array in the array set to be scanned when the host survival detection is successful;

[0080] A security scanning module 14, configured to perform at least one security scan on the host corresponding to the IP address array in the array set;

[0081] The output module 15 is used to update the IP address array included in the array set according to the result of the security scan, and output the result of the security scan.

[0082] In one embodiment, the types of security scans include brute force detection, vulnerability scanning, webtitle detection, web fingerprinting, and vulnerability exploitation.

[0083] The network security scanning device 100 proposed in this embodiment first obtains the IP address and the service port from a pre-written configuration file through the address combination module 11, combines the IP address and the service port to obtain multiple IP address arrays, and then performs host survival detection on each host corresponding to the IP address array through the survival detection module 12. When the host survival detection is successful, the corresponding IP address array is saved in the array set to be scanned through the saving module 13, and then the host corresponding to the IP address array in the array set is subjected to at least one security scan through the security scanning module 14. Finally, the IP address array included in the array set is updated according to the result of the security scan through the output module 15, and the result of the security scan is output. This embodiment performs survival detection on the corresponding host according to the self-combined IP address array, and performs security scanning on the host that succeeds in the survival detection, so as to realize automatic acquisition of the scanning target, eliminate the step of manually adding the scanning address, and improve the scanning efficiency of the scanner.

[0084] In one embodiment, the survival detection module 12 specifically includes:

[0085] A request message sending unit, used for starting multiple threads and sending request messages to each of the IP address arrays respectively through the TCP layer 4 protocol;

[0086] The first judgment unit is used to judge whether the addresses corresponding to the IP address arrays are reachable according to the response result of the request message, and if so, judge whether the corresponding hosts are alive.

[0087] In one embodiment, the address combination module 11 specifically includes:

[0088] An IP address selection unit, used for selecting each predefined IP address one by one;

[0089] The combining unit is used to combine each selected IP address with each predefined service port to obtain a plurality of IP address arrays.

[0090] In one embodiment, the output module 15 specifically includes:

[0091] An updating unit, used for updating the scanning times of the array set according to the security scanning times of the hosts corresponding to the IP address array in the array set;

[0092] The network security scanning device 100 further includes:

[0093] A second judgment unit is used to judge whether the scanning number is greater than a preset number, and if so, reset the scanning number of the array set to 0;

[0094] The loop unit is used to loop the steps of performing at least one security scan on the host corresponding to the IP address array in the array set, and outputting the result of the security scan, until receiving an instruction to stop the security scan.

[0095] In one of the embodiments, the security scanning module 14 is specifically used to perform at least one security scan on the host corresponding to the IP address array in the array set in a loop. If the host corresponding to the IP address array has completed the security scan in the previous round of security scan and is not back online, then the security scan of the host corresponding to the corresponding IP address array will not be performed in this loop. If the host corresponding to the IP address array has completed the security scan in the previous round of security scan and is back online, then the security scan of the host corresponding to the corresponding IP address array will be performed in this loop.

[0096] In one embodiment, the security scanning module 14 specifically includes:

[0097] Timing unit, used to start multi-threading and timing tasks;

[0098] The scanning unit is used to perform a security scan on the host corresponding to the IP address array in the array set through the multi-threading when the scheduled task ends.

[0099] The meaning of the above-mentioned "first" and "second" is only to distinguish different objects, and is not used to define which object has a higher priority or other limiting meanings. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The division of modules in this application is only a logical division, and there may be other division methods when implemented in actual applications.

[0100] For the specific definition of the network security scanning device, please refer to the definition of the network security scanning method above, which will not be repeated here. Each module in the above network security scanning device can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0101] In one embodiment, a computer device is provided, which may be a server. The computer device includes a processor, a memory, a network interface, and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a storage medium and an internal memory. The storage medium includes a non-volatile storage medium and / or a volatile storage medium, and the storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the storage medium. The database of the computer device is used to store data involved in a network security scanning method. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a network security scanning method is implemented.

[0102] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a storage medium and an internal memory. The storage medium includes a non-volatile storage medium and / or a volatile storage medium, and the storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the storage medium. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, a network security scanning method is implemented.

[0103] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the network security scanning method in the above embodiment are implemented, such as Figure 2 Steps 101 to 105 and other extensions of the method and related steps are shown. Alternatively, when the processor executes the computer program, the functions of each module / unit of the network security scanning device in the above embodiment are realized, for example Figure 4 The functions of modules 11 to 15 are shown in Figure 1. To avoid repetition, they will not be described here.

[0104] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the computer device, and various interfaces and lines are used to connect various parts of the entire computer device.

[0105] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the computer device by running or executing the computer program and / or module stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, video data, etc.), etc.

[0106] The memory may be integrated into the processor or may be arranged separately from the processor.

[0107] In one embodiment, a computer-readable storage medium is provided on which a computer program is stored. When the computer program is executed by a processor, the steps of the network security scanning method in the above embodiment are implemented, such as Figure 2 Steps 101 to 105 and other extensions of the method and related steps are shown. Alternatively, when the computer program is executed by the processor, the functions of each module / unit of the network security scanning device in the above embodiment are realized, such as Figure 4 The functions of modules 11 to 15 are shown in Figure 1. To avoid repetition, they will not be described here.

[0108] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile and / or volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0109] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0110] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A network security scanning method, characterized in that: The method comprises: Acquire an IP address and a service port from a pre-written configuration file, combine the IP address and the service port to obtain a plurality of IP address arrays, wherein each of the pre-defined IP addresses is selected one by one, and each of the selected IP addresses is respectively combined with each of the pre-defined service ports to obtain a plurality of IP address arrays; Performing host survival detection on the host corresponding to each of the IP address arrays; When the host survival detection is successful, the corresponding IP address array is saved in the array set to be scanned; Perform at least one security scan on the host corresponding to the IP address array in the array set; The IP address array included in the array set is updated according to the result of the security scan, and the result of the security scan is output; The updating of the IP address array included in the array set according to the result of the security scan includes: According to the number of security scans performed on the hosts corresponding to the IP address arrays in the array set, the number of scans of the array set is updated; After performing at least one security scan on the host corresponding to the IP address array in the array set, the method further includes: Determine whether the scanning number is greater than a preset number, and if so, reset the scanning number of the array set to 0; The steps of performing at least one security scan on the hosts corresponding to the IP address array in the array set and outputting the result of the security scan are repeated until an instruction to stop the security scan is received; The performing at least one security scan on the host corresponding to the IP address array in the array set includes: When performing at least one security scan on the hosts corresponding to the IP address arrays in the array set in a loop, if the hosts corresponding to the IP address arrays have completed the security scan in the previous round of security scans and are not back online, then the security scan on the hosts corresponding to the corresponding IP address arrays will not be performed in this loop; if the hosts corresponding to the IP address arrays have completed the security scan in the previous round of security scans and are back online, then the security scan on the hosts corresponding to the corresponding IP address arrays will be performed in this loop; in, Create a map collection. The collection initialization save key is count for the current scan round and lastcount for the previous scan round. The corresponding initial values ​​are all 0. When filtering the scanned address array, check whether the map set has a key of the address value. If not, determine that the address has not been scanned before, and add the address to the address array to be scanned and set the key in the map set to the address value, and the value to the value corresponding to count. If the map set has a key of the address value, get its corresponding value and compare it with the value of lastcount. If they are equal, determine that the address has been scanned in the previous round of scanning tasks. This round of scanning tasks will not repeat the scan and update its corresponding value to the value corresponding to count. If they are not equal, determine that the address has been scanned in the previous round and was not detected by the host survival in the previous round of scanning tasks. Determine that the address is back online, and this round of scanning tasks will rescan it, save the address to the address array to be scanned, and update the corresponding value of the map set to the value corresponding to count; Perform the corresponding scanning operation on the address array to be scanned generated after filtering, and update the values ​​corresponding to count and lastcount in the map set. The value corresponding to lastcount is updated to the value corresponding to count, and the value corresponding to count is incremented by 1. The value of count is judged. If the value of count is greater than or equal to 12, it is determined that the scanning task has been carried out for 12 rounds. The key values ​​in the map set are cleared, and the values ​​corresponding to count and lastcount are reset to 0. In this way, when the scanning task reaches 12 rounds, all addresses detected by the host survival need to be scanned.

2. The network security scanning method according to claim 1, characterized in that: The performing host survival detection on each host corresponding to the IP address array includes: Start multithreading and send request messages to each of the IP address arrays respectively through the TCP layer 4 protocol; It is determined whether the address corresponding to each IP address array is reachable according to the response result of the request message, and if so, it is determined whether the corresponding host is alive.

3. The network security scanning method according to claim 1, characterized in that: Performing at least one security scan on the host corresponding to the IP address array in the array set includes: Enable multithreading and scheduled tasks; When the scheduled task is finished, a security scan is performed on the hosts corresponding to the IP address array in the array set through the multithreading.

4. The network security scanning method according to any one of claims 1 to 3, characterized in that: The types of security scanning include brute force detection, vulnerability scanning, webtitle detection, web fingerprint recognition, and vulnerability exploitation.

5. A network security scanning device, characterized in that: The device comprises: An address combination module, used for obtaining an IP address and a service port from a pre-written configuration file, combining the IP address and the service port to obtain a plurality of IP address arrays, wherein each of the pre-defined IP addresses is selected one by one, and each of the selected IP addresses is respectively combined with each of the pre-defined service ports to obtain a plurality of IP address arrays; A survival detection module, used for performing host survival detection on the host corresponding to each of the IP address arrays; The saving module is used to save the corresponding IP address array in the array set to be scanned when the host survival detection is successful; A security scanning module, used for performing at least one security scan on the host corresponding to the IP address array in the array set; An output module, used to update the IP address array included in the array set according to the result of the security scan, and output the result of the security scan; The output module is further used to update the number of scans of the array set according to the number of security scans performed on the hosts corresponding to the IP address arrays in the array set; determine whether the number of scans is greater than a preset number, and if so, reset the number of scans of the array set to 0; and cyclically perform operations from performing at least one security scan on the hosts corresponding to the IP address arrays in the array set to outputting the results of the security scan until an instruction to stop the security scan is received; The security scanning module is further configured to, when performing at least one security scan on the hosts corresponding to the IP address arrays in the array set in a loop, if the hosts corresponding to the IP address arrays have completed the security scan in the previous round of security scans and are not back online, then the security scan on the hosts corresponding to the corresponding IP address arrays will not be performed in this loop; if the hosts corresponding to the IP address arrays have completed the security scan in the previous round of security scans and are back online, then the security scan on the hosts corresponding to the corresponding IP address arrays will be performed in this loop; The device is also used to Create a map collection. The collection initialization save key is count for the current scan round and lastcount for the previous scan round. The corresponding initial values ​​are all 0. When filtering the scanned address array, check whether the map set has a key of the address value. If not, determine that the address has not been scanned before, and add the address to the address array to be scanned and set the key in the map set to the address value, and the value to the value corresponding to count. If the map set has a key of the address value, get its corresponding value and compare it with the value of lastcount. If they are equal, determine that the address has been scanned in the previous round of scanning tasks. This round of scanning tasks will not repeat the scan and update its corresponding value to the value corresponding to count. If they are not equal, determine that the address has been scanned in the previous round and was not detected by the host survival in the previous round of scanning tasks. Determine that the address is back online, and this round of scanning tasks will rescan it, save the address to the address array to be scanned, and update the corresponding value of the map set to the value corresponding to count; Perform the corresponding scanning operation on the address array to be scanned generated after filtering, and update the values ​​corresponding to count and lastcount in the map set. The value corresponding to lastcount is updated to the value corresponding to count, and the value corresponding to count is incremented by 1. The value of count is judged. If the value of count is greater than or equal to 12, it is determined that the scanning task has been carried out for 12 rounds. The key values ​​in the map set are cleared, and the values ​​corresponding to count and lastcount are reset to 0. In this way, when the scanning task reaches 12 rounds, all addresses detected by the host survival need to be scanned.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the network security scanning method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network security scanning method according to any one of claims 1 to 4 are implemented.

Images