Vulnerability detection method, device, electronic device and readable storage medium

Abstract

Embodiments of the present application provide a vulnerability detection method, apparatus, electronic device, and readable storage medium, relating to the field of computer technology. The method includes obtaining port information corresponding to multiple ports of a target device; determining target port information from the port information corresponding to the multiple ports according to a target rule table, wherein the rules in the target rule table are used for vulnerability matching; and performing vulnerability verification based on each piece of target port information. This method reduces the number of targets to be verified through filtering, thereby improving vulnerability scanning efficiency.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a vulnerability detection method, device, electronic device, and readable storage medium. Background Art

[0002] The existing vulnerability scanning process involves sequentially scanning all ports of each IP asset to obtain information about the host's TCP / IP port and its corresponding network access service. This information is then matched against the vulnerability library provided by the network vulnerability scanning system. If a match is met, a vulnerability is considered present. This existing vulnerability scanning method requires scanning all ports of each IP asset sequentially, and then validating each port based on the information obtained from the vulnerability scan. This results in low efficiency, and even if an enterprise updates the vulnerability library when a new vulnerability emerges, it is still difficult to complete asset vulnerability investigation and reinforcement in a short period of time. Summary of the Invention

[0003] Embodiments of the present application provide a vulnerability detection method, device, electronic device, and readable storage medium, which can reduce targets to be verified by filtering, thereby improving vulnerability scanning efficiency.

[0004] The embodiments of the present application can be implemented as follows:

[0005] In a first aspect, an embodiment of the present application provides a vulnerability detection method, the method comprising:

[0006] Obtain the port information corresponding to each of the multiple ports of the target device;

[0007] determining target port information from port information corresponding to each of the plurality of ports according to a target rule table, wherein rules in the target rule table are used for vulnerability matching;

[0008] Perform vulnerability verification based on the target port information of each item.

[0009] In a second aspect, an embodiment of the present application provides a vulnerability detection device, the device comprising:

[0010] An information acquisition module is used to obtain port information corresponding to each of the multiple ports of the target device;

[0011] a screening module, configured to determine target port information from the port information corresponding to each of the plurality of ports according to a target rule table, wherein the rules in the target rule table are used for vulnerability matching;

[0012] The detection module is used to perform vulnerability verification based on each piece of target port information.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor can execute the machine-executable instructions to implement the vulnerability detection method described in the aforementioned embodiment.

[0014] In a fourth aspect, an embodiment of the present application provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the vulnerability detection method as described in the aforementioned embodiment.

[0015] The embodiments of the present application provide a vulnerability detection method, device, electronic device, and readable storage medium. When the port information of each of the multiple ports of a target device is obtained, the target port information is determined from the port information corresponding to each of the multiple ports according to a target rule table including rules for vulnerability matching, and vulnerability verification is then performed on each piece of target port information. In this way, through filtering, the targets to be verified are reduced, thereby improving the efficiency of vulnerability scanning, and further facilitating the effective and rapid collection of asset vulnerabilities and risk points of various networks within the enterprise. It also facilitates the enterprise to quickly complete the reinforcement of its own network assets after the outbreak of a new vulnerability, thereby improving the security protection of sensitive and critical information. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A block diagram of an electronic device provided in an embodiment of the present application;

[0018] Figure 2 One of the flow charts of the vulnerability detection method provided in the embodiment of the present application;

[0019] Figure 3 The second flowchart of the vulnerability detection method provided in the embodiment of the present application;

[0020] Figure 4 for Figure 2 One of the flowcharts of the sub-steps included in step S120;

[0021] Figure 5 for Figure 4 A schematic flow chart of the sub-steps included in sub-step S121;

[0022] Figure 6 for Figure 2Flowchart 2 of the sub-steps included in step S120;

[0023] Figure 7 This is a block diagram of a vulnerability detection device provided in an embodiment of the present application;

[0024] Figure 8 This is a second block diagram of the vulnerability detection device provided in an embodiment of the present application.

[0025] Icon: 100 - electronic device; 110 - memory; 120 - processor; 130 - communication unit; 200 - vulnerability detection device; 201 - determination module; 210 - information acquisition module; 220 - screening module; 230 - detection module. DETAILED DESCRIPTION

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0027] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present application.

[0028] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0029] The following describes some embodiments of the present application in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features therein may be combined with each other.

[0030] Please refer to Figure 1 , Figure 1 This is a block diagram of an electronic device 100 provided in an embodiment of the present application. The electronic device 100 may be, but is not limited to, a computer, a server, or the like. The electronic device 100 may include a memory 110, a processor 120, and a communication unit 130. The memory 110, the processor 120, and the communication unit 130 are electrically connected to each other, directly or indirectly, to enable data transmission or interaction. For example, these components may be electrically connected to each other via one or more communication buses or signal lines.

[0031] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0032] The processor 120 is used to read / write data or programs stored in the memory 110 and execute corresponding functions. For example, the memory 110 stores a vulnerability detection device 200, which includes at least one software function module that can be stored in the memory 110 in the form of software or firmware. The processor 120 executes various functional applications and data processing by running software programs and modules stored in the memory 110, such as the vulnerability detection device 200 in the embodiment of the present application, thereby implementing the vulnerability detection method in the embodiment of the present application.

[0033] The communication unit 130 is used to establish a communication connection between the electronic device 100 and other communication terminals through a network, and to send and receive data through the network.

[0034] It should be understood that Figure 1 The structure shown is only a schematic diagram of the structure of the electronic device 100. The electronic device 100 may also include Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0035] Please refer to Figure 2 , Figure 2 This is one of the flow diagrams of the vulnerability detection method provided in an embodiment of the present application. The method can be applied to the electronic device 100 described above. The specific flow of the vulnerability detection method is described in detail below. In this embodiment, the method may include steps S110 to S130.

[0036] Step S110: obtaining port information corresponding to each of the multiple ports of the target device.

[0037] In this embodiment, the target device is a device that needs to be checked for vulnerabilities. The target device can be various devices used in computer (or communication) networks, such as hosts, network devices (routers, switches, etc.) and security devices (firewalls, etc.), etc., which can be determined in combination with actual needs. A vulnerability is a defect in the specific implementation of hardware, software, or a protocol or a system security policy. Such a defect can enable an attacker to access or damage the system without authorization. Among them, the multiple ports can be all ports on the target device, or some ports of the target device, which can be determined in combination with actual conditions. When the multiple ports are some ports of the target device, the multiple ports can be manually specified by the user, or specified by the electronic device itself in combination with other situations, or specified by other devices, which are not specifically limited here.

[0038] When vulnerability detection is required, the electronic device can obtain port information of each port through asset scanning, vulnerability scanning, or other methods (e.g., receiving asset scanning results sent by other devices). The specific content of the port information can be set according to actual needs and is not specifically limited here.

[0039] Step S120 : determining target port information from the port information corresponding to each of the plurality of ports according to the target rule table.

[0040] In this embodiment, the electronic device may further include a target rule table, wherein the target rule table includes at least one rule, and the rules in the target rule table are used for vulnerability matching. After obtaining the port information corresponding to each of the multiple ports, each piece of port information may be matched with a rule in the target rule table, and the port information that matches the rule in the target rule table is used as the target port information. In other words, based on the vulnerability-based rules, target port information that may correspond to a vulnerability is screened from the multiple pieces of port information obtained.

[0041] Step S130: performing vulnerability verification based on each piece of target port information.

[0042] Once the target port information is determined, vulnerability verification is performed on each piece of target port information to determine whether the port corresponding to that piece of target port information has a vulnerability. If a vulnerability is confirmed, the specific vulnerability type can be identified to facilitate subsequent security measures. This can be done by matching and verifying each piece of target port information against a pre-defined vulnerability database. The specific vulnerability verification methods used can be tailored to actual needs and are not specifically limited here.

[0043] In this embodiment, filtering reduces the port information to be verified, which is equivalent to reducing the confirmation range from one building to a certain floor, thereby improving the efficiency of vulnerability scanning, and facilitating the effective and rapid collection of asset vulnerabilities and risk points of various networks within the enterprise. It also facilitates enterprises to quickly strengthen their network assets after the outbreak of new vulnerabilities, thereby improving the security protection of sensitive and critical information.

[0044] Optionally, as a possible implementation, the electronic device pre-stores the target rule table. When performing vulnerability detection, filtering is performed directly based on the target rule table. That is, the same target rule table is used each time a vulnerability detection is performed. This facilitates direct vulnerability detection when needed, eliminating the need to perform other operations to obtain the target rule table.

[0045] Alternatively, as another possible implementation, Figure 3 Step S101 obtains the target rule table used in each detection. Figure 3 , Figure 3 This is a second flow chart of the vulnerability detection method provided in an embodiment of the present application. In this embodiment, before step S120, the method may further include step S101.

[0046] Step S101 : determining the target rule table according to the original rule table and the received rule selection operation.

[0047] In this embodiment, the original rule table may include rules pre-set based on various vulnerabilities. The electronic device may receive a rule selection operation, and then select a rule corresponding to the rule selection operation from the original rule table based on the rule selection operation, and use the selected rule as the target rule in the target rule table. The rules in the target rule table may be referred to as target rules, and the target rules in the target rule table are at least some of the rules in the original rule table.

[0048] For example, the vulnerability names corresponding to the original rule table can be displayed. If the user selects some vulnerability names, the rules corresponding to the selected vulnerability names in the original rule table can be used as the target rules in the target rule table to obtain the target rules. Alternatively, if the user does not select any vulnerability names, the original rule table can be used as the target rule table.

[0049] This makes it easier to perform targeted vulnerability matching filtering and can increase the filtering speed.

[0050] With the advancement of technology, the "intelligence" aspect of cyberspace has become increasingly important. Only with intelligence can we identify attack targets and realize the value of attacks. IP assets themselves possess a certain value, and the business systems running on these assets are even higher-value targets. Through multi-dimensional mapping of IP assets (i.e., asset scanning), information such as device type, open ports, corresponding components and services, and geographic location can be obtained. Radar is a device that performs this type of information discovery. IP assets are primarily various devices used in computer (or communication) networks, including hosts, network equipment (routers, switches, etc.), and security devices (firewalls, etc.).

[0051] The inventors of this application discovered that current asset scanning and vulnerability scanning are performed separately. Typically, an asset scan is performed first, followed by vulnerability scanning and verification for all ports of the IP assets. However, much of the information obtained from asset and vulnerability scanning is redundant, making separate asset and vulnerability scanning processes time-consuming and labor-intensive.

[0052] To improve efficiency, in this embodiment, the electronic device obtains the IP intelligence information of the target device obtained in advance through asset detection. For example, the electronic device performs asset detection on the target device in advance, thereby obtaining the IP intelligence information of the target device and using it during vulnerability detection. Alternatively, other devices have previously performed asset detection on the target device and obtained the IP intelligence information of the target device, and the electronic device obtains the IP intelligence information of the target device from the other devices for vulnerability detection. The IP intelligence information includes the port information corresponding to each of the multiple ports. That is, the port information obtained through asset detection is used as the information for vulnerability verification, and there is no need to perform asset detection and vulnerability scanning in sequence. In this way, the efficiency of vulnerability scanning can be improved by rationally utilizing existing information.

[0053] Asset detection can be performed using the Zoomeye engine. The Zoomeye engine includes various asset information collected and accumulated by the 404 Lab, ensuring the accuracy and comprehensiveness of identification information. This supports specific vulnerability information services, ensuring both efficiency and accuracy.

[0054] As a possible implementation, the target rule table includes a first target rule table, which can be Figure 4 The target port information can be determined by the method shown. Figure 4 , Figure 4 for Figure 2 One of the flow charts of the sub-steps included in step S120. In this embodiment, step S120 may include sub-steps S121 and S122.

[0055] Sub-step S121 : For each piece of port information, match the piece of port information with the first target rule in the first target rule table.

[0056] Sub-step S122: When a piece of port information matches a piece of the first target rule, determine that the piece of port information is a piece of the target port information.

[0057] In this embodiment, each piece of the port information may include at least one of a port identifier, a vulnerability feature, and service-related information corresponding to the port. The port identifier may be a port number or other identifier that can be used to identify the port. The vulnerability feature may be represented by Dork, which is a feature field used for key matching. Dork can be obtained by extracting the attack code and some keywords in a vulnerability and converting them through regular expressions. The service-related information may include Product and / or service information (i.e., Service information), wherein the Product represents the product name, i.e., the product where the service is located, such as Google, Baidu, etc.; the service information is used to describe various information of the server, such as the version number of the service.

[0058] In this embodiment, the rules in the first target rule table are referred to as first target rules. The first target rule table includes at least one first target rule. Correspondingly, each of the first target rules includes at least one of the target port identifier corresponding to the vulnerability, the target vulnerability feature, and the first target service related information. That is, the first target rule is a rule set based on the vulnerability, which is used to match the vulnerability. It can be understood that the type of information included in the port information is the same as the type of information included in the first target rule, which facilitates rule matching. In addition, if a certain port is not detected to have certain information required for rule matching, the field value of this information can be set to empty. For example, if a port does not detect a vulnerability feature, the vulnerability feature in the port information of the port can be empty.

[0059] When port information is obtained, each piece of port information may be matched against a first target rule in the first target rule table to determine whether the port information matches a first target rule. If a piece of port information matches a first target rule, the port information may be used as the target port information.

[0060] Optionally, the port information may be directly matched against each first target rule in the first target rule table in sequence until all first target rules are matched, and then a determination may be made based on the matching results whether the port information matches a first target rule. Alternatively, during the matching process based on the first target rule table, a determination may be made whether to stop matching after each first target rule is matched; if it is determined that the port information matches a first target rule, the matching process may stop.

[0061] Optionally, the matching method between a piece of port information and a first target rule can be set according to actual needs and is not specifically limited here. For example, all information in the port information can be directly analyzed with all information in a first target rule without prioritizing various information in the port information.

[0062] As a possible implementation, the port information includes vulnerability features and other features, and the other features include port identifiers and / or service related information. Correspondingly, the first target rule includes target vulnerability features and target other features, and the other target features include target port identifiers and / or first target service related information. In this embodiment, Figure 5 The matching with the first target rule is completed in the manner shown. Figure 5 , Figure 5 for Figure 4The flowchart of the sub-steps included in sub-step S121 is as follows. In this embodiment, sub-step S121 may include sub-steps S1211 to S1213.

[0063] Sub-step S1211 : matching the vulnerability feature in the port information with the target vulnerability feature in the first target rule.

[0064] Sub-step S1212: if a third target rule exists, matching the other features in the piece of port information with the features in the third target rule except the target vulnerability feature.

[0065] The third target rule is the first target rule in which the target vulnerability feature matches the vulnerability feature in the port information.

[0066] Sub-step S1213 , when the other features of the port information match the features in the third target rule except the target vulnerability feature, determining that the port information matches the first target rule.

[0067] In this embodiment, for a piece of port information and a first target rule, first, the vulnerability features in the port information are matched with the target vulnerability features in the first target rule; if the vulnerability features match the target vulnerability features, then other features in the port information are matched with other target features (i.e., features other than the target vulnerability features) in the first target rule; if the other features match the other target features, then it can be determined that the port information matches the first target rule. In this way, it is convenient to quickly match vulnerabilities. Among them, the specific method of determining whether the features match can be determined in combination with actual needs.

[0068] For example, in the case where the feature is a port identifier, the port identifier can be determined to be a match if the port identifier in the port information is the same as the target port identifier in the first target rule. For another example, in the case where the feature is a vulnerability feature, each keyword in the vulnerability feature of the port information can be compared with each keyword in the target vulnerability feature, and then the proportion of the identical keywords can be calculated. If the proportion is greater than a preset value, the vulnerability feature is determined to be a match. It will be understood that the above is merely an example, and this embodiment does not limit the specific method for determining whether a feature matches.

[0069] In this embodiment, when the vulnerability feature in the port information does not match the target vulnerability feature in each of the first target rules, and when the other features of the port information do not match the features other than the target vulnerability feature in each of the third target rules, it can be determined that the port information does not match each of the first target rules.

[0070] Vulnerability matching based on the first target rule table may result in omissions. To avoid omissions, in this embodiment, the port information includes vulnerability features and service-related information corresponding to the port. The target rule table may also include a second target rule table. The second target rule table includes at least one second target rule. The second target rule includes information related to the second target service corresponding to the vulnerability and a verification method. Figure 6 Secondary screening shown in sub-steps S123 to S125. Figure 6 , Figure 6 for Figure 2 FIG2 is a flow chart showing the sub-steps included in step S120. In this embodiment, after sub-step S122, step S120 may further include sub-steps S123 to S125.

[0071] Sub-step S123 : for each piece of port information that does not match any of the first target rules, determine a second target rule to be used from the second target rule table according to the service-related information in the piece of port information.

[0072] Sub-step S124: Verify according to the verification means in the second target rule to be used to determine whether the port information matches a second target rule to be used.

[0073] Sub-step S125 : When the piece of port information matches a second target rule to be used, determining the piece of port information as the target port information.

[0074] In this embodiment, the verification means in the second target rule can be set based on the common attack methods of the vulnerability. For each port information that does not match the first target rule table, based on the service-related information in the port information, a second target rule with the second target service-related information that is the same as the service-related information can be found from the second target rule table, and the found second target rule can be used as the second target rule to be used. Then, based on the port information, verification is performed using the verification means in the second target rule to be used to determine whether the port information matches a second target rule to be used. If the port information matches a second target rule to be used, the port information can be used as the target port information. If the port information does not match any of the second target rules to be used, the port information may not be used as the target port information.

[0075] Optionally, the verification means may include a verification method and an expected result. If the actual verification situation obtained after verification based on the verification method matches the expected result, it can be determined that the port information matches a second target rule to be used.

[0076] Optionally, each time it is determined that a piece of port information does not match the first target rule table, a match can be performed on the port information based on the second target rule report. Alternatively, after completing the matching of all port information with the first target rule table, a match can be performed based on the second target rule table for the port information that does not match the first target rule table. In the process of matching based on the second target rule table, for a piece of port information, all the second target rules to be used corresponding to the port information can be obtained first, and then verified based on each of the second target rules to be used in turn; or after determining a second target rule to be used corresponding to the port information, verification can be performed based on the second target rule to be used, and if there is no match, the next second target rule to be used can be found from the second target rule table for the next match. The specific execution order can be determined in combination with actual needs and is not specifically limited here.

[0077] After the target port information is determined, vulnerability verification may be performed on each piece of target port information to determine whether a vulnerability exists.

[0078] The embodiment of the present application obtains the port information of each port including at least one of the port identification, vulnerability characteristics, and service-related information corresponding to the port through asset detection, and then filters the port information in combination with the first target rule table and the second target rule table to determine the target port information to be subject to vulnerability verification, and finally performs vulnerability verification. In this way, by utilizing known target intelligence information, the duration of vulnerability scanning is greatly reduced, thereby reducing the confirmation range from 1 building to a certain floor. The vulnerability detection method provided by the embodiment of the present application can effectively and quickly collect asset vulnerabilities and risk points in various networks within the enterprise; and after a new vulnerability breaks out, the enterprise can check the vulnerabilities and weaknesses in the network assets in the shortest time and complete the repair, thereby completing the reinforcement of its own network assets and improving the security protection of sensitive and critical information.

[0079] The following is an example to illustrate the above vulnerability detection method.

[0080] First, deploy the radar.

[0081] As an asset discovery device, radar can clearly identify how many of our assets are exposed to risks, which high-risk ports are open on these assets, which high-risk components are running on these ports, etc. By knowing ourselves, we can form timely defenses to reduce security risks.

[0082] The radar can be deployed in the network environment to be scanned so that it can communicate with the target and obtain IP intelligence information. After deployment, it is necessary to ensure that the target network has two-way communication with the radar. IP intelligence information includes port information for each port, including port number, product, service information, and dork information.

[0083] For radar, update and replace the asset vulnerability workflow, that is, replace the original vulnerability scanning and judgment process to complete the radar deployment.

[0084] Use vulnerability scanning workflow script code and specific rule files to replace the original asset vulnerability workflow in the system.

[0085] Among them, the vulnerability scanning workflow script code is actually a modified new API interface used to connect and link with the asset engine.

[0086] A specific rule file consists of two parts. The first part is used to quickly match vulnerabilities when working with the asset engine. This is the rule table used for dork feature matching. This rule table extracts the specific port, product, and service information required for vulnerability detection and encapsulates it with the dork into separate rules. When used in this rule table, dork matching is performed first, followed by matching of the remaining information.

[0087] Given that omissions are inevitable in the previous section, to avoid them, a second vulnerability mapping table is created for secondary screening. This table contains distinct rules (which may include verification methods), but these rules have a larger range than the rule table used for the first dork match. Specifically, this means the dork's feature range has been expanded. For example, if the feature in the first rule table is "log4j," the second rule table will have "Apache," "log4j," and "Apache Solr," increasing the matching area. Product and service information will also be prioritized, matching ahead of the dork to avoid omissions. Overall, this vulnerability mapping table is a very small file, only a few hundred megabytes, making it very fast for computers to process.

[0088] The second rule table is used to match port information that does not match the first rule table. When the second rule table is used, the rule to be used is first determined based on the product and service information in the port information to be matched in the second rule table, and then matching is performed based on the selected rule.

[0089] Next, the radar detects the target.

[0090] Radar uses its asset engine to perform asset detection on a target and obtain its IP intelligence information. Once completed, users can select a vulnerability name on Radar to determine the first and second target rule tables to be used in the vulnerability detection screening process from Radar's built-in rule tables.

[0091] Finally, vulnerability identification is performed.

[0092] When the radar initiates a vulnerability scan, the internal vulnerability engine will give priority to extracting the target banner & service port information (i.e. the IP intelligence information of the aforementioned target) that has been obtained, and match this information based on the first target rule table.

[0093] When at least one port information in the IP intelligence information matches a rule in the first target rule table, the vulnerability engine will use the matched port information (also called vulnerability information at this time) to verify and return the result.

[0094] If no match is found in the first round, a match based on the second target rule table can be performed on the port information that was previously filtered out. In other words, if there is port information that does not match any rules in the first target rule table, this part of the port information will be matched against the second target rule table. In the second round of matching, the second target rule table is first searched based on the Product and Service information in the port information, and the port information is verified based on the verification methods in the retrieved rules to determine whether the port information matches the retrieved rules. Finally, the vulnerability engine completes the final verification work for the port information that matches the rules in the second target rule table (also called vulnerability information at this time).

[0095] Existing vulnerability detection devices, after completing an asset scan, request each port according to the vulnerability rules. Only when the request is successful and matches, will they call the vulnerability attack code to simulate the attack and finally verify the authenticity of the vulnerability. However, this solution skips this tedious and time-consuming operation and directly skips to the vulnerability identification step of existing vulnerability scanning devices, performing accurate matching and vulnerability simulation verification.

[0096] In order to execute the corresponding steps in the above embodiments and various possible methods, an implementation method of a vulnerability detection device 200 is given below. Optionally, the vulnerability detection device 200 can adopt the above Figure 1 The device structure of the electronic device 100 is shown in FIG. Figure 7 , Figure 7 This is a block diagram of a vulnerability monitoring device provided in an embodiment of the present application. It should be noted that the basic principles and technical effects of the vulnerability detection device 200 provided in this embodiment are the same as those of the aforementioned embodiments. For the sake of brevity, any details not mentioned in this embodiment can be referred to the corresponding contents of the aforementioned embodiments. The vulnerability detection device 200 may include: an information acquisition module 210, a screening module 220, and a detection module 230.

[0097] The information obtaining module 210 is configured to obtain port information corresponding to each of the multiple ports of the target device.

[0098] The screening module 220 is configured to determine target port information from the port information corresponding to each of the plurality of ports according to a target rule table, wherein the rules in the target rule table are used for vulnerability matching.

[0099] The detection module 230 is used to perform vulnerability verification based on each piece of target port information.

[0100] In this embodiment, the information acquisition module 210 is specifically configured to perform asset detection on the target device to obtain IP intelligence information of the target device, wherein the IP intelligence information includes port information corresponding to the multiple ports.

[0101] Please refer to Figure 8 , Figure 8 This is a second block diagram of the vulnerability detection device 200 provided in an embodiment of the present application. In this embodiment, the vulnerability detection device 200 may further include a determination module 201 .

[0102] The determining module 201 is configured to determine the target rule table according to the original rule table and the received rule selection operation, wherein the target rules in the target rule table are at least part of the rules in the original rule table.

[0103] Optionally, the above modules can be stored in the form of software or firmware. Figure 1 The memory 110 shown in FIG. 110 or the operating system (OS) of the electronic device 100 may be fixed and may be used by Figure 1 Meanwhile, the data, program codes, etc. required to execute the above modules may be stored in the memory 110.

[0104] An embodiment of the present application also provides a readable storage medium having a computer program stored thereon, which implements the vulnerability detection method when the computer program is executed by a processor.

[0105] In summary, the vulnerability detection method, device, electronic device, and readable storage medium provided by the embodiments of the present application, when obtaining the port information of each of the multiple ports of the target device, determine the target port information from the port information corresponding to each of the multiple ports according to the target rule table including the rules for vulnerability matching, and then perform vulnerability verification on each piece of target port information. In this way, through filtering, the targets to be verified are reduced, thereby improving the efficiency of vulnerability scanning, and further facilitating the effective and rapid collection of asset vulnerabilities and risk points of various networks within the enterprise. It also facilitates the enterprise to quickly complete the reinforcement of its own network assets after the outbreak of a new vulnerability, thereby improving the security protection of sensitive and critical information.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0107] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0108] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0109] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A vulnerability detection method, characterized in that: The method comprises: Obtain the port information corresponding to each of the multiple ports of the target device; determining target port information from port information corresponding to each of the plurality of ports according to a target rule table, wherein rules in the target rule table are used for vulnerability matching; Perform vulnerability verification based on the target port information described in each item; The port information includes vulnerability characteristics and other characteristics, the other characteristics include a port identifier and / or service-related information corresponding to the port, the target rule table includes a first target rule table, the first target rule table includes at least one first target rule, the first target rule includes a target port identifier corresponding to the vulnerability and / or first target service-related information and a target vulnerability characteristic, and determining the target port information from the port information corresponding to each of the multiple ports according to the target rule table includes: For each piece of port information, matching the piece of port information with the first target rule in the first target rule table; When a piece of port information matches a piece of the first target rule, determining the piece of port information as the target port information; Among them, matching the port information with the first target rule in the first target rule table includes: matching the vulnerability characteristics in the port information with the target vulnerability characteristics in the first target rule; in the case that there is a third target rule, matching the other characteristics in the port information with the characteristics in the third target rule other than the target vulnerability characteristics, wherein the third target rule is the first target rule whose target vulnerability characteristics match the vulnerability characteristics in the port information; in the case that the other characteristics of the port information match the characteristics in the third target rule other than the target vulnerability characteristics, it is determined that the port information matches one of the first target rules.

2. The method according to claim 1, characterized in that The port information includes vulnerability characteristics and service-related information corresponding to the port, the target rule table also includes a second target rule table, the second target rule table includes at least one second target rule, the second target rule includes second target service-related information corresponding to the vulnerability and a verification method, and determining target port information from the port information corresponding to each of the multiple ports according to the target rule table further includes: For each piece of port information that does not match any of the first target rules, determine a second target rule to be used from the second target rule table according to the service-related information in the piece of port information; Verify according to the verification means in the second target rule to be used to determine whether the port information matches a second target rule to be used; In a case where the piece of port information matches a second target rule to be used, the piece of port information is determined to be the target port information.

3. The method according to any one of claims 1 to 2, characterized in that The obtaining of port information corresponding to each of the plurality of ports of the target device includes: The IP intelligence information of the target device obtained in advance through asset detection is obtained, wherein the IP intelligence information includes port information corresponding to each of the multiple ports.

4. The method according to any one of claims 1 to 2, characterized in that Before determining the target port information from the port information corresponding to each of the plurality of ports according to the target rule table, the method further includes: The target rule table is determined according to the original rule table and the received rule selection operation, wherein the target rules in the target rule table are at least part of the rules in the original rule table.

5. A vulnerability detection device, characterized in that: The device comprises: An information acquisition module is used to obtain port information corresponding to each of the multiple ports of the target device; a screening module, configured to determine target port information from the port information corresponding to each of the plurality of ports according to a target rule table, wherein the rules in the target rule table are used for vulnerability matching; A detection module, configured to perform vulnerability verification based on each piece of target port information; The port information includes vulnerability characteristics and other characteristics, the other characteristics include a port identifier and / or service-related information corresponding to the port, the target rule table includes a first target rule table, the first target rule table includes at least one first target rule, the first target rule includes a target port identifier corresponding to the vulnerability and / or first target service-related information and a target vulnerability characteristic, and the screening module is specifically configured to: For each piece of port information, matching the piece of port information with the first target rule in the first target rule table; When a piece of port information matches a piece of the first target rule, determining the piece of port information as the target port information; Among them, the screening module matches in the following manner: matching the vulnerability features in the port information with the target vulnerability features in the first target rule; in the case that there is a third target rule, matching the other features in the port information with the features in the third target rule other than the target vulnerability features, wherein the third target rule is the first target rule in which the target vulnerability features match the vulnerability features in the port information; in the case that the other features of the port information match the features in the third target rule other than the target vulnerability features, it is determined that the port information matches one of the first target rules.

6. The device according to claim 5, characterized in that The information acquisition module is specifically used for: Perform asset detection on the target device to obtain IP intelligence information of the target device, wherein the IP intelligence information includes port information corresponding to the multiple ports.

7. An electronic device, characterized in that: The system comprises a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor can execute the machine executable instructions to implement the vulnerability detection method according to any one of claims 1 to 4.

8. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the vulnerability detection method according to any one of claims 1 to 4 is implemented.

Images