A security protection capability detection system, method, device, equipment and medium

Abstract

The present invention discloses a security protection capability detection system, method, device, equipment and medium, a vulnerability scanning module, used to send a vulnerability scanning task to an escape scheduling module, the vulnerability scanning task carries vulnerability identification information to be scanned; the escape scheduling module is used to obtain an escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module; the vulnerability scanning module is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted scanning message to the target side device through the security protection device; and receive the feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result. Thus, a technical solution capable of detecting the security protection capability of the security protection device is realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security protection capability detection system, method, device, equipment and medium. Background Art

[0002] Vulnerability scanning refers to the detection of security vulnerabilities of target assets through scanning and other means based on the vulnerability database. The target assets are, for example, designated remote or local computer systems. Vulnerability scanning is a security detection behavior that discovers exploitable vulnerabilities, or is called a penetration attack behavior.

[0003] Traditional vulnerability scanning is used to assess the vulnerability of target assets. By detecting vulnerability instances of the target, quantitative risk assessment and related reports are provided as evidence of asset external risk compliance. In the current network environment, in order to protect valuable assets, most of them are deployed with various security protection devices, such as firewalls, website application-level intrusion prevention systems WAF, IDPS, etc. Assets are deployed behind these security devices. The protection effect of these security devices can change the results of external risk compliance, which is a way to circumvent vulnerability repair and is crucial for asset vulnerability compliance.

[0004] The existing vulnerability scanning technology solution is to directly scan assets and report vulnerabilities. The target of the scanning process is the final asset, and the task configuration only contains a vulnerability list or template. The problem with the existing technology is that it cannot test the effectiveness of security protection. At present, there is an urgent need for a technical solution that can detect the security protection capabilities of security protection equipment. Summary of the invention

[0005] Embodiments of the present invention provide a security protection capability detection system, method, apparatus, equipment and medium, which are used to provide a technical solution capable of detecting the security protection capability of security protection equipment.

[0006] The embodiment of the present invention provides a security protection capability detection system, the system comprising: a scanning source device, a security protection device and a target side device; the scanning source device comprises a vulnerability scanning module and an escape scheduling module;

[0007] A vulnerability scanning module, used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned;

[0008] The escape scheduling module is used to obtain the escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module;

[0009] The vulnerability scanning module is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the target side device through the security protection device; and receive the feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result.

[0010] Furthermore, the scanning source device also includes an escape technology interface library;

[0011] The escape scheduling module is specifically used to obtain the escape technology interface corresponding to the vulnerability to be scanned from the escape technology interface library according to the vulnerability identification information to be scanned.

[0012] Furthermore, the scanning source device also includes a policy server;

[0013] The escape scheduling module is further configured to send an escape strategy negotiation instruction to the policy server if it is determined that the vulnerability to be scanned does not support escape technology self-negotiation;

[0014] The policy server is used to configure the escape strategy for the target side device according to the escape strategy negotiation instruction, and respond to the vulnerability scanning module with a configuration completion instruction after the configuration is completed;

[0015] The vulnerability scanning module is also used to, when receiving the configuration completion instruction, use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the target side device through the security protection device.

[0016] Further, the target side device includes an escape strategy client and an asset target;

[0017] The policy server is specifically configured to send the escape policy negotiation instruction to the escape policy client;

[0018] The escape strategy client is used to configure the escape strategy for the asset target according to the escape strategy negotiation instruction.

[0019] Further, the target side device includes an asset target library;

[0020] The vulnerability scanning module is further used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library;

[0021] The escape scheduling module is used to obtain the escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module;

[0022] The vulnerability scanning module is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the asset target library in the target side device through the security protection device; and receive the feedback result of the asset target library response, and determine the security protection capability of the security protection device according to the feedback result.

[0023] On the other hand, an embodiment of the present invention provides a security protection capability detection method, the method comprising:

[0024] Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned;

[0025] Receiving the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module;

[0026] The escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the target side device through the security protection device;

[0027] Receive a feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result.

[0028] Furthermore, after sending the vulnerability scanning task to the escape scheduling module, the escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and before the scanning message after the transmission processing is sent to the target side device through the security protection device, the method also includes:

[0029] After receiving the configuration completion instruction, the escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the transmitted scanning message is sent to the target side device through the security protection device; wherein, the configuration completion instruction is that the escape scheduling module determines that the vulnerability to be scanned does not support escape technology self-negotiation, and sends an escape policy negotiation instruction to the policy server; the policy server configures the escape strategy of the target side device according to the escape strategy negotiation instruction, and responds to the vulnerability scanning module after the configuration is completed.

[0030] Furthermore, it specifically includes:

[0031] Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library;

[0032] Receiving the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module;

[0033] The escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the asset target library in the target side device through the security protection device; and the feedback result of the asset target library response is received, and the security protection capability of the security protection device is determined according to the feedback result.

[0034] In another aspect, an embodiment of the present invention provides a security protection capability detection device, the device comprising:

[0035] A sending unit, used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned;

[0036] A receiving unit, configured to receive an escape technology interface corresponding to the vulnerability to be scanned and sent by the escape scheduling module;

[0037] A processing unit, used to use the escape technology interface to perform transmission processing on the scanning message corresponding to the vulnerability to be scanned, and send the scanning message after transmission processing to the target side device through the security protection device;

[0038] The detection unit is used to receive the feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result.

[0039] The processing unit is also used to, after receiving a configuration completion instruction, use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the target side device through the security protection device; wherein, the configuration completion instruction is that the escape scheduling module determines that the vulnerability to be scanned does not support escape technology self-negotiation, and sends an escape policy negotiation instruction to the policy server; the policy server configures the escape strategy of the target side device according to the escape strategy negotiation instruction, and responds to the vulnerability scanning module after the configuration is completed.

[0040] A sending unit, specifically used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library;

[0041] A receiving unit, specifically used to receive the escape technology interface corresponding to the vulnerability to be scanned, sent by the escape scheduling module;

[0042] A processing unit, specifically used to use the escape technology interface to perform transmission processing on the scanning message corresponding to the vulnerability to be scanned, and send the scanning message after transmission processing to the asset target library in the target side device through the security protection device;

[0043] The detection unit is specifically used to receive the feedback result of the asset target library response, and determine the security protection capability of the security protection device according to the feedback result.

[0044] In another aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0045] Memory, used to store computer programs;

[0046] The processor is used to implement any of the method steps described above when executing the program stored in the memory.

[0047] On the other hand, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of the above are implemented.

[0048] The embodiments of the present invention provide a security protection capability detection system, method, apparatus, equipment and medium, wherein the system comprises: a scanning source device, a security protection device and a target side device; the scanning source device comprises a vulnerability scanning module and an escape scheduling module; the vulnerability scanning module is used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned; the escape scheduling module is used to obtain an escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module; the vulnerability scanning module is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted scanning message to the target side device through the security protection device; and receive the feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result.

[0049] The above technical solution has the following advantages or beneficial effects:

[0050] Since in the embodiment of the present invention, the vulnerability scanning module sends a vulnerability scanning task to the escape scheduling module, and the vulnerability scanning task carries the vulnerability identification information to be scanned, the escape scheduling module obtains the escape technology interface corresponding to the vulnerability to be scanned, and sends the escape technology interface to the vulnerability scanning module. The vulnerability scanning module uses the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the target side device through the security protection device; finally, the security protection capability of the security protection device is received and determined according to the feedback result of the target side device response. Thus, a technical solution capable of detecting the security protection capability of the security protection device is realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 A schematic diagram of the structure of a security protection capability detection system provided in Example 1 of the present invention;

[0053] Figure 2 A schematic diagram of another security protection capability detection system structure provided in Example 1 of the present invention;

[0054] Figure 3 A schematic diagram of the structure of a security protection capability detection system provided in Example 2 of the present invention;

[0055] Figure 4 A schematic diagram of the structure of another security protection capability detection system provided in Example 2 of the present invention;

[0056] Figure 5 A schematic diagram of the structure of a security protection capability detection system provided in Example 3 of the present invention;

[0057] Figure 6 A framework diagram of a security protection capability detection system provided in Example 3 of the present invention;

[0058] Figure 7 A schematic diagram of a security protection capability detection process provided in Example 4 of the present invention;

[0059] Figure 8 A security protection capability detection timing diagram provided in Example 4 of the present invention;

[0060] Fig. 9 Another security protection capability detection timing diagram provided by Embodiment 4 of the present invention;

[0061] Fig.10 Another security protection capability detection timing diagram provided by Embodiment 4 of the present invention;

[0062] Fig.11 A schematic diagram of the structure of a security protection capability detection device provided in Example 5 of the present invention;

[0063] Fig.12 This is a schematic diagram of the structure of an electronic device provided in Example 6 of the present invention. DETAILED DESCRIPTION

[0064] The present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] Embodiment 1:

[0066] Figure 1 A schematic diagram of the structure of a security protection capability detection system provided by an embodiment of the present invention, the system comprises: a scanning source device 11, a security protection device 12 and a target side device 13; the scanning source device 11 comprises a vulnerability scanning module 111 and an escape scheduling module 112;

[0067] The vulnerability scanning module 111 is used to send a vulnerability scanning task to the escape scheduling module 112, wherein the vulnerability scanning task carries vulnerability identification information to be scanned;

[0068] The escape scheduling module 112 is used to obtain the escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module 111;

[0069] The vulnerability scanning module 111 is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the target side device 13 through the security protection device 12; and receive the feedback result of the target side device 13, and determine the security protection capability of the security protection device according to the feedback result.

[0070] In an embodiment of the present invention, the vulnerability scanning module sends a vulnerability scanning task carrying vulnerability identification information to be scanned to the escape scheduling module. After receiving the vulnerability scanning task, the escape scheduling module obtains the escape technology interface corresponding to the vulnerability to be scanned based on the vulnerability identification information to be scanned carried in the vulnerability scanning task.

[0071] Specifically, Figure 2 As shown, the scanning source device also includes an escape technology interface library 113; the escape scheduling module 112 is specifically used to obtain the escape technology interface corresponding to the vulnerability to be scanned from the escape technology interface library 113 according to the vulnerability identification information to be scanned. After the escape scheduling module obtains the escape technology interface corresponding to the vulnerability to be scanned, it sends the escape technology interface to the vulnerability scanning module.

[0072] The vulnerability scanning module uses the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and then sends the transmitted and processed scanning message to the target side device through the security protection device.

[0073] After receiving the scan message after transmission processing, the target side device will send a response message to the vulnerability scanning module, and the response message carries the feedback result of the target side device. The vulnerability scanning module determines the security protection capability of the security protection device based on the feedback result. Specifically, the feedback result of the target side device includes the successful exploitation of the vulnerability to be scanned or the failure of the exploitation of the vulnerability to be scanned. If the feedback result of the target side device is successful exploitation, it means that the security protection device has not successfully protected and has poor protection capability. If the feedback result of the target side device is failed exploitation, it means that the security protection device has successfully protected and has good protection capability.

[0074] It should be noted that the security protection capability detection system can detect the security protection capability of the security protection equipment against different vulnerabilities. For different vulnerabilities to be scanned, the above-mentioned method is used to obtain the feedback results of the target side device response, and then the security protection capability of the security protection equipment for different vulnerabilities is determined according to the feedback results, and corresponding detection reports are generated, so as to intuitively view which vulnerabilities the security protection equipment has successfully protected and which vulnerabilities it has failed to protect.

[0075] Since in the embodiment of the present invention, the vulnerability scanning module sends a vulnerability scanning task to the escape scheduling module, and the vulnerability scanning task carries the vulnerability identification information to be scanned, the escape scheduling module obtains the escape technology interface corresponding to the vulnerability to be scanned, and sends the escape technology interface to the vulnerability scanning module. The vulnerability scanning module uses the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the target side device through the security protection device; finally, the security protection capability of the security protection device is received and determined according to the feedback result of the target side device response. Thus, a technical solution capable of detecting the security protection capability of the security protection device is realized.

[0076] Embodiment 2:

[0077] When detecting the security protection capability of the security protection device, if the vulnerability to be scanned supports self-negotiation of escape technology, the solution of the above embodiment can be used to detect the security protection capability of the security protection device. However, for vulnerabilities that do not support self-negotiation of escape technology, escape strategy negotiation is required, and the security protection capability of the security protection device can be detected only after the negotiation is completed. Therefore, for vulnerabilities that do not support self-negotiation of escape technology, in order to realize the detection of the security protection capability of the security protection device, based on the above embodiment, in the embodiment of the present invention, Figure 3 As shown, the scanning source device also includes a policy server 114;

[0078] The escape scheduling module 112 is further configured to send an escape strategy negotiation instruction to the policy server 114 if it is determined that the vulnerability to be scanned does not support escape technology self-negotiation;

[0079] The policy server 114 is used to configure the escape strategy for the target side device 13 according to the escape strategy negotiation instruction, and respond to the vulnerability scanning module 111 with a configuration completion instruction after the configuration is completed;

[0080] The vulnerability scanning module 111 is also used to, when receiving the configuration completion instruction, use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the target side device 13 through the security protection device.

[0081] For some escape technologies, if the vulnerability to be scanned does not support auto-negotiation, the escape configuration of the target device can be completed through self-negotiation between the policy server and the target device on the control plane before the task is issued, such as transmission compression and encryption, so as to bypass the security protection device and complete the escape scan.

[0082] Specifically, Figure 4 As shown, the target side device 13 includes an escape strategy client 131 and an asset target 132;

[0083] The policy server 114 is specifically configured to send the escape policy negotiation instruction to the escape policy client 131;

[0084] The escape strategy client 131 is used to configure the escape strategy for the asset target 132 according to the escape strategy negotiation instruction.

[0085] In an embodiment of the present invention, for some escape technologies, if the vulnerability to be scanned does not support self-negotiation, the escape configuration of the asset target can be completed by self-negotiation on the control plane through the policy server and the escape policy client preset on the target side device before the task is issued, such as transmission compression, encryption, etc., so as to bypass the security protection device and complete the escape scan.

[0086] Embodiment 3:

[0087] In order to more directly measure the protective effect of the safety protection equipment, based on the above embodiments, in the embodiment of the present invention, Figure 5 As shown, the target side device 13 includes an asset target library 133;

[0088] The vulnerability scanning module 111 is further used to send a vulnerability scanning task to the escape scheduling module 112, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library 133;

[0089] The escape scheduling module 112 is used to obtain the escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module 111;

[0090] The vulnerability scanning module 111 is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the asset target library 133 in the target side device 13 through the security protection device 12; and receive the feedback result of the asset target library 133 response, and determine the security protection capability of the security protection device 12 according to the feedback result.

[0091] In an embodiment of the present invention, in order to more directly measure the protection effect of the security protection device, an asset target library is built into the target side device. The vulnerabilities in the asset target library are vulnerabilities that support self-negotiation of escape technology. The security protection device is connected in series between the scanning source device and the asset target library. The asset target library is used to simulate and replace the original scanning asset target, and a vulnerability scanning task with attack escape technology is issued to achieve the measurement of the protection effect of the security device.

[0092] The security protection capability detection process provided by the embodiment of the present invention is described in detail below with reference to the accompanying drawings. Escape interface scanning refers to the addition of attack escape processing to the underlying traffic transmission of the existing vulnerability scan in combination with the type of target assets / vulnerabilities, so as to bypass the security protection equipment. Interactive escape strategy scanning refers to the modification of the asset environment policy by the client preset on the asset target side through the control plane instructing the control plane in addition to the data plane on the basis of the escape interface scanning, so as to facilitate the implementation of the attack escape technology. Target-assisted protection effect detection refers to the pre-setting of an asset target library behind the security protection equipment, providing support for a variety of asset vulnerabilities and related attack escape technologies, and changing the scanning target from the asset target to the target library.

[0093] Figure 6 The framework diagram of the security protection capability detection system provided by the embodiment of the present invention is as follows: Figure 6 As shown, the system includes: a scanning source device 11, a security protection device 12 and a target side device 13. The scanning source device is connected to the security protection device through an external network, and the security protection device is connected to the target side device through an external network. The scanning source device 11 includes a vulnerability scanning module 111, an escape scheduling module 112, an escape technology interface library 113 and a policy server 114. The target side device 13 includes an escape strategy client 131, an asset target 132 and an asset target library 133.

[0094] The escape scheduling module is used for traditional vulnerability scanning. For the selected vulnerability (range), it analyzes the attack escape technology interface that it relies on and dispatches it as a scanning task parameter. Attack escape technologies include but are not limited to fragmentation, encoding, deformation, request header spoofing, compression, encryption, rebound shell, etc.

[0095] The escape technology interface library is used to scan packets for existing vulnerabilities, add various attack escape processing during the underlying transmission, and use them by index according to the interface. The example is similar to:

[0096] int TY_INF(dst, / / Detection target, IP4 address port or URL;

[0097] PROTO, / / The protocol type originally used by the missed scan POC;

[0098] POC_PARAM, / / Parameter configuration of the original POC protocol;

[0099] TY_IDX, / / Technology type, such as 0 to 7, 0 means no escape;

[0100] TY_PARAM / / parameter set of the escape instance, providing default values;

[0101] ) / / Return: error code or number of bytes sent;

[0102] This function first completes the negotiation with the peer system internally and encapsulates various attack evasion technology packet sending interfaces. Specific interface types include but are not limited to those shown in the following table:

[0103]

[0104]

[0105] The policy server is used for some evasion technologies. For example, if the scanned assets or vulnerabilities do not support auto-negotiation, the escape configuration of the target can be completed on the control plane through the escape policy configuration server and the client preset on the scan target before the task is issued, such as transmission compression and encryption, so as to bypass the security device and complete the evasion scan.

[0106] Requires peer policy coordination: policy negotiation type;

[0107] In addition to the above TY_INF, there is one more interface as follows:

[0108] Bool TY_NEG(dst, / / Detection target, IP4 address port or URL;

[0109] TY_IDX, / / Technology type, such as 0 to 7;

[0110] TY_PARAM / / parameter set of the escape instance, providing default values;

[0111] ) / / Return the negotiation result. If successful, you can call TY_INF;

[0112] This function instructs the peer system to execute the corresponding configuration plug-in, rebound shell plug-in, or hook plug-in through the escape strategy server to complete the negotiation or specific escape interface.

[0113] The asset target library is used to more directly measure the protective effect of security equipment. The system also supports built-in asset target libraries of various types that support escape. The security equipment is connected in series between the scan source and the target library. The target library is used to simulate and replace the original scan target assets, and vulnerability scanning tasks with attack escape technology are issued to achieve measurement of the protective effect of security equipment.

[0114] Embodiment 4:

[0115] Figure 7 A schematic diagram of a security protection capability detection process provided by an embodiment of the present invention, the process includes the following steps:

[0116] S101: Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned.

[0117] S102: Receive an escape technology interface corresponding to the vulnerability to be scanned, sent by the escape scheduling module.

[0118] S103: Using the escape technology interface to perform transmission processing on the scanning message corresponding to the vulnerability to be scanned, and sending the scanning message after transmission processing to the target side device through the security protection device.

[0119] S104: receiving a feedback result of a response from the target-side device, and determining a security protection capability of the security protection device according to the feedback result.

[0120] The security protection capability detection method provided by the embodiment of the present invention is applied to a vulnerability scanning module in a scanning source device.

[0121] After sending the vulnerability scanning task to the escape scheduling module, the escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and before the scanning message after transmission and processing is sent to the target side device through the security protection device, the method also includes:

[0122] After receiving the configuration completion instruction, the escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the transmitted scanning message is sent to the target side device through the security protection device; wherein, the configuration completion instruction is that the escape scheduling module determines that the vulnerability to be scanned does not support escape technology self-negotiation, and sends an escape policy negotiation instruction to the policy server; the policy server configures the escape strategy of the target side device according to the escape strategy negotiation instruction, and responds to the vulnerability scanning module after the configuration is completed.

[0123] Specifically include:

[0124] Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library;

[0125] Receiving the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module;

[0126] The escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the asset target library in the target side device through the security protection device; and the feedback result of the asset target library response is received, and the security protection capability of the security protection device is determined according to the feedback result.

[0127] Figure 8 The security protection capability detection timing diagram provided by the embodiment of the present invention corresponds to the remote scanning target being able to self-negotiate the escape technology, for example, the vulnerability range scanned includes the vulnerability that can be self-negotiated. Figure 8 As shown, first the task is issued on the standard leak scanning front end, and the following steps are added:

[0128] 1. Task dependency query: which vulnerabilities can be self-negotiated and which local escape technology preparations are required.

[0129] 2. Escape scheduling module returns: returns after local query.

[0130] 3. Escape interface preparation: Start the relevant escape interface instance.

[0131] 4. Escape interface ready: The relevant escape interface instance is ready.

[0132] 5. Escape state ready: The end-to-end escape mode is ready.

[0133] 6. The data plane scans the traffic and sends it to the escape interface library to supplement the transmission processing of the escape technology (including auto-negotiation). The traffic is processed by the security device for protection before reaching the scanned asset target.

[0134] 7. The asset target returns the scan response data flow, and the scanner gives a relevant task conclusion report.

[0135] Fig. 9 The security protection capability detection timing diagram provided by the embodiment of the present invention corresponds to the remote scanning target cannot self-negotiate the escape technology, which requires local policy configuration cooperation. For example, the scope of the scanned vulnerability includes vulnerabilities that cannot be self-negotiated. First, the task is issued at the standard vulnerability scanning front end, and the following links are added:

[0136] 1. Task dependency query: which vulnerabilities can be self-negotiated and which local escape technology preparations are required.

[0137] 2. Escape scheduling module returns: returns after local query.

[0138] 3. Escape strategy negotiation instructions: sent from the scheduling module to the preset client through the policy configuration server.

[0139] 4. Policy configuration: The client pre-configures escape strategies locally on the asset target, such as session support compression, encryption, etc.

[0140] 5. Policy negotiation results: The client returns the negotiation results to the scheduling module through the server.

[0141] 6. Escape interface preparation: Start the relevant escape interface instance.

[0142] 7. Escape interface ready: The relevant escape interface instance is ready.

[0143] 8. Escape state ready: end-to-end escape mode is ready.

[0144] 9. The data plane scans the traffic and sends it to the escape interface library to supplement the transmission processing of the escape technology (including auto-negotiation). The traffic is processed by the security device for protection before reaching the scanned asset target.

[0145] 10. The asset target returns the scan response data flow, and the scanner gives the relevant task report.

[0146] Fig.10 This is a timing diagram of the security protection capability detection provided by the embodiment of the present invention. The timing diagram corresponds to the direct use of the built-in target, which can provide self-negotiation escape technology. The scope of the scanned vulnerabilities includes target-related vulnerabilities. First, the task is issued at the standard vulnerability scanning front end, and the following links are added:

[0147] 1. Task dependency query: which vulnerabilities can be self-negotiated and which local escape technology preparations are required.

[0148] 2. Escape scheduling module returns: returns after local query.

[0149] 3. Escape interface preparation: Start the relevant escape interface instance.

[0150] 4. Start the corresponding target: The scheduling module starts scanning the target, including configuring the escape strategy.

[0151] 5. Corresponding target is ready: indicates the status after the target is ready.

[0152] 6. Escape interface ready: The relevant escape interface instance is ready.

[0153] 7. Escape state ready: end-to-end escape mode is ready.

[0154] 8. The data plane scans the traffic and sends it to the escape interface library to supplement the transmission processing of the escape technology (including auto-negotiation). The traffic is processed by the security device for protection before reaching the scanned asset target.

[0155] 9. The asset target returns the scan response data traffic, and the scanner gives the relevant task conclusion, that is, the protection capability specification of the security device.

[0156] The embodiment of the present invention provides a vulnerability scanning method flow for detecting the protective effect of security equipment. Compared with the pure vulnerability scanning of the prior art, the present invention can combine vulnerability exploitation, transmission protocol characteristics, etc., provide attack escape methods, support bypassing security protection equipment (rules), and thus achieve quantitative detection of the protective capabilities of security equipment. The embodiment of the present invention provides multiple modules, supports combined coverage of various attack escape scenarios, provides bypassing of the protective capabilities of security equipment, and can support the detection of more vulnerabilities. The embodiment of the present invention switches the scanning target from a simple asset to a combination of protective equipment and assets, and can be converted (through a target) to a simple protective equipment, provides a framework to integrate various attack escape technology interfaces, supports the detection of more vulnerabilities, and supports quantifying the protection level of security equipment through different vulnerability and escape technology combination specifications.

[0157] Embodiment 5:

[0158] Fig.11 A schematic diagram of the structure of a security protection capability detection device provided in an embodiment of the present invention, the device includes:

[0159] A sending unit 01 is used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned;

[0160] The receiving unit 02 is used to receive the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module;

[0161] The processing unit 03 is used to use the escape technology interface to perform transmission processing on the scanning message corresponding to the vulnerability to be scanned, and send the scanning message after transmission processing to the target side device through the security protection device;

[0162] The detection unit 04 is used to receive the feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result.

[0163] The processing unit 03 is also used to, after receiving the configuration completion instruction, use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the target side device through the security protection device; wherein, the configuration completion instruction is that the escape scheduling module determines that the vulnerability to be scanned does not support escape technology self-negotiation, and sends an escape policy negotiation instruction to the policy server; the policy server configures the escape strategy of the target side device according to the escape strategy negotiation instruction, and responds to the vulnerability scanning module after the configuration is completed.

[0164] The sending unit 01 is specifically used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library;

[0165] The receiving unit 02 is specifically configured to receive the escape technology interface corresponding to the vulnerability to be scanned and sent by the escape scheduling module;

[0166] The processing unit 03 is specifically used to use the escape technology interface to perform transmission processing on the scanning message corresponding to the vulnerability to be scanned, and send the scanning message after transmission processing to the asset target library in the target side device through the security protection device;

[0167] The detection unit 04 is specifically used to receive the feedback result of the asset target library response, and determine the security protection capability of the security protection device according to the feedback result.

[0168] Embodiment 6:

[0169] Based on the above embodiments, an electronic device is also provided in an embodiment of the present invention, such as Fig.12 As shown, it includes: a processor 301, a communication interface 302, a memory 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304;

[0170] The memory 303 stores a computer program. When the program is executed by the processor 301, the processor 301 performs the following steps:

[0171] Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned;

[0172] Receiving the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module;

[0173] The escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the target side device through the security protection device;

[0174] Receive a feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result.

[0175] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present invention. Since the principle of solving the problem by the above electronic device is similar to the security protection capability detection method, the implementation of the above electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0176] The communication bus mentioned in the electronic device provided in the embodiment of the present invention may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0177] The communication interface 302 is used for communication between the electronic device and other devices.

[0178] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0179] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0180] Embodiment 7:

[0181] On the basis of the above embodiments, an embodiment of the present invention further provides a computer storage readable storage medium, wherein the computer readable storage medium stores a computer program executable by an electronic device, and when the program is run on the electronic device, the electronic device implements the following steps when executing:

[0182] Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned;

[0183] Receiving the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module;

[0184] The escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the target side device through the security protection device;

[0185] Receive a feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result.

[0186] Based on the same inventive concept, a computer-readable storage medium is also provided in an embodiment of the present invention. Since the principle of solving the problem when the processor executes the computer program stored on the above-mentioned computer-readable storage medium is similar to the security protection capability detection method, the implementation of the processor when executing the computer program stored on the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0187] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD), etc.

[0188] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0189] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0190] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0191] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0192] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A security protection capability detection system, characterized in that: The system comprises: a scanning source device, a security protection device and a target side device; the scanning source device comprises a vulnerability scanning module and an escape scheduling module; A vulnerability scanning module, used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned; The escape scheduling module is used to obtain the escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module; The vulnerability scanning module is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the scanning message after transmission and processing to the target side device through the security protection device; and receive the feedback result of the target side device response, and determine the security protection capability of the security protection device according to the feedback result; Among them, the feedback result of the target side device includes the successful exploitation of the vulnerability to be scanned or the failure of the exploitation of the vulnerability to be scanned; if the feedback result of the target side device is successful exploitation, it is determined that the protection capability is poor; if the feedback result of the target side device is failed exploitation, it is determined that the protection capability is good.

2. The system according to claim 1, characterized in that The scanning source device also includes an escape technology interface library; The escape scheduling module is specifically used to obtain the escape technology interface corresponding to the vulnerability to be scanned from the escape technology interface library according to the vulnerability identification information to be scanned.

3. The system according to claim 1, characterized in that The scanning source device also includes a policy server; The escape scheduling module is further configured to send an escape strategy negotiation instruction to the policy server if it is determined that the vulnerability to be scanned does not support escape technology self-negotiation; The policy server is used to configure the escape strategy for the target side device according to the escape strategy negotiation instruction, and respond to the vulnerability scanning module with a configuration completion instruction after the configuration is completed; The vulnerability scanning module is also used to, when receiving the configuration completion instruction, use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the target side device through the security protection device.

4. The system according to claim 3, characterized in that The target side device includes an escape strategy client and an asset target; The policy server is specifically configured to send the escape policy negotiation instruction to the escape policy client; The escape strategy client is used to configure the escape strategy for the asset target according to the escape strategy negotiation instruction.

5. The system according to claim 1, wherein: The target side device includes an asset target library; The vulnerability scanning module is further used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library; The escape scheduling module is used to obtain the escape technology interface corresponding to the vulnerability to be scanned according to the vulnerability identification information to be scanned, and send the escape technology interface to the vulnerability scanning module; The vulnerability scanning module is used to use the escape technology interface to transmit and process the scanning message corresponding to the vulnerability to be scanned, and send the transmitted and processed scanning message to the asset target library in the target side device through the security protection device; and receive the feedback result of the asset target library response, and determine the security protection capability of the security protection device according to the feedback result.

6. A method for detecting security protection capability, characterized in that: The method comprises: Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned; Receiving the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module; The escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the target side device through the security protection device; receiving a feedback result of a response from the target side device, and determining a safety protection capability of the safety protection device according to the feedback result; Among them, the feedback result of the target side device includes the successful exploitation of the vulnerability to be scanned or the failure of the exploitation of the vulnerability to be scanned; if the feedback result of the target side device is successful exploitation, it is determined that the protection capability is poor; if the feedback result of the target side device is failed exploitation, it is determined that the protection capability is good.

7. The method according to claim 6, characterized in that After sending the vulnerability scanning task to the escape scheduling module, the escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and before the scanning message after transmission and processing is sent to the target side device through the security protection device, the method also includes: After receiving the configuration completion instruction, the escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the transmitted scanning message is sent to the target side device through the security protection device; wherein, the configuration completion instruction is that the escape scheduling module determines that the vulnerability to be scanned does not support escape technology self-negotiation, and sends an escape policy negotiation instruction to the policy server; the policy server configures the escape strategy of the target side device according to the escape strategy negotiation instruction, and responds to the vulnerability scanning module after the configuration is completed.

8. The method according to claim 6, characterized in that Specifically include: Sending a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries identification information of the vulnerability to be scanned in the asset target library; Receiving the escape technology interface corresponding to the vulnerability to be scanned sent by the escape scheduling module; The escape technology interface is used to transmit and process the scanning message corresponding to the vulnerability to be scanned, and the scanning message after transmission and processing is sent to the asset target library in the target side device through the security protection device; and the feedback result of the asset target library response is received, and the security protection capability of the security protection device is determined according to the feedback result.

9. A safety protection capability detection device, characterized in that: The device comprises: A sending unit, used to send a vulnerability scanning task to the escape scheduling module, wherein the vulnerability scanning task carries vulnerability identification information to be scanned; A receiving unit, configured to receive an escape technology interface corresponding to the vulnerability to be scanned and sent by the escape scheduling module; A processing unit, used to use the escape technology interface to perform transmission processing on the scanning message corresponding to the vulnerability to be scanned, and send the scanning message after transmission processing to the target side device through the security protection device; A detection unit, configured to receive a feedback result of a response from the target side device, and determine a safety protection capability of the safety protection device according to the feedback result; Among them, the feedback result of the target side device includes the successful exploitation of the vulnerability to be scanned or the failure of the exploitation of the vulnerability to be scanned; if the feedback result of the target side device is successful exploitation, it is determined that the protection capability is poor; if the feedback result of the target side device is failed exploitation, it is determined that the protection capability is good.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 6 to 8 when executing a program stored in a memory.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 6 to 8 are implemented.

Images