A vulnerability detection processing method and device, a computer and a readable storage medium

Abstract

Embodiments of the present application disclose a vulnerability detection processing method and device, a computer and a readable storage medium. The method comprises the following steps: detecting a target virtualization component deployed in a host computer, and searching for a component management channel associated with the target virtualization component; acquiring virtualization component vulnerability information published by the component management channel; detecting a virtual running component in a running state in the target virtualization component, and if there is a vulnerability associated component in the virtual running component, it is determined that there is target component vulnerability information in the virtualization component vulnerability information; and updating the target virtualization component based on vulnerability repair data related to the target component vulnerability information. The functions implemented by the component include but are not limited to cloud services, cloud storage, cloud computing, cloud communication, middleware, security services, car-road cooperation, content distribution, big data, AI platform, map platform, etc. By using the present application, the accuracy of vulnerability detection processing can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a vulnerability detection and processing method, apparatus, computer, and readable storage medium. Background Technology

[0002] Virtualization technology is the cornerstone of cloud platforms. Security vulnerabilities in virtualization platforms can compromise the security and stability of cloud servers, leading to attackers controlling the servers, leaking sensitive data, and even disrupting the overall operation of the internet. Therefore, vulnerability detection for virtual machines is extremely important. Currently, vulnerability detection is typically performed using vulnerability scanning systems or exploit tools, such as security assessment systems and system vulnerability scanning and analysis software. Essentially, these methods actively probe the virtualization platform and then determine its vulnerability status by enumerating vulnerability databases and identifying relevant characteristics. Because cloud vendors modify and compile their virtualization platforms, the version numbers used by different cloud vendors are not uniform, leading to a large number of false positives in vulnerability scanning. Moreover, if vulnerability scanning systems or exploit tools are used to detect vulnerabilities in virtual machine platforms, the isolated nature of virtual personal computers (VPCs) means that the host virtualization configuration is a black box to these systems or tools. They cannot obtain the host configuration information of kernel-based virtual machines (KVMs), resulting in incomplete verification information for the virtualization platform and inaccurate virtual machine vulnerability detection results.

[0003] However, by using a verification method tailored to a specific vulnerability, the causes and principles of the vulnerability are analyzed to obtain a customized vulnerability detection method. Since the vulnerabilities of virtual machines are not fixed, the verification and analysis methods are also not fixed. Therefore, this method needs to understand the details and causes of each virtualization vulnerability, and needs to understand the principles and triggering details of each vulnerability in detail, which leads to low efficiency in detecting virtual machine vulnerabilities. Summary of the Invention

[0004] This application provides a vulnerability detection and processing method, apparatus, computer, and readable storage medium, which can improve the accuracy and efficiency of vulnerability detection and processing.

[0005] One embodiment of this application provides a vulnerability detection and processing method, the method comprising:

[0006] Detect the target virtualization components deployed on the host machine and find the component management channels associated with the target virtualization components;

[0007] Monitor component management channels to obtain virtualization component vulnerability information released by these channels; virtualization component vulnerability information includes vulnerability-related components;

[0008] The system detects running virtual components within the target virtualization component. If a vulnerability-related component exists within the virtual component, it determines that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component.

[0009] Update the target virtualization component based on vulnerability remediation data related to the vulnerability information of the target component.

[0010] This includes detecting the target virtualization components deployed on the host machine and locating the component management channels associated with the target virtualization components, including:

[0011] Scan and probe the virtual platform in the host machine to identify the target virtualization components included in the virtual platform;

[0012] Locate the access interface associated with the target virtualization component in the data network, and identify the access interface as the component management channel associated with the target virtualization component.

[0013] This includes obtaining virtualization component vulnerability information released by component management channels, including:

[0014] Obtain component update information released by the component management channel, perform semantic parsing on the component update information to obtain at least one semantic grouping information, search for vulnerability keyword groups from at least one semantic grouping information, and generate virtualization component vulnerability information based on the semantic grouping information associated with the vulnerability keyword groups.

[0015] Among them, the virtual running components in the target virtualization component that are in a running state include:

[0016] The command parser is invoked in the host machine, and the component execution detection program for the target virtualization component is received based on the command parser.

[0017] Running this component will run the detection program and obtain the virtual running components that are in the running state within the target virtualization component.

[0018] The vulnerability information for virtualization components also includes vulnerability-related functions;

[0019] If a vulnerability-associated component exists within the virtual runtime component, then the vulnerability information of the virtualization component is determined to contain vulnerability information of a target component associated with the target virtualization component, including:

[0020] If a vulnerability-associated component exists in the virtual runtime component, the virtual program code deployed on the host machine is obtained, at least one code segment in the virtual program code is traversed, and at least one code segment is matched with the vulnerability-associated function in turn.

[0021] If at least one code segment contains a code segment that matches the associated function of the vulnerability, then it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component.

[0022] The vulnerability information for virtualization components also includes vulnerability association functionality;

[0023] If a vulnerability-associated component exists within the virtual runtime component, then the vulnerability information of the virtualization component is determined to contain vulnerability information of a target component associated with the target virtualization component, including:

[0024] If a vulnerability association component exists in the virtual runtime component, the vulnerability association function is invoked in the host machine to determine the running status of the vulnerability association function in the host machine;

[0025] If the vulnerability association function is in the enabled state, it is determined that there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information.

[0026] The method also includes:

[0027] If there are no vulnerability-related components in the virtual runtime component, then virtualization component verification information is generated based on the vulnerability information of the virtual runtime component and the virtualization component.

[0028] The virtualization component verification information is cached. When deploying vulnerability-related components, the virtualization component verification information is called to update and deploy the vulnerability-related components.

[0029] The target component vulnerability information includes vulnerability remediation data; the target virtualization component is updated based on the vulnerability remediation data related to the target component vulnerability information, including:

[0030] From the virtual program code deployed on the host machine, find the vulnerability-associated program code that is related to the vulnerability information of the target component;

[0031] Vulnerability remediation data is integrated into vulnerability-associated program code to obtain remediation program code, and the integration result of vulnerability remediation data into the remediation program code is detected.

[0032] If the integration result of the vulnerability remediation data is a valid integration result, then the remediation code will be functionally tested. When the functional test passes, the target virtualization component will be updated based on the remediation code.

[0033] If the integration result of the vulnerability remediation data is an integration anomaly, then the terminal device corresponding to the vulnerability information of the target component is obtained, and a vulnerability remediation anomaly message is sent to the terminal device so that the terminal device can perform detection and update of the target virtualization component based on the vulnerability remediation anomaly message; the vulnerability remediation anomaly message includes the vulnerability information of the target component.

[0034] Among these, vulnerability remediation data is integrated into the vulnerability-associated program code to obtain remediation program code, including:

[0035] The vulnerability-related program code is parsed to obtain the interface name and code implementation logic;

[0036] The vulnerability remediation data is updated based on the interface name, and the updated vulnerability remediation data is added to the vulnerability-associated program code based on the code implementation logic to obtain the remediation program code.

[0037] This includes performing functional testing on the fix code, including:

[0038] Generate code test cases based on the fix code, run the code test cases, and perform test case testing on the fix code;

[0039] If the test cases for the fix code pass, the fix code is then subjected to grayscale processing to obtain grayscale test code. The target virtualization component is then updated based on the grayscale test code to obtain the grayscale virtualization component.

[0040] The grayscale virtualization component is to be released, and the functional test results of the fix program code are determined based on the planned release status of the grayscale virtualization component.

[0041] This includes planning the release of the grayscale virtualization component, and determining the functional test results of the fix code based on the planned release status of the grayscale virtualization component, including:

[0042] Obtain the computer devices associated with the host machine, and identify the computer devices whose usage frequency for the virtual platform is less than the test threshold as test devices;

[0043] Send the grayscale virtualization component to the test device for planned release, so that the test device can deploy the grayscale virtualization component and send the grayscale component's running results to the host machine;

[0044] Receive the grayscale component running results sent by the test equipment. If the grayscale component running results are normal, then the functional test of the repair program code is confirmed to have passed.

[0045] If the grayscale component's execution result includes vulnerability feedback information, then the functional test of the fix code is determined to have failed, and the fix code is updated based on the vulnerability feedback information.

[0046] One embodiment of this application provides a vulnerability detection and processing device, which includes:

[0047] The channel lookup module is used to detect the target virtualization component deployed on the host machine and find the component management channel associated with the target virtualization component;

[0048] The channel monitoring module is used to monitor the component management channel and obtain virtualization component vulnerability information released by the component management channel; the virtualization component vulnerability information includes the vulnerable associated components;

[0049] The component detection module is used to detect virtual running components that are in the running state in the target virtualization component. If there are vulnerability-related components in the virtual running component, it is determined that there is target component vulnerability information related to the target virtualization component in the virtualization component vulnerability information.

[0050] The component update module is used to update the target virtualization component based on vulnerability remediation data related to the target component vulnerability information.

[0051] The channel search module includes:

[0052] The platform detection unit is used to scan and detect the virtual platform in the host machine and identify the target virtualization components included in the virtual platform;

[0053] The channel determination unit is used to find the access interface associated with the target virtualization component in the data network and determine the access interface as the component management channel associated with the target virtualization component.

[0054] Specifically, regarding the acquisition of virtualization component vulnerability information released by the component management channel, the channel's monitoring module includes:

[0055] The information parsing unit is used to obtain component update information released by the component management channel, perform semantic parsing on the component update information to obtain at least one semantic grouping information, search for vulnerability keyword groups from the at least one semantic grouping information, and generate virtualization component vulnerability information based on the semantic grouping information associated with the vulnerability keyword groups.

[0056] Specifically, regarding the detection of virtual runtime components that are in a running state within the target virtualization component, the component detection module includes:

[0057] The program receiving unit is used to call the command parser in the host machine and receive the component execution detection program for the target virtualization component based on the command parser;

[0058] The program execution unit is used to run the component execution detection program to obtain the virtual running components in the target virtualization component that are in the running state.

[0059] The vulnerability information for virtualization components also includes vulnerability-related functions;

[0060] In determining whether a vulnerability-associated component exists within a virtual runtime component, and thus whether the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, the component detection module includes:

[0061] The code matching unit is used to obtain the virtual program code deployed on the host machine if there is a vulnerability-related component in the virtual runtime component, traverse at least one code segment in the virtual program code, and perform function matching between at least one code segment and the vulnerability-related function in turn.

[0062] The result determination unit is used to determine that if at least one code segment contains a code segment that matches the vulnerability-associated function, then the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component.

[0063] The vulnerability information for virtualization components also includes vulnerability association functionality;

[0064] In determining whether a vulnerability-associated component exists within a virtual runtime component, and thus whether the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, the component detection module includes:

[0065] The status detection unit is used to call the vulnerability association function in the host machine if there is a vulnerability association component in the virtual runtime component, and to determine the running status of the vulnerability association function in the host machine.

[0066] The result determination unit is also used to determine, if the vulnerability association function is in the running state, that there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information.

[0067] The device also includes:

[0068] The verification generation module is used to generate virtualization component verification information based on the vulnerability information of the virtual running component and the virtualization component if there is no vulnerability-related component in the virtual running component.

[0069] The verification cache module is used to cache verification information of virtualization components. When deploying vulnerability-related components, the verification information of the virtualization components is called to update and deploy the vulnerability-related components.

[0070] The target component vulnerability information includes vulnerability remediation data; the component update module includes:

[0071] The code search unit is used to search for vulnerability-associated program code that is related to the vulnerability information of the target component from the virtual program code deployed on the host machine.

[0072] The code fusion unit is used to integrate vulnerability remediation data into vulnerability-associated program code to obtain remediation program code, and to detect the integration result of vulnerability remediation data into the remediation program code.

[0073] The code testing unit is used to perform functional testing on the patch code if the integration result of the vulnerability patch data is a valid integration result. When the functional test passes, the target virtualization component is updated based on the patch code.

[0074] The anomaly repair unit is used to obtain the terminal device corresponding to the vulnerability information of the target component if the integration result of the vulnerability repair data is an integration anomaly result, and send a vulnerability repair anomaly message to the terminal device so that the terminal device can detect and update the target virtualization component based on the vulnerability repair anomaly message; the vulnerability repair anomaly message includes the vulnerability information of the target component.

[0075] Specifically, vulnerability remediation data is integrated into the vulnerability-associated program code to obtain remediation program code. This code fusion unit includes:

[0076] The program parsing subunit is used to parse the vulnerability-related program code to obtain the interface name and code implementation logic.

[0077] The code repair subunit is used to update vulnerability repair data based on the interface name, and add the updated vulnerability repair data to the vulnerability-related program code based on the code implementation logic to obtain the repair program code.

[0078] Specifically, the code testing unit for functional testing of the fix code includes:

[0079] The test case subunit is used to generate code test cases based on the fix code, run the code test cases, and perform test case testing on the fix code;

[0080] The grayscale testing subunit is used to perform grayscale processing on the repair program code if the test case tests on the repair program code pass, to obtain grayscale test code, and update the target virtualization component according to the grayscale test code to obtain the grayscale virtualization component;

[0081] The grayscale release subunit is used to plan the release of grayscale virtualization components and determine the functional test results of the fix program code based on the planned release running status of the grayscale virtualization components.

[0082] The grayscale release subunit includes:

[0083] The device selection sub-unit is used to obtain the computer devices associated with the host machine, and to identify the computer devices whose usage frequency for the virtual platform is less than the usage test threshold as test devices.

[0084] The grayscale deployment subunit is used to send the grayscale virtualization component to the test device for planned release, so that the test device can deploy the grayscale virtualization component and send the grayscale component running results to the host machine;

[0085] The result receiving subunit is used to receive the grayscale component running results sent by the test equipment. If the grayscale component running result is a normal running result, it is determined that the functional test of the repair program code has passed.

[0086] The code update subunit is used to determine that the functional test of the fix code has failed if the grayscale component's running result includes runtime vulnerability feedback information, and to update the fix code based on the runtime vulnerability feedback information.

[0087] One embodiment of this application provides a computer device, including a processor, a memory, and an input / output interface;

[0088] The processor is connected to a memory and an input / output interface, respectively. The input / output interface is used to receive and output data, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device containing the processor executes the vulnerability detection processing method in one aspect of the embodiments of this application.

[0089] One aspect of this application provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor, so that a computer device having the processor performs the vulnerability detection processing method of one aspect of this application.

[0090] One aspect of this application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional embodiments of this application.

[0091] Implementing the embodiments of this application will have the following beneficial effects:

[0092] In this embodiment, the host machine can detect the target virtualization component deployed on the host machine, find the component management channel associated with the target virtualization component; monitor the component management channel, and obtain the virtualization component vulnerability information published by the component management channel; the virtualization component vulnerability information includes vulnerability-associated components; detect the virtual running components in the target virtualization component that are in a running state, and if there are vulnerability-associated components in the virtual running components, it is determined that there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information; and update the target virtualization component based on the vulnerability remediation data related to the target component vulnerability information. Through the above process, when the host machine publishes virtualization component vulnerability information in the component management channel, it can analyze and verify the vulnerability information and detect the target virtualization components deployed on the host machine. When the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, it can be considered that the component vulnerability indicated by the virtualization component vulnerability information may affect the operation of the virtual machine deployed on the host machine. That is, the virtual machine on the host machine may have a component vulnerability. By fixing the component vulnerability, even when there is no component vulnerability in the virtual machine deployed on the host machine, it is possible to pre-detect potential component vulnerabilities, thereby enabling timely or even earlier detection of component vulnerabilities and improving the accuracy and efficiency of vulnerability detection and handling. Attached Figure Description

[0093] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0094] Figure 1a This is a network interaction architecture diagram for vulnerability detection and processing provided in an embodiment of this application;

[0095] Figure 1b This is an information monitoring architecture diagram provided in an embodiment of this application;

[0096] Figure 2 This is a schematic diagram of a vulnerability detection and processing scenario provided in an embodiment of this application;

[0097] Figure 3 This is a flowchart of a vulnerability detection and processing method provided in an embodiment of this application;

[0098] Figure 4 This is a schematic diagram of a virtualization component logical architecture provided in an embodiment of this application;

[0099] Figure 5This application provides a schematic diagram of an information generation scenario.

[0100] Figure 6 This is a schematic diagram illustrating a specific process for vulnerability detection and processing provided in an embodiment of this application;

[0101] Figure 7 This is a schematic diagram of a code functionality testing scenario provided in an embodiment of this application;

[0102] Figure 8 This is a schematic diagram of a vulnerability detection and processing device provided in an embodiment of this application;

[0103] Figure 9 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0104] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0105] In the embodiments of this application, please refer to Figure 1a , Figure 1a This is a network interaction architecture diagram for vulnerability detection and processing provided in this application embodiment. This application embodiment can be implemented by a host machine. The host machine 101 can deploy virtual machines, which are physical machines and can provide bridges or network cards to enable data interaction between different virtual machines. A virtual machine can be considered an application running on the host machine. This application "simulates" an operating system environment, which is the same as a regular computer device, making the virtual machine in use very similar to a real physical machine. In other words, a virtual machine refers to a complete computer system with full hardware system functionality simulated by software, running in a completely isolated environment. A physical machine, in contrast to a virtual machine, refers to a physical computer that provides the hardware environment for the virtual machine. The host machine 101 can interact with virtual machines deployed in other computer devices. Optionally, the host machine 101 can deploy one virtual machine or at least two virtual machines. When at least two virtual machines are deployed on the host machine 101, an operating system environment can be provided to enable data interaction between at least two virtual machines.

[0106] like Figure 1aAs shown, there is at least one computer device, such as computer device 102a, computer device 102b, and computer device 102c. The virtual machines deployed in each computer device can be obtained by deploying virtual machines based on the virtual machines deployed in host machine 101. That is, in this embodiment, updating the virtual machines in host machine 101 can update the virtual machines in each computer device. The virtual machines deployed in host machine 101 are referred to as the first virtual machine, and the virtual machines deployed in each computer device are referred to as the second virtual machines. The first virtual machine can manage the second virtual machine. Further, host machine 101 can detect the target virtualization component deployed in host machine 101, obtain virtualization component vulnerability information from the component management channel associated with the target virtualization component, and when there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information, update the target virtualization component based on the target component vulnerability information. Optionally, host machine 101 can publish the updated target virtualization component, that is, send the updated target virtualization component to each computer device so that each computer device can deploy the updated target virtualization component.

[0107] Through the above process, even before a component vulnerability is discovered, the host machine can detect whether the target virtualization component running on the host machine is affected by virtualization component vulnerability information. Based on the detection results, the appropriate action can be taken. For example, if the target virtualization component running on the host machine is affected by a vulnerability, the action is to update the target virtualization component based on the vulnerability information; if the target virtualization component is not affected, the action is not to update the target virtualization component. This allows for pre-detection and pre-repair of target virtualization components deployed on the host machine, improving the accuracy and efficiency of vulnerability detection and handling.

[0108] Further, see Figure 1b , Figure 1b This is an information monitoring architecture diagram provided in an embodiment of this application. For example... Figure 1bAs shown, host machine 101 can detect the target virtualization component deployed on host machine 101, locate the component management channel associated with the target virtualization component, and monitor the component management channel to obtain virtualization component vulnerability information published by the component management channel. The data managed by the component management channel can be stored on the computer device corresponding to the component management channel or in cloud storage; there are no restrictions. For example, if the data managed by the component management channel is stored in cloud storage, and host machine 101 detects that the component management channel has published virtualization component vulnerability information, it determines the storage location of the component management channel in the cloud storage and obtains the virtualization component vulnerability information from that storage location. Alternatively, if the data managed by the component management channel is stored on the computer device corresponding to the component management channel, host machine 101 can monitor the component management channel and obtain the virtualization component vulnerability information published by the component management channel from the computer device corresponding to the component management channel. Figure 1b As shown, the data managed by the component management channel is stored in the computer device corresponding to the component management channel. There are component management channels 1, 2, and 3. Component management channel 1 corresponds to computer device 103a, component management channel 2 corresponds to computer device 103b, and component management channel 3 corresponds to computer device 103c. The host machine 101 monitors each computer device. If virtualization component vulnerability information is published in computer device 103b, the host machine 101 obtains the virtualization component vulnerability information from computer device 103b.

[0109] Optionally, the component management channel can publish virtualization component vulnerability information based on a data network, and the host machine 101 obtains the virtualization component vulnerability information published by the component management channel from the data network. In other words, the host machine 101 can obtain the virtualization component vulnerability information published by the component management channel. In this embodiment, the method of obtaining the virtualization component vulnerability information can be determined according to the storage method of the virtualization component vulnerability information, and the host machine 101 obtains the virtualization component vulnerability information published by the component management channel based on the method of obtaining the information.

[0110] For details, please see Figure 2 , Figure 2 This is a schematic diagram of a vulnerability detection and processing scenario provided in an embodiment of this application. For example... Figure 2As shown, host machine 201 detects the target virtualization components deployed on host machine 201, such as target virtualization component 2021, target virtualization component 2022, and target virtualization component 2023, etc. That is, one target virtualization component can be deployed on the host machine, or at least two target virtualization components can be deployed. The computer device can search for the component association channels 203 associated with the target virtualization components. For example, it can obtain the component management channel 2031 associated with target virtualization component 2021, the component management channel 2032 associated with target virtualization component 2022, and the component management channel 2033 associated with target virtualization component 2023, etc. One target virtualization component can correspond to one component management channel, or different target virtualization components can correspond to the same component management channel, or one target virtualization component can correspond to at least two component management channels; no restrictions are imposed here.

[0111] Furthermore, the host machine 201 monitors the component management channel 203 to obtain virtualization component vulnerability information published by the component management channel 203. This virtualization component vulnerability information may include vulnerability-associated components. The host machine 201 detects the running virtual components in the target virtualization component. If a vulnerability-associated component exists in the virtual running component, it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. Based on the target component vulnerability information, the target virtualization component is updated. Through this process, when the target virtualization component deployed on the host machine may be affected by the component vulnerability indicated by the virtualization component vulnerability information, even if the component vulnerability has not yet appeared on the host machine, pre-detection and pre-repair of the component vulnerability can be achieved. This allows the host machine to promptly repair the component vulnerability, avoid attacks targeting the component vulnerability, thereby improving the timeliness, accuracy, and efficiency of vulnerability detection and handling, and enhancing the security of the virtual machine.

[0112] It is understood that the host machine mentioned in the embodiments of this application can be a computer device, and the computer device in the embodiments of this application includes, but is not limited to, terminal devices or servers. In other words, the computer device can be a server or a terminal device, or a system composed of servers and terminal devices. Among them, the terminal device mentioned above can be an electronic device, including but not limited to mobile phones, tablets, desktop computers, laptops, handheld computers, in-vehicle devices, augmented reality / virtual reality (AR / VR) devices, head-mounted displays, wearable devices, smart speakers, digital cameras, webcams, and other mobile internet devices (MIDs) with network access capabilities. Among them, the server mentioned above can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, vehicle-to-everything (V2X) services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0113] Optionally, the data involved in the embodiments of this application may be stored in a computer device or may be stored based on cloud storage technology, without any limitation.

[0114] Further, please see Figure 3 , Figure 3 This is a flowchart of a vulnerability detection and processing method provided in an embodiment of this application. Figure 3 As shown, a description is given using an original image as an example; in other words, in... Figure 3 In the described method embodiment, the vulnerability detection process includes the following steps:

[0115] Step S301: Detect the target virtualization component deployed on the host machine and find the component management channel associated with the target virtualization component.

[0116] In this embodiment, the host machine can collect data on target virtualization components deployed on the host machine through asset mapping. This asset mapping method can be based on network asset fingerprinting, actively collecting, identifying, and analyzing information such as network hardware, middleware, software applications, and system services within critical information infrastructure. It uses asset attribute information to quickly match virtualization components. This asset mapping method includes, but is not limited to, rapid scanning technology, firewall circumvention technology, protocol identification technology, fingerprint recognition technology, and passive detection technology. For example, the host machine can use asynchronous stateless scanning technology based on rapid scanning technology to quickly detect live assets in the virtual network associated with the host machine, i.e., detect the target virtualization components deployed on the host machine, which can greatly save resources. This can reduce the detection time of the target virtualization component; alternatively, when the host machine is detecting the target virtualization component, it can use firewall circumvention technology to perform deep analysis of the system ports of the first virtual machine in the host machine, bypass the firewall virtual ports, thereby reducing false alarms and improving the detection accuracy of the target virtualization component; alternatively, the host machine can use protocol identification technology to identify one or more network protocols used by the first virtual machine in the host machine through the protocol identification engine, and obtain the internal application information of the first virtual machine based on the network protocol used by the first virtual machine, that is, the target virtualization component deployed in the host machine; alternatively, the host machine can use fingerprint recognition technology to detect the target virtualization component deployed in the host machine from the collected fingerprint rules, etc., without limitation.

[0117] The host machine can scan and probe the virtual platform within it to identify the target virtualization components included in the virtual platform. This virtual platform refers to the operating system runtime environment of the first virtual machine. Optionally, the host machine can obtain component configuration information, parse this information, search for component keywords, and identify the virtualization components corresponding to the found keywords as the target virtualization components deployed on the host machine. These target virtualization components can be virtualization operation interfaces (libvirt), Quick Emulator (QEMU), kernels, or virtualization instruction components (virsh), etc. Optionally, the host machine can obtain the logical architecture of the virtualization components and scan and probe the virtual platform within it based on this architecture to identify the target virtualization components; or, it can parse the component configuration information based on the logical architecture to obtain the target virtualization components deployed on the host machine.

[0118] See Figure 4 , Figure 4 This is a schematic diagram of a virtualization component logical architecture provided in an embodiment of this application. For example... Figure 4As shown, this virtual platform generally includes user-space management tools 401, a virtualization operation interface 402, and a virtualization architecture. The user-space management tools 401 provide a data interaction interface, allowing access to the first virtual machine on the host machine through trigger operations on the user-space management tools 401. The user-space management tools 401 may include, but are not limited to, virtualization command components (virsh), command management components (virt-manager), virtual graphics control components (virt-viewer), virtual machine creation components (virt-install), and other components. For example, virsh has command mode and interactive mode; the virsh command can call the functional interfaces provided by libvirt; virt-manager can be used to manage virtual machines; virt-viewer is a component used to display the graphical console of the virtual machine, etc. The virtualization operation interface (libvirt) manages the application programming interface (API) of the virtual platform, essentially acting as a public library for storing application programming interfaces. The virtualization architecture includes, but is not limited to, hypervisor architecture 4031, virtual machine kernel architecture 4032, virtualization layer architecture 4033, and open-source virtual machine architecture 4034. The virtualization architecture is described in detail below:

[0119] The virtualization monitoring architecture 4031 can be a Xen-based virtualization architecture. Xen supports both semi-virtualized and fully virtualized virtual machines, and virtual machines can be managed using the Xen Hypervisor. The virtual machine kernel architecture 4032 is a kernel-based Virtual Machine (KVM) architecture, which can manage virtual machines using KVM or a combination of KVM and QEMU. The virtualization layer architecture 4033 is a VMware-based virtualization architecture, which manages virtual machines through a virtualization layer. The open-source virtual machine architecture 4034 is a virtualization architecture based on Hyper-V or VirtualBox, where Hyper-V is a very streamlined software layer that does not contain any physical drivers. These are just a few examples of virtualization architectures. As virtualization technology develops, the components of this virtual platform, and the virtualization components included in each component, can be updated based on evolving virtualization technologies.

[0120] Furthermore, the host machine can search for access interfaces associated with the target virtualization component in the data network, and identify these access interfaces as the component management channels associated with the target virtualization component. For example, the host machine can search for the target virtualization component using a search engine, obtain the access interfaces associated with the target virtualization component from the search results, and identify these access interfaces as the component association channels associated with the target virtualization component. Optionally, a channel management database can exist, which contains the association relationships between virtualization components and management channels. The host machine can search for the component management channels associated with the target virtualization component from the channel management database. These component management channels can be the component information publishing URL corresponding to the target virtualization component, such as a Uniform Resource Locator (URL), or the location of the device where the component information is published, etc., without limitation. These component management channels include, but are not limited to, the official website address of the target virtualization component, the access address of the virtual technology management platform, and the access interface of the virtual machine vulnerability management platform.

[0121] For example, if the component management channel is a URL for publishing component information, and the host machine obtains a target virtualization component associated with Xen, then the component management channel corresponding to that target virtualization component can be determined to include "www.xen.org". This component management channel may also include "www.openwall.com", "https: / / seclists.org / ", or the National Vulnerability Database (NVD), etc. Specifically, the component management channel "www.openwall.com" is used to publish open-source firewall protection information, while the component management channel "https: / / seclists.org / " is used to publish security testing information. Optionally, the component management channel can also be preset; that is, staff can preset a list of channels to be monitored on the host machine. After the host machine obtains the target virtualization component, it retrieves the component management channel from this preset list.

[0122] Step S302: Monitor the component management channel and obtain the virtualization component vulnerability information released by the component management channel, which includes the vulnerability-related components.

[0123] In this embodiment, the host machine can monitor the component management channel. When information is published in the component management channel, the host machine obtains the component update information published by the component management channel and examines the obtained component update information. If the obtained component update information is vulnerability-related, it is determined to be virtualization component vulnerability information. The host machine can use web crawling technology to crawl the component update information from the component management channel. Alternatively, the host machine can request a vulnerability information acquisition protocol from the component management channel to establish a vulnerability information acquisition protocol. When the component management channel publishes virtualization component vulnerability information, it can send the virtualization component vulnerability information to the host machine based on the vulnerability information acquisition protocol. The host machine then obtains the virtualization component vulnerability information sent by the component management channel. The vulnerability information acquisition protocol can include an information receiving method. The component management channel can send the virtualization component vulnerability information to the host machine using this information receiving method based on the vulnerability information acquisition protocol. This information receiving method can be a receiving method corresponding to an email address or a receiving method corresponding to the host machine's information receiving address, etc.

[0124] Furthermore, the host machine obtains component update information released by the component management channel, performs semantic parsing on the component update information to obtain at least one semantic grouping information, searches for vulnerability keyword groups from the at least one semantic grouping information, and generates virtualization component vulnerability information based on the semantic grouping information associated with the vulnerability keyword groups. This virtualization component vulnerability information includes vulnerability-related components, and may also include vulnerability-related functions or vulnerabilities-related features, or it may also include vulnerability identifiers and vulnerability types. The vulnerability identifier can be a Common Vulnerabilities & Exposures (CVE) number, or a vulnerability type identifier, etc. CVEs are essentially a dictionary, including the public names of widely recognized information security vulnerabilities or exposed weaknesses. Optionally, the host machine can obtain the vulnerability identifier from the component update information, determine the vulnerability information data format corresponding to the vulnerability identifier, extract data from the component update information based on the vulnerability information data format, and generate virtualization component vulnerability information based on the extracted data. Optionally, the virtualization component vulnerability information can be represented in text or chart format, etc. Taking chart format as an example, the virtualization component vulnerability information can be as shown in Table 1 below:

[0125] Table 1

[0126] … … … … … …

[0127] As shown in Table 1, the vulnerability information of the virtualization component can be represented in the form of key-value pairs, which makes it possible to intuitively obtain the required parameters from the vulnerability information of the virtualization component for detection or use.

[0128] For example, see Figure 5 , Figure 5 This is a schematic diagram of an information generation scenario provided in an embodiment of this application. For example... Figure 5 As shown, taking the generation of virtualization component vulnerability information based on vulnerability identifiers as an example, the host machine obtains component update information 501, identifies vulnerability identifier 502 from the component update information 501, determines vulnerability information data format 503 based on vulnerability identifier 502, and splits the component update information 501 based on vulnerability information data format 503, as follows: Figure 5 As shown in 5041, at least one information segment 505 is obtained, such as information segment 5051 and information segment 5052, etc. Vulnerability keyword groups are identified from each information segment. Based on the identified vulnerability keyword groups and the information content associated with the vulnerability keyword groups, virtualization component vulnerability information 506 is generated. For example, the host machine identifies the vulnerability keyword group "vulnerability identifier" from information segment 5051 and obtains the information content associated with the vulnerability keyword group "vulnerability identifier"; it identifies the vulnerability keyword group "vulnerability associated component" from information segment 5052 and obtains the information content associated with the vulnerability keyword group "vulnerability associated component", etc.; the information content obtained from information segment 5051 and the information content obtained from information segment 5052, etc., are used to compose the virtualization component vulnerability information 506.

[0129] Step S303: Detect the virtual running components that are in the running state in the target virtualization component. If there are vulnerability-related components in the virtual running components, it is determined that there are target component vulnerability information related to the target virtualization component in the virtualization component vulnerability information.

[0130] In this embodiment, the host machine can detect and verify the deployed target virtualization component. Specifically, the host machine can call a command parser to receive a component execution detection program for the target virtualization component; run the component execution detection program to obtain the virtual running components in the target virtualization component that are in a running state. Furthermore, key components can be selected for detection and verification. Specifically, key components can be selected based on common attack points or the results of historical data analysis. For example, QEMU can be selected as the target virtualization component to improve detection efficiency.

[0131] The computer device obtains vulnerability-associated components from the virtualization component vulnerability information. Taking the vulnerability-associated component as an example, if the target virtualization component deployed on the host machine includes the "virtual machine network card component," the host machine can run a detection program to detect the running virtual components within the target virtualization component. If the "virtual machine network card component" exists within the virtual components, meaning it is running on the host machine, then it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. This target component vulnerability information is "Vulnerability Identifier: CVE-2020-15859; Vulnerability Type: QEMU e1000e;...", indicating that the host machine may have a component vulnerability, "Device Denial of Service Vulnerability." Optionally, the host machine can obtain the compilation configuration file, parse it, and detect whether the target virtualization component has been compiled on the host machine. If the target virtualization component has been compiled on the host machine, then it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. For example, if the target virtualization component is a "virtual machine network card component", then the compilation configuration file corresponding to the "virtual machine network card component" is "default-configs / x86_64-softmmu.mak".

[0132] Furthermore, the virtualization component vulnerability information may also include vulnerability association functions. If a vulnerability association component exists in the virtual runtime component, the host machine can obtain the virtual program code deployed on the host machine, traverse at least one code segment in the virtual program code, and perform function matching between the at least one code segment and the vulnerability association function in turn. If at least one code segment contains a code segment that matches the vulnerability association function, it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, meaning that the host machine may be affected by the vulnerability association function. If at least one code segment does not contain a code segment that matches the vulnerability association function, it is determined that the virtualization component vulnerability information does not contain target component vulnerability information associated with the target virtualization component, meaning that the host machine will not be affected by the vulnerability association function. In other words, if a component vulnerability corresponding to the virtualization component vulnerability information exists, the component vulnerability will not occur because there is no vulnerability association function on the host machine.

[0133] Optionally, the virtualization component vulnerability information may also include a vulnerability association function. If a vulnerability association component exists in the virtual runtime component, the host machine can call the vulnerability association function to determine its running status on the host machine. If the vulnerability association function is running in the enabled state, it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. If the vulnerability association function is running in the disabled state, it is determined that the virtualization component vulnerability information does not contain target component vulnerability information associated with the target virtualization component.

[0134] Optionally, the host machine can sequentially match at least one code segment with the vulnerability association function. If at least one code segment matches the vulnerability association function, the vulnerability association function is invoked on the host machine to determine its running status. If the vulnerability association function is running in the enabled state, it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. If at least one code segment does not match the vulnerability association function, or if the vulnerability association function is running in the disabled state on the host machine, it is determined that the virtualization component vulnerability information does not contain target component vulnerability information associated with the target virtualization component.

[0135] Furthermore, if there is no vulnerability-related component in the virtual runtime component, the host machine can generate virtualization component verification information based on the vulnerability information of the virtual runtime component and the virtualization component; cache the virtualization component verification information, and when deploying the vulnerability-related component, the host machine calls the virtualization component verification information to update and deploy the vulnerability-related component.

[0136] Step S304: Update the target virtualization component based on vulnerability remediation data related to the target component vulnerability information.

[0137] In this embodiment, the target component vulnerability information includes vulnerability remediation data, which may be vulnerability patches, etc. The host machine can update the target virtualization component based on the vulnerability remediation data related to the target component vulnerability information, ensuring that the updated target virtualization component does not contain the component vulnerability corresponding to the target component vulnerability information. Specifically, the host machine searches for vulnerability-associated program code related to the target component vulnerability information from the virtual program code deployed on the host machine; it integrates the vulnerability remediation data into the vulnerability-associated program code to obtain remediation program code, and detects the integration result of the vulnerability remediation data into the remediation program code; if the integration result of the vulnerability remediation data is a valid integration result, the remediation program code undergoes functional testing; if the functional test passes, the target virtualization component is updated based on the remediation program code; if the integration result of the vulnerability remediation data is an abnormal integration result, the terminal device corresponding to the target component vulnerability information is obtained, and a vulnerability remediation anomaly message is sent to the terminal device, so that the terminal device performs detection and update of the target virtualization component based on the vulnerability remediation anomaly message; the vulnerability remediation anomaly message includes the target component vulnerability information. Among these, the detection of the integration of vulnerability remediation data into the remediation code can be done manually or by detecting the logic of the remediation code.

[0138] Furthermore, the host machine integrates vulnerability remediation data into the vulnerability-associated program code to obtain the remediation program code. This is achieved by parsing the vulnerability-associated program code to obtain the interface name and code implementation logic. The vulnerability remediation data is updated based on the interface name, and the updated data is added to the vulnerability-associated program code based on the code implementation logic, resulting in the remediation program code. Since virtual program code on different virtual platforms may be modified and compiled according to the corresponding virtual platform, mismatches may occur between the virtual program code and the virtualization component vulnerability information released by the component management channel when applied to the host machine. Therefore, the host machine can detect the integration of vulnerability remediation data into the remediation program code to reduce code anomalies, such as bugs, caused by updates to the virtual program code.

[0139] Furthermore, when the host machine performs functional testing on the patch code, it can generate code test cases based on the patch code, run the code test cases, and perform test case testing on the patch code. If the test case testing on the patch code passes, the patch code is subjected to gray-scale processing to obtain gray-scale test code. The target virtualization component is updated based on the gray-scale test code to obtain the gray-scale virtualization component. The gray-scale virtualization component is then planned for release. Based on the planned release running status of the gray-scale virtualization component, the functional test results of the patch code are determined.

[0140] Furthermore, a planned release of the grayscale virtualization component is conducted. Based on the planned release status of the grayscale virtualization component, the functional test results of the fix code are determined, including:

[0141] The host machine can obtain the computer devices associated with it and identify those whose usage frequency for the virtual platform is less than the usage test threshold as test devices. The grayscale virtualization component is sent to the test device for planned release, allowing the test device to deploy the grayscale virtualization component and send the grayscale component's running results back to the host machine. These results indicate the planned release running status of the grayscale virtualization component. The host machine receives the grayscale component's running results from the test device. If the grayscale component's running results are normal, the functional test of the patch code is considered passed; if the grayscale component's running results include vulnerability feedback information, the functional test of the patch code is considered failed. The patch code is then updated based on the vulnerability feedback information, resulting in a functional test failure.

[0142] In this embodiment, the host machine can detect the target virtualization component deployed on the host machine, find the component management channel associated with the target virtualization component; monitor the component management channel, and obtain the virtualization component vulnerability information published by the component management channel; the virtualization component vulnerability information includes vulnerability-associated components; detect the virtual running components in the target virtualization component that are in a running state, and if there are vulnerability-associated components in the virtual running components, it is determined that there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information; and update the target virtualization component based on the vulnerability remediation data related to the target component vulnerability information. Through the above process, when the host machine publishes virtualization component vulnerability information in the component management channel, it can analyze and verify the vulnerability information and detect the target virtualization components deployed on the host machine. When the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, it can be considered that the component vulnerability indicated by the virtualization component vulnerability information may affect the operation of the virtual machine deployed on the host machine. That is, the virtual machine on the host machine may have a component vulnerability. By fixing the component vulnerability, even when there is no component vulnerability in the virtual machine deployed on the host machine, it is possible to pre-detect potential component vulnerabilities, thereby enabling timely or even earlier detection of component vulnerabilities and improving the accuracy and efficiency of vulnerability detection and handling.

[0143] Further, please see Figure 6 , Figure 6 This is a schematic diagram illustrating a specific process for vulnerability detection and processing provided in an embodiment of this application. For example... Figure 6As shown, the method includes the following steps:

[0144] Step S601: Detect the target virtualization component deployed on the host machine and find the component management channel associated with the target virtualization component.

[0145] In this embodiment, the host machine can scan and probe the virtual platform within the host machine, or parse the component configuration information within the host machine to obtain the target virtualization component deployed on the host machine. The access interface associated with the target virtualization component is then searched in the data network, and this access interface is identified as the component management channel associated with the target virtualization component.

[0146] Step S602: Monitor the component management channel and obtain the virtualization component vulnerability information released by the component management channel, which includes the vulnerability-related components.

[0147] In this embodiment of the application, the host machine monitors the component management channel and crawls the virtualization component vulnerability information published by the component management channel, or receives the virtualization component vulnerability information actively sent by the component management channel.

[0148] Step S603: Detect the virtual running components that are in the running state in the target virtualization component.

[0149] In this embodiment, the host machine can detect the running virtual components within the target virtualization component. Specifically, the host machine invokes a command parser, receives a component operation detection program for the target virtualization component from the command parser, runs the component operation detection program, and obtains the running virtual components within the target virtualization component. The vulnerability information of this virtualization component includes vulnerability-associated components. If no vulnerability-associated components exist in the virtual component, step S609 is executed; if vulnerability-associated components exist in the virtual component, step S604 is executed.

[0150] Step S604: Detect whether there is a code segment in the virtual program code deployed on the host machine that matches the function associated with the vulnerability.

[0151] In this embodiment of the application, the vulnerability information of the virtualization component also includes a vulnerability association function. The host machine can detect at least one code segment in the virtual program code deployed on the host machine, and perform function matching between the at least one code segment and the vulnerability association function in sequence. If there is a code segment in the at least one code segment that matches the vulnerability association function, then step S605 is executed; if there is no code segment in the at least one code segment that matches the vulnerability association function, then step S609 is executed.

[0152] Taking the component vulnerability "network card buffer overflow vulnerability" as an example, the host machine obtains the virtualization component vulnerability information "Vulnerability ID: CVE-2020-7039; Vulnerability Type: QEMU SLIRP;...". Based on this virtualization component vulnerability information, the host machine can determine that the component vulnerability corresponding to this virtualization component vulnerability information exists in the QEMU SLIRP network. When the tcp_emu() function processes data on port 113, i.e., the identification protocol, it does not perform effective data verification, resulting in a heap overflow. The virtualization component vulnerability information may include a vulnerability-related function, such as "tcp_emu() function". The virtual program code searches for this vulnerability-related function, and at least one code segment is sequentially matched with the vulnerability-related function. If no code segment matching "tcp_emu() function" exists in the virtual program code, step S609 is executed; if a code segment matching "tcp_emu() function" exists in the virtual program code, step S605 is executed.

[0153] Step S605: Detect the running status of the vulnerability association function on the host machine.

[0154] In this embodiment of the application, the vulnerability information of the virtualization component also includes a vulnerability association function. The host machine can call the vulnerability association function to determine the running status of the vulnerability association function in the host machine. If the running status of the vulnerability association function in the host machine is the started state, then step S606 is executed; if the running status of the vulnerability association function in the host machine is the closed state, then step S609 is executed. For example, taking the virtualization component vulnerability information "Vulnerability ID: CVE-2020-7039; Vulnerability Type: QEMU SLIRP;..." as an example, the host machine can call the vulnerability association function included in the virtualization component vulnerability information to determine the running status of the vulnerability association function on the host machine. For example, by calling the vulnerability association function, the startup parameters of the target virtualization component "QEMU" can be obtained, and it can be checked whether the startup parameters contain running parameters such as "-net" or "-netnic-net user". If the startup parameters contain running parameters, it is determined that the running status of the vulnerability association function on the host machine is the running status; if the startup parameters do not contain running parameters, it is determined that the running status of the vulnerability association function on the host machine is the running status is the disabled status.

[0155] Step S606: Integrate vulnerability remediation data into the vulnerability-associated program code to obtain the remediation program code.

[0156] In this embodiment, the virtualization component vulnerability information also includes vulnerability remediation data. The host machine can integrate the vulnerability remediation data into the vulnerability-associated program code to obtain remediation program code. The integration result of the vulnerability remediation data into the remediation program code is detected. If the integration result is valid, step S607 is executed to perform functional testing on the remediation program code. If the integration result is abnormal, the terminal device corresponding to the target component vulnerability information is obtained, and a vulnerability remediation anomaly message is sent to the terminal device so that the terminal device can perform detection and updates on the target virtualization component based on the vulnerability remediation anomaly message. The vulnerability remediation anomaly message includes the target component vulnerability information.

[0157] Step S607: Perform functional testing on the repair program code.

[0158] In this embodiment, the host machine can perform functional testing on the patch code. When the functional test passes, step S608 is executed to update the target virtualization component based on the patch code. When the functional test fails, the host machine obtains the terminal device corresponding to the vulnerability information of the target component and sends a vulnerability patching exception message to the terminal device so that the terminal device can detect and update the target virtualization component based on the vulnerability patching exception message. The vulnerability patching exception message includes the vulnerability information of the target component.

[0159] For details, please refer to Figure 7 , Figure 7 This is a schematic diagram of a code functionality testing scenario provided in an embodiment of this application. For example... Figure 7As shown, the host machine generates code test cases 702 based on the fix code 701, runs the code test cases 702 to test the fix code 701. If the test cases for the fix code 701 pass, the fix code 701 is then subjected to gray-scale processing to obtain gray-scale test code 703. The host machine updates the target virtualization component based on the gray-scale test code 703 to obtain gray-scale virtualization component 704. The gray-scale virtualization component 704 is then planned for release. Specifically, the host machine obtains the computer devices 705 associated with the host machine, and identifies the computer devices 705 whose usage frequency for the virtual platform is less than the usage test threshold as test devices 7051. The gray-scale virtualization component 704 is sent to the test device 7051 for planned release, so that the test device 7051 deploys the gray-scale virtualization component 704 and sends the gray-scale component running results to the host machine. If the grayscale component runs normally, the functional test of the repair code is confirmed to be passed, and step S608 is executed; if the functional test fails, the host obtains the terminal device corresponding to the vulnerability information of the target component and sends a vulnerability repair exception message to the terminal device so that the terminal device can detect and update the target virtualization component based on the vulnerability repair exception message, which includes the vulnerability information of the target component.

[0160] Step S608: When the functional test passes, update the target virtualization component based on the fix code.

[0161] In this embodiment of the application, when the functional test passes, the host machine can update the target virtualization component based on the fix code. Further, as... Figure 7 As shown, the updated target virtualization component can be sent to computer device 705, enabling computer device 705 to redeploy the updated target virtualization component. Furthermore, the host machine can generate a virtualization component update log based on the virtualization component vulnerability information. This update log can be used to verify the update status of the target virtualization component. Further, the host machine can automatically trigger a component alert to obtain the terminal device corresponding to the target component vulnerability information, or to obtain the personnel associated with the target component vulnerability information, and send the component alert to the terminal device corresponding to the target component vulnerability information, or to the terminal device associated with the personnel. The host machine can store the communication method associated with the target component vulnerability information, and the host machine sends the component alert to the terminal device associated with the personnel based on this communication method.

[0162] Step S609: Generate virtualization component verification information.

[0163] In this embodiment, the host machine can generate virtualization component verification information based on the vulnerability information of the virtual runtime component and the virtualization component, and cache the virtualization component verification information. When deploying a vulnerability-associated component, the host machine can call the virtualization component verification information to update and deploy the vulnerability-associated component. The host machine can cache the virtualization component verification information in its own storage space or in a cloud storage. The virtualization component verification information can include all the contents of the virtualization component vulnerability information, such as vulnerability identifier, vulnerability type, vulnerability-associated component, vulnerability-associated function, vulnerability-associated function, and vulnerability remediation data. It can also include the verification result of the target virtualization component. For example, if this step is executed after step S603, the verification result can be "no vulnerability-associated component exists in the virtual runtime component"; if this step is executed after step S604, the verification result can be "no code segment matching the vulnerability-associated function exists in the virtual program code"; if this step is executed after step S606, the verification result can be "the vulnerability-associated function is disabled in the host machine". Furthermore, the host machine can automatically trigger component alerts to obtain the terminal devices corresponding to the target component vulnerability information, or to obtain the personnel associated with the target component vulnerability information and send component alerts to the terminal devices corresponding to the target component vulnerability information or to the terminal devices associated with the personnel. The host machine may store the communication methods associated with the target component vulnerability information, and the host machine sends component alerts to the terminal devices associated with the personnel based on these communication methods.

[0164] In this embodiment, since the virtualization component vulnerability information comes from the component management channel and is synchronized during the CVE application stage and before the official announcement, vulnerability detection of the target virtualization component can be performed more quickly. When it is determined that the target virtualization component will be affected by the component vulnerability indicated by the vulnerability information, the detection results can be automatically synchronized to the development team, allowing the development team to re-examine and confirm the virtualization vulnerability. Compared with other vulnerability detection platforms, this platform has higher accuracy because it analyzes and tests the compilation configuration information, vulnerability association functions, and vulnerability association features within the virtual platform deployed on the host machine. In specific experiments, the results of virtualization vulnerability detection by this application and other vulnerability detection platforms are shown in Table 2:

[0165] Table 2

[0166]

[0167] Furthermore, the implementation costs of this application when performing virtualized vulnerability detection with other vulnerability detection platforms are shown in Table 3:

[0168] Table 3

[0169]

[0170]

[0171] In summary, this application represents a significant improvement over existing methods.

[0172] In this embodiment, the host machine can detect the target virtualization component deployed on the host machine, find the component management channel associated with the target virtualization component; monitor the component management channel, and obtain the virtualization component vulnerability information published by the component management channel; the virtualization component vulnerability information includes vulnerability-associated components; detect the virtual running components in the target virtualization component that are in a running state, and if there are vulnerability-associated components in the virtual running components, it is determined that there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information; update the target virtualization component based on the vulnerability remediation data related to the target component vulnerability information; the updated target virtualization component does not have component vulnerabilities. Through the above process, when the host machine publishes virtualization component vulnerability information in the component management channel, it can analyze and verify the vulnerability information and detect the target virtualization components deployed on the host machine. When the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, it can be considered that the component vulnerability indicated by the virtualization component vulnerability information may affect the operation of the virtual machine deployed on the host machine. That is, the virtual machine on the host machine may have a component vulnerability. By fixing the component vulnerability, even when there is no component vulnerability in the virtual machine deployed on the host machine, it is possible to pre-detect potential component vulnerabilities, thereby enabling timely or even earlier detection of component vulnerabilities and improving the accuracy and efficiency of vulnerability detection and handling.

[0173] Further, please see Figure 8 , Figure 8 This is a schematic diagram of a vulnerability detection and processing device provided in an embodiment of this application. The vulnerability detection and processing device can be a computer program (including program code, etc.) running on a computer device; for example, the vulnerability detection and processing device can be an application software. The device can be used to execute the corresponding steps in the method provided in the embodiment of this application. Figure 8 As shown, the vulnerability detection and processing device 800 can be used for Figure 3 Specifically, the computer device in the corresponding embodiment may include: a channel search module 11, a channel monitoring module 12, a component detection module 13, and a component update module 14.

[0174] The channel lookup module 11 is used to detect the target virtualization component deployed in the host machine and find the component management channel associated with the target virtualization component;

[0175] Channel monitoring module 12 is used to monitor component management channels and obtain virtualization component vulnerability information released by component management channels; virtualization component vulnerability information includes vulnerability-related components;

[0176] The component detection module 13 is used to detect virtual running components that are in the running state in the target virtualization component. If there are vulnerability-related components in the virtual running component, it is determined that there is target component vulnerability information related to the target virtualization component in the virtualization component vulnerability information.

[0177] The component update module 14 is used to update the target virtualization component based on vulnerability remediation data related to the target component vulnerability information.

[0178] The channel search module 11 includes:

[0179] The platform detection unit 111 is used to scan and detect the virtual platform in the host machine and identify the target virtualization components included in the virtual platform;

[0180] The channel determination unit 112 is used to find the access interface associated with the target virtualization component in the data network and determine the access interface as the component management channel associated with the target virtualization component.

[0181] Specifically, regarding the acquisition of virtualization component vulnerability information released by the component management channel, the channel monitoring module 12 includes:

[0182] The information parsing unit 121 is used to obtain component update information released by the component management channel, perform semantic parsing on the component update information to obtain at least one semantic grouping information, search for vulnerability keyword groups from the at least one semantic grouping information, and generate virtualization component vulnerability information based on the semantic grouping information associated with the vulnerability keyword groups.

[0183] Specifically, regarding the detection of virtual runtime components that are in a running state within the target virtualization component, the component detection module 13 includes:

[0184] The program receiving unit 131 is used to call the command parser in the host machine and receive the component execution detection program for the target virtualization component based on the command parser;

[0185] The program execution unit 132 is used to run the component execution detection program to obtain the virtual running component in the target virtualization component that is in the running state.

[0186] The vulnerability information for virtualization components also includes vulnerability-related functions;

[0187] In determining whether a vulnerability-associated component exists within a virtual runtime component, and thus identifying a target component vulnerability associated with the target virtualization component within the virtualization component vulnerability information, the component detection module 13 includes:

[0188] The code matching unit 133 is used to obtain the virtual program code deployed on the host machine if there is a vulnerability-related component in the virtual runtime component, traverse at least one code segment in the virtual program code, and perform function matching between at least one code segment and the vulnerability-related function in turn.

[0189] The result determination unit 134 is used to determine that if at least one code segment contains a code segment that matches the vulnerability-associated function, then the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component.

[0190] The vulnerability information for virtualization components also includes vulnerability association functionality;

[0191] In determining whether a vulnerability-associated component exists within a virtual runtime component, and thus identifying a target component vulnerability associated with the target virtualization component within the virtualization component vulnerability information, the component detection module 13 includes:

[0192] The status detection unit 135 is used to call the vulnerability association function in the host machine if there is a vulnerability association component in the virtual running component, and to determine the running status of the vulnerability association function in the host machine.

[0193] The result determination unit 134 is also used to determine, if the vulnerability association function is in the running state, that there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information.

[0194] The device 800 also includes:

[0195] The verification generation module 15 is used to generate virtualization component verification information based on the vulnerability information of the virtual running component and the virtualization component if there is no vulnerability-related component in the virtual running component.

[0196] The verification cache module 16 is used to cache the verification information of the virtualization component. When deploying the vulnerability-related component, the verification information of the virtualization component is called to update and deploy the vulnerability-related component.

[0197] The target component vulnerability information includes vulnerability remediation data; the component update module 14 includes:

[0198] The code search unit 141 is used to search for vulnerability-related program code associated with the vulnerability information of the target component from the virtual program code deployed in the host machine.

[0199] The code fusion unit 142 is used to integrate vulnerability repair data into vulnerability-associated program code to obtain repair program code and to detect the integration result of vulnerability repair data into the repair program code.

[0200] Code testing unit 143 is used to perform functional testing on the patch code if the integration result of the vulnerability patch data is a valid integration result. When the functional test passes, the target virtualization component is updated based on the patch code.

[0201] The anomaly repair unit 144 is used to obtain the terminal device corresponding to the vulnerability information of the target component if the integration result of the vulnerability repair data is an integration anomaly result, and send a vulnerability repair anomaly message to the terminal device so that the terminal device can detect and update the target virtualization component based on the vulnerability repair anomaly message; the vulnerability repair anomaly message includes the vulnerability information of the target component.

[0202] Among them, vulnerability remediation data is integrated into the vulnerability-associated program code to obtain remediation program code. This code fusion unit 142 includes:

[0203] The program parsing subunit 1421 is used to parse the vulnerability-related program code to obtain the interface name and code implementation logic.

[0204] The code repair subunit 1422 is used to update vulnerability repair data based on the interface name and add the updated vulnerability repair data to the vulnerability-related program code based on the code implementation logic to obtain the repair program code.

[0205] Specifically, in terms of functional testing of the repair program code, the code testing unit 143 includes:

[0206] The test case subunit 1431 is used to generate code test cases based on the fix program code, run the code test cases, and perform test case testing on the fix program code.

[0207] The grayscale testing subunit 1432 is used to perform grayscale processing on the repair program code if the test case test of the repair program code passes, to obtain grayscale test code, and update the target virtualization component according to the grayscale test code to obtain the grayscale virtualization component.

[0208] The grayscale release subunit 1433 is used to plan the release of the grayscale virtualization component and determine the functional test results of the repair program code based on the planned release running status of the grayscale virtualization component.

[0209] The grayscale release subunit 1433 includes:

[0210] The device selection subunit 143a is used to obtain the computer devices associated with the host machine, and to identify the computer devices whose usage frequency for the virtual platform is less than the usage test threshold as test devices.

[0211] The grayscale deployment subunit 143b is used to send the grayscale virtualization component to the test device for pre-release, so that the test device can deploy the grayscale virtualization component and send the grayscale component running results to the host machine;

[0212] The result receiving subunit 143c is used to receive the grayscale component running result sent by the test equipment. If the grayscale component running result is a normal running result, it is determined that the functional test of the repair program code has passed.

[0213] The code update subunit 143d is used to determine that the functional test of the fix code has failed if the grayscale component's running result includes running vulnerability feedback information, and to update the fix code based on the running vulnerability feedback information.

[0214] This application provides a vulnerability detection and processing device that can run on a host machine. The device detects target virtualization components deployed on the host machine, locates component management channels associated with the target virtualization components, monitors the component management channels, and obtains virtualization component vulnerability information published by the component management channels. The virtualization component vulnerability information includes vulnerability-associated components. The device detects running virtual components within the target virtualization components. If a vulnerability-associated component exists within the virtual running component, it determines that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. The device updates the target virtualization component based on vulnerability remediation data related to the target component vulnerability information. Through the above process, when the host machine publishes virtualization component vulnerability information in the component management channel, it can analyze and verify the vulnerability information and detect the target virtualization components deployed on the host machine. When the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, it can be considered that the component vulnerability indicated by the virtualization component vulnerability information may affect the operation of the virtual machine deployed on the host machine. That is, the virtual machine on the host machine may have a component vulnerability. By fixing the component vulnerability, even when there is no component vulnerability in the virtual machine deployed on the host machine, it is possible to pre-detect potential component vulnerabilities, thereby enabling timely or even earlier detection of component vulnerabilities and improving the accuracy and efficiency of vulnerability detection and handling.

[0215] See Figure 9 , Figure 9 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 9As shown, the computer device in this embodiment may include one or more processors 901, a memory 902, and an input / output interface 903. The processor 901, memory 902, and input / output interface 903 are connected via a bus 904. The memory 902 stores a computer program, which includes program instructions. The input / output interface 903 receives and outputs data, such as for data interaction between the host machine and the computer device, or for data interaction between various virtual machines within the host machine. The processor 901 executes the program instructions stored in the memory 902.

[0216] The processor 901 can perform the following operations:

[0217] Detect the target virtualization components deployed on the host machine and find the component management channels associated with the target virtualization components;

[0218] Monitor component management channels to obtain virtualization component vulnerability information released by these channels; virtualization component vulnerability information includes vulnerability-related components;

[0219] The system detects running virtual components within the target virtualization component. If a vulnerability-related component exists within the virtual component, it determines that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component.

[0220] Update the target virtualization component based on vulnerability remediation data related to the vulnerability information of the target component.

[0221] In some feasible implementations, the processor 901 may be a central processing unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0222] The memory 902 may include read-only memory and random access memory, and provides instructions and data to the processor 901 and the input / output interface 903. A portion of the memory 902 may also include non-volatile random access memory. For example, the memory 902 may also store device type information.

[0223] In practice, the computer device can perform actions such as these through its built-in functional modules. Figure 3 or Figure 6 For details on the implementation methods provided for each step, please refer to [the relevant documentation / document / etc.]. Figure 3 or Figure 6 The implementation methods provided for each step are not elaborated here.

[0224] This application provides a computer device including a processor, an input / output interface, and a memory. The processor retrieves a computer program from the memory and executes it. Figure 3 Each step of the method shown is used to perform vulnerability detection and processing operations. This embodiment of the application detects the target virtualization component deployed on the host machine, locates the component management channel associated with the target virtualization component; monitors the component management channel to obtain virtualization component vulnerability information published by the component management channel; the virtualization component vulnerability information includes vulnerability-associated components; detects running virtual components within the target virtualization component; if a vulnerability-associated component exists within the virtual running component, it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component; and updates the target virtualization component based on vulnerability remediation data related to the target component vulnerability information. Through the above process, when the host machine publishes virtualization component vulnerability information in the component management channel, it can analyze and verify the vulnerability information and detect the target virtualization components deployed on the host machine. When the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, it can be considered that the component vulnerability indicated by the virtualization component vulnerability information may affect the operation of the virtual machine deployed on the host machine. That is, the virtual machine on the host machine may have a component vulnerability. By fixing the component vulnerability, even when there is no component vulnerability in the virtual machine deployed on the host machine, it is possible to pre-detect potential component vulnerabilities, thereby enabling timely or even earlier detection of component vulnerabilities and improving the accuracy and efficiency of vulnerability detection and handling.

[0225] This application also provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor. Figure 3 or Figure 6 For details on the vulnerability detection and handling methods provided in each step, please refer to the document. Figure 3 or Figure 6The implementation methods provided for each step are not repeated here. Furthermore, the beneficial effects of using the same method are also not repeated. For technical details not disclosed in the computer-readable storage medium embodiments involved in this application, please refer to the description of the method embodiments of this application. As an example, a computer program may be deployed to execute on a single computer device, or on multiple computer devices located in one location, or on multiple computer devices distributed across multiple locations and interconnected via a communication network.

[0226] The computer-readable storage medium can be the vulnerability detection processing device provided in any of the foregoing embodiments or the internal storage unit of the computer device, such as the hard drive or memory of the computer device. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0227] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform... Figure 3 or Figure 6 The methods provided in the various optional approaches enable the host machine to analyze and verify virtualization component vulnerability information when it publishes such information in the component management channel. This allows for the detection of target virtualization components deployed on the host machine. When the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component, it can be assumed that the component vulnerability indicated by the virtualization component vulnerability information may affect the operation of the virtual machines deployed on the host machine. In other words, the virtual machines on the host machine may have component vulnerabilities. By fixing these vulnerabilities, even when there are no component vulnerabilities in the virtual machines deployed on the host machine, pre-detection of potential component vulnerabilities can be achieved. This allows for timely or even earlier detection of component vulnerabilities, improving the accuracy and efficiency of vulnerability detection and handling.

[0228] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0229] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0230] The methods and related apparatus provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowcharts and / or structural diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable vulnerability detection processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable vulnerability detection processing device, create means for implementing the functions specified in one or more blocks of the flowcharts and / or one or more blocks of the structural diagrams. These computer program instructions can also be stored in a computer-readable storage medium capable of directing a computer or other programmable vulnerability detection processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more blocks of the flowcharts and / or one or more blocks of the structural diagrams. These computer program instructions may also be loaded onto a computer or other programmable vulnerability detection and processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable device, provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more blocks in the structural diagram.

[0231] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A vulnerability detection and processing method, characterized in that, The method includes: Scan and detect the virtual platform in the host machine to identify the target virtualization components included in the virtual platform; Locate the access interface associated with the target virtualization component in the data network, and determine the access interface as the component management channel associated with the target virtualization component; the component management channel is the component information publishing URL corresponding to the target virtualization component, or the device location for publishing the component information corresponding to the target virtualization component; Monitor the component management channel to obtain virtualization component vulnerability information released by the component management channel; the virtualization component vulnerability information includes vulnerability-related components; Detect the virtual running components that are in the running state in the target virtualization component. If the vulnerability-associated component exists in the virtual running component, then determine that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. The target virtualization component is updated based on vulnerability remediation data related to the vulnerability information of the target component.

2. The method as described in claim 1, characterized in that, The step of obtaining virtualization component vulnerability information released by the component management channel includes: Obtain component update information released by the component management channel, perform semantic parsing on the component update information to obtain at least one semantic grouping information, search for vulnerability keyword groups from the at least one semantic grouping information, and generate virtualization component vulnerability information based on the semantic grouping information associated with the vulnerability keyword groups.

3. The method as described in claim 1, characterized in that, The detection of virtual running components in the target virtualization component that are in a running state includes: The command parser is invoked in the host machine, and the component execution detection program for the target virtualization component is received based on the command parser. Run the component operation detection program to obtain the virtual running components in the running state of the target virtualization component.

4. The method as described in claim 1, characterized in that, The virtualization component vulnerability information also includes vulnerability association functions; If the virtual runtime component contains the vulnerability-associated component, then determining that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component includes: If the vulnerability-associated component exists in the virtual runtime component, then the virtual program code deployed in the host machine is obtained, at least one code segment in the virtual program code is traversed, and the at least one code segment is sequentially matched with the vulnerability-associated function. If at least one code segment contains a code segment that matches the vulnerability-associated function, then it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component.

5. The method as described in claim 1, characterized in that, The virtualization component vulnerability information also includes vulnerability association functionality; If the virtual runtime component contains the vulnerability-associated component, then determining that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component includes: If the vulnerability association component exists in the virtual runtime component, then the vulnerability association function is invoked in the host machine to determine the running status of the vulnerability association function in the host machine; If the vulnerability association function is in the enabled state, then it is determined that there is target component vulnerability information associated with the target virtualization component in the virtualization component vulnerability information.

6. The method as described in claim 1, characterized in that, The method further includes: If the vulnerability-associated component does not exist in the virtual runtime component, then virtualization component verification information is generated based on the vulnerability information of the virtual runtime component and the virtualization component. The virtualization component verification information is cached, and when the vulnerability-associated component is deployed, the virtualization component verification information is invoked to update and deploy the vulnerability-associated component.

7. The method as described in claim 1, characterized in that, The target component vulnerability information includes the vulnerability remediation data; updating the target virtualization component based on the vulnerability remediation data related to the target component vulnerability information includes: From the virtual program code deployed in the host machine, find the vulnerability-associated program code that is related to the vulnerability information of the target component; The vulnerability remediation data is incorporated into the vulnerability-associated program code to obtain remediation program code, and the incorporation result of the vulnerability remediation data into the remediation program code is detected. If the integration result of the vulnerability remediation data is a valid integration result, then the remediation code is subjected to functional testing. When the functional test passes, the target virtualization component is updated based on the remediation code. If the integration result of the vulnerability remediation data is an integration anomaly, then the terminal device corresponding to the vulnerability information of the target component is obtained, and a vulnerability remediation anomaly message is sent to the terminal device so that the terminal device can perform detection and update of the target virtualization component based on the vulnerability remediation anomaly message; the vulnerability remediation anomaly message includes the vulnerability information of the target component.

8. The method as described in claim 7, characterized in that, The process of incorporating the vulnerability remediation data into the vulnerability-associated program code to obtain remediation program code includes: The vulnerability-related program code was parsed to obtain the interface name and code implementation logic; The vulnerability repair data is updated based on the interface name, and the updated vulnerability repair data is added to the vulnerability-associated program code based on the code implementation logic to obtain the repair program code.

9. The method as described in claim 7, characterized in that, The functional testing of the fix code includes: Generate code test cases based on the fix code, run the code test cases, and perform test case testing on the fix code; If the test case of the fix code passes, the fix code is subjected to grayscale processing to obtain grayscale test code. The target virtualization component is then updated according to the grayscale test code to obtain the grayscale virtualization component. The grayscale virtualization component is to be released, and the functional test results of the fix code are determined based on the planned release running status of the grayscale virtualization component.

10. The method as described in claim 9, characterized in that, The step of preparing for the release of the grayscale virtualization component, and determining the functional test results of the fix code based on the planned release running status of the grayscale virtualization component, includes: Obtain the computer devices associated with the host machine, and identify the computer devices whose usage frequency for the virtual platform is less than the usage test threshold as test devices; The grayscale virtualization component is sent to the test device for planned release, so that the test device deploys the grayscale virtualization component and sends the grayscale component's running results to the host machine; Receive the grayscale component operation result sent by the test device. If the grayscale component operation result is a normal operation result, then it is determined that the functional test of the repair program code has passed. If the grayscale component's execution result includes runtime vulnerability feedback information, then it is determined that the functional test of the fix code has failed, and the fix code is updated based on the runtime vulnerability feedback information.

11. A vulnerability detection and processing device, characterized in that, The device includes: The channel search module is used to scan and detect virtual platforms in the host machine and identify target virtualization components included in the virtual platform; The channel search module is further configured to search for the access interface associated with the target virtualization component in the data network, and determine the access interface as the component management channel associated with the target virtualization component; the component management channel is the component information publishing URL corresponding to the target virtualization component, or the device location for publishing the component information corresponding to the target virtualization component; The channel monitoring module is used to monitor the component management channel and obtain virtualization component vulnerability information published by the component management channel; the virtualization component vulnerability information includes vulnerability-related components; The component detection module is used to detect virtual running components that are in the running state in the target virtualization component. If the vulnerability-associated component exists in the virtual running component, it is determined that the virtualization component vulnerability information contains target component vulnerability information associated with the target virtualization component. The component update module is used to update the target virtualization component based on vulnerability remediation data related to the vulnerability information of the target component.

12. A computer device, characterized in that, Includes processor, memory, and input / output interfaces; The processor is connected to the memory and the input / output interface respectively, wherein the input / output interface is used to receive data and output data, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device executes the method according to any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-10.

Images