Application-based vulnerability management method, device, medium and equipment

Abstract

Embodiments of the present application provide a kind of based on application program's vulnerability management method, device, medium and equipment, the method includes: obtaining the vulnerability information of vulnerability to be detected;According to the positioning information, obtain the target development process execution file corresponding to the vulnerability to be detected;Judge whether the actual execution result of each link in target development process execution file is consistent with the expected execution result corresponding to vulnerability type;If not consistent, then the actual execution result and the expected execution result are not consistent in target development process execution file with the exception link marked. Utilize the embodiment of the present application, by setting the execution rule in each key link in development process execution file. After the vulnerability of application program appears, by comparing the actual execution result of each link in development process execution file with the expected execution result corresponding to the vulnerability type of the vulnerability to be detected, then the specific existing link of the vulnerability to be detected is located in development process execution file, and the specific reason of the vulnerability to be detected is analyzed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electronic communication, in particular to the technical field of vulnerability management based on application programs, and specifically to a vulnerability management method, device, medium and equipment based on application programs. BACKGROUND

[0002] The development life cycle of an application program is referred to as SDLC (Software Development Life Cycle) in the art, which is the life cycle of software from generation to obsolescence, including stages such as problem definition, feasibility analysis, overall description, system design, coding, debugging and testing, acceptance and operation, maintenance and upgrade to abandonment. For an application program, if any node in its development life cycle is not well maintained, it is likely to cause abnormality of the application program in the running process, i.e. vulnerability. Therefore, for the developers of the application program, it is necessary to ensure that there is no problem in each link before the application program goes online. However, the logic of the application program itself is complex, and it is difficult to check all the problems in detail in the early stage, so it is inevitable that some problems cannot be found by the developers, which leads to various vulnerabilities of the application program after it goes online, affecting the normal operation of the application program. SUMMARY

[0003] The present application provides a vulnerability management method, device, medium and equipment based on application programs, which defines a plurality of key links based on the development life cycle of an application program, obtains a development process execution file, and sets execution rules for each key link in the development process execution file. After a vulnerability of the application program occurs, the developer uploads the vulnerability information of the to-be-tested vulnerability to the system, and calls out the development process execution file of the application program, compares the actual execution result of each link in the development process execution file with the expected execution result corresponding to the vulnerability type of the to-be-tested vulnerability, and then locates the link where the to-be-tested vulnerability specifically exists in the development process execution file, and analyzes the specific reason for the to-be-tested vulnerability.

[0004] The present application provides a vulnerability management method based on application programs, which comprises:

[0005] Obtaining vulnerability information of a to-be-tested vulnerability in a target application program, wherein the vulnerability information comprises a vulnerability type of the to-be-tested vulnerability and positioning information of a development process execution file of the target application program;

[0006] According to the positioning information, obtaining a target development process execution file corresponding to the to-be-tested vulnerability;

[0007] determining whether the actual execution result of each link in the target development process execution file is consistent with the expected execution result corresponding to the vulnerability type, to obtain a corresponding determination result of each link;

[0008] If the determination result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result, an abnormal link in which the actual execution result is inconsistent with the expected execution result is marked in the target development process execution file.

[0009] In the application embodiment, if the determination result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result, the method further comprises:

[0010] According to the difference information that the actual execution result is inconsistent with the expected execution result in each abnormal link, a corresponding textual description is generated;

[0011] In the target development process execution file, the textual description is inserted into the corresponding abnormal link and displayed in a preset form.

[0012] In the application embodiment, the positioning information includes a preset identifier of an application associated with the vulnerability and a version number of a development process execution file.

[0013] The target development process execution file corresponding to the to-be-detected vulnerability is obtained according to the positioning information, and the method comprises the following steps:

[0014] According to the preset identifier, at least one requirement information corresponding to the version number is obtained;

[0015] According to the version number, target requirement information corresponding to the version number is obtained from the at least one requirement information corresponding to the version number;

[0016] According to the target requirement information, a target development process execution file corresponding thereto is obtained.

[0017] In the application embodiment, the development process execution file includes at least whether the security review result is accurate, whether the security scenario identification is accurate, and whether the security design for the security scenario identification is accurate and complete.

[0018] In the application embodiment, the security scenario includes one or more of input verification, output encoding verification, access control, parameterized SQL, security resource competition, and sensitive information usage check.

[0019] In the application embodiment, the application-based vulnerability management method further comprises the following steps before the step of obtaining the vulnerability information of the to-be-detected vulnerability in the target application program.

[0020] A work order input platform is provided for the application developer to provide the vulnerability information of the to-be-detected vulnerability after discovering that the target application program has a vulnerability.

[0021] In the application embodiment, the step of marking the abnormal link in the target development process execution file, in which the actual execution result is inconsistent with the expected execution result, comprises the following steps.

[0022] The abnormal link in which the actual execution result is inconsistent with the expected execution result is marked in the target development process execution file in the form of font color highlighting or font enlargement.

[0023] Correspondingly, the application embodiment further provides an application-based vulnerability management device, which comprises the following components.

[0024] An information obtaining module is configured to obtain the vulnerability information of a to-be-detected vulnerability in a target application program, wherein the vulnerability information comprises a vulnerability type of the to-be-detected vulnerability and positioning information of a development process execution file of the target application program.

[0025] A file obtaining module is configured to obtain a target development process execution file corresponding to the to-be-detected vulnerability according to the positioning information.

[0026] A result judging module is configured to judge whether the actual execution result of each link in the target development process execution file is consistent with the expected execution result corresponding to the vulnerability type, and obtain a judging result corresponding to each link.

[0027] A result marking module is configured to mark an abnormal link in which the actual execution result is inconsistent with the expected execution result in the target development process execution file if the judging result is that the actual execution result is inconsistent with the expected execution result.

[0028] Correspondingly, the application embodiment further provides a storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the application-based vulnerability management method.

[0029] Correspondingly, the application embodiment further provides a terminal device, which comprises a processor and a memory, wherein the memory stores a plurality of instructions, and the processor loads the instructions to execute the application-based vulnerability management method.

[0030] The embodiment of the present application provides a vulnerability management method, device, medium and equipment based on an application program, which comprises the following steps: obtaining vulnerability information of a to-be-detected vulnerability in a target application program, wherein the vulnerability information comprises a vulnerability type of the to-be-detected vulnerability and positioning information of a development process execution file of the target application program; obtaining a target development process execution file corresponding to the to-be-detected vulnerability according to the positioning information; judging whether an actual execution result of each link in the target development process execution file is consistent with an expected execution result corresponding to the vulnerability type, to obtain a judgment result corresponding to each link; if the judgment result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result, marking an abnormal link in which the actual execution result is inconsistent with the expected execution result in the target development process execution file. By using the vulnerability management method based on the application program provided by the embodiment of the present application, a plurality of key links are defined based on an application program development life cycle, a development process execution file is obtained, and an execution rule is set for each key link in the development process execution file. The focus is on whether the security review result of the application program is accurate, whether the security scene recognition is accurate, and whether the security design for the security scene recognition is accurate and complete. After the vulnerability of the application program occurs, the developer uploads the vulnerability information of the to-be-detected vulnerability to the system, and the development process execution file of the application program is called out, the actual execution result of each link in the development process execution file is compared with the expected execution result corresponding to the vulnerability type of the to-be-detected vulnerability, then the link in which the to-be-detected vulnerability exists is located in the development process execution file, and the specific reason for the to-be-detected vulnerability is analyzed. Meanwhile, compared with the prior art which is mainly before the software is put on line, the present application mainly inversely deduces the reason for the vulnerability after the vulnerability occurs, and can solve the reason for the vulnerability in a targeted manner. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creating laborious work.

[0032] Figure 1 The flowchart of the vulnerability management method based on the application program provided by the embodiment of the present application.

[0033] Figure 2 The structure diagram of the vulnerability management device based on the application program provided by the embodiment of the present application.

[0034] Figure 3Another structural diagram of the application program based vulnerability management device provided by the embodiment of the present application.

[0035] Figure 4 A structural diagram of the terminal device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person skilled in the art without creative effort belong to the protection scope of the present application.

[0037] It should be noted that the present scheme is mainly applicable to the application scenario of application program vulnerability management, and the following content is a simple introduction to the background of the present scheme:

[0038] The present scheme mainly focuses on the technical problem of how to quickly locate the specific link of the development life cycle of the application program where the vulnerability exists, and determine the cause of the vulnerability. It can be understood that the development life cycle of the application program is called SDLC (Software Development Life Cycle) in the art, which is the life cycle of software from generation to scrap, including problem definition, feasibility analysis, overall description, system design, coding, debugging and testing, acceptance and operation, maintenance and upgrade to abandonment stages. For an application program, if any node in its development life cycle is not well maintained, it is likely to cause application program to appear abnormal in the running process, i.e. vulnerability. Therefore, for the developers of the application program, it is necessary to ensure that there is no problem in each link before the application program is put on line. However, the logic of the application program itself is complex, and it is difficult to check all the problems in detail in the early stage, so it is inevitable that some problems cannot be found by the developers, which leads to various vulnerabilities of the application program after it is put on line, affecting the normal operation of the application program.

[0039] In order to ensure that the application program can run normally throughout the life cycle, an application program-based vulnerability management method is provided in the embodiments of the present application. By using the application program-based vulnerability management method provided in the embodiments of the present application, a plurality of key links are defined based on the application program development life cycle, a development process execution file is obtained, and an execution rule is set for each key link in the development process execution file. The focus is on whether the security review result of the application program is accurate, whether the identification of the security scenario is accurate, and whether the security design for the identification of the security scenario is accurate and complete. After the vulnerability of the application program occurs, the developer uploads the vulnerability information of the to-be-tested vulnerability to the system, and the development process execution file of the application program is called out, the actual execution result of each link in the development process execution file is compared with the expected execution result corresponding to the vulnerability type of the to-be-tested vulnerability, and then the specific link where the to-be-tested vulnerability exists is located in the development process execution file, and the specific reason for the to-be-tested vulnerability is analyzed. Meanwhile, compared with the prior art which is mainly before the software is put on line, the present application inversely deduces the reason for the vulnerability after the vulnerability occurs, and can solve the reason for the vulnerability in a targeted manner.

[0040] Please refer to Figure 1 , Figure 1 The flowchart of the application program-based vulnerability management method provided in the embodiments of the present application is shown. The application program-based vulnerability management method is applied to a terminal device. Optionally, the terminal device is a terminal or a server. Optionally, the server is a physical server, or a server cluster or a distributed system composed of a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a smart voice interaction device, a smart home appliance, and a vehicle terminal, but is not limited thereto.

[0041] In an embodiment, the present application is explained and described by taking bank batch deduction as an example. The method can include the following steps:

[0042] In step 101, the vulnerability information of the to-be-tested vulnerability in the target application program is obtained, and the vulnerability information includes the vulnerability type of the to-be-tested vulnerability and the positioning information of the development process execution file of the target application program.

[0043] When the developer of the application discovers a vulnerability in evaluating the performance of the application, for example, the application can directly log in the account without entering the password in the user login process, which is obviously unreasonable, and the vulnerability needs to be traced back, the link of the vulnerability in the development life cycle of the application is located, and the specific reason for the vulnerability is determined. Specifically, when the developer can initiate an information input request to the terminal device, the terminal device provides a work order input platform on the display device for the application developer to provide vulnerability information of the to-be-detected vulnerability after discovering that the target application has a vulnerability. The vulnerability information includes the vulnerability type of the to-be-detected vulnerability and the positioning information of the development process execution file of the target application.

[0044] The links in the development process execution file at least include whether the security review result is accurate, whether the security scenario identification is accurate, and whether the security design performed for the security scenario identification is accurate and complete.

[0045] The security scenario includes one or more of input verification, output encoding verification, access control, parameterized SQL, security resource competition, and sensitive information use check.

[0046] In step 102, according to the positioning information, the target development process execution file corresponding to the to-be-detected vulnerability is obtained.

[0047] The positioning information includes a preset identifier of the application associated with the vulnerability and a version number of the development process execution file. It needs to be explained that each application is pre-created with a corresponding preset identifier, for example, "0001". According to the preset identifier, the development process execution file corresponding to the application that discovers the to-be-detected vulnerability can be obtained. Since the same application may have multiple versions of development process execution files at different development stages, the target development process execution file needs to be determined through the version.

[0048] Specifically, at least one requirement information corresponding to the version number is obtained according to the preset identifier in the positioning information, the target requirement information corresponding to the version number is obtained from the at least one requirement information corresponding to the version number according to the version number, and the target development process execution file corresponding to the target requirement information is obtained.

[0049] In step 103, it is determined whether the actual execution result of each link in the target development process execution file is consistent with the expected execution result corresponding to the vulnerability type, and a judgment result corresponding to each link is obtained.

[0050] Each vulnerability can be attributed to a vulnerability type, for example, when the developer finds that the application does not require a password when logging in an account, the vulnerability type corresponding to the vulnerability can be defined as "authentication exception". The configuration rules of each link in the design and development process execution file are different for each vulnerability type, and the expected execution result is also different. The expected execution result is used to measure whether an application is executed according to the requirements in the development process, so the actual execution result of each link in the target development process execution file can be obtained by judging whether the actual execution result of each link in the target development process execution file is consistent with the expected execution result corresponding to the vulnerability type, and then the cause of the vulnerability of the application can be judged.

[0051] In step 104, if the judgment result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result, the abnormal link in which the actual execution result is inconsistent with the expected execution result is marked in the target development process execution file.

[0052] In some embodiments, the abnormal link can be marked by highlighting the font color or enlarging the font in the area where the abnormal link is located.

[0053] In some embodiments, according to the difference information between the actual execution result and the expected execution result of each abnormal link, a corresponding textual description can be generated, and the textual description is inserted into the abnormal link corresponding thereto and displayed in a preset form in the target development process execution file.

[0054] All the optional technical solutions described above can be combined to form optional embodiments of the present application, and will not be described one by one here.

[0055] In specific implementation, the present application is not limited by the execution order of each step, and some steps can be performed in other order or simultaneously without conflict.

[0056] From the above, the application embodiment provides an application-based vulnerability management method, which acquires vulnerability information of a to-be-detected vulnerability in a target application, the vulnerability information including a vulnerability type of the to-be-detected vulnerability and positioning information of a development process execution file of the target application; acquires a target development process execution file corresponding to the to-be-detected vulnerability according to the positioning information; judges whether actual execution results of each link in the target development process execution file are consistent with expected execution results corresponding to the vulnerability type, to obtain a judgment result corresponding to each link; if the judgment result is that the actual execution results in the target development process execution file are inconsistent with the expected execution results, marks an abnormal link in which the actual execution results are inconsistent with the expected execution results in the target development process execution file. The application embodiment provides an application-based vulnerability management method, which defines a plurality of key links based on an application development life cycle, obtains a development process execution file, and sets an execution rule for each key link in the development process execution file. The focus is on whether the security review result of the application is accurate, whether the security scenario recognition is accurate, and whether the security design for the security scenario recognition is accurate and complete. After a vulnerability occurs in the application, the developer uploads the vulnerability information of the to-be-detected vulnerability to the system, and calls out the development process execution file of the application, compares the actual execution results of each link in the development process execution file with the expected execution results corresponding to the vulnerability type of the to-be-detected vulnerability, and then locates the link in which the to-be-detected vulnerability exists in the development process execution file, and analyzes the specific reason for the to-be-detected vulnerability. Meanwhile, compared with the prior art, the application mainly inversely deduces the reason for the vulnerability after the vulnerability occurs, and can solve the reason for the vulnerability in a targeted manner.

[0057] The application embodiment further provides an application-based vulnerability management device, which can be integrated in a terminal device.

[0058] Please refer to Figure 2 , Figure 2 The application embodiment provides an application-based vulnerability management device, which can be integrated in a terminal device.

[0059] The information acquisition module 31 is configured to acquire vulnerability information of a to-be-detected vulnerability in a target application, the vulnerability information including a vulnerability type of the to-be-detected vulnerability and positioning information of a development process execution file of the target application;

[0060] The file acquisition module 32 is configured to acquire a target development process execution file corresponding to the to-be-detected vulnerability according to the positioning information;

[0061] The result judging module 33 is configured to judge whether the actual execution result of each link in the target development process execution file is consistent with the expected execution result corresponding to the vulnerability type, to obtain a judging result corresponding to each link.

[0062] The result marking module 34 is configured to, if the judging result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result, mark the abnormal link in which the actual execution result is inconsistent with the expected execution result in the target development process execution file.

[0063] In some embodiments, if the judging result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result, the device further comprises a remark module configured to generate a corresponding textual description according to the difference information in which the actual execution result is inconsistent with the expected execution result in each abnormal link, and insert the textual description into the abnormal link corresponding thereto and display the textual description in a preset form in the target development process execution file.

[0064] In some embodiments, the positioning information comprises a preset identifier of an application associated with the vulnerability and a version number of the development process execution file; the file obtaining module 32 is configured to obtain at least one requirement information corresponding to the version number according to the preset identifier, obtain target requirement information corresponding to the version number from the at least one requirement information corresponding to the version number, and obtain the target development process execution file corresponding to the target requirement information.

[0065] In some embodiments, each link in the development process execution file at least comprises whether the security review result is accurate, whether the security scenario identification is accurate, and whether the security design performed for the security scenario identification is accurate and complete.

[0066] In some embodiments, the security scenario comprises one or more of input verification, output encoding verification, access control, parameterized SQL, security resource competition, and sensitive information usage check.

[0067] In some embodiments, the device further comprises an entry module configured to provide a work order entry platform, and the work order entry platform is configured to be used by an application developer to provide vulnerability information of a to-be-detected vulnerability after discovering that the target application has a vulnerability.

[0068] In some embodiments, the result marking module 34 is configured to mark the abnormal link in which the actual execution result is inconsistent with the expected execution result in the target development process execution file in the form of font color highlighting or font amplification.

[0069] In practice, the above various modules can be implemented as independent entities, or combined as the same or several entities.

[0070] From the above, the application embodiment provides an application program based vulnerability management device 30, wherein an information acquisition module 31 is configured to acquire vulnerability information of a to-be-detected vulnerability in a target application program, the vulnerability information including a vulnerability type of the to-be-detected vulnerability and positioning information of a development process execution file of the target application program; a file acquisition module 32 is configured to acquire a target development process execution file corresponding to the to-be-detected vulnerability according to the positioning information; a result judgment module 33 is configured to judge whether actual execution results of each link in the target development process execution file are consistent with expected execution results corresponding to the vulnerability type, to obtain a judgment result corresponding to each link; and a result marking module 34 is configured to mark an abnormal link in which the actual execution result is inconsistent with the expected execution result in the target development process execution file, if the judgment result is that the actual execution result is inconsistent with the expected execution result.

[0071] Please refer to Figure 3 , Figure 3 Another structural diagram of the application embodiment provides an application program based vulnerability management device, the application program based vulnerability management device 30 includes a memory 120, one or more processors 180, and one or more application programs, wherein the one or more application programs are stored in the memory 120 and configured to be executed by the processor 180; the processor 180 can include an information acquisition module 31, a file acquisition module 32, a result judgment module 33, a result marking module 34, and a generation module 35. For example, the structure and connection relationship of the above various components can be as follows:

[0072] The memory 120 can be used to store application programs and data. The application programs stored in the memory 120 include executable codes. The application programs can constitute various functional modules. The processor 180 executes various functional applications and data processing by running the application programs stored in the memory 120. In addition, the memory 120 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. Accordingly, the memory 120 can also include a memory controller to provide the processor 180 with access to the memory 120.

[0073] The processor 180 is the control center of the device, connects each part of the entire terminal through various interfaces and lines, performs various functions of the device and processes data by running or executing the application programs stored in the memory 120 and calling the data stored in the memory 120, and thus performs overall monitoring on the device. Optionally, the processor 180 can include one or more processing cores; preferably, the processor 180 can integrate an application processor and a modem processor, wherein the application processor mainly processes operating systems, user interfaces, and application programs, etc.

[0074] In particular, in the embodiment, the processor 180 loads the executable code corresponding to the process of one or more application programs into the memory 120 according to the following instructions, and runs the application programs stored in the memory 120 by the processor 180, so as to realize various functions:

[0075] The information acquisition instruction is used to acquire vulnerability information of a to-be-detected vulnerability in a target application program, and the vulnerability information includes a vulnerability type of the to-be-detected vulnerability and positioning information of a development flow execution file of the target application program.

[0076] The file acquisition instruction is used to acquire a target development flow execution file corresponding to the to-be-detected vulnerability according to the positioning information.

[0077] The result judgment instruction is used to judge whether the actual execution result of each link in the target development flow execution file is consistent with an expected execution result corresponding to the vulnerability type, to obtain a judgment result corresponding to each link.

[0078] The result marking instruction is used to mark an abnormal link in the target development flow execution file, if the judgment result is that the actual execution result in the target development flow execution file is inconsistent with the expected execution result.

[0079] In some embodiments, if the judgment result is that the actual execution result in the target development flow execution file is inconsistent with the expected execution result, the program further includes a note instruction, which is used to generate a corresponding textual description according to difference information existing between the actual execution result and the expected execution result in each abnormal link; and the textual description is inserted into the abnormal link corresponding thereto and displayed in a preset form in the target development flow execution file.

[0080] In some embodiments, the positioning information comprises a preset identifier of the application associated with the vulnerability and a version number of the development process execution file; the file acquisition instruction is used to acquire at least one requirement information corresponding to the version number according to the preset identifier; the target requirement information corresponding to the version number is acquired from the at least one requirement information corresponding to the version number according to the version number; and the target development process execution file corresponding to the target requirement information is acquired according to the target requirement information.

[0081] In some embodiments, the development process execution file comprises at least whether the security review result is accurate, whether the security scene identification is accurate, and whether the security design for the security scene identification is accurate and complete.

[0082] In some embodiments, the security scene comprises one or more of input verification, output encoding verification, access control, parameterized SQL, security resource competition, and sensitive information usage check.

[0083] In some embodiments, the program further comprises an entry instruction for providing a work order entry platform, the work order entry platform being used for providing the vulnerability information of the to-be-detected vulnerability by the application developer after discovering that the target application has the vulnerability.

[0084] In some embodiments, the result marking instruction is used to mark the abnormal link in the target development process execution file in the form of font color highlighting or font amplification when the actual execution result is inconsistent with the expected execution result.

[0085] Embodiments of the present application also provide a terminal device. The terminal device can be a server, a smart phone, a computer, a tablet computer, and the like.

[0086] Please refer to Figure 4 , Figure 4 A structure schematic diagram of a terminal device provided by an embodiment of the present application is shown, which can be used to implement the application program-based vulnerability management method provided in the above embodiments. The terminal device 1200 can be a television or a smart phone or a tablet computer.

[0087] As shown in Figure 4 , the terminal device 1200 can include RF (Radio Frequency, radio frequency) circuit 110, a memory 120 including one or more (only one is shown in the figure) computer readable storage media, an input unit 130, a display unit 140, a sensor 150, an audio circuit 160, a transmission module 170, a processor 180 including one or more (only one is shown in the figure) processing cores, and a power supply 190, and the like. Those skilled in the art can understand that Figure 4The structure of the terminal device 1200 shown in the figure does not constitute a limitation on the terminal device 1200, and can include more or fewer components than shown, or combine certain components, or different component arrangements. Among them:

[0088] The RF circuit 110 is used to receive and send electromagnetic waves, and realizes the mutual conversion between electromagnetic waves and electrical signals, so as to communicate with a communication network or other devices. The RF circuit 110 can include various existing circuit elements for performing these functions, such as an antenna, a radio frequency transceiver, a digital signal processor, an encryption / decryption chip, a subscriber identity module (SIM) card, a memory, and the like. The RF circuit 110 can communicate with various networks such as the Internet, an intranet, a wireless network, or other devices through a wireless network.

[0089] The memory 120 can be used to store software programs and modules, such as the program instructions / modules corresponding to the application-based vulnerability management method in the above embodiments. The processor 180 executes various functions and data processing by running the software programs and modules stored in the memory 120, and can automatically select a vibration reminder mode for application-based vulnerability management according to the current scene of the terminal device, which can ensure that the conference and other scenes are not disturbed, and the user can perceive the incoming call, thereby improving the intelligence of the terminal device. The memory 120 can include a high-speed random access memory, and can also include a non-volatile memory such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 120 can further include a memory remotely arranged relative to the processor 180, which can be connected to the terminal device 1200 through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] The input unit 130 can be configured to receive input digital or character information, and generate a key signal, a mouse signal, a lever signal, an optical or a track ball signal related to a user's setting and function control. Specifically, the input unit 130 can include a touch sensitive surface 131 and other input devices 132. The touch sensitive surface 131, also called a touch screen or a touch pad, can collect a touch operation (e.g., an operation of a user using a finger, a stylus, or any suitable object or accessory near the touch sensitive surface 131) on or near the touch sensitive surface 131 and drive a corresponding connection device according to a pre-set program. Optionally, the touch sensitive surface 131 can include a touch detection device and a touch controller. The touch detection device detects a touch position of a user and detects a signal caused by a touch operation and transmits the signal to the touch controller. The touch controller receives the touch information from the touch detection device, converts the touch information into touch coordinates, and transmits the touch coordinates to the processor 180. The touch controller can also receive a command from the processor 180 and execute the command. In addition, the touch sensitive surface 131 can be implemented in various types such as a resistive type, a capacitive type, an infrared type, and a surface acoustic wave type. In addition to the touch sensitive surface 131, the input unit 130 can include other input devices 132. Specifically, the other input devices 132 can include one or more of a physical keyboard, a function key (e.g., a volume control key, an on / off key, etc.), a trackball, a mouse, a lever, etc.

[0091] The display unit 140 can be configured to display information input by a user or information provided to the user and various graphical user interfaces of the terminal device 1200, which can be composed of graphics, text, icons, video, and any combination thereof. The display unit 140 can include a display panel 141, which can be implemented in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), etc. Further, the touch sensitive surface 131 can cover the display panel 141, and when the touch sensitive surface 131 detects a touch operation on or near the touch sensitive surface 131, the touch sensitive surface 131 transmits the touch operation to the processor 180 to determine a type of the touch event, and then the processor 180 provides a corresponding visual output on the display panel 141 according to the type of the touch event. Although in the above description, the touch sensitive surface 131 and the display panel 141 are implemented as two separate components to perform input and output functions, in some embodiments, the touch sensitive surface 131 and the display panel 141 can be integrated to perform input and output functions. Figure 4

[0092] ​The terminal device 1200 can also include at least one sensor 150, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor can include an ambient light sensor that can adjust the brightness of the display panel 141 according to the brightness of ambient light, and a proximity sensor that can turn off the display panel 141 and / or the backlight when the terminal device 1200 is moved to the ear. As one of the motion sensors, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and when at rest, it can detect the magnitude and direction of gravity, which can be used for identifying the posture of the mobile phone (such as switching between landscape and portrait screens, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometers, taps), and the like. As for other sensors that the terminal device 1200 can also be configured, such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, they will not be described here.

[0093] The audio circuit 160, the speaker 161, and the microphone 162 can provide an audio interface between the user and the terminal device 1200. The audio circuit 160 can convert the received audio data into an electrical signal, transmit it to the speaker 161, and convert it into a sound signal output by the speaker 161. On the other hand, the microphone 162 converts the collected sound signal into an electrical signal, which is received by the audio circuit 160 and converted into audio data. After being processed by the processor 180, the audio data is output to the RF circuit 110 for transmission to another terminal, for example, or to the memory 120 for further processing. The audio circuit 160 can also include a jack for providing communication between an external earphone and the terminal device 1200.

[0094] The terminal device 1200 can help the user to send and receive emails, browse web pages, and access streaming media, etc. through the transmission module 170 (such as a Wi-Fi module), which provides the user with wireless broadband Internet access. Although Figure 4 The transmission module 170 is shown, but it can be understood that it does not belong to the essential components of the terminal device 1200, and can be omitted as needed without changing the essence of the application.

[0095] The processor 180 is the control center of the terminal device 1200. It connects to various parts of the mobile phone via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 120, and by calling data stored in the memory 120, it performs various functions of the terminal device 1200 and processes data, thereby providing overall monitoring of the mobile phone. Optionally, the processor 180 may include one or more processing cores; in some embodiments, the processor 180 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor 180.

[0096] The terminal device 1200 also includes a power supply 190 that supplies power to the various components. In some embodiments, the power supply can be logically connected to the processor 180 through a power management system, thereby enabling functions such as discharge management and power consumption management through the power management system. The power supply 190 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0097] Although not shown, the terminal device 1200 may also include a camera (such as a front-facing camera and a rear-facing camera), a Bluetooth module, etc., which will not be described in detail here. Specifically, in this embodiment, the display unit 140 of the terminal device 1200 is a touch screen display, and the terminal device 1200 also includes a memory 120 and one or more programs, one or more of which are stored in the memory 120 and configured to be executed by one or more processors 180. One or more programs contain instructions for performing the following operations:

[0098] Information acquisition instructions are used to acquire vulnerability information of a vulnerability to be detected in a target application. The vulnerability information includes the vulnerability type of the vulnerability to be detected and the location information of the development process execution file of the target application.

[0099] The file retrieval instruction is used to retrieve the target development process execution file corresponding to the vulnerability to be detected based on the location information.

[0100] The result judgment instruction is used to determine whether the actual execution result of each step in the target development process execution file is consistent with the expected execution result corresponding to the vulnerability type, and to obtain the judgment result corresponding to each step.

[0101] The result marking instruction is used for marking the abnormal link of the actual execution result and the expected execution result in the target development process execution file if the judgment result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result.

[0102] In some embodiments, if the judgment result is that the actual execution result in the target development process execution file is inconsistent with the expected execution result, the program further comprises a note instruction, which is used for generating corresponding textual description according to the difference information of the actual execution result and the expected execution result in each abnormal link; and the textual description is inserted into the corresponding abnormal link in the target development process execution file and displayed in a preset form.

[0103] In some embodiments, the positioning information comprises a preset identifier of an application associated with the vulnerability and a version number of a development process execution file; the file acquisition instruction is used for acquiring at least one requirement information corresponding to the version number according to the preset identifier; acquiring target requirement information corresponding to the version number from the at least one requirement information corresponding to the version number according to the version number; and acquiring the target development process execution file corresponding to the target requirement information according to the target requirement information.

[0104] In some embodiments, each link in the development process execution file at least comprises whether the security review result is accurate, whether the security scenario identification is accurate, and whether the security design for the security scenario identification is accurate and complete.

[0105] In some embodiments, the security scenario comprises one or more of input verification, output encoding verification, access control, parameterized SQL, security resource competition, and sensitive information use checking.

[0106] In some embodiments, the program further comprises an entry instruction, which is used for providing a work order entry platform, and the work order entry platform is used for providing vulnerability information of a to-be-detected vulnerability by an application developer after discovering that the target application has a vulnerability.

[0107] In some embodiments, the result marking instruction is used for marking the abnormal link of the actual execution result and the expected execution result in the target development process execution file in the form of font color highlighting or font amplification.

[0108] Embodiments of the present application further provide a terminal device. The terminal device can be a smart phone, a computer, or the like.

[0109] As can be seen from the above, the embodiments of the present application provide a terminal device 1200, which performs the following steps:

[0110] obtain vulnerability information of a to-be-detected vulnerability in a target application program, the vulnerability information including a vulnerability type of the to-be-detected vulnerability and positioning information of a development process execution file of the target application program;

[0111] obtain a target development process execution file corresponding to the to-be-detected vulnerability according to the positioning information;

[0112] determine whether actual execution results of each link in the target development process execution file are consistent with expected execution results corresponding to the vulnerability type, to obtain a judgment result corresponding to each link;

[0113] if the judgment result is that the actual execution results in the target development process execution file are inconsistent with the expected execution results, mark an abnormal link in which the actual execution results are inconsistent with the expected execution results in the target development process execution file.

[0114] The application also provides a storage medium, which stores a computer program. When the computer program runs on a computer, the computer executes the application-based vulnerability management method.

[0115] It should be noted that, for the application-based vulnerability management method, a person skilled in the art can understand that all or part of the processes of the application-based vulnerability management method can be completed by a computer program controlling related hardware. The computer program can be stored in a computer-readable storage medium, such as a memory of a terminal device, and executed by at least one processor in the terminal device. In the execution process, the computer program can include the processes of the embodiments of the application-based vulnerability management method. The storage medium can be a disk, an optical disc, a read-only memory (ROM), a random access memory (RAM), or the like.

[0116] For the application-based vulnerability management device, each functional module can be integrated in one processing chip, or each module can exist physically independently, or two or more modules can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software functional module. If the integrated module is realized in the form of a software functional module and sold or used as an independent product, the software functional module can also be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disc.

[0117] The application provides a vulnerability management method and device based on an application program, a medium and equipment.

Claims

1. An application-based vulnerability management method, characterized by, The method comprises the following steps: obtaining vulnerability information of a vulnerability to be detected in a target application, wherein the vulnerability information comprises a vulnerability type of the vulnerability to be detected and positioning information of a development process execution file of the target application, the positioning information comprises a preset identifier of an application associated with the vulnerability and a version number of the development process execution file, and each link in the development process execution file at least comprises whether a security review result is accurate, whether security scenario identification is accurate, and whether security design performed for the security scenario identification is accurate and complete; obtaining at least one requirement information corresponding to the version number according to the preset identifier; obtaining target requirement information corresponding to the version number from the at least one requirement information corresponding to the version number according to the version number; obtaining a target development process execution file corresponding to the target requirement information according to the target requirement information; judging whether actual execution results of each link in the target development process execution file are consistent with expected execution results corresponding to the vulnerability type, to obtain a judgment result corresponding to each link; if the judgment result is that the actual execution results in the target development process execution file are inconsistent with the expected execution results, marking an abnormal link in which the actual execution results are inconsistent with the expected execution results in the target development process execution file.

2. The vulnerability management method of claim 1, wherein, If the judgment result is that the actual execution results in the target development process execution file are inconsistent with the expected execution results, the method further comprises: generating a corresponding textual description according to difference information in which the actual execution results are inconsistent with the expected execution results in each abnormal link; and inserting the textual description into the abnormal link corresponding to the textual description in the target development process execution file and displaying the textual description in a preset form.

3. The vulnerability management method of claim 1, wherein, The security scenario comprises one or more of input verification, output encoding verification, access control, parameterized SQL, security resource competition, and sensitive information usage check.

4. The vulnerability management method of claim 1, wherein, Before the step of obtaining the vulnerability information of the vulnerability to be detected in the target application, the method further comprises: providing a work order input platform, wherein the work order input platform is used for a developer of an application to provide the vulnerability information of the vulnerability to be detected after discovering that the target application has a vulnerability.

5. The vulnerability management method of claim 1, wherein, The step of marking the abnormal link in which the actual execution results are inconsistent with the expected execution results in the target development process execution file comprises: highlighting or enlarging the abnormal link in which the actual execution results are inconsistent with the expected execution results in the target development process execution file by using font color or font size.

6. An application-based vulnerability management apparatus, characterized by comprising: The vulnerability management device based on an application comprises: an information obtaining module, configured to obtain vulnerability information of a vulnerability to be detected in a target application, wherein the vulnerability information comprises a vulnerability type of the vulnerability to be detected and positioning information of a development process execution file of the target application, the positioning information comprises a preset identifier of an application associated with the vulnerability and a version number of the development process execution file, and each link in the development process execution file at least comprises whether a security review result is accurate, whether security scenario identification is accurate, and whether security design performed for the security scenario identification is accurate and complete; The file acquisition module is configured to acquire at least one requirement information corresponding to the version number according to the preset identifier, acquire target requirement information corresponding to the version number from the at least one requirement information corresponding to the version number according to the version number, and acquire a target development process execution file corresponding to the target requirement information according to the target requirement information. The result judgment module is configured to judge whether actual execution results of each link in the target development process execution file are consistent with expected execution results corresponding to the vulnerability type, and obtain a judgment result corresponding to each link. The result marking module is configured to mark an abnormal link in which the actual execution result is inconsistent with the expected execution result in the target development process execution file if the judgment result is that the actual execution result is inconsistent with the expected execution result.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores a plurality of instructions, which are suitable for being loaded by the processor to execute the application program based vulnerability management method in any one of claims 1 to 5.

8. A terminal device, comprising: The computer readable storage medium stores a plurality of instructions, which are suitable for being loaded by the processor to execute the application program based vulnerability management method in any one of claims 1 to 5.

Images