Asset vulnerability static analysis method and device based on intrinsic security

Abstract

The present invention discloses a static analysis method and device for asset vulnerabilities based on intrinsic security, which relates to the field of security detection technology and optimizes the detection and analysis of asset vulnerabilities. The main technical scheme of the present invention is: obtaining asset information corresponding to the asset to be analyzed; searching for the target vulnerability identifier corresponding to the asset information by matching the asset information with the asset identification rules contained in the general platform enumeration CPE, wherein each asset identification rule in the general platform enumeration CPE corresponds to a vulnerability identifier; obtaining the vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base, wherein the target vulnerability knowledge base is obtained by integrating multiple different types of vulnerability knowledge bases, and the target vulnerability knowledge base stores the vulnerability information corresponding to each vulnerability identifier; and statically analyzing the vulnerabilities contained in the asset according to the vulnerability information. The present invention is mainly used to complete static analysis and detection of asset vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the field of security detection technology, and in particular to an asset vulnerability static analysis method and device based on intrinsic security. Background Art

[0002] As an enterprise operates over the years, it will continue to accumulate a large amount of assets, including not only hardware assets, such as equipment, but also soft assets consisting of information or resources that are valuable to the organization, such as websites, business systems, software, services, network resources, etc.

[0003] At present, vulnerability detection based on asset information is the main means of asset maintenance. The commonly used vulnerability detection method is to write scripts to simulate attacks to determine whether a vulnerability exists. However, writing scripts is time-consuming and laborious, and the simulated attack method also requires traversing all asset information. Therefore, this detection method has the problems of low vulnerability scanning efficiency and long time, and poor user experience. Summary of the invention

[0004] In view of this, the present invention provides a static analysis method and device for asset vulnerabilities based on intrinsic security, the main purpose of which is to optimize the detection and analysis of asset vulnerabilities, and solve the problems of low efficiency and poor experience of existing dynamic detection methods.

[0005] The first aspect of the present application provides an asset vulnerability static analysis method based on intrinsic security, the method comprising:

[0006] Obtain asset information corresponding to the asset to be analyzed;

[0007] By matching the asset information with the asset identification rules included in the general platform enumeration CPE, searching for the target vulnerability identifier corresponding to the asset information, each asset identification rule in the general platform enumeration CPE corresponding to a vulnerability identifier;

[0008] Acquire vulnerability information corresponding to the target vulnerability identifier from a target vulnerability knowledge base, wherein the target vulnerability knowledge base is obtained by integrating multiple vulnerability knowledge bases of different types, and the target vulnerability knowledge base stores vulnerability information corresponding to each vulnerability identifier;

[0009] Perform static analysis on the vulnerabilities contained in the assets according to the vulnerability information.

[0010] In some modified implementations of the first aspect of the present application, the step of matching the asset information with an asset identification rule included in the general platform enumeration CPE to find a target vulnerability identifier corresponding to the asset information includes:

[0011] Acquire first attribute information included in the asset information;

[0012] Obtaining second attribute information contained in each asset identification rule in the asset identification rule included in the general platform enumeration CPE;

[0013] determining whether the first attribute information matches the second attribute information;

[0014] If so, obtain the target vulnerability identifier associated with the matching asset identification rule.

[0015] In some modified implementations of the first aspect of the present application, the determining whether the first attribute information matches the second attribute information includes:

[0016] Convert the first attribute information into a character string corresponding to the first attribute;

[0017] The second attribute information is integrated and processed by using a uniform resource identifier, and a character string corresponding to the second attribute is output;

[0018] Determine whether the character string corresponding to the second attribute contains the character string corresponding to the first attribute;

[0019] If so, determining that the first attribute information matches the second attribute information;

[0020] If not, it is determined that the first attribute information does not match the second attribute information.

[0021] In some modified implementations of the first aspect of the present application, before acquiring vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base, the method further includes:

[0022] Acquire multiple vulnerability knowledge bases of different types, each of which contains at least a vulnerability name attribute field;

[0023] Determine the same vulnerabilities and different vulnerabilities contained in a plurality of different types of vulnerability knowledge bases according to the attribute information contained in the vulnerability name attribute field;

[0024] Integrate the attribute information of the same vulnerability from the plurality of vulnerability knowledge bases;

[0025] Acquire attribute information of the different vulnerabilities from the plurality of vulnerability knowledge bases respectively;

[0026] The target vulnerability knowledge base is configured by using a preset database template according to the attribute information of the same vulnerability and the attribute information of the different vulnerabilities.

[0027] In some modified implementations of the first aspect of the present application, the use of a preset database template to configure a target vulnerability knowledge base according to the attribute information of the same vulnerability and the attribute information of the different vulnerabilities includes:

[0028] Parsing the preset attribute fields contained in the preset database template, wherein the preset attribute fields include a plurality of vulnerability identification attribute fields and other attribute fields, and the plurality of vulnerability identification attribute fields are respectively from different vulnerability knowledge bases;

[0029] A target vulnerability knowledge base is generated by filling the attribute information of the same vulnerability and the attribute information of the different vulnerabilities into the multiple vulnerability identification attribute fields and the other attribute fields.

[0030] In some modified implementations of the first aspect of the present application, the vulnerability identifier is represented by a vulnerability number, and the acquiring vulnerability information corresponding to the target vulnerability identifier from a target vulnerability knowledge base includes:

[0031] By traversing the multiple number attribute fields of the target vulnerability knowledge base, determining whether the target vulnerability number corresponding to the asset information is included;

[0032] If so, obtain the vulnerability information corresponding to the target vulnerability number.

[0033] A second aspect of the present application provides an asset vulnerability static analysis device based on intrinsic security, the device comprising:

[0034] A first acquisition unit, used to acquire asset information corresponding to the asset to be analyzed;

[0035] A search unit, configured to search for a target vulnerability identifier corresponding to the asset information by matching the asset information with an asset identification rule included in the general platform enumeration CPE, wherein each asset identification rule in the general platform enumeration CPE corresponds to a vulnerability identifier;

[0036] A second acquisition unit is used to acquire vulnerability information corresponding to the target vulnerability identifier from a target vulnerability knowledge base, wherein the target vulnerability knowledge base is obtained by integrating multiple vulnerability knowledge bases of different types, and the target vulnerability knowledge base stores vulnerability information corresponding to each vulnerability identifier;

[0037] An execution unit is used to perform static analysis on the vulnerabilities contained in the assets according to the vulnerability information.

[0038] In some modified implementations of the second aspect of the present application, the search unit includes:

[0039] An acquisition module, used for acquiring first attribute information included in the asset information;

[0040] The acquisition module is further used to acquire the second attribute information contained in each asset identification rule in the asset identification rule included in the CPE enumeration by the general platform;

[0041] A judging module, used to judge whether the first attribute information matches the second attribute information;

[0042] The acquisition module is further configured to acquire a target vulnerability identifier associated with a matching asset identification rule when it is determined that the first attribute information matches the second attribute information.

[0043] In some modified implementations of the second aspect of the present application, the judgment module includes:

[0044] A conversion submodule, used for converting the first attribute information into a character string corresponding to the first attribute;

[0045] A processing submodule, used for integrating the second attribute information using a uniform resource identifier, and outputting a character string corresponding to the second attribute;

[0046] A judging submodule, used to judge whether the character string corresponding to the second attribute contains the character string corresponding to the first attribute;

[0047] a determination submodule, configured to determine that the first attribute information matches the second attribute information when it is determined that the character string corresponding to the second attribute contains the character string corresponding to the first attribute;

[0048] The determining submodule is further configured to determine that the first attribute information does not match the second attribute information when it is determined that the character string corresponding to the second attribute does not include the character string corresponding to the first attribute.

[0049] In some modified implementations of the second aspect of the present application, the device further includes:

[0050] A third acquisition unit is used to acquire a plurality of vulnerability knowledge bases of different types, each of which contains at least a vulnerability name attribute field;

[0051] A determination unit, configured to determine the same vulnerabilities and different vulnerabilities contained in a plurality of different types of vulnerability knowledge bases according to the attribute information contained in the vulnerability name attribute field;

[0052] A processing unit, used for integrating attribute information of the same vulnerability from a plurality of vulnerability knowledge bases;

[0053] A fourth acquisition unit, used to respectively acquire attribute information of the different vulnerabilities from the plurality of vulnerability knowledge bases;

[0054] The configuration unit is used to configure the target vulnerability knowledge base according to the attribute information of the same vulnerability and the attribute information of the different vulnerabilities by using a preset database template.

[0055] In some modified implementations of the second aspect of the present application, the configuration unit includes:

[0056] A parsing module, used for parsing the preset attribute fields contained in the preset database template, wherein the preset attribute fields include a plurality of vulnerability identification attribute fields and other attribute fields, and the plurality of vulnerability identification attribute fields are respectively from different vulnerability knowledge bases;

[0057] The generating module is used to generate a target vulnerability knowledge base by filling the attribute information of the same vulnerability and the attribute information of the different vulnerabilities into the multiple vulnerability identification attribute fields and the other attribute fields.

[0058] In some modified implementations of the second aspect of the present application, the vulnerability identifier is represented by a vulnerability number, and the second acquisition unit includes:

[0059] A judgment module, configured to judge whether the target vulnerability number corresponding to the asset information is included by traversing the multiple number attribute fields of the target vulnerability knowledge base;

[0060] The acquisition module is used to acquire vulnerability information corresponding to the target vulnerability number when it is determined that the asset information contains the target vulnerability number corresponding to the asset information.

[0061] A third aspect of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the asset vulnerability static analysis method based on intrinsic security as described above is implemented.

[0062] The fourth aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the asset vulnerability static analysis method based on intrinsic security as described above is implemented.

[0063] By means of the above technical solution, the technical solution provided by the present invention has at least the following advantages:

[0064] The present invention provides a method and device for static analysis of asset vulnerabilities based on intrinsic security. The present invention uses the asset information corresponding to the asset to be analyzed to match the asset identification rules contained in the general platform enumeration CPE, searches for the target vulnerability identifier corresponding to the asset information, and then obtains the vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base. The vulnerability information is equivalent to the potential risk information corresponding to the asset, so as to use such vulnerability information to perform static analysis on the vulnerabilities contained in the asset, which is equivalent to using a static analysis method to complete the vulnerability detection of the asset. Compared with the prior art, the present invention does not need to write a script program, but uses the search and matching operations performed by the general platform enumeration CPE and the target vulnerability knowledge base respectively, with low processing cost and high efficiency, which solves the problems of low efficiency and poor experience of the existing dynamic detection method. The present invention can improve the efficiency of asset vulnerability detection and is more convenient for users to analyze asset vulnerabilities.

[0065] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0067] Figure 1 A flow chart of a static analysis method for asset vulnerabilities based on intrinsic security provided by an embodiment of the present invention;

[0068] Figure 2 A flowchart of another method for static analysis of asset vulnerabilities based on intrinsic security provided by an embodiment of the present invention;

[0069] Figure 3 A block diagram of a static analysis device for asset vulnerabilities based on intrinsic security provided by an embodiment of the present invention;

[0070] Figure 4 A block diagram of another device for static analysis of asset vulnerabilities based on intrinsic security provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0071] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0072] The embodiment of the present invention provides a static analysis method of asset vulnerabilities based on intrinsic security, such as Figure 1 As shown, the method uses a static method to detect and analyze asset vulnerabilities, and the embodiment of the present invention provides the following specific steps:

[0073] 101. Obtain asset information corresponding to the asset to be analyzed.

[0074] In the embodiment of the present invention, assets include hardware assets and soft assets. Hardware assets include equipment, and soft assets include websites, business systems, software, services, network resources, etc. Asset information is the attribute information of assets. Furthermore, based on different asset types, the attribute information contained in asset information is also different. For example, if the asset type is "software application", the attribute information of the asset information of this asset type may include, but is not limited to: name attribute information, language item attribute information, version number attribute information, update package attribute information, etc.

[0075] 102. By matching the asset information with the asset identification rules included in the general platform enumeration CPE, the target vulnerability identifier corresponding to the asset information is found.

[0076] Among them, Common Platform Enumeration (CPE) is a standardized method for describing and identifying software, operating systems, and hardware devices in enterprise assets. Common Platform Enumeration CPE contains multiple asset identification rules, each of which contains a pre-added asset type and preset attribute information contained in the asset type, and each asset identification rule corresponds to a vulnerability identifier, which can be but is not limited to a vulnerability number.

[0077] Therefore, for the embodiments of the present invention, the asset information is matched with the asset identification rules contained in the general platform enumeration CPE, that is, the attribute information contained in the asset information is compared with the attribute information in each asset identification rule, and then it is determined which CPE rule the asset information matches, and then the target vulnerability identifier corresponding to the asset information is determined based on the vulnerability identifier associated with the CPE rule.

[0078] 103. Obtain vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base.

[0079] The target vulnerability knowledge base is obtained by integrating multiple vulnerability knowledge bases of different types, and the target vulnerability knowledge base stores vulnerability information corresponding to each vulnerability identifier.

[0080] In an embodiment of the present invention, the target vulnerability identifier corresponding to the asset information determined in step 102 may be compared with each vulnerability identifier in the target vulnerability knowledge base. If the same vulnerability identifier is found, the corresponding vulnerability information may be further obtained from the target vulnerability knowledge base based on the target vulnerability identifier.

[0081] 104. Perform static analysis on the vulnerabilities contained in the assets based on the vulnerability information.

[0082] In an embodiment of the present invention, the vulnerability information corresponding to the asset information obtained in step 103 is equivalent to the potential risk information corresponding to the asset. Based on the potential risk information, static detection and analysis of the vulnerabilities contained in the assets can complete the asset vulnerability detection operation in a targeted and efficient manner.

[0083] The embodiment of the present invention provides a static analysis method for asset vulnerabilities based on intrinsic security. The embodiment of the present invention uses the asset information corresponding to the asset to be analyzed to match the asset identification rules contained in the general platform enumeration CPE, searches for the target vulnerability identifier corresponding to the asset information, and then obtains the vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base. The vulnerability information is equivalent to the potential risk information corresponding to the asset, so as to use such vulnerability information to perform static analysis on the vulnerabilities contained in the asset, which is equivalent to using a static analysis method to complete the vulnerability detection of the asset. Compared with the prior art, the embodiment of the present invention does not need to write a script program, but uses the search and matching operations performed by the general platform enumeration CPE and the target vulnerability knowledge base respectively, with low processing cost and high efficiency, which solves the problems of low efficiency and poor experience of the existing dynamic detection method. The embodiment of the present invention can improve the efficiency of asset vulnerability detection and is more convenient for users to analyze asset vulnerabilities.

[0084] In order to explain the above embodiment in more detail, the embodiment of the present invention also provides another static analysis method of asset vulnerabilities based on intrinsic security, such as Figure 2 As shown, this method is a detailed explanation of the above embodiment, and this embodiment of the present invention provides the following specific steps:

[0085] 201. Obtain multiple vulnerability knowledge bases of different types, each vulnerability knowledge base at least including a vulnerability name attribute field.

[0086] In an embodiment of the present invention, multiple different types of vulnerability knowledge bases may include: CVE vulnerability base, CNNVD vulnerability base, etc. Different types of vulnerability knowledge bases may include multiple attribute fields, and the common feature of these attribute fields is that they at least include a vulnerability identification attribute field and a vulnerability name attribute field.

[0087] 202. Determine the same vulnerabilities and different vulnerabilities included in multiple different types of vulnerability knowledge bases based on the attribute information included in the vulnerability name attribute field.

[0088] For the embodiments of the present invention, different types of vulnerability knowledge bases are maintained by different organizations, and the vulnerability information they focus on may be different. Therefore, similar situations may occur: the types of vulnerabilities maintained in different types of vulnerability knowledge bases may be different, and the vulnerability information maintained for the same type of vulnerability may be different.

[0089] Therefore, the embodiment of the present invention can determine the same vulnerabilities and different vulnerabilities contained in multiple different types of vulnerability knowledge bases based on the attribute information contained in the vulnerability name attribute field, and use it as the basic data for integration, so as to subsequently establish a more comprehensive standardized vulnerability knowledge base covering these different types of vulnerability knowledge bases.

[0090] 203. Integrate the attribute information of the same vulnerability from multiple vulnerability knowledge bases.

[0091] 204. Obtain attribute information of different vulnerabilities from multiple vulnerability knowledge bases.

[0092] In the embodiment of the present invention, with respect to these different types of vulnerability knowledge bases, the method for integrating the same vulnerability is to integrate the attribute information of the same vulnerability, and the method for integrating different vulnerabilities is to obtain the attribute information of different vulnerabilities.

[0093] 205. Using the preset database template, configure the target vulnerability knowledge base according to the attribute information of the same vulnerability and the attribute information of different vulnerabilities.

[0094] In the embodiment of the present invention, the same vulnerabilities and different vulnerabilities from different types of vulnerability knowledge bases are integrated into a standardized vulnerability knowledge base. Specifically, a preset database template can be used to implement the establishment of the standardized vulnerability knowledge base. The specific explanation is as follows:

[0095] First, the preset attribute fields contained in the preset database template are parsed, and the preset attribute fields include a plurality of vulnerability identification attribute fields and other attribute fields, and the plurality of vulnerability identification attribute fields are respectively from different vulnerability knowledge bases.

[0096] Secondly, a target vulnerability knowledge base is generated by filling the attribute information of the same vulnerability and the attribute information of different vulnerabilities into multiple vulnerability identification attribute fields and other attribute fields.

[0097] In the embodiment of the present invention, with regard to different vulnerability knowledge bases, their biggest commonality is that they all have vulnerability identification attribute fields and vulnerability name attribute fields. According to some vulnerability generalization standards, the names of the same vulnerabilities are generally standardized (i.e., the names are the same due to unified standards).

[0098] Therefore, for the target vulnerability knowledge base to be established, the first thing to consider is that the attribute fields that should be included are the vulnerability identification attribute field and the vulnerability name attribute field. Since the names of the same vulnerabilities are standardized, the newly created target vulnerability knowledge base can contain a vulnerability name attribute field and multiple vulnerability identification attribute fields. These multiple vulnerability identification attribute fields come from other different vulnerability knowledge bases, and further, a vulnerability identification attribute field of the target vulnerability knowledge base can be established in the target vulnerability knowledge base. The attribute information in this field can come from the vulnerability identification attribute fields of the other different types of vulnerability knowledge bases mentioned above, and priority is given to obtaining attribute information from the vulnerability identification attribute field in the vulnerability knowledge base with the highest priority among other different types of vulnerability knowledge bases.

[0099] As described above, based on the considerations for establishing the target vulnerability knowledge base, a database template can be pre-established to meet this requirement, and then the database template can be used to efficiently complete the construction of the standardized vulnerability knowledge base.

[0100] It should be noted that, in the embodiment of the present invention, it is necessary to regularly supplement or update the established preset vulnerability knowledge base so as to subsequently provide more comprehensive and accurate auxiliary vulnerability information search operations to avoid missed detection and missed reporting of vulnerability information.

[0101] According to the embodiment of the present invention, a target vulnerability knowledge base is established by integrating multiple different vulnerability knowledge bases, and a more comprehensive vulnerability knowledge base is constructed as a data set for vulnerability static analysis detection, thereby improving the coverage of vulnerability detection.

[0102] For example, for the established target vulnerability knowledge base, some attribute fields are listed in Table 1 below:

[0103]

[0104]

[0105] 206. Obtain asset information corresponding to the asset to be analyzed.

[0106] In the embodiment of the present invention, the explanation of this step is shown in step 101, which will not be repeated here.

[0107] 207. The target vulnerability identifier corresponding to the asset information is found by matching the asset information with the asset identification rules included in the general platform enumeration CPE, where each asset identification rule in the general platform enumeration CPE corresponds to a vulnerability identifier.

[0108] In the embodiment of the present invention, this step can be further detailed and explained as follows:

[0109] First, obtain the first attribute information contained in the asset information.

[0110] For example, if the asset type is "ios operating system", then the asset information it has may include: the manufacturer is cisco, the name is ios, the version number is 12.2(50)sg5, etc. These information are actually the attribute information of the asset information. In order to distinguish them from other attribute information mentioned in the embodiment of the present invention, they are marked as the first attribute information.

[0111] Next, the second attribute information included in each asset identification rule in the asset identification rules included in the general platform enumeration CPE is obtained.

[0112] Common Platform Enumeration (CPE) is a standardized method for describing and identifying the software, operating systems, and hardware devices present in an enterprise's computing assets.

[0113] Among them, the general platform enumeration CPE includes multiple asset identification rules, each asset identification rule includes a pre-added asset type and preset attribute information contained in the asset type, and each asset identification rule corresponds to a vulnerability identifier, which can be but is not limited to a vulnerability number.

[0114] Furthermore, it is determined whether the first attribute information matches the second attribute information. If so, a target vulnerability identifier associated with the matching asset identification rule is obtained.

[0115] Furthermore, a string comparison method may be used to determine whether the first attribute information matches the second attribute information. The specific explanation is as follows:

[0116] First, for the asset information to be detected, the first attribute information is converted into a character string corresponding to the first attribute.

[0117] Second, for the asset identification rule, the second attribute information is integrated and processed using a uniform resource identifier, and a character string corresponding to the second attribute is output.

[0118] In the embodiment of the present invention, for the asset identification rule, the Uniform Resource Identifier (URI) syntax adopted is as follows:

[0119] cpe: / <part> : <vendor> : <product> : <version> : <update> : <edition> : <language>Among them, the various attributes contained in this syntax are introduced:

[0120] part indicates the target type. The allowed values ​​are a (application), h (hardware platform), and o (operating system).

[0121] vendor indicates the vendor information of the asset;

[0122] product indicates the asset name;

[0123] version indicates the asset version number;

[0124] update means update package;

[0125] edition indicates the version;

[0126] language represents a language item.

[0127] Third, determine whether the character string corresponding to the second attribute contains the character string corresponding to the first attribute; if so, determine that the first attribute information matches the second attribute information; if not, determine that the first attribute information does not match the second attribute information.

[0128] 208. Obtain vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base.

[0129] By traversing multiple vulnerability identification attribute fields of the target vulnerability knowledge base, it is determined whether the target vulnerability identification corresponding to the asset information is included, and if so, the vulnerability information corresponding to the target vulnerability identification is obtained. Specifically, in the embodiment of the present invention, the vulnerability identification can be represented by a vulnerability number.

[0130] 209. Perform static analysis on the vulnerabilities contained in the assets based on the vulnerability information.

[0131] In the embodiment of the present invention, for the asset information to be detected, the general platform is used to enumerate CPE and search the target vulnerability knowledge base to find vulnerability information, which is equivalent to predicting the vulnerability information that may exist in the asset, that is, potential risk information. Then, by using such vulnerability information to perform static analysis on the vulnerabilities contained in the asset, the vulnerability detection operation of the asset can be completed in a targeted and efficient manner.

[0132] Furthermore, in an embodiment of the present invention, the universal human-computer interaction interface can display asset information corresponding to a variety of vulnerability information and the associations between them.

[0133] Furthermore, as a response to the above Figure 1 , Figure 2 The implementation of the method shown in the figure, the embodiment of the present invention provides an asset vulnerability static analysis device based on intrinsic security. The device embodiment corresponds to the aforementioned method embodiment. For ease of reading, the device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. The device is used to complete the static analysis detection of asset vulnerabilities, specifically as follows Figure 3 As shown, the device comprises:

[0134] A first acquisition unit 31 is used to acquire asset information corresponding to the asset to be analyzed;

[0135] A search unit 32, configured to search for a target vulnerability identifier corresponding to the asset information by matching the asset information with an asset identification rule included in the general platform enumeration CPE, wherein each asset identification rule in the general platform enumeration CPE corresponds to a vulnerability identifier;

[0136] A second acquisition unit 33 is used to acquire vulnerability information corresponding to the target vulnerability identifier from a target vulnerability knowledge base, wherein the target vulnerability knowledge base is obtained by integrating multiple vulnerability knowledge bases of different types, and the target vulnerability knowledge base stores vulnerability information corresponding to each vulnerability identifier;

[0137] The execution unit 34 is used to perform static analysis on the vulnerabilities contained in the assets according to the vulnerability information.

[0138] Further, such as Figure 4 As shown, the search unit 32 includes:

[0139] An acquisition module 321 is used to acquire first attribute information included in the asset information;

[0140] The acquisition module 321 is further used to acquire the second attribute information contained in each asset identification rule in the asset identification rule included in the general platform enumeration CPE;

[0141] A judging module 322, configured to judge whether the first attribute information matches the second attribute information;

[0142] The acquisition module 321 is further configured to acquire a target vulnerability identifier associated with a matching asset identification rule when it is determined that the first attribute information matches the second attribute information.

[0143] Further, such as Figure 4 As shown, the judging module 322 includes:

[0144] A conversion submodule 3221, configured to convert the first attribute information into a character string corresponding to the first attribute;

[0145] The processing submodule 3222 is used to integrate the second attribute information using a uniform resource identifier and output a character string corresponding to the second attribute;

[0146] A judging submodule 3223, used to judge whether the character string corresponding to the second attribute contains the character string corresponding to the first attribute;

[0147] A determination submodule 3224, configured to determine that the first attribute information matches the second attribute information when it is determined that the character string corresponding to the second attribute includes the character string corresponding to the first attribute;

[0148] The determining submodule 3224 is further configured to determine that the first attribute information does not match the second attribute information when it is determined that the character string corresponding to the second attribute does not include the character string corresponding to the first attribute.

[0149] Further, such as Figure 4 As shown, the device also includes:

[0150] A third acquisition unit 35 is used to acquire a plurality of vulnerability knowledge bases of different types, each of which contains at least a vulnerability name attribute field;

[0151] A determination unit 36, configured to determine the same vulnerabilities and different vulnerabilities contained in a plurality of different types of vulnerability knowledge bases according to the attribute information contained in the vulnerability name attribute field;

[0152] A processing unit 37, configured to integrate attribute information of the same vulnerability from the plurality of vulnerability knowledge bases;

[0153] A fourth acquisition unit 38, configured to respectively acquire attribute information of the different vulnerabilities from the plurality of vulnerability knowledge bases;

[0154] The configuration unit 39 is used to configure the target vulnerability knowledge base according to the attribute information of the same vulnerability and the attribute information of the different vulnerabilities by using a preset database template.

[0155] Further, such as Figure 4 As shown, the configuration unit 39 includes:

[0156] A parsing module 391, used for parsing the preset attribute fields contained in the preset database template, wherein the preset attribute fields include a plurality of vulnerability identification attribute fields and other attribute fields, and the plurality of vulnerability identification attribute fields are respectively from different vulnerability knowledge bases;

[0157] The generating module 392 is used to generate a target vulnerability knowledge base by filling the attribute information of the same vulnerability and the attribute information of the different vulnerabilities into the multiple vulnerability identification attribute fields and the other attribute fields.

[0158] Further, such as Figure 4 As shown, the vulnerability identifier is represented by a vulnerability number, and the second acquisition unit 33 includes:

[0159] A judgment module 331 is used to judge whether the target vulnerability number corresponding to the asset information is included by traversing the multiple number attribute fields of the target vulnerability knowledge base;

[0160] The acquisition module 332 is used to acquire the vulnerability information corresponding to the target vulnerability number when it is determined that the asset information contains the target vulnerability number corresponding to the asset information.

[0161] In summary, the embodiment of the present invention provides a method and device for static analysis of asset vulnerabilities based on intrinsic security. The embodiment of the present invention uses the asset information corresponding to the asset to be analyzed to match the asset identification rules contained in the general platform enumeration CPE, searches for the target vulnerability identifier corresponding to the asset information, and then obtains the vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base. The vulnerability information is equivalent to the potential risk information corresponding to the asset, so as to use such vulnerability information to perform static analysis on the vulnerabilities contained in the asset, which is equivalent to using a static analysis method to complete the vulnerability detection of the asset. Compared with the prior art, the embodiment of the present invention does not need to write a script program, but uses the search and matching operations performed by the general platform enumeration CPE and the target vulnerability knowledge base respectively, with low processing cost and high efficiency, which solves the problems of low efficiency and poor experience of the existing dynamic detection method. The embodiment of the present invention can improve the efficiency of asset vulnerability detection and is more convenient for users to analyze asset vulnerabilities.

[0162] The asset vulnerability static analysis device based on intrinsic security includes a processor and a memory. The above-mentioned first acquisition unit, search unit, second acquisition unit and execution unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to implement corresponding functions.

[0163] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the detection and analysis of asset vulnerabilities can be optimized by adjusting kernel parameters, solving the problems of low efficiency and poor experience of existing dynamic detection methods.

[0164] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the asset vulnerability static analysis method based on intrinsic security as described above is implemented.

[0165] An embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned static analysis method for asset vulnerabilities based on intrinsic security when executing the computer program.

[0166] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0167] In a typical configuration, the device includes one or more processors (CPU), memory and bus. The device may also include input / output interface, network interface and the like.

[0168] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0169] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0170] It should also be noted that the term "includes", "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the existence of other identical elements in the process, method, commodity or device including the element.

[0171] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0172] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent insertion, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.< / language> < / edition> < / update> < / version> < / product> < / vendor> < / part>

Claims

1. A static analysis method for asset vulnerabilities based on intrinsic security, characterized in that: The method comprises: Obtain asset information corresponding to the asset to be analyzed; By matching the asset information with the asset identification rules included in the general platform enumeration CPE, searching for the target vulnerability identifier corresponding to the asset information, each asset identification rule in the general platform enumeration CPE corresponding to a vulnerability identifier; Acquire vulnerability information corresponding to the target vulnerability identifier from a target vulnerability knowledge base, wherein the target vulnerability knowledge base is obtained by integrating multiple vulnerability knowledge bases of different types, and the target vulnerability knowledge base stores vulnerability information corresponding to each vulnerability identifier; Wherein, before acquiring the vulnerability information corresponding to the target vulnerability identifier from the target vulnerability knowledge base, the method further includes: acquiring a plurality of vulnerability knowledge bases of different types, each of the vulnerability knowledge bases at least including a vulnerability name attribute field; determining the same vulnerabilities and different vulnerabilities included in a plurality of different types of vulnerability knowledge bases according to the attribute information included in the vulnerability name attribute field; integrating the attribute information of the same vulnerability from the plurality of vulnerability knowledge bases; respectively acquiring the attribute information of the different vulnerabilities from the plurality of vulnerability knowledge bases; configuring the target vulnerability knowledge base according to the attribute information of the same vulnerability and the attribute information of the different vulnerabilities using a preset database template; Perform static analysis on the vulnerabilities contained in the assets according to the vulnerability information.

2. The method according to claim 1, characterized in that The step of searching for a target vulnerability identifier corresponding to the asset information by matching the asset information with an asset identification rule included in the general platform enumeration CPE includes: Acquire first attribute information included in the asset information; Obtaining second attribute information contained in each asset identification rule in the asset identification rule included in the general platform enumeration CPE; determining whether the first attribute information matches the second attribute information; If so, obtain the target vulnerability identifier associated with the matching asset identification rule.

3. The method according to claim 2, characterized in that The determining whether the first attribute information matches the second attribute information includes: Convert the first attribute information into a character string corresponding to the first attribute; The second attribute information is integrated and processed by using a uniform resource identifier, and a character string corresponding to the second attribute is output; Determine whether the character string corresponding to the second attribute contains the character string corresponding to the first attribute; If so, determining that the first attribute information matches the second attribute information; If not, it is determined that the first attribute information does not match the second attribute information.

4. The method according to claim 1, characterized in that: The using of the preset database template to configure the target vulnerability knowledge base according to the attribute information of the same vulnerability and the attribute information of the different vulnerabilities includes: Parsing the preset attribute fields contained in the preset database template, wherein the preset attribute fields include a plurality of vulnerability identification attribute fields and other attribute fields, and the plurality of vulnerability identification attribute fields are respectively from different vulnerability knowledge bases; A target vulnerability knowledge base is generated by filling the attribute information of the same vulnerability and the attribute information of the different vulnerabilities into the multiple vulnerability identification attribute fields and the other attribute fields.

5. The method according to claim 4, characterized in that The vulnerability identifier is represented by a vulnerability number, and obtaining vulnerability information corresponding to the target vulnerability identifier from a target vulnerability knowledge base includes: By traversing the multiple number attribute fields of the target vulnerability knowledge base, determining whether the target vulnerability number corresponding to the asset information is included; If so, obtain the vulnerability information corresponding to the target vulnerability number.

6. An asset vulnerability static analysis device based on intrinsic security, characterized in that: The device comprises: A third acquisition unit is used to acquire a plurality of vulnerability knowledge bases of different types, each of which contains at least a vulnerability name attribute field; A determination unit, configured to determine the same vulnerabilities and different vulnerabilities contained in a plurality of different types of vulnerability knowledge bases according to the attribute information contained in the vulnerability name attribute field; A processing unit, used for integrating attribute information of the same vulnerability from a plurality of vulnerability knowledge bases; A fourth acquisition unit, used to respectively acquire attribute information of the different vulnerabilities from the plurality of vulnerability knowledge bases; A configuration unit, configured to configure a target vulnerability knowledge base according to the attribute information of the same vulnerability and the attribute information of the different vulnerabilities by using a preset database template; A first acquisition unit, used to acquire asset information corresponding to the asset to be analyzed; A search unit, configured to search for a target vulnerability identifier corresponding to the asset information by matching the asset information with an asset identification rule included in the general platform enumeration CPE, wherein each asset identification rule in the general platform enumeration CPE corresponds to a vulnerability identifier; A second acquisition unit is used to acquire vulnerability information corresponding to the target vulnerability identifier from a target vulnerability knowledge base, wherein the target vulnerability knowledge base is obtained by integrating multiple vulnerability knowledge bases of different types, and the target vulnerability knowledge base stores vulnerability information corresponding to each vulnerability identifier; An execution unit is used to perform static analysis on the vulnerabilities contained in the assets according to the vulnerability information.

7. The device according to claim 6, characterized in that The search unit comprises: An acquisition module, used for acquiring first attribute information included in the asset information; The acquisition module is further used to acquire the second attribute information contained in each asset identification rule in the asset identification rule included in the CPE enumeration by the general platform; A judging module, used to judge whether the first attribute information matches the second attribute information; The acquisition module is further configured to acquire a target vulnerability identifier associated with a matching asset identification rule when it is determined that the first attribute information matches the second attribute information.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for static analysis of asset vulnerabilities based on intrinsic security according to any one of claims 1 to 5 is implemented.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the asset vulnerability static analysis method based on intrinsic security as described in any one of claims 1 to 5 when executing the computer program.

Images