A method and device for associating network assets and vulnerabilities based on fingerprints

Abstract

The present invention provides a method and device for associating network assets and vulnerabilities based on fingerprints, the method comprising: detecting network assets and obtaining return messages of the network assets; generating network asset CPE fingerprints; associating the extracted CPE information with the CVE number; storing the obtained correspondence between CPE and CVE in a CPE-CVE association database; storing the data in the CPE-CVE association database in a CPE-CVE cache database; querying the cache database based on a time value, if the network asset CPE fingerprint matches the fingerprint in the CPE-CVE cache database, adding the corresponding CVE number to the network asset identified by the network asset CPE fingerprint and storing it in the network asset database. According to the solution of the present invention, the real-time and accuracy of the association are improved; rapid association query of asset vulnerabilities can be realized, and the query speed is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a method and device for associating network assets and vulnerabilities based on fingerprints. Background Art

[0002] Specific vulnerabilities can affect one or more products and their versions. After common vulnerabilities are exposed, a verification Poc can be written based on the vulnerability details. This Poc can be used to remotely verify whether the tested system has the corresponding vulnerability. However, this operation has many limitations, such as the need to generate message interactions with the other party's server, easy traceability, and large resource overhead for large-scale verification systems.

[0003] Currently, network assets are abundant, and there are more and more network asset detection platforms, such as Shodan, ZoomEye and Fofa. After the detection platform detects network assets, it needs to associate the corresponding assets with vulnerabilities, and then store the assets in the database. These platforms will process the detected data before storing the detected assets. One step is to associate the assets with vulnerabilities and label the assets with corresponding vulnerability tags. This operation can increase the value of platform data and lay the foundation for subsequent analysis. The platform usually sets up Poc to verify asset vulnerabilities while detecting assets, and then transmits the scanned vulnerability information and the detected assets back to the server. For example, asset detection and vulnerability scanning for common operating systems, Web applications, databases, and industrial control equipment are typically applied by software such as Nmap, but this step requires high resources and time.

[0004] Similar applications also exist in the antivirus field. Currently, security software such as 360 Antivirus, Rising Antivirus, and Kingsoft Antivirus will scan the host for vulnerabilities when performing a security scan on the host. A common practice is to scan the host operating system and installed software, and use known vulnerability information for verification to check whether there are vulnerabilities in the current system and installed software version. However, this operation also consumes more system resources and time, and can easily cause system instability. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a fingerprint-based network asset and vulnerability association method and device to solve the technical problem of low efficiency in associating network assets with vulnerabilities in the prior art. Currently, the industry mostly uses POC to verify possible vulnerabilities in assets, which has large resource overhead and low speed.

[0006] According to a first aspect of the present invention, a method for associating network assets and vulnerabilities based on fingerprints is provided, the method comprising the following steps:

[0007] Step S1: Detect network assets and obtain return messages from the network assets; parse key information from the return messages, where the key information includes the category, name, and version of the affected products; generate a network asset CPE fingerprint based on the key information, where the network asset CPE fingerprint is used to identify a single network asset;

[0008] Step S2: regularly obtain updated CVE data from the NVD database, and parse the CPE field in the updated CVE data; obtain a CPE dictionary, extract the category, name, and version information of the affected product in the CPE dictionary, and use it as the extracted CPE information; associate the extracted CPE information with the CVE data; store the corresponding relationship between the obtained CPE information and the CVE data in a CPE-CVE association database; store the data in the CPE-CVE association database in a CPE-CVE cache database;

[0009] Step S3: Match the network asset CPE fingerprint with the fingerprint of the CPE-CVE cache database; if the match is successful, it means that the current network asset has a vulnerability; if the match is unsuccessful, it means that the current asset does not have a vulnerability stored in the database;

[0010] Step S4: Add the corresponding CVE number to the network asset identified by the network asset CPE fingerprint. If the detected network asset has no vulnerability, the CVE number is left blank and stored in the network asset database.

[0011] Preferably, in step S1, wherein:

[0012] The key information includes banner information, which includes the category, name, and version of the affected product;

[0013] The network asset CPE fingerprint refers to a corresponding fingerprint compiled from the category, name, and version information of the affected product in the CPE information extracted from the CVE data packet crawled from the network.

[0014] Preferably, a network asset CPE fingerprint is generated in a customized manner, and based on the attributes of the category, name, and version of the network asset, the attributes are encoded and the encoding is used as the asset fingerprint.

[0015] Preferably, storing the data in the CPE-CVE association database in a cache database includes:

[0016] Step S201: Determine cache data that the CPE-CVE association database needs to store in a cache database;

[0017] Step S202: partitioning the cache server by year, extracting the time value in the CVE data, inputting the time value into the classification algorithm module, and the classification algorithm module obtains the cache partition number according to the time value;

[0018] Step S203: writing the cache data into a cache partition corresponding to the cache data in a cache server according to the year, and the cache server deploys the cache database.

[0019] Preferably, the step S4 comprises:

[0020] Step S401: obtaining a CPE fingerprint generated by a resolution server, and obtaining a time value of the network asset; determining a corresponding cache partition in the CVE-CPE association database based on the time value, and obtaining a cache partition number;

[0021] Step S402: traverse the data in the cache partition corresponding to the cache partition number, and query the CVE number corresponding to the network asset; if it exists, proceed to step S403; if not, set a null value and proceed to step S404;

[0022] Step S403: adding a label with a corresponding CVE number to the network asset, adding the network asset to the asset database, and the method ends;

[0023] Step S404: adding an empty tag to the network asset, adding the network asset to the asset database, and the method ends.

[0024] According to a second aspect of the present invention, a fingerprint-based network asset and vulnerability association device is provided, the device comprising:

[0025] Detection module: configured to detect network assets and obtain return messages from the network assets; parse key information from the return messages, where the key information includes the category, name, and version of the affected product; generate a network asset CPE fingerprint based on the key information, where the network asset CPE fingerprint is used to identify a single network asset;

[0026] CPE-CVE association module: configured to periodically obtain updated CVE data from the NVD database, parse the CPE field in the updated CVE data; obtain a CPE dictionary, extract the category, name, and version information of the affected product in the CPE dictionary, and use it as the extracted CPE information; associate the extracted CPE information with the CVE data; store the corresponding relationship between the obtained CPE information and the CVE data in the CPE-CVE association database; store the data in the CPE-CVE association database in the CPE-CVE cache database;

[0027] Matching module: configured to match the network asset CPE fingerprint with the fingerprint of the CPE-CVE cache database; if the match is successful, it means that the current network asset has a vulnerability; if the match is unsuccessful, it means that the current asset does not have a vulnerability stored in the database;

[0028] Storage module: add the corresponding CVE number to the network asset identified by the network asset CPE fingerprint; if the detected network asset has no vulnerability, the CVE number is cleared and stored in the network asset database.

[0029] According to a third aspect of the present invention, a fingerprint-based network asset and vulnerability association system is provided, comprising:

[0030] A processor, which is used to execute multiple instructions;

[0031] A memory for storing a plurality of instructions;

[0032] The plurality of instructions are used to be stored in the memory and loaded and executed by the processor as described above.

[0033] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein a plurality of instructions are stored in the storage medium; the plurality of instructions are used for a processor to load and execute the aforementioned method.

[0034] According to the above scheme of the present invention, the method automatically and batch extracts the detected asset CPE fingerprint from the parsing server; when the CVE and CPE official website information are updated and the internal data is updated, the CPE-CVE association database can be updated in time; the database can be deployed on the cache server to improve the query efficiency and the storage speed. The present invention adopts CPE fingerprint generation technology, CPE-CVE association technology, cache database query technology, and does not use Poc for large-scale remote verification, which better avoids the problem of triggering the remote host protection mechanism and greatly improves the speed of associating assets and vulnerabilities. It has the following technical effects: (1) The method can be used to automatically extract relevant CPE information in assets, and the CPE structure can be customized according to the task to be carried out; (2) The method can be used to automatically associate CPE and CVE, and automatically update the CPE-CVE association database, ensuring that the work tasks can use the latest version of the database to perform the association task, thereby improving the real-time and accuracy of the association. (3) The classification-based distributed cache database technology can be used to realize rapid association query of asset vulnerabilities and improve the query speed.

[0035] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, the following is a detailed description of the preferred embodiments of the present invention in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention, and the present invention is described by providing the following accompanying drawings. In the accompanying drawings:

[0037] Figure 1 This is a flow chart of a method for associating network assets and vulnerabilities based on fingerprints according to an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of generating CPE-CVE association data according to an embodiment of the present invention;

[0039] Figure 3 A schematic diagram of storing data in a CPE-CVE association database in a cache database according to an embodiment of the present invention;

[0040] Figure 4 This is a structural block diagram of a fingerprint-based network asset and vulnerability association device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] First combine Figure 1 The following is a flow chart of a fingerprint-based network asset and vulnerability association method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0043] Step S1: Detect network assets and obtain return messages from the network assets; parse key information from the return messages, where the key information includes the category, name, and version of the affected products; generate a network asset CPE fingerprint based on the key information, where the network asset CPE fingerprint is used to identify a single network asset;

[0044] Step S2: regularly obtain updated CVE data from the NVD database, and parse the CPE field in the updated CVE data; obtain a CPE dictionary, extract the category, name, and version information of the affected product in the CPE dictionary, and use it as the extracted CPE information; associate the extracted CPE information with the CVE data; store the corresponding relationship between the obtained CPE information and the CVE data in a CPE-CVE association database; store the data in the CPE-CVE association database in a CPE-CVE cache database;

[0045] Step S3: Match the network asset CPE fingerprint with the fingerprint of the CPE-CVE cache database; if the match is successful, it means that the current network asset has a vulnerability; if the match is unsuccessful, it means that the current asset does not have a vulnerability stored in the database;

[0046] Step S4: Add the corresponding CVE number to the network asset identified by the network asset CPE fingerprint. If the detected network asset has no vulnerability, the CVE number is left blank and stored in the network asset database.

[0047] The step S1, wherein:

[0048] The generating of the network asset fingerprint based on the key information includes:

[0049] The key information includes banner information, which includes the category, name, version, etc. of the affected product.

[0050] The fingerprint in the database refers to the corresponding fingerprint compiled by extracting the category, name, version and other information of the affected product in the CPE information from the CVE data packets crawled from the Internet.

[0051] The latest CPE (Common Platform Enumeration) version is 2.3. The CPE2.3 naming specification defines a standardized method for assigning names to IT product categories. Take Microsoft Internet Explorer 8.0.6001Beta as an example:

[0052] wfn: [part="a", vendor="microsoft", product="internet_explorer", version="8\.0\.6001", update="beta"]

[0053] This naming method is called WFN (well-formed CPE names), which is an abstract logical structure. The CPE naming specification defines the process of binding WFNs to machine-readable codes and unbinding these codes back to WFNs. CPE 2.3 includes a binding called Uniform Resource Identifier (URI) for backward compatibility with CPE 2.2. The URI binding of the WFN above is represented as:

[0054] cpe: / a:microsoft:internet_explorer:8.0.6001:beta

[0055] The second binding defined in CPE 2.3 is called a formatted string binding. Its syntax is slightly different from the URI binding and also supports additional product attributes. Using the formatted string binding, the above WFN can be expressed in the following form:

[0056] cpe:2.3:a:microsoft:internet_explorer:8.0.6001:beta:*:*:*:*:*:*

[0057] The WFN contains the following attributes as shown in Table 1:

[0058] Table 1

[0059] Serial number property describe 1 part Asset Type 2 vendor A person or organization that makes or creates a product 3 product The most common and recognizable product title or name 4 version A specific release version of a product 5 update A specific update, service pack or point release for a product 6 edition This attribute has been deprecated in CPE version 2.3. 7 language Languages ​​supported in the product's user interface 8 sw_edition Products tailored to specific markets or end-user categories 9 target_sw The software computing environment in which the product runs 10 target_hw The instruction set architecture on which the product is based 11 other Other general descriptive or identifying information

[0060] In this embodiment, a customized CPE format is used to generate network asset fingerprints. The customized CPE format refers to extracting key information such as asset category, name, version, etc. from the detected network assets, simplifying the CPE official format, retaining only attributes such as category, name, version, encoding the retained attributes, and using the encoding as the asset fingerprint. This approach can both increase the matching speed and reduce attribute redundancy. The fingerprints in the local fingerprint library can use open source fingerprints, or custom fingerprints can be added according to the task to form an exclusive fingerprint library.

[0061] like Figure 2 As shown, the step S2, wherein:

[0062] NVD is a repository of standard-based vulnerability management data represented by the U.S. government using the Security Content Automation Protocol (SCAP). These data support the automation of vulnerability management, security metrics, and regulatory compliance. NVD includes a database of security checklist references, security-related software defects, misconfigurations, product names, and impact metrics. Its CVE data is updated monthly, and the data contains the formatted vulnerability numbers exposed that month, the software and hardware version information affected by the vulnerability, and the CVSS score of the vulnerability, which has a high reference value. The U.S. National Vulnerability Database regularly publishes CPE dictionaries. Extract key information such as asset category, name, version, etc. in the CPE dictionary, and generate network asset CPE fingerprints based on this; when a CVE vulnerability is released, the asset information affected by the vulnerability will be disclosed, including CPE information, and the CPE involved in the vulnerability will be associated with the CVE number. In this embodiment, the CPE dictionary and CVE database are crawled, and the CPE information obtained is cleaned, and the CPE and the CVE corresponding to the CPE are determined by regular matching. One CPE can correspond to multiple CVEs, and one CVE may also have multiple CPEs. In this embodiment, a crawler is used to crawl relevant data regularly, and CPE and CVE information are extracted to form a CPE-to-CVE association database. Furthermore, the CVE number can be compiled according to internal rules by adding relevant associated data, and CPE information can be generated according to a custom CPE format, and CVE and CPE associated information can be added to the database. For example, for some 0day vulnerabilities, there is no corresponding CVE number and CPE information on the Internet, so the CVE number can be compiled according to internal rules, and CPE information can be generated according to a custom CPE format, and the CVE and CPE associated information of the relevant 0day vulnerabilities can be added to the database.

[0063] The data storage format in the CVE and CPE association database is shown in Table 2 below:

[0064] Table 2

[0065] CPE Information CVE Information

[0066] For example, one of the CPE storage formats for CVE-2021-0203 is shown in Table 3 below:

[0067] Table 3

[0068] cpe:2.3:o:juniper:junos:15.1:* CVE-2021-0203

[0069] In this embodiment, CPE is a structured naming scheme for information technology systems, software, and packages. Based on the universal syntax of uniform resource identifiers (URIs), CPE includes a formal name format, a method for checking names according to the system, and a description format for binding text and tests to names. The officially released CVE database contains CVE information and CPE information such as the software version affected by this vulnerability, as well as CVSS information. The software version information involved can be extracted using regular matching, stored in CPE format, and then associated with the CVE number.

[0070] Furthermore, the data in the CPE-CVE association database is backed up, the backup data is stored in a cache database, and the CPE-CVE association database is regularly updated and synchronized to the cache database.

[0071] In this embodiment, the cache database refers to a cache system that stores data in memory. Since the CPE-CVE associated database is not large, memory storage can be used to reduce the number of times the database is read, speed up the query speed, and thus improve the performance of the entire system. The operation of the cache database involves reading and writing. The write operation is to store or update the CPE-CVE data, that is, to store the data in the CPE-CVE associated database in the cache database. Since the NVD original data can be crawled by year, it can be classified by year, and the formation of distributed operations can be formed by using multiple cache servers, or by opening up multiple cache partitions in a cache server. The present invention selects the latter scheme for distributed operations to achieve the purpose of shortening the query time during query.

[0072] like Figure 3 As shown, storing the data in the CPE-CVE association database in a cache database includes:

[0073] Step S201: the CPE-CVE association database becomes cache data that needs to be stored in the cache database;

[0074] Step S202: partitioning the cache server by year, extracting the time value in the CVE data, inputting the time value into the classification algorithm module, and using the classification algorithm to obtain the cache partition number according to the time value;

[0075] Step S203: writing the cache data into a cache partition corresponding to the cache data in a cache server according to the year, and the cache server deploys the cache database.

[0076] That is, a distributed cache write operation is completed.

[0077] The step S4, wherein:

[0078] In this embodiment, the generated CPE-CVE association database is stored on the cache server. After the CPE fingerprint of the newly detected asset is extracted, it is sent to the cache server for vulnerability matching. If it is associated with relevant CVE information, the new asset is labeled with the corresponding CVE number and stored in the asset database.

[0079] Query Operation The read operation is to query whether the newly detected network assets have associated vulnerabilities.

[0080] Based on the CPE information, query the CVE information corresponding to the CPE information; add the corresponding CVE information to the network asset, and store the network asset in the asset database, including:

[0081] Step S401: obtaining a CPE fingerprint generated by a resolution server, and obtaining a time value of the network asset; determining a corresponding cache partition in the CVE-CPE association database based on the time value, and obtaining a cache partition number;

[0082] Step S402: traverse the data in the cache partition corresponding to the cache partition number, and query the CVE number corresponding to the network asset; if it exists, proceed to step S403; if not, set a null value and proceed to step S404;

[0083] Step S403: adding a label with a corresponding CVE number to the network asset, adding the network asset to the asset database, and the method ends;

[0084] Step S404: adding an empty tag to the network asset, adding the network asset to the asset database, and the method ends.

[0085] Figure 4 FIG. 1 is a schematic diagram of a fingerprint-based network asset and vulnerability association device according to an embodiment of the present invention. Figure 4 As shown, the device comprises:

[0086] Detection module: configured to detect network assets and obtain return messages from the network assets; parse key information from the return messages, where the key information includes the category, name, and version of the affected product; generate a network asset CPE fingerprint based on the key information, where the network asset CPE fingerprint is used to identify a single network asset;

[0087] CPE-CVE association module: configured to periodically obtain updated CVE data from the NVD database, parse the CPE field in the updated CVE data; obtain a CPE dictionary, extract the category, name, and version information of the affected product in the CPE dictionary, and use it as the extracted CPE information; associate the extracted CPE information with the CVE data; store the corresponding relationship between the obtained CPE information and the CVE data in the CPE-CVE association database; store the data in the CPE-CVE association database in the CPE-CVE cache database;

[0088] Matching module: configured to match the network asset CPE fingerprint with the fingerprint of the CPE-CVE cache database; if the match is successful, it means that the current network asset has a vulnerability; if the match is unsuccessful, it means that the current asset does not have a vulnerability stored in the database;

[0089] Storage module: add the corresponding CVE number to the network asset identified by the network asset CPE fingerprint; if the detected network asset has no vulnerability, the CVE number is cleared and stored in the network asset database.

[0090] The embodiment of the present invention further provides a fingerprint-based network asset and vulnerability association system, including:

[0091] A processor, which is used to execute multiple instructions;

[0092] A memory for storing a plurality of instructions;

[0093] The plurality of instructions are used to be stored in the memory and loaded and executed by the processor as described above.

[0094] The embodiment of the present invention further provides a computer-readable storage medium, wherein a plurality of instructions are stored in the storage medium; the plurality of instructions are used for a processor to load and execute the aforementioned method.

[0095] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0096] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0097] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0098] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0099] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a physical server, or a network cloud server, etc., which needs to be installed with Windows or Windows Server operating system) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (RandomAccess Memory, RAM), disk or optical disk and other media that can store program codes.

[0100] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A fingerprint-based method for associating network assets with vulnerabilities. It is characterized in that The method comprises the following steps: Step S1: Detect network assets and obtain return messages from the network assets; parse key information from the return messages, where the key information includes the category, name, and version of the affected products; generate a network asset CPE fingerprint based on the key information, where the network asset CPE fingerprint is used to identify a single network asset; Step S2: regularly obtain updated CVE data from the NVD database, and parse the CPE field in the updated CVE data; obtain a CPE dictionary, extract the category, name, and version information of the affected product in the CPE dictionary, and use it as the extracted CPE information; associate the extracted CPE information with the CVE data; store the corresponding relationship between the obtained CPE information and the CVE data in a CPE-CVE association database; store the data in the CPE-CVE association database in a CPE-CVE cache database; Step S3: Match the network asset CPE fingerprint with the fingerprint of the CPE-CVE cache database; if the match is successful, it means that the current network asset has a vulnerability; if the match is unsuccessful, it means that the current asset does not have a vulnerability stored in the database; Step S4: Add the corresponding CVE number to the network asset identified by the network asset CPE fingerprint. If the detected network asset has no vulnerability, the CVE number is left blank and stored in the network asset database.

2. The method according to claim 1, It is characterized in that The step S1, wherein: The key information includes banner information, which includes the category, name, and version of the affected product; The network asset CPE fingerprint refers to a corresponding fingerprint compiled from the category, name, and version information of the affected product in the CPE information extracted from the CVE data packet crawled from the network.

3. The method according to claim 2, It is characterized in that A network asset CPE fingerprint is generated in a custom manner, and based on the attributes of the category, name, and version of the network asset, the attributes are encoded and the encoding is used as the asset fingerprint.

4. The method according to claim 3, It is characterized in that Storing the data in the CPE-CVE association database in a cache database includes: Step S201: Determine cache data that the CPE-CVE association database needs to store in a cache database; Step S202: partitioning the cache server by year, extracting the time value in the CVE data, inputting the time value into the classification algorithm module, and the classification algorithm module obtains the cache partition number according to the time value; Step S203: writing the cache data into a cache partition corresponding to the cache data in a cache server according to the year, and the cache server deploys the cache database.

5. The method according to claim 4, It is characterized in that The step S4 comprises: Step S401: obtaining a CPE fingerprint generated by a resolution server, and obtaining a time value of the network asset; determining a corresponding cache partition in the CVE-CPE association database based on the time value, and obtaining a cache partition number; Step S402: traverse the data in the cache partition corresponding to the cache partition number, and query the CVE number corresponding to the network asset; if it exists, proceed to step S403; if not, set a null value and proceed to step S404; Step S403: adding a label with a corresponding CVE number to the network asset, adding the network asset to the asset database, and the method ends; Step S404: adding an empty tag to the network asset, adding the network asset to the asset database, and the method ends.

6. A fingerprint-based network asset and vulnerability association device, It is characterized in that The device comprises: Detection module: configured to detect network assets and obtain return messages from the network assets; parse key information from the return messages, where the key information includes the category, name, and version of the affected product; generate a network asset CPE fingerprint based on the key information, where the network asset CPE fingerprint is used to identify a single network asset; CPE-CVE association module: configured to periodically obtain updated CVE data from the NVD database, parse the CPE field in the updated CVE data; obtain a CPE dictionary, extract the category, name, and version information of the affected product in the CPE dictionary, and use it as the extracted CPE information; associate the extracted CPE information with the CVE number; store the obtained correspondence between CPE and CVE in the CPE-CVE association database; store the data in the CPE-CVE association database in the CPE-CVE cache database; Matching module: configured to match the network asset CPE fingerprint with the fingerprint of the CPE-CVE cache database; if the match is successful, it means that the current network asset has a vulnerability; if the match is unsuccessful, it means that the current asset does not have a vulnerability stored in the database; Storage module: add the corresponding CVE number to the network asset identified by the network asset CPE fingerprint; if the detected network asset has no vulnerability, the CVE number is cleared and stored in the network asset database.

7. A fingerprint-based network asset and vulnerability association system, It is characterized in that include: A processor, which is used to execute multiple instructions; A memory for storing a plurality of instructions; Wherein, the plurality of instructions are used to be stored by the memory, and loaded by the processor to execute the method as described in any one of claims 1-5.

8. A computer-readable storage medium, It is characterized in that The storage medium stores a plurality of instructions; the plurality of instructions are used by a processor to load and execute the method as described in any one of claims 1-5.

Images