File scanning processing method, device, system and terminal equipment

Abstract

The embodiment of the application discloses a file scanning processing method, device, system and terminal equipment, and belongs to the field of safety detection. The file scanning processing method comprises the following steps: receiving a scanning processing command, wherein the scanning processing command is used for indicating a scanning target file; in response to the scanning processing command, obtaining a scanning engine image from the cloud; running the scanning engine image in a containerized manner to start the scanning engine; and scanning the target file by using at least the scanning engine. According to the application, the scanning engine software does not need to be installed locally, no temporary file is left, and the computing power resource can be effectively limited, so that the problem of large resource occupation in the process of scanning the file by using the safety product in the related art is solved.

Description

Technical Field

[0001] This invention relates to the field of security detection, and in particular to a document scanning and processing method, apparatus, system and terminal equipment. Background Technology

[0002] With the development of computer technology, the role of security products is becoming increasingly prominent. Security products can promptly scan and discover product vulnerabilities and malicious files, safeguarding the operation of numerous applications.

[0003] Security products in related technologies employ a method of installing product software, dependent environments, and vulnerability rule data locally to detect system and application vulnerabilities. For example, the image scanning plugin for Anchore (an open-source tool for Docker container policy compliance and static analysis) installs the Anchore package, database, and other dependent packages into the user's environment. At runtime, it saves the user image to a specified directory in Anchore, performs file analysis on the layers, and matches system and application vulnerability rules in the library to discover vulnerabilities.

[0004] However, these traditional security products still have shortcomings in actual use: First, the software is installed locally, which will occupy local storage resources for a long time; second, the scanning software will consume a lot of computing power and network bandwidth when running, which will cause the local device to run slowly; third, temporary files need to be cleaned up after the scan is completed, and failure to clean up or incomplete cleaning can easily leave content residue, which will also occupy storage resources.

[0005] It is evident that security products in related technologies consume significant computing, network, and storage resources during file scanning, which can easily disrupt the normal operation of local devices and consequently impact user experience. Currently, no effective solution has been proposed to address these issues.

[0006] The information disclosed in the background section is only intended to enhance the understanding of the background art described herein. Therefore, the background art may contain information that would not be considered part of the prior art by those skilled in the art. Summary of the Invention

[0007] This invention provides a document scanning and processing method, apparatus, system, and terminal device to at least solve the technical problem of high resource consumption in the process of scanning documents using security products in related technologies.

[0008] According to a first aspect of the present invention, a file scanning processing method is provided, comprising: receiving a scanning processing command, the scanning processing command being used to instruct scanning a target file; in response to the scanning processing command, obtaining a scanning engine image from the cloud; running the scanning engine image in a containerized manner to start the scanning engine; and scanning the target file using at least the scanning engine.

[0009] Furthermore, the target file is a Docker image; after scanning the target file using at least a scanning engine, the method also includes: if the scan results indicate a vulnerability, determining the corresponding remediation strategy; and if the remediation conditions are met, using the remediation strategy to remediate the vulnerability.

[0010] Furthermore, after the scan results show no vulnerabilities or the vulnerabilities detected by the scan are repaired, the method also includes: pushing the Docker image to the target image repository.

[0011] Furthermore, at least the target file is scanned using a scanning engine, including: obtaining a detection script from the cloud, the detection script including vulnerability scanning rules; controlling the scanning engine to load the detection script; and controlling the scanning engine with the detection script loaded to scan the target file.

[0012] Furthermore, after controlling the scanning engine loaded with the detection script to scan the target file, at least using the scanning engine to scan the target file also includes: determining the risk data obtained by the scanning engine, the risk data including potential vulnerability information; sending the risk data to the cloud detection engine; and receiving the detection results from the cloud detection engine for the risk data.

[0013] Furthermore, if the scan results indicate a vulnerability, the corresponding remediation strategy is determined, including: identifying the vulnerability based on the scan results from the scanning engine; matching the corresponding remediation strategy from the remediation strategy library based on the vulnerability; and / or receiving a remediation strategy from the cloud-based detection engine.

[0014] Furthermore, after patching the vulnerability using a patching strategy, the method also includes: controlling the destruction of the container running the scanning engine; and / or, determining that the patching conditions are met if at least one of the following conditions is met: the vulnerability is in an automatic patching whitelist, which is pre-configured by the user; or receiving a patching instruction for the vulnerability input by the user.

[0015] Furthermore, the scanning engine image is run in a containerized manner to start the scanning engine, including running the scanning engine image in Docker-in-Docker mode to start the scanning engine.

[0016] According to a second aspect of the present invention, a file scanning processing apparatus is also provided, comprising: a receiving unit for receiving a scanning processing command, the scanning processing command being used to instruct a target file to be scanned; an acquiring unit for acquiring a scanning engine image from the cloud in response to the scanning processing command; a starting unit for running the scanning engine image in a containerized manner to start the scanning engine; and a scanning unit for scanning the target file using at least the scanning engine.

[0017] According to a third aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, when the program is running, it controls the device where the non-volatile storage medium is located to perform the above-described file scanning processing method.

[0018] According to a fourth aspect of the present invention, a terminal device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described file scanning processing method.

[0019] According to a fifth aspect of the present invention, a document scanning and processing system is also provided, comprising: a local terminal, which is the terminal device described above; and a cloud terminal, which is communicatively connected to the local terminal and stores a scanning engine image.

[0020] Furthermore, the cloud storage contains a cloud detection engine. When the cloud detection engine is run by the cloud processor, it performs the following steps: receiving risk data from the local end; detecting the risk data to determine the vulnerabilities contained in the risk data and the corresponding remediation strategies; and sending the vulnerabilities and remediation strategies to the local end.

[0021] The file scanning processing method of this invention includes: receiving a scanning processing command, the scanning processing command being used to instruct scanning a target file; in response to the scanning processing command, obtaining a scanning engine image from the cloud; running the scanning engine image in a containerized manner to start the scanning engine; and at least using the scanning engine to scan the target file. After receiving a scan processing command input by the user, the scanning engine image is obtained from the cloud and run locally in a containerized manner, thereby starting the scanning engine and at least using the scanning engine to complete the scanning operation of the local target file. This scanning method offers the following advantages: The scanning engine image is stored in the cloud. When a scan is needed, the image is pulled to the local machine and run in a containerized manner. This eliminates the need to install numerous software packages related to the scanning engine locally, avoiding the storage resource consumption caused by software residing locally. After the scan is complete, the files generated during the scanning process are automatically cleaned up from the temporary space as the container is destroyed, leaving no temporary file residue and preventing temporary file residue from consuming storage resources. Running the scanning engine image in a containerized manner allows for the allocation of computing and network bandwidth resources as needed during container creation, effectively limiting the scanning engine's consumption of computing and bandwidth resources during runtime. This prevents excessive resource consumption during file access that could affect normal user experience. In summary, this scanning method effectively limits the scanning engine software's consumption of local storage, computing, and network bandwidth resources, ensuring the normal operation of local devices and solving the technical problem of high resource consumption encountered when using security products to scan files in related technologies. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0023] Figure 1 A flowchart illustrating a document scanning and processing method provided in an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of a document scanning and processing device provided in an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram illustrating the execution process of a file scanning and processing method provided in an embodiment of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] The file scanning processing method of this invention is applied to a security product on the edge. The edge security product runs on an edge device and communicates with a cloud server to scan local target files. The term "edge" differs from "cloud," and the edge can take several specific forms, such as a local device, an edge device, or other IoT devices. In actual use, the edge security product can run on the edge device as standalone software or as a plugin. For example, when running as standalone software, it is an independent detection or scanning software that, when launched by the user, executes the following file scanning processing method. Alternatively, it can be integrated into various software programs as a plugin; when the user launches the plugin within the corresponding software, the following file scanning processing method is executed. Figure 1 This is a document scanning and processing method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0028] Step S102: Receive a scan processing command, which is used to instruct the target file to be scanned;

[0029] Step S104: In response to the scan processing command, obtain the scan engine image from the cloud;

[0030] Step S106: Run the scanning engine image in a containerized manner to start the scanning engine;

[0031] Step S108: At least use the scanning engine to scan the target file.

[0032] The file scanning and processing method using the above scheme includes: receiving a scan processing command, which instructs the target file to be scanned; in response to the scan processing command, retrieving a scan engine image from the cloud; running the scan engine image in a containerized manner to start the scan engine; and at least using the scan engine to scan the target file. Upon receiving the scan processing command input by the user, the scan engine image (the image file corresponding to the scan engine, including the scan engine program and its dependencies) is retrieved from the cloud and run locally in a containerized manner (integrating the application into a container), thereby starting the scan engine (scan engine software) and at least using the scan engine to complete the scanning operation of the local target file. This scanning method offers the following advantages: The scanning engine image is stored in the cloud. When a scan is needed, the image is pulled to the local machine and run in a containerized manner. This eliminates the need to install numerous software packages related to the scanning engine locally, avoiding the storage resource consumption caused by software residing locally. After the scan is complete, the files generated during the scanning process are automatically cleaned up from the temporary space as the container is destroyed, leaving no temporary file residue and preventing temporary file residue from consuming storage resources. Running the scanning engine image in a containerized manner allows for the allocation of computing and network bandwidth resources as needed during container creation, effectively limiting the scanning engine's consumption of computing and bandwidth resources during runtime. This prevents excessive resource consumption during file access that could affect normal user experience. In summary, this scanning method effectively limits the scanning engine software's consumption of local storage, computing, and network bandwidth resources, ensuring the normal operation of local devices and solving the technical problem of high resource consumption encountered when using security products to scan files in related technologies.

[0033] To further enhance the security of the file scanning process, after receiving the scan command, the file scanning method also includes: authenticating the user; and if authentication is successful, obtaining the scan engine image. This ensures that the operator performing the file scanning process has the necessary permissions, preventing unauthorized personnel from accidentally performing operations, thereby improving the security of the file scanning process.

[0034] In this embodiment, the scanning engine image is stored in the cloud. After receiving the scanning processing command, the scanning engine image is pulled from the cloud through a specific preset port and run locally, thereby starting the scanning engine. The scanning engine image can be managed in the cloud, which effectively facilitates the management and maintenance of the scanning engine image.

[0035] The file scanning processing method of this invention can be used to scan various files. In recent years, with the rise of cloud services and cloud-native technologies, more and more applications are being built and run using cloud-native methods. Cloud services provide services via the Internet, such as IT and software services, Internet-related services, or other services. Cloud-native technologies are a set of cloud technology product systems built on distributed cloud deployment and unified operation, based on technologies such as containers, microservices, and DevOps (a collective term for processes, methods, and systems). Applications run on the cloud and fully leverage the advantages of the cloud. Applications are usually packaged into Docker images to run in the cloud. To ensure that Docker images are scanned before running, the file scanning processing method of this invention can be used to scan Docker images, i.e., the target file is a Docker image. During the scanning process of the Docker image, after at least using a scanning engine to scan the target file, the file scanning processing method further includes: if the scan result indicates a vulnerability, determining the corresponding remediation strategy; and if the remediation conditions are met, using the remediation strategy to remediate the vulnerability.

[0036] In this embodiment, the file scanning method described above is used to scan the Docker image, where the target file is the Docker image itself. Related Docker image scanning engines can only scan the Docker image and determine if it has vulnerabilities. However, this application, after identifying vulnerabilities through scanning, determines a corresponding remediation strategy based on the type of vulnerability, and then remediates the vulnerabilities according to that strategy. This achieves automatic scanning and remediation of Docker images, effectively facilitating Docker image inspection and problem remediation. Of course, the remediation process can be automatic after a vulnerability is discovered, or it can be initiated in response to a user-triggered remediation command.

[0037] When using remediation strategies to fix vulnerabilities, the remediation methods include, but are not limited to: using the update command to upgrade the software package to a higher version, deleting malicious files, etc.

[0038] After the scan results show no vulnerabilities or the vulnerabilities found in the scan are repaired, the file scanning process also includes pushing the Docker image to the target image repository.

[0039] In other words, in this embodiment, the Docker image is only pushed to the target image repository after being scanned and repaired, for subsequent pulling and running. The target image repository is a pre-defined image repository used to store the created Docker images. Compared to related technologies where images are directly uploaded to the image repository after creation and then scanned later, this method performs scanning and repair before image upload, discovering and eliminating defects in the Docker image as early as possible. This ensures that the Docker image uploaded to the image repository is safe, rather than scanning after upload, discovering problems, and then going back to modify the image. This places security protection as early as possible in the entire lifecycle of cloud-native applications, preventing defects from occurring and discovering vulnerabilities as early as possible, effectively achieving a "shift left" approach to security.

[0040] As mentioned above, the file scanning processing method of this invention is applied to local security products. These products can run on local devices as software or as plugins. To further facilitate use, in a typical scenario, the local security product is integrated as a plugin into a CI / CD (Continuous Integration and Continuous Delivery) tool. When a user starts the plugin in CI / CD, the tool can call the cloud-based scanning engine image through a preset interface and run it locally in a containerized manner to scan the target file. This plugin-based integration makes the file scanning processing method applicable to CI environments with Docker. After completing code development, developers can package it into a Docker image, and scanning of the Docker image can be achieved in a continuous build environment. This implementation allows the scanning process to intervene during the user's development build phase, effectively meeting the cloud-native (cloud means applications run on the cloud, native means fully leveraging the advantages of the cloud, namely elasticity and distributed nature, implemented through microservices, DevOps, continuous delivery, and containerization) security left-shift strategy. After a Docker image is built, security risks are detected and patched to ensure that all images pushed to the remote image repository are secure, effectively facilitating the development and testing of Docker images. When scanning target files, the scanning engine relies on preset scanning rules. The quality of these rules directly affects the file scanning results. In a preferred implementation, at least the scanning engine is used to scan the target files, including: obtaining a detection script from the cloud, the script including vulnerability scanning rules; controlling the scanning engine to load the detection script; and controlling the scanning engine with the loaded detection script to scan the target files.

[0041] When using a scanning engine to scan target files, the engine relies on detection scripts retrieved in real-time from the cloud. These scripts include vulnerability scanning rules, guiding the engine to scan the target files according to these rules and identify vulnerabilities or risks. Since these rules originate from the cloud, they can be managed and updated in real-time. For example, using a vulnerability database optimized based on the common CVE (Common Vulnerabilities and Exposures) library is more accurate and can exclude outdated and false positives. Therefore, using this method of retrieving detection scripts from the cloud to determine scanning strategies in real-time effectively improves scanning accuracy and reduces the risk of missed or false positives. Preferably, the detection script includes vulnerability file type information and vulnerability file feature information. Controlling the scanning engine loaded with the detection script to scan the target file includes: determining whether the target file type is a vulnerability file type based on the vulnerability file type information (vulnerable file type, as the name suggests, is a file type that may be vulnerable, such as a script file); if the target file type is a risk-free type, such as a log file, it can be ignored, thus reducing the detection workload; if the target file type is a vulnerability file type, determining whether the target file has a vulnerability based on the vulnerability file feature information. In other words, the scanning engine performs the scan in two steps: first, it filters out potentially vulnerable files based on file type, and then it uses the vulnerability file feature information for further detection. This initial screening followed by detailed inspection significantly improves scanning efficiency while ensuring detection accuracy.

[0042] After controlling the scanning engine loaded with the detection script to scan the target file, at least the scanning engine is used to scan the target file, which also includes: determining the risk data obtained by the scanning engine, including potential vulnerability information; sending the risk data to the cloud detection engine; and receiving the detection results from the cloud detection engine.

[0043] After the target file is scanned by the local scanning engine, based on the vulnerability scanning rules of the detection script, some relatively mature malicious files or vulnerabilities can be directly identified. These vulnerabilities do not need to be transmitted to the cloud for detection, resulting in high detection efficiency. For vulnerabilities that cannot be directly identified by the local scanning engine, in this embodiment, after scanning the target file using the local scanning engine, risk data is identified. Risk data refers to data that may contain vulnerabilities; it can be in the form of physical files or information without physical files. The local scanning engine cannot determine whether it is a vulnerability. After identifying the risk data, it is sent to the cloud detection engine for re-examination. The cloud detection engine's computing power and / or rich basic data are used to determine whether the risk data contains vulnerabilities. For example, the cloud can match a rule base optimized based on public CVE vulnerabilities (i.e., based on the CVE vulnerability database, vulnerability rules are deleted or supplemented to form a more effective and accurate vulnerability rule base) to achieve optimized detection of mirrored vulnerabilities. After the cloud detection engine completes the re-examination, the re-examination results are sent to the local machine, where the machine receives the detection results from the cloud detection engine. This approach enables effective collaboration between the edge and cloud environments. The local scanning engine performs initial data screening, while the cloud-based detection engine performs secondary checks on risky data. This ensures both high efficiency and accuracy in file scanning. The cloud-based detection engine is a cloud-native security service provided by the cloud security center. By adopting this edge-cloud collaborative detection solution, security capabilities can be exported to non-cloud environments, enabling collaboration between the cloud and cloud sides and enhancing the security detection capabilities and scope of the local environment. When scanning Docker images using this edge-cloud collaborative scanning method, in addition to system and application vulnerabilities, it also supports monitoring baseline configurations, binary files, WebShells (a type of malicious script commonly used by hackers), and other malicious scripts, providing more comprehensive coverage of vulnerability detection types.

[0044] Specifically, if the scan results indicate a vulnerability, the corresponding remediation strategy is determined, including: identifying the vulnerability based on the scan results from the scanning engine; matching the corresponding remediation strategy from the remediation strategy library based on the vulnerability; and / or receiving a remediation strategy from the cloud-based detection engine.

[0045] In other words, during the process of determining a remediation strategy, if the local scanning engine can clearly identify a vulnerability after scanning, it can match the corresponding remediation strategy from the remediation strategy library based on the specific vulnerability type. Each remediation strategy in the library corresponds one-to-one with a specific vulnerability. If the local scanning engine cannot identify a vulnerability after scanning but only identifies risk data, it sends the risk data to the cloud detection engine. The cloud detection engine then re-examines the data, identifies the vulnerability, and simultaneously determines a remediation strategy. This remediation strategy is then pushed back to the local machine, where it receives the strategy from the cloud detection engine and applies it to fix the vulnerability.

[0046] After patching the vulnerability using a remediation strategy, the file scanning process also includes controlling the destruction of the container running the scanning engine.

[0047] In other words, the container is automatically destroyed after scanning and repairing the Docker image file. Since the decompression and analysis of the image layer are performed within the scanning engine container during the scanning process, the temporary space is automatically cleaned up after the container is destroyed. Compared with the method of executing a shell (shell script) to clean up temporary files after the file scan is completed, this method eliminates the problem of cleaning up residual space after the shell execution fails.

[0048] Specifically, the remediation conditions are determined to be met if at least one of the following conditions is met: the vulnerability is in the automatic remediation whitelist, which is pre-configured by the user; or a remediation instruction for the vulnerability is received from the user.

[0049] Users can configure an automatic remediation whitelist. If a vulnerability is found after a file scan and it is on the whitelist, it will be automatically remediated according to the remediation strategy, effectively simplifying the user's operation. Additionally, if the user manually enters a remediation command for a specific vulnerability, that vulnerability will also be remediated.

[0050] In one embodiment, after scanning the target file using at least a scanning engine, the file scanning process further includes: controlling a display device to display the detected vulnerabilities, thereby facilitating user understanding of the vulnerabilities in the target file. Preferably, controlling the display device to display the detected vulnerabilities includes: determining whether the vulnerability is on a ignore list; if the vulnerability is on the ignore list, controlling the hiding of the vulnerability, so that the display device will not display the vulnerability, allowing users to more intuitively observe some important vulnerabilities.

[0051] In a preferred embodiment, in addition to running the scanning engine image in a containerized manner to start the scanning engine, the file scanning processing method specifically includes: running the scanning engine image in Docker-in-Docker mode to start the scanning engine.

[0052] Docker in Docker (DinD) is a technology built on Docker, referring to running another image with its own Docker environment within a Docker environment. The Docker environment of this image can be mounted on sockets on the host machine, enabling mapping between the inner and outer Docker containers. The inner Docker container can access information within the outer Docker container. The scanning engine container uses DinD to map the scanning engine Docker container to the user's host machine Docker container, allowing direct access to target files on the host machine via commands. This DinD-based mounting method directly retrieves target files from the host machine without copying, reducing disk read / write pressure on the user's environment. More importantly, in related technologies, scanning engines require users to grant high-privilege ports to the scanning engine when retrieving files from the host machine, increasing user risk. The mounting method in this application, however, does not require users to grant high privileges to the scanning engine to retrieve target files from the host machine, effectively facilitating file retrieval and thus simplifying Docker image scanning.

[0053] The following specific embodiment will be used to describe in detail the file scanning processing method of the present invention. In this embodiment, the purpose is to achieve security scanning of Docker images:

[0054] In related technologies, the scanning process for Docker images typically involves installing software packages, databases, and dependencies into the user's environment before running the scanning software to perform security scans on the Docker images obtained from the image repository. For example, Anchore's image scanning plugin installs the Anchore package, database, and other dependencies into the user's environment. At runtime, it saves the user's Docker image to a specified Anchore directory, performs file analysis on the layer, and matches system and application vulnerability rules in the library to discover vulnerabilities. However, this approach has several drawbacks in practical use, such as: requiring the installation of many software packages, which imposes certain environmental limitations; requiring the execution of a shell script on the host machine to save the image and then copy it to the Anchore environment; vulnerability rule data coming from the open-source Linux CVE library, making real-time updates difficult to guarantee; and requiring a shell script to clean up temporary files after image decompression, which can consume user disk space if cleanup fails. Furthermore, it only supports the detection of system and application vulnerabilities and lacks subsequent remediation capabilities.

[0055] In this embodiment, the Docker scanning method using the above-mentioned technical solution interacts with cloud-native security capabilities through a containerized end engine (scanning engine) running in the user environment. This breaks through the limitations of local image scanning capabilities, outputs cloud image security capabilities to any environment that supports Docker containerized deployment, and achieves more comprehensive risk type detection.

[0056] like Figure 3 As shown, the specific steps of this embodiment are as follows:

[0057] Startup: The private network is the local end. The end engine (scanning engine) consists of two parts: the CICD plugin and the local scanning engine. The CICD plugin is directly installed into the CICD environment (each CICD provides plugin integration functionality). After receiving the scan processing command, it collects the user's cloud access authentication information. After successful authentication, it pulls the Docker image of the local scanning engine from the cloud to the user environment through the CICD plugin port (i.e., in response to the scan processing command, it retrieves the scanning engine image from the cloud). Then, it starts the scanning engine in DIND form (i.e., runs the scanning engine image in a containerized manner).

[0058] Initial screening: The scanning engine container uses DinD to map the engine Docker and the user's host machine Docker, allowing direct command-line access to the host machine image information, including image saving, decompression, and layer information acquisition. Next, a detection script is downloaded from the cloud. This script includes vulnerability scanning rules and performs preliminary checks on six risk items: system vulnerabilities, application vulnerabilities, host machine baseline configuration, binary files, WebShells, and malicious scripts. After the preliminary check, different data will result in three categories: vulnerable, non-vulnerable, and risky file (vulnerability uncertain). The software packages installed in the image and the baseline configuration are collected, and potentially risky files are filtered out and uploaded to the cloud. Specifically, risky files can be documents or purely informational, such as version numbers.

[0059] Re-inspection: After receiving the information uploaded by the end engine, the cloud platform matches it with a rule base optimized based on public CVE vulnerabilities (i.e., based on the CVE vulnerability database, vulnerability rules are deleted or supplemented to form a more effective and accurate vulnerability rule base) to achieve optimized detection of mirror vulnerabilities. Through long-term collection of baseline risk configuration big data, configuration suggestions such as weak passwords and enhanced authentication are made for the user's baseline configuration. The file detection engine re-inspects the initially screened risky files to confirm detailed risk information. After completing the re-inspection of all items, a remediation plan or remediation command is provided for each risky file and sent back to the scanning engine.

[0060] Remediation: The scanning engine supports user whitelist configuration via UI or command line. After receiving the cloud-based re-examination results, the scanning engine matches the user's configuration rules, upgrades system and application vulnerabilities in the whitelist to more secure versions using the update command, deletes risky files, and only provides risk warnings for other unauthorized items. The scanning engine can also flexibly upgrade corresponding vulnerabilities based on user remediation control commands (i.e., it is determined to meet remediation conditions if at least one of the following conditions is met: the vulnerability is in the automatic remediation whitelist, the automatic remediation whitelist is pre-configured by the user; or a remediation command for the vulnerability is received from the user).

[0061] By adopting a cloud-based collaborative approach, the system can fully deliver cloud-native image security testing capabilities while avoiding the shortcomings of competing products. The aforementioned scanning method offers at least the following advantages:

[0062] Containerized deployment has simple requirements for the user environment, requiring only a Docker environment;

[0063] The containerized deployment engine and cloud collaboration enable strong cloud-based management and control, achieving full coverage of the detection range and outputting cloud-native security detection capabilities to any non-cloud environment.

[0064] By using DinD to mount and map, information about the host machine image can be obtained directly without copying, reducing the pressure on disk read and write in the user's CICD environment. Users do not need to open high-privilege interfaces, which improves security. The DinD mechanism also optimizes image information collection and file cleanup after decompression.

[0065] The detection rules are sourced from the cloud and managed in real time. They can be updated in real time, and the vulnerability database optimized based on the public CVE database is more accurate, eliminating expired vulnerabilities and false positives, which helps to improve detection accuracy.

[0066] The decompression and analysis of the image layer are performed in the scanning engine container. As the container is destroyed after execution, the temporary space is automatically cleaned up, avoiding the problem of residual space after the shell execution fails to clean up.

[0067] In addition to system vulnerabilities and application vulnerabilities, it also supports monitoring of baseline configurations, binary files, WebShells, and malicious scripts, which can more comprehensively cover the types of vulnerabilities detected.

[0068] It supports user-configurable automatic repair and malicious file deletion functions, and allows users to customize repair items, automatically repairing risks on the user's local machine.

[0069] Secondly, such as Figure 2As shown, embodiments of the present invention also provide a file scanning and processing apparatus, comprising: a receiving unit for receiving a scanning processing command, the scanning processing command being used to instruct scanning a target file; an acquiring unit for acquiring a scanning engine image from the cloud in response to the scanning processing command; a starting unit for running the scanning engine image in a containerized manner to start the scanning engine (scanning engine software); and a scanning unit for scanning the target file using at least the scanning engine. In the file scanning and processing apparatus employing the above scheme, after the receiving unit receives the scanning processing command input by the user, the acquiring unit acquires the scanning engine image from the cloud and runs it locally in a containerized manner through the starting unit, thereby starting the scanning engine and using the scanning engine to complete the scanning operation of the local target file. This scanning method offers the following advantages: The scanning engine image is stored in the cloud. When a scan is needed, the image is pulled to the local machine and run in a containerized manner. This eliminates the need to install numerous software packages related to the scanning engine locally, avoiding the storage resource consumption caused by software residing locally. After the scan is complete, the files generated during the scanning process are automatically cleaned up from the temporary space as the container is destroyed, leaving no temporary file residue and preventing temporary file residue from consuming storage resources. Running the scanning engine image in a containerized manner allows for the allocation of computing and network bandwidth resources as needed during container creation, effectively limiting the scanning engine's consumption of computing and bandwidth resources during runtime. This prevents excessive resource consumption during file access that could affect normal user experience. In summary, this scanning method effectively limits the scanning engine software's consumption of local storage, computing, and network bandwidth resources, ensuring the normal operation of local devices and solving the technical problem of high resource consumption encountered when using security products to scan files in related technologies.

[0070] The acquisition unit is used to: respond to a scan processing command and acquire a scan engine image from the cloud via a preset port; the target file is a Docker image; the file scanning processing device also includes a determination unit and a repair unit: the determination unit is used to determine the repair strategy corresponding to the vulnerability after scanning the target file using at least the scan engine, if the scan result shows a vulnerability; the repair unit is used to repair the vulnerability using the repair strategy if the repair conditions are met; the file scanning processing device also includes a push unit: the push unit is used to push the Docker image to the target image repository after the scan result shows no vulnerability or the vulnerability obtained in the scan is repaired; the scanning unit is used to: acquire a detection script from the cloud, the detection script including vulnerability scanning rules; control the scan engine to load the detection script; control the scan engine loaded with the detection script to scan the target file; after controlling the scan engine loaded with the detection script to scan the target file, at least The scanning unit uses a scanning engine to scan target files. It further determines risk data obtained by the scanning engine, including potential vulnerability information; sends the risk data to a cloud-based detection engine; and receives detection results from the cloud-based detection engine. The determining unit determines vulnerabilities based on the scanning engine's results; matches corresponding remediation strategies from a remediation strategy library based on the vulnerabilities; and / or receives remediation strategies from the cloud-based detection engine. After remediating the vulnerabilities using the remediation strategies, the file scanning processing device also includes a destruction unit. This destruction unit controls the destruction of the container running the scanning engine. The remediation condition is determined to be met if at least one of the following conditions is met: the vulnerability is in an automatic remediation whitelist, which is pre-configured by the user; a user-input remediation command for the vulnerability is received; or the scanning engine image is run in a containerized manner to start the scanning engine, including running the scanning engine image in Docker-in-Docker mode to start the scanning engine.

[0071] Secondly, embodiments of the present invention also provide a non-volatile storage medium, which includes a stored program, wherein the program controls the device where the non-volatile storage medium is located to execute the above-described file scanning processing method during runtime.

[0072] Furthermore, embodiments of the present invention also provide a terminal device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described file scanning processing method.

[0073] Finally, embodiments of the present invention also provide a document scanning and processing system, comprising: a local terminal, which is the aforementioned terminal device; and a cloud terminal, which is communicatively connected to the local terminal and stores a scanning engine image.

[0074] The cloud storage contains a cloud detection engine. When the cloud detection engine is run by the cloud processor, it performs the following steps: receiving risk data from the local end; detecting the risk data to determine the vulnerabilities contained in the risk data and the corresponding remediation strategies; and sending the vulnerabilities and remediation strategies back to the local end.

[0075] The sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. Moreover, the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than that shown here.

[0076] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0078] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0079] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0080] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0081] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A document scanning and processing method, comprising: Receive a scan processing command, the scan processing command being used to instruct the target file to be scanned; In response to the scan processing command, obtain the scan engine image from the cloud; The scanning engine image is run in a containerized manner to start the scanning engine; The target file is scanned using at least the aforementioned scanning engine; The step of scanning the target file using at least the scanning engine includes: The detection script is obtained from the cloud in real time; the scanning engine is controlled to load the detection script; the scanning engine loaded with the detection script is controlled to scan the target file. The detection script includes vulnerability file type information and vulnerability file feature information. The scanning engine loaded with the detection script scans the target file, including: determining whether the target file is a vulnerability file type based on the vulnerability file type information; if the target file is a vulnerability file type, determining whether the target file has a vulnerability based on the vulnerability file feature information. After the scanning engine, which is loaded with the detection script, scans the target file, the step of scanning the target file using at least the scanning engine further includes: The risk data obtained by the scanning engine is determined, and the risk data includes information on potential vulnerabilities. The risk data is sent to the cloud detection engine; Receive detection results from the cloud-based detection engine for the risk data.

2. The document scanning and processing method according to claim 1, wherein, The target file is a Docker image; After scanning the target file using at least the scanning engine, the method further includes: If the scan results indicate the presence of vulnerabilities, determine the corresponding remediation strategy for those vulnerabilities; If the remediation conditions are met, the aforementioned remediation strategy is used to remediate the vulnerability.

3. The document scanning and processing method according to claim 2, wherein, After the scan results show no vulnerabilities or the vulnerabilities identified in the scan are repaired, the method further includes: Push the Docker image to the target image repository.

4. The document scanning and processing method according to claim 3, wherein, When the scan results indicate the presence of a vulnerability, determining the corresponding remediation strategy for that vulnerability includes: Based on the scanning results of the scanning engine, vulnerabilities are identified; based on the vulnerabilities, corresponding remediation strategies are matched from the remediation strategy library; and / or, Receive the repair strategy from the cloud detection engine.

5. The document scanning and processing method according to claim 2, wherein: After patching the vulnerability using the aforementioned remediation strategy, the method further includes: controlling the destruction of the container running the scanning engine; and / or, The remediation condition is determined to be met if at least one of the following conditions is met: the vulnerability is in the automatic remediation whitelist, which is pre-configured by the user; or a remediation instruction for the vulnerability is received from the user.

6. The document scanning and processing method according to any one of claims 1 to 5, wherein, The step of running the scanning engine image in a containerized manner to start the scanning engine includes: The scanning engine image is run in Docker-in-Docker mode to start the scanning engine.

7. A document scanning and processing apparatus, comprising: A receiving unit is configured to receive a scan processing command, wherein the scan processing command is used to instruct the target file to be scanned; The acquisition unit is used to acquire the scan engine image from the cloud in response to the scan processing command; A startup unit is used to run the scanning engine image in a containerized manner to start the scanning engine; A scanning unit is configured to scan the target file using at least the scanning engine; The scanning unit is specifically used for: The detection script is obtained from the cloud in real time; the scanning engine is controlled to load the detection script; the scanning engine loaded with the detection script is controlled to scan the target file. The detection script includes vulnerability file type information and vulnerability file feature information. The scanning unit is further specifically used to: determine whether the target file is a vulnerability file type based on the vulnerability file type information; if the target file is a vulnerability file type, determine whether the target file has a vulnerability based on the vulnerability file feature information. After the scanning engine, which is loaded with the detection script, scans the target file, during the scanning of the target file using at least the scanning engine, the scanning unit is further configured to: The risk data obtained by the scanning engine is determined, and the risk data includes information on potential vulnerabilities. The risk data is sent to the cloud detection engine; Receive detection results from the cloud-based detection engine for the risk data.

8. A non-volatile storage medium, the non-volatile storage medium comprising a stored program, wherein, When the program is running, it controls the device containing the non-volatile storage medium to execute the file scanning processing method according to any one of claims 1 to 6.

9. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the file scanning processing method according to any one of claims 1 to 6.

10. A document scanning and processing system, comprising: The local terminal is the terminal device as described in claim 9; The cloud is connected to the local terminal and stores the scanning engine image.

11. The document scanning and processing system according to claim 10, wherein, The cloud storage contains a cloud detection engine. When the cloud detection engine is run by the cloud processor, it performs the following steps: Receive risk data from the local terminal; The risk data is examined to identify the vulnerabilities contained within it and the corresponding remediation strategies. The vulnerability and remediation strategy are sent to the local terminal.

Images