Vulnerability detection method, device, electronic device and readable storage medium

Abstract

The present disclosure relates to a vulnerability detection method, device, electronic device, and readable storage medium. The vulnerability detection method comprises: first obtaining port information and service intermediate information of a detection target, wherein the port information includes an operating port, and the service intermediate information includes a service middleware; then, determining the target risk location based on the port information and the service intermediate information; then, determining a target vulnerability detection program based on the target risk location; and finally, performing vulnerability detection on the detection target through the target vulnerability detection program to obtain a vulnerability detection result. By performing a fixed-point lightweight scan on the detection target, aimless traversal detection of the detection target by a large number of vulnerability detection programs is avoided, thereby reducing the burden on the control system and achieving the effect of successfully completing the vulnerability scan without affecting the business of the control system.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a vulnerability detection method, device, electronic device, and readable storage medium. Background Art

[0002] Vulnerability scanning technology, in conjunction with firewalls and intrusion detection systems, can effectively improve network security. By scanning the network, network administrators can understand the network's security configuration and running application services, promptly identify security vulnerabilities, and objectively assess the network's risk level. Based on the scan results, network administrators can correct network vulnerabilities and system misconfigurations, preventing hacker attacks before they occur.

[0003] In related technologies, some control systems are sensitive to the production environment and cannot withstand system crashes and equipment downtime caused by traffic loads, making it impossible to promptly discover and repair the network security status and vulnerabilities of the control system. Summary of the Invention

[0004] The purpose of the present disclosure is to provide a vulnerability detection method, device, electronic device and readable storage medium, which can reduce the burden on the control system by performing fixed-point lightweight scanning on the detection target and successfully complete the vulnerability scanning without affecting the business of the control system.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present disclosure provides a vulnerability detection method, the vulnerability detection method comprising:

[0006] Acquire port information and service middleware information of the detection target, wherein the port information includes the operating port, and the service middleware information includes the service middleware;

[0007] Determining a target risk location based on the port information and the service intermediate information;

[0008] Determining target vulnerability detection procedures based on the target risk location;

[0009] Perform vulnerability detection on the detection target through the target vulnerability detection program to obtain a vulnerability detection result.

[0010] Optionally, determining a target risk location according to the port information and the service intermediate information includes:

[0011] Determine, according to the running port, the service corresponding to the running port;

[0012] According to the service corresponding to the running port and the service middleware, a risk position table is queried to obtain a target risk position, wherein the risk position table includes the risk position when any service corresponding to the running port and any service middleware are combined.

[0013] Optionally, the service middleware information further includes a version of the service middleware;

[0014] The determining of a target risk location according to the port information and the service intermediate information includes:

[0015] Determine, according to the running port, the service corresponding to the running port;

[0016] According to the service corresponding to the running port, the service middleware and the version of the service middleware, the risk position table is queried to obtain the target risk position. The risk position table includes the risk position when the service corresponding to any running port, any service middleware and any service middleware version are combined.

[0017] Optionally, before determining a vulnerability detection program according to the target risk location, the method further includes:

[0018] Obtain the vulnerability detection program corresponding to each risk location;

[0019] Establishing an association relationship between each risk location and its corresponding vulnerability detection program to obtain a vulnerability detection program query table;

[0020] Based on the target risk location, determine the target vulnerability detection procedures, including:

[0021] According to the target risk location, the target vulnerability detection program associated with the target risk location is determined from the vulnerability detection program query table.

[0022] Optionally, performing vulnerability detection on the detection target by the target vulnerability detection program to obtain a vulnerability detection result includes:

[0023] Sending the target vulnerability detection program to the target risk location of the detection target;

[0024] Obtaining a detection data packet sent by the detection target, wherein the detection data packet includes multiple echo results;

[0025] According to the multiple echo results, the probability that a vulnerability exists at the target risk position of the detection target is determined.

[0026] Optionally, determining, based on the multiple echo results, a probability that a vulnerability exists at the target risk location of the detection target includes:

[0027] Get the probability and weight of each echo result;

[0028] The probability that a vulnerability exists at the target risk location is determined based on the probability of each echo result and the weight of each echo result.

[0029] Optionally, obtaining the port information and service intermediate information of the detection target includes:

[0030] Perform port scanning on the detection target to obtain port information;

[0031] Perform network asset fingerprint identification on the detection target to obtain service intermediate information.

[0032] According to a second aspect of an embodiment of the present disclosure, a vulnerability detection device is provided, the vulnerability detection device comprising:

[0033] A first acquisition module is configured to acquire port information and service middleware information of a detection target, wherein the port information includes a running port, and the service middleware information includes a service middleware;

[0034] a first determining module configured to determine a target risk location based on the port information and the service intermediate information;

[0035] a second determination module configured to determine a target vulnerability detection program according to the target risk location;

[0036] The acquisition module is configured to perform vulnerability detection on the detection target through the target vulnerability detection program to obtain a vulnerability detection result.

[0037] Optionally, the first determining module includes:

[0038] A first determining submodule is configured to determine, according to the running port, a service corresponding to the running port;

[0039] The first query submodule is configured to query the risk location table according to the service corresponding to the running port and the service middleware to obtain the target risk location. The risk location table includes the risk location of any combination of the service corresponding to the running port and any service middleware.

[0040] Optionally, the service middleware information further includes a version of the service middleware;

[0041] The first determining module includes:

[0042] A second determining submodule is configured to determine, according to the running port, a service corresponding to the running port;

[0043] The second query sub-module is configured to query the risk location table according to the service corresponding to the running port, the service middleware and the version of the service middleware to obtain the target risk location. The risk location table includes the risk location when the service corresponding to any running port, any service middleware and any service middleware version are combined.

[0044] Optionally, the device further comprises:

[0045] A second acquisition module is configured to obtain a vulnerability detection program corresponding to each risk location;

[0046] an association module configured to establish an association relationship between each risk location and its corresponding vulnerability detection program to obtain a vulnerability detection program query table;

[0047] The second determining module includes:

[0048] The third determining submodule is configured to determine the target vulnerability detection program associated with the target risk location from the vulnerability detection program query table according to the target risk location.

[0049] Optionally, the obtaining module includes:

[0050] a sending submodule, configured to send the target vulnerability detection program to the target risk location of the detection target;

[0051] an acquisition submodule, configured to acquire a detection data packet sent by the detection target, wherein the detection data packet includes a plurality of echo results;

[0052] The determination submodule is configured to determine the probability that a vulnerability exists at the target risk position of the detection target based on multiple echo results.

[0053] Optionally, the determining submodule includes:

[0054] an acquisition unit configured to acquire a probability of each echo result and a weight of each echo result;

[0055] The determining unit is configured to determine the probability that a vulnerability exists at the target risk location according to the probability of each echo result and the weight of each echo result.

[0056] Optionally, the first acquisition module includes:

[0057] The scanning submodule is configured to perform port scanning on the detection target to obtain port information;

[0058] The identification submodule is configured to perform network asset fingerprint identification on the detection target to obtain service intermediate information.

[0059] According to a third aspect of an embodiment of the present disclosure, a non-transitory computer-readable storage medium is further provided, on which a computer program is stored. When the program is executed by a processor, the method described in the first aspect is implemented.

[0060] According to a fourth aspect of the embodiments of the present disclosure, there is further provided an electronic device, including:

[0061] a memory having a computer program stored thereon;

[0062] A processor is used to execute the computer program in the memory to implement the method described in the first aspect above.

[0063] Through the above technical solution, the port information and service middleware of the detection target are first obtained, the port information includes the running port, and the service middleware includes the service middleware. Then, based on the port information and service middleware, the target risk position is determined. Then, based on the target risk position, the target vulnerability detection program is determined. Finally, the target vulnerability detection program is used to perform vulnerability detection on the detection target to obtain the vulnerability detection result. By obtaining the port information and service middleware of the detection target, it is possible to determine the port on which the detection target is running and which service middleware is used to ensure that the service corresponding to the port can be executed smoothly. Then, combined with the port information and service middleware, it is possible to determine the target risk position that may be at risk, so that the target vulnerability detection program corresponding to the target risk position can be selected to perform vulnerability detection on the detection target. By performing a fixed-point lightweight scan on the detection target, it is avoided that a large number of vulnerability detection programs are used to perform aimless traversal detection on the detection target, thereby reducing the burden on the control system and achieving the effect of successfully completing the vulnerability scan without affecting the business of the control system.

[0064] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following detailed description, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings:

[0066] Figure 1 This is a flowchart of the steps of a vulnerability detection method provided by an embodiment of the present disclosure;

[0067] Figure 2 is a flowchart of the steps of a method for determining a target risk location provided by an embodiment of the present disclosure;

[0068] Figure 3 is a flowchart of another method for determining a target risk location provided by an embodiment of the present disclosure;

[0069] Figure 4 is a flowchart of the steps of a method for determining vulnerability detection results provided by an embodiment of the present disclosure;

[0070] Figure 5 is a block diagram of a vulnerability detection device provided by an embodiment of the present disclosure;

[0071] Figure 6 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0072] The following describes the specific embodiments of the present disclosure in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present disclosure and are not intended to limit the present disclosure.

[0073] It should be noted that all actions of acquiring signals, information or data in the present disclosure are carried out in compliance with the corresponding data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0074] Figure 1 This is a flowchart of a vulnerability detection method provided by an embodiment of the present disclosure. Figure 1 As shown, the vulnerability detection method includes the following steps:

[0075] In step S11, the port information and service middleware information of the detection target are acquired, wherein the port information includes the running port, and the service middleware information includes the service middleware.

[0076] The detection target can be an industrial control system or power monitoring system, a control system that is sensitive to the production environment. Before sending the vulnerability detection program to the detection target, the target's port information and service intermediate information are first obtained. The port information may include the operating port, that is, the operating port is the port currently in use by the detection target. Specifically, a port scan can be performed on the detection target to obtain the port in use by the detection target. The scanner can scan multiple ports of the detection target. For example, the operating port number can be 21 or 23.

[0077] Among them, the service middleware may include service middleware, which is different assets, that is, different frameworks. Specifically, network asset fingerprint identification can be performed on the detection target to obtain the service middleware, which can be Web server software, such as Apache.

[0078] In step S12, a target risk location is determined based on the port information and the service intermediate information.

[0079] After determining the port information, that is, after determining the port where the detection target is running, since different ports cooperate with different middleware, the locations of possible vulnerabilities are not the same. In order to narrow the scope of vulnerability detection, the service middleware in the service middleware information can also be obtained, and the running port and the service middleware can be combined to obtain a more accurate target risk location, so that vulnerability detection can be performed on the target risk location.

[0080] In step S13, a target vulnerability detection program is determined according to the target risk location.

[0081] After determining the target risk location, the possible vulnerabilities at the location can be determined based on the target risk location, and the corresponding target vulnerability detection program can be obtained to determine whether there is a vulnerability at the location.

[0082] In step S14, vulnerability detection is performed on the detection target by the target vulnerability detection program to obtain a vulnerability detection result.

[0083] After determining the target vulnerability detection program, the target vulnerability detection program can be used to perform vulnerability detection on the detection target to obtain a vulnerability detection result. The vulnerability detection result can be a probability of vulnerability existence, such as a 70% probability of vulnerability existence, or a classification of the degree of vulnerability possibility, such as a high risk probability of vulnerability existence, a medium risk probability of vulnerability existence, or a low risk probability of vulnerability existence. Alternatively, the result can be a direct determination of whether a vulnerability exists, i.e., whether a vulnerability exists or not.

[0084] Figure 2 This is a flowchart of a method for determining a target risk location provided by an embodiment of the present disclosure. Figure 2 As shown, in a feasible implementation manner, a specific method for determining a target risk location according to port information and service intermediate information may include the following steps S21 to S22:

[0085] In step S21, the service corresponding to the operating port is determined according to the operating port.

[0086] Different running ports correspond to different services, but a certain running port usually runs a certain service, that is, one-to-one correspondence. The service corresponding to the running port can be determined through the running port. For example, if the port number of the running port is 21, the corresponding service is the file transfer service. If the port number of the running port is 23, the corresponding service is the remote login service.

[0087] In step S22, according to the service corresponding to the running port and the service middleware, a risk position table is queried to obtain a target risk position. The risk position table includes the risk position when any service corresponding to the running port and any service middleware are combined.

[0088] Among them, the risk location table includes the risk location when any service corresponding to the running port and any service middleware are combined. The risk location table can be generated in advance. Specifically, the location where the vulnerability may exist when the service corresponding to the running port and the service middleware are combined can be obtained, and the service and service middleware combination corresponding to the running port is associated with the possible vulnerability location, thereby establishing a risk location table. The service and service middleware corresponding to the running port are combined, and then the vulnerability location corresponding to the same combination is queried from the risk location table to obtain the target risk location. Through the above method, the risk location table is established in advance, and the target risk location corresponding to the combination of the service corresponding to the current running port and the service middleware can be quickly queried in the risk location table, thereby facilitating fixed-point vulnerability detection.

[0089] Figure 3 is a flowchart of another method for determining a target risk location provided by an embodiment of the present disclosure. Figure 3 As shown, in a feasible implementation manner, the service middleware information also includes the version of the service middleware;

[0090] The specific method of determining the target risk location based on the port information and the service intermediate information may include the following steps S31 to S32:

[0091] In step S31, according to the operating port, the service corresponding to the operating port is determined;

[0092] In step S32, according to the service corresponding to the running port, the service middleware and the version of the service middleware, the risk location table is queried to obtain the target risk location. The risk location table includes the risk location of any combination of the service corresponding to any running port, any service middleware and any version of the service middleware.

[0093] The specific explanation of the above step S31 can refer to step S21 and will not be repeated here. The risk location table includes the risk location of any service corresponding to the running port, any service middleware, and any service middleware version combination. The risk location table can be generated in advance. Specifically, the location where the vulnerability may exist when the service, service middleware, and service middleware version combination corresponding to the running port are obtained, and the service, service middleware, and service middleware version combination corresponding to the running port are associated with the existing vulnerability location, thereby establishing a risk location table. The service, service middleware, and service middleware corresponding to the running port are combined, and the vulnerability location corresponding to the same combination is queried from the risk location table to obtain the target risk location.

[0094] Through the above method, the port information and service middleware information can be combined to quickly determine the location where the combination of the current running port and service middleware may have vulnerability risks, that is, the target risk location, thereby avoiding blind vulnerability detection on the detection target and reducing the burden on the control system.

[0095] In a feasible implementation manner, before determining the vulnerability detection program based on the target risk location, the method further includes:

[0096] Obtain the vulnerability detection program corresponding to each risk location;

[0097] An association relationship is established between each risk location and its corresponding vulnerability detection program to obtain a vulnerability detection program query table.

[0098] In this embodiment, a vulnerability detection program corresponding to each risk location can be obtained. Specifically, it can be queried whether there is a corresponding vulnerability detection program for each risk location. If so, the corresponding vulnerability detection program can be directly obtained. If not, the vulnerability detection program input by the programmer can be obtained. Alternatively, regardless of whether there is a vulnerability detection program, the vulnerability detection program input by the programmer can be obtained. The vulnerability detection program can be a vulnerability detection program based on python3.

[0099] Then, an association relationship between each risk location and its corresponding vulnerability detection program is established to obtain a vulnerability detection program query table.

[0100] Based on the target risk location, determine the target vulnerability detection procedures, including:

[0101] According to the target risk location, the target vulnerability detection program associated with the target risk location is determined from the vulnerability detection program query table.

[0102] In this embodiment, since the vulnerability detection program query table contains the association relationship between each risk location and its corresponding vulnerability detection program, after obtaining the target risk location, the target vulnerability detection program can be directly queried from the vulnerability detection program query table based on the target risk location, so as to perform corresponding vulnerability detection on the target location, thereby improving detection efficiency and accuracy, and reducing the operating pressure of the detection target.

[0103] Figure 4 This is a flowchart of a method for determining vulnerability detection results provided by an embodiment of the present disclosure. Figure 4 As shown, in a feasible implementation manner, performing vulnerability detection on the detection target by the target vulnerability detection program to obtain a vulnerability detection result may include the following steps S41 to S43:

[0104] In step S41, the target vulnerability detection program is sent to the target risk location of the detection target.

[0105] After determining the target risk position of the detection target and the target vulnerability detection program corresponding to the target risk position, the target vulnerability detection program can be sent to the target risk position of the detection target. The target vulnerability detection program is used to enable the detection target to return the corresponding detection data packet, that is, after the detection target receives the target vulnerability detection program, it responds to the received target vulnerability detection program and returns the detection data packet to this vulnerability detection device.

[0106] In step S42, a detection data packet sent by the detection target is obtained, where the detection data packet includes a plurality of echo results.

[0107] After the detection target receives the target vulnerability detection program, the detection target will respond to the received target vulnerability detection program and return a detection data packet to the vulnerability detection device. The vulnerability detection device receives and obtains the detection data packet sent by the detection target, wherein the detection data packet includes multiple echo results. Specifically, the number of echo results included in the monitoring data packet can be limited by setting the content of the target vulnerability detection program. For example, for an existing vulnerability detection program, the vulnerability detection program can be directly simplified to reduce the number of echo results in the returned detection data packet, thereby reducing the data processing amount and data transmission amount of the detection target.

[0108] In step S43, the probability that a vulnerability exists at the target risk position of the detection target is determined based on the multiple echo results.

[0109] After obtaining multiple echo results, you can analyze the echo results to determine whether a vulnerability exists at the target risk location or the probability of a vulnerability existing. The echo results can indicate the probability of a vulnerability existing. For example, the multiple echo results may indicate: no information leakage vulnerability, no struts2_053 vulnerability, and no coremail vulnerability.

[0110] Specifically, the specific method for determining the probability that a vulnerability exists at the target risk position of the detection target based on the multiple echo results may be:

[0111] Get the probability and weight of each echo result;

[0112] The probability that a vulnerability exists at the target risk location is determined based on the probability of each echo result and the weight of each echo result.

[0113] In this embodiment, due to the possibility of false positives, a probability is set for each echo result, and the size of the probability is the size of the confidence level. For example, the probability that the echo result indicates that there is no information leakage vulnerability is 70%, that is, the echo result indicates that there is no information leakage vulnerability, and its confidence level is 70%. Each echo result also corresponds to a weight, which is used to calculate the total probability. Specifically, the probability of the existence of a vulnerability or the probability of the absence of a vulnerability is first unified, and then the weight of each echo result is used to perform a weighted average of the probabilities of all unified echo results to obtain the total probability of the absence of a vulnerability or the total probability of the presence of a vulnerability, thereby obtaining the probability of the presence of a vulnerability at the target risk location. For example, if one echo result indicates that there is no information leakage vulnerability, the corresponding probability is 70% and the weight is 0.3, and another echo result indicates that there is a coremail email vulnerability, the corresponding probability is 70% and the weight is 0.7. In this case, both are considered to have a vulnerability, that is, an information leakage vulnerability, with a corresponding probability of 30%. At this time, the probability of the information leakage vulnerability is multiplied by the weight to obtain 9%, and the probability of the coremail email vulnerability is multiplied by the weight to obtain 49%. Then, adding them together, we can get the probability of the vulnerability existing in the target risk location to be 58%.

[0114] In the above method, by sending the target vulnerability detection program to the target location of the detection target, the detection data packet returned by the detection target can be obtained. The detection data packet contains multiple echo results. By analyzing the multiple echo results, the final vulnerability detection result can be obtained based on the multiple echo results, that is, the probability that a vulnerability exists in the detection target.

[0115] Figure 5 is a block diagram of a vulnerability detection device provided by an embodiment of the present disclosure, such as Figure 5As shown, the vulnerability detection device includes a first acquisition module 51, a first determination module 52, a second determination module 53 and an acquisition module 54:

[0116] The first acquisition module 51 is configured to acquire port information and service middleware information of the detection target, wherein the port information includes the operating port, and the service middleware information includes the service middleware;

[0117] The first determining module 52 is configured to determine a target risk location based on the port information and the service intermediate information;

[0118] The second determining module 53 is configured to determine a target vulnerability detection program according to the target risk location;

[0119] The obtaining module 54 is configured to perform vulnerability detection on the detection target through the target vulnerability detection program to obtain a vulnerability detection result.

[0120] Optionally, the first determining module 52 includes:

[0121] A first determining submodule is configured to determine, according to the running port, a service corresponding to the running port;

[0122] The first query submodule is configured to query the risk location table according to the service corresponding to the running port and the service middleware to obtain the target risk location. The risk location table includes the risk location of any combination of the service corresponding to the running port and any service middleware.

[0123] Optionally, the service middleware information further includes a version of the service middleware;

[0124] The first determining module 52 includes:

[0125] A second determining submodule is configured to determine, according to the running port, a service corresponding to the running port;

[0126] The second query sub-module is configured to query the risk location table according to the service corresponding to the running port, the service middleware and the version of the service middleware to obtain the target risk location. The risk location table includes the risk location when the service corresponding to any running port, any service middleware and any service middleware version are combined.

[0127] Optionally, the device further comprises:

[0128] A second acquisition module is configured to obtain a vulnerability detection program corresponding to each risk location;

[0129] an association module configured to establish an association relationship between each risk location and its corresponding vulnerability detection program to obtain a vulnerability detection program query table;

[0130] The second determining module 53 includes:

[0131] The third determining submodule is configured to determine the target vulnerability detection program associated with the target risk location from the vulnerability detection program query table according to the target risk location.

[0132] Optionally, the obtaining module 54 includes:

[0133] a sending submodule, configured to send the target vulnerability detection program to the target risk location of the detection target;

[0134] an acquisition submodule, configured to acquire a detection data packet sent by the detection target, wherein the detection data packet includes a plurality of echo results;

[0135] The determination submodule is configured to determine the probability that a vulnerability exists at the target risk position of the detection target based on multiple echo results.

[0136] Optionally, the determining submodule includes:

[0137] an acquisition unit configured to acquire a probability of each echo result and a weight of each echo result;

[0138] The determining unit is configured to determine the probability that a vulnerability exists at the target risk location according to the probability of each echo result and the weight of each echo result.

[0139] Optionally, the first acquisition module 51 includes:

[0140] The scanning submodule is configured to perform port scanning on the detection target to obtain port information;

[0141] The identification submodule is configured to perform network asset fingerprint identification on the detection target to obtain service intermediate information.

[0142] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0143] Figure 6 FIG. 1 is a block diagram of an electronic device according to an exemplary embodiment. Figure 6 As shown, the electronic device 700 may include: a processor 701 , a memory 702 , and may further include one or more of a multimedia component 703 , an input / output interface 704 , and a communication component 705 .

[0144] The processor 701 is used to control the overall operation of the electronic device 700 to complete all or part of the steps in the vulnerability detection method described above. The memory 702 is used to store various types of data to support the operation of the electronic device 700. Such data may include, for example, instructions for any application or method operating on the electronic device 700, as well as application-related data, such as contact information, sent and received messages, images, audio, video, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The multimedia component 703 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signal may be further stored in the memory 702 or sent via the communication component 705. The audio component also includes at least one speaker for outputting audio signals. The input / output interface 704 provides an interface between the processor 701 and other interface modules. The above-mentioned other interface modules may be a keyboard, a mouse, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 705 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IOT, eMTC, or other 5G, etc., or a combination of one or more thereof, is not limited here. Therefore, the corresponding communication component 705 may include: a Wi-Fi module, a Bluetooth module, an NFC module, etc.

[0145] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-mentioned vulnerability detection method.

[0146] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided. When the program instructions are executed by a processor, the steps of the vulnerability detection method described above are implemented. For example, the computer-readable storage medium may be the memory 702 including the program instructions described above. The program instructions may be executed by the processor 701 of the electronic device 700 to implement the vulnerability detection method described above.

[0147] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings. However, the present disclosure is not limited to the specific details of the above embodiments. Within the technical concept of the present disclosure, various simple modifications can be made to the technical solutions of the present disclosure, and these simple modifications all fall within the scope of protection of the present disclosure.

[0148] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0149] In addition, the various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

Claims

1. A vulnerability detection method, characterized in that: The vulnerability detection method includes: Acquire port information and service middleware information of the detection target, wherein the port information includes the operating port, and the service middleware information includes the service middleware; Determining a target risk location based on the port information and the service intermediate information; Determining target vulnerability detection procedures based on the target risk location; Performing vulnerability detection on the detection target through the target vulnerability detection program to obtain a vulnerability detection result; The step of determining a target risk location based on the port information and the service intermediate information includes: Determine the service corresponding to the running port according to the running port, and the service middleware is used to ensure that the service corresponding to the running port can be executed smoothly; According to the service corresponding to the running port and the service middleware, a risk position table is queried to obtain a target risk position, wherein the risk position table includes the risk position when any service corresponding to the running port and any service middleware are combined.

2. The vulnerability detection method according to claim 1, wherein: The service middleware information also includes the version of the service middleware; The determining of a target risk location according to the port information and the service intermediate information includes: Determine, according to the running port, the service corresponding to the running port; According to the service corresponding to the running port, the service middleware and the version of the service middleware, the risk position table is queried to obtain the target risk position. The risk position table includes the risk position when the service corresponding to any running port, any service middleware and any service middleware version are combined.

3. The vulnerability detection method according to claim 1, wherein: Before determining a vulnerability detection program based on the target risk location, the method further includes: Obtain the vulnerability detection program corresponding to each risk location; Establishing an association relationship between each risk location and its corresponding vulnerability detection program to obtain a vulnerability detection program query table; Based on the target risk location, determine the target vulnerability detection procedures, including: According to the target risk location, the target vulnerability detection program associated with the target risk location is determined from the vulnerability detection program query table.

4. The vulnerability detection method according to claim 1, wherein: The step of performing vulnerability detection on the detection target by using the target vulnerability detection program to obtain a vulnerability detection result includes: Sending the target vulnerability detection program to the target risk location of the detection target; Obtaining a detection data packet sent by the detection target, wherein the detection data packet includes multiple echo results; According to the multiple echo results, the probability that a vulnerability exists at the target risk position of the detection target is determined.

5. The vulnerability detection method according to claim 4, characterized in that: The determining, based on the plurality of echo results, a probability that a vulnerability exists at the target risk location of the detection target, includes: Get the probability and weight of each echo result; The probability that a vulnerability exists at the target risk location is determined based on the probability of each echo result and the weight of each echo result.

6. The vulnerability detection method according to claim 1, wherein: The obtaining of the port information and service intermediate information of the detection target includes: Perform port scanning on the detection target to obtain port information; Perform network asset fingerprint identification on the detection target to obtain service intermediate information.

7. A vulnerability detection device, characterized in that: The vulnerability detection device comprises: A first acquisition module is configured to acquire port information and service middleware information of a detection target, wherein the port information includes a running port, and the service middleware information includes a service middleware; a first determining module configured to determine a target risk location based on the port information and the service intermediate information; a second determination module configured to determine a target vulnerability detection program according to the target risk location; an acquisition module configured to perform vulnerability detection on the detection target through the target vulnerability detection program to obtain a vulnerability detection result; The first determining module includes: A first determining submodule is configured to determine, according to the running port, a service corresponding to the running port; The first query submodule is configured to query the risk location table according to the service corresponding to the running port and the service middleware to obtain the target risk location. The risk location table includes the risk location of any combination of the service corresponding to the running port and any service middleware.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

9. An electronic device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 6.

Images