Vulnerability scanning monitoring method, system, electronic device and storage medium

Abstract

The present invention provides a vulnerability scanning and monitoring method, system, electronic device, and storage medium, relating to the field of network security technology. The method includes obtaining traffic logs; performing offline analysis of the traffic logs using preconfigured rules to screen for vulnerability results; and sending the vulnerability results to an SDP vulnerability management platform. This method allows for flexible definition of rules based on specific business scenarios, efficient use of probes, and secure, efficient, and low-cost offline detection, resolving the issues of low detection efficiency and high cost associated with existing methods.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a vulnerability scanning and monitoring method, system, electronic device, and storage medium. Background Art

[0002] Traditional application security scanning technologies include active and passive scanning, IAST, and others. These technologies capture normal data packets, modify parameter values to create security test vectors, and then send data packets to the server to monitor its response. However, these technologies have high false positive rates, insufficient coverage, and the insertion of corrupted data into the system, making them incompatible with agile development processes.

[0003] Traditional IAST technology consumes additional performance, increasing server burden and impacting business operations through bytecode. Different deployment environments present different challenges, making IAST technology difficult to apply across a wide range of applications. In complex deployment environments, adding probes can negatively impact the product, leading to disapproval from other departments regarding security efforts. This necessitates a public service platform, which is costly. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a vulnerability scanning and monitoring method, system, electronic device and storage medium, which can flexibly define rules according to their own business scenarios, efficiently use probes, and achieve safe and efficient offline detection with low usage costs, thus solving the problems of low detection efficiency and high cost of existing methods.

[0005] The present invention provides a vulnerability scanning and monitoring method, which includes:

[0006] Get traffic logs;

[0007] Performing offline analysis on the traffic log using pre-configured rules to filter out vulnerability results;

[0008] Send the vulnerability results to the SDP vulnerability management platform.

[0009] In the above implementation process, you can flexibly customize rules according to your own business scenarios and use probes efficiently. The intermediate-state instrumented vulnerability scanning monitoring system has security detection and monitoring capabilities. Vulnerability detection is more accurate and scans generate very little dirty data. There is no need to perform vulnerability detection logic at the business code layer. You only need to push the variables of interest to the security team's Kafka cluster, which can achieve safe and efficient offline detection with low usage costs, solving the problems of low detection efficiency and high cost of existing methods.

[0010] Furthermore, obtaining the traffic log includes:

[0011] Obtain traffic logs in the Kafka cluster, including stack result traffic and HTTP original traffic;

[0012] The traffic logs come from normal access traffic, test traffic and Hydra scanner replay traffic collected by the CAT platform from the application server through public embedding points.

[0013] In the above implementation process, the application only needs to be connected to the CAT platform, which has low usage costs. Through the application tracking data connected to the CAT platform, a wide range of application security detection coverage within the industry can be achieved.

[0014] Furthermore, before the step of performing offline analysis on the traffic log using pre-configured rules to filter out vulnerability results, the method further includes:

[0015] The stack result traffic and the http original traffic are associated with each other using a unique serial number, and the associated result is stored in a Redis cluster.

[0016] In the above implementation process, the stack result traffic and the original HTTP traffic are associated through a unique serial number to facilitate subsequent vulnerability detection.

[0017] Furthermore, the offline analysis of the traffic log using pre-configured rules to filter out vulnerability results includes:

[0018] The association results are analyzed offline based on the rules to determine whether there is a vulnerability.

[0019] In the above implementation process, preset rules are used to perform offline analysis on the association results. Rules can be flexibly customized according to one's own business scenarios, and probes can be used efficiently.

[0020] Furthermore, the offline analysis of the correlation result based on the rule to determine whether a vulnerability exists includes:

[0021] If the parameter values in the traffic log are brought into the SQL statement for execution, the corresponding traffic contains a vulnerability;

[0022] If the security mark in the traffic log is brought into the SQL statement for execution, the traffic corresponding to the traffic log contains an SQL injection vulnerability;

[0023] If the traffic is replayed through the Hydra scanner, with security test vectors added, and SQL statements are brought in for execution, then the traffic contains a SQL injection vulnerability.

[0024] In the above implementation process, specific detection rules are given, the vulnerability detection accuracy is higher, the dirty data generated by the scan is extremely small, and there is no need to set vulnerability detection logic at the business code layer.

[0025] The present invention also provides a vulnerability scanning and monitoring system, comprising:

[0026] The Blackcat cluster is used to obtain traffic logs; perform offline analysis on the traffic logs using pre-configured rules to filter out vulnerability results; and send the vulnerability results to the SDP vulnerability management platform.

[0027] In the above implementation process, you can flexibly customize rules according to your own business scenarios and use probes efficiently. The intermediate-state instrumented vulnerability scanning monitoring system has security detection and monitoring capabilities. Vulnerability detection is more accurate and scans generate very little dirty data. There is no need to set vulnerability detection logic at the business code layer. You only need to push the variables of interest to the security team's Kafka cluster, which can achieve safe and efficient offline detection with low usage costs, solving the problems of low detection efficiency and high cost of existing methods.

[0028] Furthermore, the system further comprises:

[0029] The CAT platform is used to collect traffic logs from application servers through public embedding points and store them in the Kafka cluster, so that the Blackcat cluster obtains traffic logs from the Kafka cluster. The traffic logs include stack result traffic and http original traffic.

[0030] In the above implementation process, the CAT platform captures the traffic logs of the program during runtime by hooking key functions. The application only needs to be connected to CAT, which has low usage costs. It borrows the existing model of the public service CAT platform and the intermediate state plug-in leakage scanning monitoring system, which has security detection and monitoring capabilities.

[0031] Furthermore, the system further comprises:

[0032] The Redis cluster is used to store a correlation result obtained by correlating the stack result traffic with the http original traffic using a unique serial number, so that the Blackcat cluster performs offline analysis on the correlation result based on the rule.

[0033] In the above implementation process, CAT collects data for direct offline security analysis, implements a distributed architecture, and forms a multi-node high-availability form based on the framework.

[0034] An embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute any one of the vulnerability scanning and monitoring methods described above.

[0035] An embodiment of the present application further provides a readable storage medium, wherein the readable storage medium stores computer program instructions. When the computer program instructions are read and executed by a processor, any one of the vulnerability scanning and monitoring methods described above is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 A flowchart of a vulnerability scanning and monitoring method provided in an embodiment of the present application;

[0038] Figure 2 A flowchart of vulnerability detection provided in an embodiment of the present application;

[0039] Figure 3 A flowchart of the specific implementation of the vulnerability scanning and monitoring method provided in the embodiment of the present application;

[0040] Figure 4 This is a system architecture diagram of the vulnerability scanning and monitoring system provided in an embodiment of the present application.

[0041] icon:

[0042] 100-Hydra scanner; 200-CAT platform; 300-Kafka cluster; 400-Redis cluster; 500-Blackcat cluster; 600-SDP vulnerability management platform. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0044] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0045] Example 1

[0046] Please see Figure 1 , Figure 1 A flowchart of a vulnerability scanning and monitoring method provided in an embodiment of the present application. Applied to Blackcat cluster 500, such as Figure 2 FIG. 1 is a flowchart of vulnerability detection, and the method may specifically include the following steps:

[0047] Step S100: Obtain traffic logs;

[0048] Step S200: Analyze the traffic log offline using pre-configured rules to filter out vulnerability results;

[0049] Step S300: Send the vulnerability result to the SDP vulnerability management platform 600.

[0050] Obtaining traffic logs specifically includes:

[0051] Obtaining traffic logs in the Kafka cluster 300, where the traffic logs include stack result traffic and HTTP original traffic;

[0052] The traffic log comes from normal access traffic, test traffic and Hydra scanner 100 replay traffic collected from the application server by the CAT platform 200 through public embedding points.

[0053] The application only needs to be connected to the CAT platform 200, which has low usage costs. Through the application tracking data that has been connected to the CAT platform 200, a wide range of application security detection coverage within the bank can be achieved.

[0054] The system generates traffic stack logs in three scenarios: normal access, system testing, and traffic replay by the Hydra scanner 100. These logs are collected and uploaded to the CAT platform 200 in real time, processed, and then stored in the Kafka cluster 300.

[0055] The Hydra scanner 100 obtains the mirrored traffic between the user and the application server, replays the traffic, and includes it in the security test payload when sending the packet.

[0056] Before step S200, the method further includes:

[0057] The stack result traffic and the http original traffic are associated with each other using a unique serial number, and the associated result is stored in the Redis cluster 400 .

[0058] The stack result traffic and the original HTTP traffic are associated through a unique serial number to facilitate subsequent vulnerability detection.

[0059] Step S200 may specifically include:

[0060] The association results are analyzed offline based on the rules to determine whether there is a vulnerability, specifically:

[0061] If the parameter values in the traffic log are brought into the SQL statement for execution, the corresponding traffic contains a vulnerability;

[0062] If the security mark in the traffic log is brought into the SQL statement for execution, the traffic corresponding to the traffic log contains an SQL injection vulnerability;

[0063] If the traffic is replayed by the Hydra scanner 100 and security test vectors are added, and SQL statements are brought in for execution, then the traffic contains an SQL injection vulnerability.

[0064] Specifically, if a normal parameter value is found in the SQL execution result, a vulnerability is suspected;

[0065] If a special security tag is found in the SQL execution result, a vulnerability is suspected;

[0066] If the security test payload is found in the SQL execution result, there is a high probability of a vulnerability.

[0067] Specific detection rules are given, the vulnerability detection accuracy is higher, the scanning generates very little dirty data, and there is no need to set vulnerability detection logic at the business code layer.

[0068] like Figure 3 As shown in the figure, it is a specific implementation flow chart of the vulnerability scanning and monitoring method. Specifically, the CAT platform 200 captures the stack data of the program during runtime by hooking key functions. The stack data is the running data of each application connected to CAT. The captured embedded data is pushed to the Blackcat cluster 500 for vulnerability detection. The vulnerability will be reported to the MySQL database of the SDP vulnerability management platform 600 and displayed in a visual form.

[0069] The Blackcat cluster 500 includes a collection node and a rule analysis node. The collection node collects traffic logs in the Kafka cluster 300 and performs vulnerability detection through the rule analysis node.

[0070] Taking SQL injection detection as an example, based on the capabilities of the CAT Platform 200, CAT has integrated key application monitoring classes, such as those related to JDBC, to capture all SQL execution statements. This intermediate-state instrumented vulnerability scanning monitoring system in a test environment can function as an IAST, offering vulnerability discovery capabilities. In a production environment, this intermediate-state instrumented vulnerability scanning monitoring system can function as a RASP, offering attack detection capabilities. After obtaining the original SQL log, it is possible to directly determine whether the application uses splicing. Keyword search can be used to monitor actual SQL injection attacks. By blindly scanning traffic with a passive scanner and inserting identifiers, SQL injection vulnerabilities can be confirmed by retrieving identifiers from the SQL log, minimizing false positives.

[0071] Rules can be flexibly customized according to one's own business scenarios, and probes can be used efficiently. The intermediate-state instrumented vulnerability scanning monitoring system has security detection and monitoring capabilities. Vulnerability detection is more accurate and scans generate very little dirty data. There is no need to perform vulnerability detection logic at the business code layer. Instead, only the variables of interest need to be pushed to the security team's Kafka cluster 300, enabling safe and efficient offline detection with low usage costs, solving the problems of low detection efficiency and high costs of existing methods.

[0072] Example 2

[0073] The present application also provides a vulnerability scanning monitoring system. Figure 4 The figure shows the system architecture diagram of the vulnerability scanning and monitoring system. This system is an intermediate-state plug-in vulnerability scanning and monitoring system that relies on a distributed framework to achieve multi-node deployment. Based on the concept of IAST (Interactive application security testing, a technology that automatically identifies and diagnoses software vulnerabilities in applications and APIs), the intermediate-state plug-in vulnerability scanning and monitoring system is implemented. By reusing public services to bury points in applications, and then analyzing passive traffic, it ultimately achieves intrusion detection and vulnerability verification. It also implements a distributed architecture, relying on the framework to form a multi-node high-availability form. The system includes:

[0074] The Blackcat cluster 500 is used to obtain traffic logs; perform offline analysis on the traffic logs using pre-configured rules to filter out vulnerability results; and send the vulnerability results to the SDP vulnerability management platform 600.

[0075] The CAT platform 200 is used to collect traffic logs from the application server through public tracking points and store them in the Kafka cluster 300, so that the Blackcat cluster 500 obtains traffic logs from the Kafka cluster 300. The traffic logs include stack result traffic and http original traffic.

[0076] Traffic includes normal access traffic, test traffic, and Hydra scanner 100 replay traffic. In the three scenarios of normal access, test system, and Hydra scanner 100 replay traffic, the system will record and generate traffic stack logs. These logs will be collected and uploaded to the CAT platform 200 in real time, and then stored in the Kafka cluster 300 after processing.

[0077] The Hydra scanner 100 obtains the traffic from the user to the application server through a mirror and replays the traffic, adding a security test payload when sending packets;

[0078] The CAT platform 200 provides client tracking functionality, collects traffic logs, and stores them in the Kafka cluster 300.

[0079] The Blackcat cluster 500 extracts traffic logs from the Kafka cluster 300 and writes the correlation results to the Redis cluster 400 based on unique serial number matching. The Blackcat rule analysis node performs offline analysis on the correlation results in the Redis cluster 400 to determine whether a vulnerability exists.

[0080] The specific judgment rules are:

[0081] If the parameter values in the traffic log are brought into the SQL statement for execution, the corresponding traffic contains a vulnerability;

[0082] If the security mark in the traffic log is brought into the SQL statement for execution, the traffic corresponding to the traffic log contains an SQL injection vulnerability;

[0083] If the traffic is replayed by the Hydra scanner 100 and security test vectors are added, and SQL statements are brought in for execution, then the traffic contains an SQL injection vulnerability.

[0084] Specifically, if a normal parameter value is found in the SQL execution result, a vulnerability is suspected;

[0085] If a special security tag is found in the SQL execution result, a vulnerability is suspected;

[0086] If the security test payload is found in the SQL execution result, there is a high probability of a vulnerability.

[0087] This rule can be used to conduct specific tests based on specific application scenarios, thereby improving the accuracy of the test results.

[0088] CAT Platform 200, like security products like RASP and IAST, uses Java bytecode technology. By hooking key functions, CAT Platform 200 captures runtime stack data from applications connected to CAT Platform 200. This captured data is then pushed to Kafka cluster 300.

[0089] The CAT platform 200 captures the traffic logs of the program during runtime by hooking key functions. The application only needs to be connected to CAT, which has low usage costs. It borrows the existing model of the public service CAT platform 200 and the intermediate state plug-in leakage scanning monitoring system, which has security detection and monitoring capabilities.

[0090] The intermediate-state instrumented vulnerability scanning monitoring system will analyze the key variables passed to sensitive functions in the stack based on the traffic logs in the Kafka cluster 300, and perform vulnerability detection on the parameters, responses, SQL or commands executed by the application in the data packets pushed by the CAT platform 200 in the test environment or production.

[0091] The Redis cluster 400 is used to store a correlation result obtained by correlating the stack result traffic with the http original traffic using a unique serial number, so that the Blackcat cluster 500 performs offline analysis on the correlation result based on the rule.

[0092] By collecting data through CAT and conducting offline security analysis directly, a distributed architecture is implemented, and a multi-node high-availability form is formed based on the framework.

[0093] The intermediate-state instrumented vulnerability scanning monitoring system detects and alerts applications of attack behaviors and proactively detects vulnerabilities. Leveraging the established popularity of the CAT Platform 200, this system bypasses the deployment difficulties and poor compatibility of IAST agents. By collecting data directly from the CAT Platform 200 and leveraging the passive scanner Hydra, it can efficiently and accurately determine whether an application has security vulnerabilities.

[0094] Analyze the traffic logs recorded by the CAT platform 200. If the rules configured by the intermediate state instrumented leak scanning monitoring system are matched, a vulnerability exists.

[0095] The collection node pulls traffic logs from the Kafka cluster 300 for analysis. Different Kafka topics are cached separately in the Redis cluster 400. The topic "catlog" contains stack result traffic, and the topic "urllog" contains HTTP initial traffic. The rule analysis node matches and performs offline analysis on the pulled logs, filtering out results with vulnerabilities. These results are then stored in the MySQL database of the SDP vulnerability management platform 600.

[0096] The system only requires application access to the CAT platform 200, and has low usage costs. It can flexibly customize rules based on its own business scenarios and use probes efficiently. It borrows the existing model of the public service CAT platform 200 and the intermediate-state plug-in vulnerability scanning monitoring system has security detection and monitoring capabilities. Through the application embedded data connected to the CAT platform 200, a wide range of application security detection coverage within the bank is achieved. The vulnerability detection accuracy is higher and the dirty data generated by the scan is extremely small. There is no need to set up vulnerability detection logic at the business code layer. It only needs to push the variables of interest to the security team's Kafka cluster 300 for offline detection. It can identify whether the developed code is safe based on the stack. It can not only play the role of bypass intrusion detection, but also cooperate with passive scanners for vulnerability detection, report vulnerabilities to the SOP vulnerability management platform, associate with in-bank applications, and manage in the comprehensive security operation system.

[0097] Rules can be flexibly customized according to one's own business scenarios, and probes can be used efficiently. The intermediate-state plug-in vulnerability scanning monitoring system has security detection and monitoring capabilities. Vulnerability detection is more accurate and scans generate very little dirty data. There is no need to perform vulnerability detection logic at the business code layer. Instead, only the variables of interest need to be pushed to the security team's Kafka cluster 300, enabling safe and efficient offline detection with low usage costs. This solves the problems of low detection efficiency and high cost of existing methods, ensuring network security in the financial technology field.

[0098] An embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the vulnerability scanning and monitoring method described in Example 1.

[0099] An embodiment of the present application further provides a readable storage medium, wherein the readable storage medium stores computer program instructions. When the computer program instructions are read and executed by a processor, the vulnerability scanning and monitoring method described in Example 1 is executed.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0101] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0102] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0103] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0104] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0105] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A vulnerability scanning and monitoring method, characterized in that: The method comprises: Obtaining traffic logs, where the traffic logs include stack result traffic and HTTP original traffic; Performing offline analysis on the traffic log using pre-configured rules to filter out vulnerability results; Send the vulnerability results to the SDP vulnerability management platform; The correlation results are analyzed offline based on the rules to determine whether there is a vulnerability: if the parameter value in the traffic log is brought into the SQL statement for execution, the corresponding traffic contains a vulnerability; if the security tag in the traffic log is brought into the SQL statement for execution, the traffic corresponding to the traffic log contains an SQL injection vulnerability; if the traffic is replayed through the Hydra scanner, and a security test vector is added, and is brought into the SQL statement for execution, then the traffic contains an SQL injection vulnerability, wherein the correlation result is obtained by correlating the stack result traffic and the http original traffic.

2. The vulnerability scanning and monitoring method according to claim 1, wherein: Obtaining traffic logs includes: Get the traffic logs in the Kafka cluster; The traffic logs are from normal access traffic, test traffic and Hydra scanner replay traffic collected from the application server by the CAT platform through public embedding points.

3. The vulnerability scanning and monitoring method according to claim 2, wherein: Before the step of performing offline analysis on the traffic log using pre-configured rules to filter out vulnerability results, the method further includes: The stack result traffic and the http original traffic are associated with each other using a unique serial number, and the associated result is stored in a Redis cluster.

4. A vulnerability scanning and monitoring system, characterized in that: The system comprises: The Blackcat cluster is used to obtain traffic logs, which include stack result traffic and http original traffic; use pre-configured rules to perform offline analysis on the traffic logs to filter out vulnerability results, specifically: if the parameter value in the traffic log is brought into the SQL statement for implementation, the corresponding traffic contains a vulnerability; if the security tag in the traffic log is brought into the SQL statement for implementation, the traffic corresponding to the traffic log contains a SQL injection vulnerability; if the traffic is replayed through the Hydra scanner, and a security test vector is added, and is brought into the SQL statement for implementation, the traffic contains a SQL injection vulnerability, wherein the correlation result is obtained by correlating the stack result traffic with the http original traffic; and the vulnerability result is sent to the SDP vulnerability management platform.

5. The vulnerability scanning and monitoring system according to claim 4, characterized in that: The system further comprises: The CAT platform is used to collect traffic logs from application servers through public embedding points and store them in the Kafka cluster, so that the Blackcat cluster obtains traffic logs from the Kafka cluster. The traffic logs include stack result traffic and http original traffic.

6. The vulnerability scanning and monitoring system according to claim 5, characterized in that: The system further comprises: The Redis cluster is used to store a correlation result obtained by correlating the stack result traffic and the http original traffic using a unique serial number, so that the Blackcat cluster performs offline analysis on the correlation result based on the rule.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the vulnerability scanning and monitoring method according to any one of claims 1 to 3.

8. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the vulnerability scanning and monitoring method according to any one of claims 1 to 3 is executed.

Images