A network vulnerability rapid scanning system and method

Abstract

A network vulnerability rapid scanning system and method, comprising a rapid scanning command module for initiating network system vulnerability rapid scanning instructions; a first scanning judgment module for receiving rapid scanning command module instructions to determine whether to perform a first scan on the network system; a comprehensive scanning module for calling all vulnerability detection programs in the vulnerability database to perform a comprehensive scan on the network system when a first scan is required, and analyzing the results; a partial scanning module for calling part of the vulnerability detection programs in the vulnerability database to perform a rapid scan on the network system based on the last scan result and the vulnerability correlation database when a first scan is not required, and generating a scan result after the scan is completed. The above scheme realizes rapid scanning of the network system, is efficient and has relatively high reliability, and further improves the user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, in particular to a network vulnerability rapid scanning system and method. BACKGROUND

[0002] The security scanning technology is a kind of network security technology, and the security scanning technology cooperates with firewall and intrusion detection system, which can effectively improve the security of network. Through scanning the network, network administrator can understand the security configuration and running application service of network, and timely find security vulnerabilities, objectively assess the network risk level, and the security scanning is a kind of active preventive measure, which can effectively avoid hacker attack behavior and prevent trouble in advance.

[0003] A basic principle of network vulnerability scanning is to call various known vulnerability detection programs in the vulnerability database for detection one by one, therefore, whether the definition of the vulnerability database is accurate directly affects the final scanning result, however, when the vulnerability database is too large, calling the vulnerability detection programs in the vulnerability database one by one will waste a lot of time, which seriously affects the user experience.

[0004] Therefore, it is necessary to provide a network vulnerability rapid scanning system and method, which aims to solve the above problems. SUMMARY

[0005] The present application provides a network vulnerability rapid scanning system and method to solve the problem that when the vulnerability database is too large, calling the vulnerability detection programs in the vulnerability database one by one will waste a lot of time.

[0006] To achieve the above purpose, the present application adopts the following technical scheme:

[0007] A network vulnerability rapid scanning system comprises:

[0008] A rapid scanning command module is used to initiate a vulnerability rapid scanning instruction for a network system and transmit it to a primary scanning judgment module.

[0009] The primary scanning judgment module is used to determine whether to perform primary scanning on the network system after receiving the instruction of the rapid scanning command module.

[0010] A comprehensive scanning module is used to call all vulnerability detection programs in the vulnerability database to perform comprehensive scanning on the network system when the primary scanning judgment module determines that primary scanning is needed, generate a scanning result including detected vulnerabilities after scanning, and analyze the scanning result by an analysis unit to supplement and improve the vulnerability data associated with the detected vulnerabilities, so as to update the existing vulnerability association database; wherein the vulnerability association database records all vulnerabilities in the vulnerability database and the association between the vulnerabilities.

[0011] The partial scanning module is configured to, when the initial scanning determination module determines that the initial scanning is not needed, invoke a partial vulnerability detection program in the vulnerability database to perform a fast scan on the network system based on the last scanning result and the vulnerability correlation database, and generate a scanning result after the scan is completed; wherein the partial vulnerability detection program includes a vulnerability detection program corresponding to the detected vulnerability in the last scanning result and a vulnerability detection program corresponding to the associated vulnerability of the detected vulnerability.

[0012] To optimize the above technical solution, the specific measures taken further include:

[0013] Further, the initial scanning determination module includes:

[0014] The scanning result query unit is configured to query, within a period of time, whether scanning data of a vulnerability is generated within the period of time and feed back to the initial scanning determination unit or the non-initial scanning determination unit.

[0015] The initial scanning determination unit is configured to, when the scanning result query unit queries that the data result is empty, determine that the current scan is the initial scan, and feed back the situation to the full scanning module.

[0016] The non-initial scanning determination unit is configured to, when the scanning result query unit queries that there is a corresponding data result, determine that the current scan is not the initial scan, and feed back the situation to the partial scanning module.

[0017] Further, in the full scanning module, the analysis unit is configured to extract each group of detected vulnerabilities in the full scanning result, compare each group of detected vulnerabilities with the existing vulnerability correlation database, find out irrelevant vulnerabilities, the irrelevant vulnerabilities refer to one or more vulnerabilities in the detected vulnerabilities, which have no mutual correlation with other detected vulnerabilities and corresponding associated vulnerabilities, and then determine the found irrelevant vulnerabilities through the discrimination unit, when there is potential correlation between the irrelevant vulnerabilities and one or more of the detected vulnerabilities, add the corresponding irrelevant vulnerabilities to the vulnerability correlation database.

[0018] Further, the identification unit is configured to count the number of times of occurrence of the irrelevant vulnerability in the historical data, and mark the irrelevant vulnerability as a to-be-judged vulnerability when the number of times of occurrence of the irrelevant vulnerability in the historical data reaches a first preset value; then, the identification unit is configured to retrieve the detected vulnerabilities in the full scan result that appear simultaneously with the to-be-judged vulnerability from the historical vulnerability scan data; the identification unit is configured to determine whether the detected vulnerabilities in the full scan result have a companion vulnerability, the companion vulnerability being a vulnerability that appears simultaneously with the to-be-judged vulnerability with a probability greater than a second preset value; the identification unit is configured to set that the companion vulnerability has a potential correlation with the irrelevant vulnerability, and further supplement the correlation between the companion vulnerability and the irrelevant vulnerability into the vulnerability correlation database.

[0019] Further, the partial scan module comprises:

[0020] The scan result matching unit is configured to retrieve the corresponding detected vulnerabilities and associated vulnerabilities from the vulnerability correlation database according to the scan result of the last time;

[0021] The fast scan unit is configured to call the vulnerability detection program corresponding to the detected vulnerabilities in the scan result of the last time from the vulnerability database, and call the vulnerability detection program corresponding to the associated vulnerabilities from the vulnerability database to perform fast scanning on the network system.

[0022] A network vulnerability fast scanning method comprises the following steps:

[0023] S1: initiating an instruction to perform fast scanning on a network system;

[0024] S2: determining whether the fast scanning is a first-time scanning on the network system;

[0025] If yes, all the vulnerability detection programs in the vulnerability database are called to perform full scanning on the network system, a scan result including detected vulnerabilities is generated after the scanning, and the scan result is analyzed to supplement the vulnerability data associated with the detected vulnerabilities, and the existing vulnerability correlation database is updated, the vulnerability correlation database recording all the vulnerabilities in the vulnerability database and the correlations between the vulnerabilities;

[0026] If no, based on the scan result of the last time and the vulnerability correlation database, part of the vulnerability detection programs in the vulnerability database are called to perform fast scanning on the network system, and a scan result is generated after the scanning; wherein the part of the vulnerability detection programs include the vulnerability detection programs corresponding to the detected vulnerabilities in the scan result of the last time and the vulnerability detection programs corresponding to the associated vulnerabilities of the detected vulnerabilities.

[0027] Further, in step S2, the rule for determining whether the fast scanning is a first-time scanning on the network system is:

[0028] If no vulnerability scanning data is generated in the period of time, it is determined that the current scan is a first-time scan; if vulnerability scanning data is generated in the period of time, it is determined that the current scan is not a first-time scan;

[0029] Similarly, after the period of time ends, whether the corresponding scan instruction is a first-time scan is determined by re-querying whether vulnerability scanning data is generated in the corresponding period of time in the next period of time.

[0030] Further, in step S2, after the network system is comprehensively scanned, the scanning result is analyzed to supplement and perfect the vulnerability data associated with the detected vulnerabilities, and the existing vulnerability association database is updated.

[0031] Each group of detected vulnerabilities in the comprehensive scanning result is extracted.

[0032] Each group of detected vulnerabilities is compared with the existing vulnerability association database to find out unassociated vulnerabilities, the unassociated vulnerabilities being that one or more vulnerabilities in the detected vulnerabilities have no mutual association with other detected vulnerabilities and corresponding associated vulnerabilities.

[0033] The found unassociated vulnerabilities are determined, and when there is potential association between the unassociated vulnerabilities and one or more of the detected vulnerabilities, the corresponding unassociated vulnerabilities are also added to the vulnerability association database.

[0034] Further, the found unassociated vulnerabilities are determined, and when there is potential association between the unassociated vulnerabilities and one or more of the detected vulnerabilities, the corresponding unassociated vulnerabilities are also added to the vulnerability association database.

[0035] The found unassociated vulnerabilities are historically accumulated and counted, and when a certain unassociated vulnerability appears a first preset number of times in multiple comprehensive scans, the unassociated vulnerability is marked as a to-be-determined vulnerability.

[0036] In the historical vulnerability scanning data, the detected vulnerabilities in the comprehensive scanning result that appear simultaneously with the to-be-determined vulnerability are called out.

[0037] It is determined whether the detected vulnerabilities in the comprehensive scanning result have accompanying vulnerabilities, the accompanying vulnerabilities being vulnerabilities that have a probability greater than a second preset value of appearing simultaneously with the to-be-determined vulnerability.

[0038] It is determined that the accompanying vulnerabilities and the unassociated vulnerabilities have potential association, and the association between the accompanying vulnerabilities and the unassociated vulnerabilities is further supplemented into the vulnerability association database.

[0039] Further, in step S2, the specific content of calling part of the vulnerability detection programs in the vulnerability database to perform rapid scanning on the network system based on the last scanning result and the vulnerability correlation database is as follows:

[0040] Matching the last vulnerability scanning result with the vulnerability correlation database, the correlation vulnerabilities of the detected vulnerabilities in the last scanning result are obtained;

[0041] Calling the vulnerability detection programs corresponding to the detected vulnerabilities in the last scanning result and the correlation vulnerabilities of the detected vulnerabilities in the vulnerability database to perform rapid scanning on the network system.

[0042] The present application has the following beneficial effects:

[0043] 1. The present application sets the vulnerability correlation database, and when performing rapid scanning, part of the vulnerability detection programs in the vulnerability database are called according to the last scanning result and the vulnerability correlation database to perform rapid scanning on the network system, wherein the part of the vulnerability detection programs includes the vulnerability detection programs corresponding to the detected vulnerabilities in the last scanning result and the vulnerability detection programs corresponding to the correlation vulnerabilities of the detected vulnerabilities, so that part of the vulnerability detection programs are called according to the last scanning result to perform rapid scanning on the network system, which is high in scanning efficiency, high in reliability, and improves the user experience.

[0044] 2. The present application analyzes the scanning result every time when performing comprehensive scanning, constantly improves the correlation between the vulnerabilities in the vulnerability correlation database, provides accuracy for subsequent rapid scanning, and avoids the failure of rapid scanning. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 is a flowchart of a network vulnerability rapid scanning method in an embodiment of the present application.

[0046] Figure 2 is a flowchart of determining whether to perform initial scanning on the network system in an embodiment of the present application.

[0047] Figure 3 is a flowchart of calling part of the vulnerability detection programs in the vulnerability database to perform rapid scanning on the network system in an embodiment of the present application.

[0048] Figure 4 is a flowchart of analyzing the comprehensive scanning result in an embodiment of the present application.

[0049] Figure 5 is a flowchart of determining the irrelevant vulnerabilities found in an embodiment of the present application.

[0050] Figure 6 is a network vulnerability fast scanning system structure schematic diagram in an embodiment of the present application.

[0051] Figure 7 is a structure schematic diagram of a primary scanning judgment module in an embodiment of the present application.

[0052] Figure 8 is a partial scanning module schematic diagram in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The present application will now be further described in detail in conjunction with the accompanying drawings.

[0054] As shown in Figure 1 , an embodiment of the present application provides a network vulnerability fast scanning method, the method comprising the following steps:

[0055] S100, receiving a network system vulnerability fast scanning command;

[0056] S200, judging whether to perform a primary scan on the network system;

[0057] S300, if it is a primary scan, calling all vulnerability detection programs in a vulnerability database to perform a comprehensive scan (one by one) on the network system, after the scan is completed, generating a scan result, the scan result comprising detected vulnerabilities;

[0058] S400, if it is not a primary scan, according to a last scan result and a vulnerability correlation database, calling partial vulnerability detection programs in the vulnerability database to perform a fast scan on the network system, after the scan is completed, generating a scan result, the vulnerability correlation database comprising all vulnerabilities in the vulnerability database and correlation vulnerabilities of each vulnerability, the partial vulnerability detection programs comprising vulnerability detection programs corresponding to the detected vulnerabilities in the last scan result and vulnerability detection programs corresponding to the correlation vulnerabilities of the detected vulnerabilities.

[0059] When the user needs to perform a quick vulnerability scan on a network system, a quick vulnerability scan command is inputted. After receiving the quick vulnerability scan command, the embodiment of the present application determines whether to perform a first-time scan on the network system. If it is a first-time scan, all vulnerability detection programs in a vulnerability database are called to scan the network system one by one. After the scan is completed, a scan result is generated, which includes detected vulnerabilities. This is a basic principle of existing network vulnerability scanning, and will not be described here. If it is not a first-time scan, according to the last scan result and a vulnerability correlation database, part of the vulnerability detection programs in the vulnerability database are called to perform a quick scan on the network system. After the scan is completed, a scan result is generated. The vulnerability correlation database includes all vulnerabilities in the vulnerability database and the correlation vulnerabilities of each vulnerability. The correlation vulnerabilities refer to the probability that another vulnerability will appear when a certain vulnerability appears. The other vulnerability is the correlation vulnerability of the certain vulnerability. The vulnerability correlation database needs to be established in advance. The vulnerability correlation database can be uploaded by staff, for example, part of the content of the vulnerability correlation database is shown in the following table:

[0060] Table 1

[0061] Vulnerability category Corresponding associated vulnerability First vulnerability Eleventh vulnerability, thirteenth vulnerability, eighteenth vulnerability Second vulnerability Twenty-fourth vulnerability, twenty-ninth vulnerability Third vulnerability Thirty-second vulnerability, thirty-sixth vulnerability Fourth vulnerability Forty-fifth vulnerability Fifth vulnerability Fifty-third vulnerability, fifty-sixth vulnerability, fifty-eighth vulnerability Sixth vulnerability Sixty-second vulnerability, sixty-seventh vulnerability

[0062] In addition, the part of the vulnerability detection programs includes the vulnerability detection programs corresponding to the detected vulnerabilities in the last scan result and the vulnerability detection programs corresponding to the correlation vulnerabilities of the detected vulnerabilities. In this way, according to the last scan result, part of the vulnerability detection programs are called to perform a quick scan on the network system, which is high in scanning efficiency and has relatively high reliability.

[0063] As shown in Figure 2 , as a preferred embodiment of the present application, the step of determining whether to perform a first-time scan on the network system specifically includes:

[0064] S201, querying the last scan result;

[0065] S202, when the last scan result is queried, it is determined that the current scan is not a first-time scan;

[0066] S203, when the last scan result is not queried, it is determined that the current scan is a first-time scan.

[0067] In the embodiment of the present application, it can be understood that there are two disadvantages in calling part of the vulnerability detection program to perform rapid scanning on the network system: one is that the last scanning result is needed, and the other is that the network system cannot be scanned comprehensively. Therefore, it is needed to determine whether to perform initial scanning on the network system. If it is initial scanning, all vulnerability detection programs in the vulnerability database should be called to scan the network system one by one, so that a basic understanding of the vulnerability situation of the network system can be obtained, and a relatively perfect scanning result can also be obtained. When determining whether to perform initial scanning on the network system, the last scanning result needs to be queried. When the last scanning result is obtained through the query, it is determined that the current scanning is not initial scanning. When the last scanning result cannot be obtained through the query, it is determined that the current scanning is initial scanning.

[0068] As shown in Figure 3 , as a preferred embodiment of the present application, the step of calling part of the vulnerability detection program in the vulnerability database to perform rapid scanning on the network system according to the last scanning result and the vulnerability correlation database specifically includes:

[0069] S401, establishing a vulnerability correlation database, wherein the vulnerability correlation database includes all vulnerabilities in the vulnerability database and the correlation vulnerabilities of each vulnerability;

[0070] S402, matching the last scanning result with the vulnerability correlation database to obtain the correlation vulnerabilities of the detected vulnerabilities in the last scanning result;

[0071] S403, calling the vulnerability detection program corresponding to the detected vulnerabilities in the last scanning result in the vulnerability database and the vulnerability detection program corresponding to the correlation vulnerabilities of the detected vulnerabilities to perform rapid scanning on the network system.

[0072] In the embodiment of the present application, after the vulnerability correlation database is established, the last scanning result needs to be matched with the vulnerability correlation database to obtain the correlation vulnerabilities of the detected vulnerabilities in the last scanning result. For example, the detected vulnerabilities in the last scanning result are the second vulnerability, the fifth vulnerability and the sixth vulnerability. The detected vulnerabilities are matched with the vulnerability correlation database to obtain the correlation vulnerabilities of the detected vulnerabilities in the last scanning result, which are the twenty-fourth vulnerability, the twenty-ninth vulnerability, the fifty-third vulnerability, the fifty-sixth vulnerability, the fifty-eighth vulnerability, the sixty-second vulnerability and the sixty-seventh vulnerability. Then, the second vulnerability detection program, the fifth vulnerability detection program, the sixth vulnerability detection program, the twenty-fourth vulnerability detection program, the twenty-ninth vulnerability detection program, the fifty-third vulnerability detection program, the fifty-sixth vulnerability detection program, the fifty-eighth vulnerability detection program, the sixty-second vulnerability detection program and the sixty-seventh vulnerability detection program in the vulnerability database need to be called to perform rapid scanning on the network system.

[0073] In the embodiment of the present application, it can be understood that the execution of the vulnerability rapid scanning command has high efficiency, but there is a risk that some vulnerabilities are not detected. Therefore, the vulnerability comprehensive scanning function provided by the embodiment of the present application can be used to perform vulnerability comprehensive scanning on the network system every certain period of time or in a relatively idle period of time, and all vulnerability detection programs in the vulnerability database are directly called to scan the network system one by one. After the scanning is completed, a comprehensive scanning result is generated.

[0074] As shown in Figure 4 As a preferred embodiment of the present application, a network vulnerability rapid scanning method analyzes the comprehensive scanning result, and specifically:

[0075] S501, extracting the detected vulnerabilities in each group of comprehensive scanning results;

[0076] S502, comparing each group of extracted detected vulnerabilities with the vulnerability correlation database to find out irrelevant vulnerabilities, the irrelevant vulnerabilities being those that have no correlation with all the vulnerabilities in the detected vulnerabilities except themselves;

[0077] S503, determining the found irrelevant vulnerabilities, and adding the irrelevant vulnerabilities to the vulnerability correlation database when the irrelevant vulnerabilities have potential correlation with certain or several vulnerabilities in the detected vulnerabilities.

[0078] In the embodiment of the present application, it should be understood that the vulnerability correlation database should be continuously improved. The improvement means can be not only manual uploading and updating by staff, but also analysis of historical comprehensive scanning results to find out vulnerabilities that have correlation but are not recorded in the vulnerability correlation database. Specifically, the detected vulnerabilities in each group of comprehensive scanning results can be extracted; then each group of extracted detected vulnerabilities is compared with the vulnerability correlation database to find out irrelevant vulnerabilities, the irrelevant vulnerabilities being those that have no correlation with all the vulnerabilities in the detected vulnerabilities except themselves, for example, the vulnerabilities in a comprehensive scanning result are the first vulnerability, the eleventh vulnerability, the thirteenth vulnerability, the eighteenth vulnerability, the third vulnerability, the thirty-second vulnerability, the thirty-sixth vulnerability, and the thirty-ninth vulnerability. The thirty-ninth vulnerability is the irrelevant vulnerability. Finally, the found irrelevant vulnerabilities are determined, and the irrelevant vulnerabilities are added to the vulnerability correlation database when the irrelevant vulnerabilities have potential correlation with certain or several vulnerabilities in the detected vulnerabilities, so that the vulnerability correlation database is continuously improved.

[0079] As shown in Figure 5As shown, as a preferred embodiment of the present application, the step of determining the irrelevant vulnerability found and adding the irrelevant vulnerability to the vulnerability correlation database when the irrelevant vulnerability has potential correlation with one or more of the detected vulnerabilities specifically comprises:

[0080] S5031, counting the irrelevant vulnerabilities found, and marking the irrelevant vulnerability as a to-be-determined vulnerability when the number of times of the irrelevant vulnerability reaches a first preset value;

[0081] S5032, calling the detected vulnerabilities in each set of comprehensive scan results corresponding to the to-be-determined vulnerability;

[0082] S5033, determining whether the detected vulnerability in the comprehensive scan result has a concomitant vulnerability, the concomitant vulnerability being a vulnerability that has a probability greater than a second preset value of appearing simultaneously with the to-be-determined vulnerability;

[0083] S5034, when the concomitant vulnerability exists, the concomitant vulnerability has potential correlation with the irrelevant vulnerability, and the irrelevant vulnerability and the concomitant vulnerability are added to the vulnerability correlation database.

[0084] In the embodiment of the present application, how to determine whether the irrelevant vulnerability has potential correlation with one or more of the detected vulnerabilities, here, the irrelevant vulnerabilities found are counted, and the irrelevant vulnerability is marked as a to-be-determined vulnerability when the number of times of the irrelevant vulnerability reaches a first preset value, for example, the number of times of the thirty-ninth vulnerability appearing in the historical comprehensive scan results reaches 10 times, then the thirty-ninth vulnerability is marked as a to-be-determined vulnerability, then the detected vulnerabilities in each set of comprehensive scan results corresponding to the thirty-ninth vulnerability are called, then it is determined whether the detected vulnerability in the comprehensive scan result has a concomitant vulnerability, the concomitant vulnerability being a vulnerability that has a probability greater than a second preset value of appearing simultaneously with the thirty-ninth vulnerability, for example, the fourth vulnerability also often appears simultaneously when the thirty-ninth vulnerability appears, the number of times of the thirty-ninth vulnerability appearing is 10 times, and the number of times of the fourth vulnerability appearing simultaneously is 8 times, then the fourth vulnerability is the concomitant vulnerability of the thirty-ninth vulnerability, which indicates that the fourth vulnerability has potential correlation with the thirty-ninth vulnerability, and then the fourth vulnerability and the thirty-ninth vulnerability are added to the vulnerability correlation database.

[0085] As shown, the embodiment of the present application also provides a network vulnerability rapid scanning system, the system comprising: Figure 6 A rapid scanning command module 100 is configured to receive a network system vulnerability rapid scanning command;

[0086] A first-time scanning determination module 200 is configured to determine whether to perform a first-time scan on the network system;

[0087] A first-time scanning determination module 200 is configured to determine whether to perform a first-time scan on the network system;

[0088] The full scan module 300, if it is the first scan, calls all vulnerability detection programs in the vulnerability database to scan the network system one by one, generates a scan result after the scan is completed, and the scan result includes detected vulnerabilities.

[0089] The partial scan module 400, if it is not the first scan, calls partial vulnerability detection programs in the vulnerability database according to the last scan result and the vulnerability correlation database to quickly scan the network system, generates a scan result after the scan is completed, the vulnerability correlation database includes all vulnerabilities in the vulnerability database and the correlation vulnerabilities of each vulnerability, and the partial vulnerability detection programs include the vulnerability detection programs corresponding to the detected vulnerabilities in the last scan result and the vulnerability detection programs corresponding to the correlation vulnerabilities of the detected vulnerabilities.

[0090] In the embodiment of the present application, when the user needs to quickly scan the vulnerabilities of the network system, the vulnerability quick scan command is input, and after the vulnerability quick scan command of the network system is received by the embodiment of the present application, it is determined whether the network system is scanned for the first time; if it is the first scan, all vulnerability detection programs in the vulnerability database are called to scan the network system one by one, a scan result is generated after the scan is completed, and the scan result includes detected vulnerabilities, which is a basic principle of the existing network vulnerability scan, and will not be repeated here; if it is not the first scan, partial vulnerability detection programs in the vulnerability database are called according to the last scan result and the vulnerability correlation database to quickly scan the network system, a scan result is generated after the scan is completed, the vulnerability correlation database includes all vulnerabilities in the vulnerability database and the correlation vulnerabilities of each vulnerability, the correlation vulnerabilities refer to the probability that another vulnerability appears when a certain vulnerability appears is extremely high, the other vulnerability here is the correlation vulnerability of the certain vulnerability, and the vulnerability correlation database needs to be established in advance, which can be uploaded by the staff, such as Table 1 above.

[0091] In addition, the partial vulnerability detection programs here include the vulnerability detection programs corresponding to the detected vulnerabilities in the last scan result and the vulnerability detection programs corresponding to the correlation vulnerabilities of the detected vulnerabilities, so that partial vulnerability detection programs are called to quickly scan the network system according to the last scan result, the scan efficiency is high, and the reliability is relatively high.

[0092] As shown in Figure 7 , as a preferred embodiment of the present application, the first scan determination module 200 includes:

[0093] The scan result query unit 201 is used to query the last scan result.

[0094] The non-initial scan judging unit 202 judges that the current scan is not an initial scan when the last scan result is found.

[0095] The initial scan judging unit 203 judges that the current scan is an initial scan when the last scan result is not found.

[0096] In the embodiment of the present application, it can be understood that there are two disadvantages in calling the partial vulnerability detection program to perform the fast scan on the network system: one is that the last scan result is needed, and the other is that the network system cannot be scanned completely. Therefore, it is necessary to judge whether the network system is scanned initially. If the network system is scanned initially, all the vulnerability detection programs in the vulnerability database should be called to scan the network system one by one, so that the network system can be understood basically and a more perfect scan result can be obtained. When judging whether the network system is scanned initially, the last scan result needs to be queried. When the last scan result is found, it is judged that the current scan is not an initial scan. When the last scan result is not found, it is judged that the current scan is an initial scan.

[0097] As shown in FIG. 4, as a preferred embodiment of the present application, the partial scan module 400 includes: Figure 8

[0098] The correlation database establishing unit 401 is used to establish a vulnerability correlation database. The vulnerability correlation database includes all the vulnerabilities in the vulnerability database and the correlation vulnerabilities of each vulnerability.

[0099] The scan result matching unit 402 is used to match the last scan result with the vulnerability correlation database to obtain the correlation vulnerabilities of the detected vulnerabilities in the last scan result.

[0100] The fast scan unit 403 is used to call the vulnerability detection programs corresponding to the detected vulnerabilities in the last scan result and the vulnerability detection programs corresponding to the correlation vulnerabilities of the detected vulnerabilities in the last scan result to perform the fast scan on the network system.

[0101] ​In the embodiment of the present application, after the vulnerability correlation database is obtained, the last scanning result needs to be matched with the vulnerability correlation database to obtain the correlation vulnerabilities of the detected vulnerabilities in the last scanning result. For example, the detected vulnerabilities in the last scanning result are the second vulnerability, the fifth vulnerability and the sixth vulnerability. The detected vulnerabilities are matched with the vulnerability correlation database to obtain the correlation vulnerabilities of the detected vulnerabilities in the last scanning result, which are the twenty-fourth vulnerability, the twenty-ninth vulnerability, the fifty-third vulnerability, the fifty-sixth vulnerability, the fifty-eighth vulnerability, the sixty-second vulnerability and the sixty-seventh vulnerability. Then, the second vulnerability detection program, the fifth vulnerability detection program, the sixth vulnerability detection program, the twenty-fourth vulnerability detection program, the twenty-ninth vulnerability detection program, the fifty-third vulnerability detection program, the fifty-sixth vulnerability detection program, the fifty-eighth vulnerability detection program, the sixty-second vulnerability detection program and the sixty-seventh vulnerability detection program in the vulnerability database need to be called to perform the rapid scanning on the network system.

[0102] In the embodiment of the present application, it can be understood that the execution of the vulnerability rapid scanning command has high efficiency, but there is a risk that the vulnerability is not detected. Therefore, the embodiment of the present application provides a vulnerability comprehensive scanning function. The user can perform the vulnerability comprehensive scanning on the network system every certain period of time or in a relatively idle period. All the vulnerability detection programs in the vulnerability database are directly called to scan the network system one by one. After the scanning is completed, the comprehensive scanning result is generated.

[0103] It should be noted that the terms such as "upper", "lower", "left", "right", "front", "back" and the like cited in the present application are only for the convenience of clear description, and are not used to limit the scope of the present application. The change or adjustment of the relative relationship without substantial change of the technical content is also regarded as the scope of the present application.

[0104] The above is only the preferred embodiment of the present application, and the protection scope of the present application is not limited to the above-mentioned embodiments. Any technical solution falling within the concept of the present application is within the protection scope of the present application. It should be noted that, for ordinary skilled persons in the art, some improvements and refinements without departing from the principle of the present application are regarded as the protection scope of the present application.

Claims

1. A network vulnerability rapid scanning system, characterized in that, The application comprises: a rapid scanning command module for initiating a rapid scanning instruction for a network system and transmitting the instruction to a primary scanning determination module; the primary scanning determination module for determining whether to perform a primary scanning on the network system after receiving the instruction from the rapid scanning command module; a comprehensive scanning module for calling all vulnerability detection programs in a vulnerability database to perform a comprehensive scanning on the network system when the primary scanning determination module determines that a primary scanning is needed, generating a scanning result including detected vulnerabilities after the scanning, and analyzing the scanning result by an analysis unit to supplement and improve vulnerability data associated with the detected vulnerabilities, thereby updating an existing vulnerability association database; wherein the vulnerability association database records all vulnerabilities in the vulnerability database and the association between the vulnerabilities; in the comprehensive scanning module, the analysis unit is configured to extract each group of detected vulnerabilities in the comprehensive scanning result, compare each group of detected vulnerabilities with the existing vulnerability association database to find out unrelated vulnerabilities, the unrelated vulnerabilities refer to one or more vulnerabilities in the detected vulnerabilities that have no mutual association with other detected vulnerabilities and corresponding associated vulnerabilities, and then determine the found unrelated vulnerabilities by a discrimination unit, and when there is potential association between the unrelated vulnerabilities and one or more detected vulnerabilities, the corresponding unrelated vulnerabilities are also added to the vulnerability association database; the discrimination unit is configured to perform historical accumulation counting on the found unrelated vulnerabilities, and when a certain unrelated vulnerability appears in a number of comprehensive scans reaching a first preset value, the unrelated vulnerability is marked as a to-be-determined vulnerability; then, in the historical vulnerability scanning data, the detected vulnerabilities in the comprehensive scanning result that appear simultaneously with the to-be-determined vulnerability are called out; it is determined whether there are accompanying vulnerabilities in the detected vulnerabilities in the comprehensive scanning result, the accompanying vulnerabilities refer to vulnerabilities that have a probability greater than a second preset value of appearing simultaneously with the to-be-determined vulnerability; meanwhile, it is set that the accompanying vulnerabilities and the unrelated vulnerabilities have potential association, and the association between the accompanying vulnerabilities and the unrelated vulnerabilities is further supplemented into the vulnerability association database; a partial scanning module for calling part of vulnerability detection programs in the vulnerability database to perform a rapid scanning on the network system based on the last scanning result and the vulnerability association database when the primary scanning determination module determines that a primary scanning is not needed, and generating a scanning result after the scanning; wherein the part of vulnerability detection programs includes the vulnerability detection programs corresponding to the detected vulnerabilities in the last scanning result and the vulnerability detection programs corresponding to the associated vulnerabilities of the detected vulnerabilities.

2. The network vulnerability rapid scanning system according to claim 1, wherein, the primary scanning determination module comprises: a scanning result query unit for querying whether there is scanning data of vulnerabilities generated in a period of time and feeding back to the primary scanning determination unit or the non-primary scanning determination unit; a primary scanning determination unit for determining that the current scanning is a primary scanning when the scanning result query unit queries that the data result is empty, and feeding back the situation to the comprehensive scanning module. The non-first-time scanning determination unit is configured to determine that the current scanning is not a first-time scanning when the scanning result query unit queries corresponding data results, and feed back the situation to the partial scanning module.

3. The system of claim 1, wherein, The partial scanning module comprises: The scanning result matching unit is configured to call corresponding detected vulnerabilities and associated vulnerabilities from the vulnerability correlation database according to the last scanning result; The fast scanning unit is configured to call the vulnerability detection programs corresponding to the detected vulnerabilities in the last scanning result from the vulnerability database and call the vulnerability detection programs corresponding to the associated vulnerabilities from the vulnerability database to perform fast scanning on the network system.

4. A method for rapid scanning of network vulnerabilities, characterized in that, The method comprises the following steps: S1: initiating an instruction to perform fast scanning on the network system; S2: determining whether the current fast scanning is a first-time scanning of the network system; If yes, calling all vulnerability detection programs in the vulnerability database to perform comprehensive scanning on the network system, generating a scanning result comprising detected vulnerabilities after the scanning is completed, and analyzing the scanning result to supplement and perfect the vulnerability data associated with the detected vulnerabilities, and then updating the existing vulnerability correlation database, wherein the vulnerability correlation database records all vulnerabilities in the vulnerability database and the correlation between the vulnerabilities; If no, calling partial vulnerability detection programs in the vulnerability database to perform fast scanning on the network system based on the last scanning result and the vulnerability correlation database, wherein the partial vulnerability detection programs comprise the vulnerability detection programs corresponding to the detected vulnerabilities in the last scanning result and the vulnerability detection programs corresponding to the associated vulnerabilities of the detected vulnerabilities, and generating a scanning result after the scanning is completed; In step S2, after performing comprehensive scanning on the network system, the specific content of analyzing the scanning result to supplement and perfect the vulnerability data associated with the detected vulnerabilities and then updating the existing vulnerability correlation database is as follows: extracting each group of detected vulnerabilities in the comprehensive scanning result; comparing each group of detected vulnerabilities with the existing vulnerability correlation database to find out irrelevant vulnerabilities, wherein the irrelevant vulnerabilities refer to one or more vulnerabilities in the detected vulnerabilities that have no correlation with other detected vulnerabilities and corresponding associated vulnerabilities; determining the found irrelevant vulnerabilities, and adding the corresponding irrelevant vulnerabilities to the vulnerability correlation database when there is potential correlation between the irrelevant vulnerabilities and one or more of the detected vulnerabilities; The specific content of determining the found irrelevant vulnerabilities and adding the corresponding irrelevant vulnerabilities to the vulnerability correlation database when there is potential correlation between the irrelevant vulnerabilities and one or more of the detected vulnerabilities is as follows: historically accumulating the found irrelevant vulnerabilities, and marking an irrelevant vulnerability as a to-be-determined vulnerability when the number of times of appearance of the irrelevant vulnerability in multiple comprehensive scanning reaches a first preset value; calling the detected vulnerabilities in the comprehensive scanning result that appear simultaneously with the to-be-determined vulnerability from the historical vulnerability scanning data; determining whether there are accompanying vulnerabilities in the detected vulnerabilities in the comprehensive scanning result, wherein the accompanying vulnerabilities refer to vulnerabilities that appear simultaneously with the to-be-determined vulnerability with a probability greater than a second preset value; The setting accompanying vulnerability is associated with the unrelated vulnerability, and the potential association is further supplemented into the vulnerability association database.

5. The method of claim 4, wherein, In step S2, the rule for determining whether the current quick scan is the first scan of the network system is: If no vulnerability scanning data is generated in a period of time, it is determined that the current scan is the first scan; if vulnerability scanning data is generated in the period of time, it is determined that the current scan is not the first scan; Similarly, after the end of the period of time, it is determined whether the corresponding scan instruction is the first scan by requerying whether vulnerability scanning data is generated in the corresponding period of time.

6. The method of claim 4, wherein, In step S2, the specific content of the quick scan of the network system based on the last scan result and the vulnerability association database is: Matching the last vulnerability scan result with the vulnerability association database, the associated vulnerabilities of the detected vulnerabilities in the last scan result are obtained; The vulnerability detection programs corresponding to the detected vulnerabilities in the last scan result and the associated vulnerabilities of the detected vulnerabilities in the last scan result are called to perform quick scan on the network system.

Images