Device vulnerability detection method and device, apparatus, and storage medium

Abstract

Embodiments of the present application disclose a device vulnerability detection method, device, equipment and storage medium. The method comprises: determining a fingerprint feature corresponding to a to-be-detected device according to feature information of the to-be-detected device, wherein the feature information comprises device packet information of the to-be-detected device and page information corresponding to a web page loaded in the to-be-detected device; determining a vulnerability detection sequence of the to-be-detected device according to the fingerprint feature; and performing vulnerability detection on the to-be-detected device based on the vulnerability detection sequence. The embodiments of the present application can dynamically determine the vulnerability detection sequence of the to-be-detected device based on the fingerprint feature, and then perform vulnerability detection on the to-be-detected device based on the vulnerability detection sequence, thereby improving the vulnerability detection efficiency, discovering high-risk vulnerabilities in priority, and ensuring device security.

Description

Technical Field

[0001] This application relates to the field of terminal device security, specifically to a vulnerability detection method and apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] With the development of network technology, the number of vulnerabilities in terminal devices has also increased. Currently, there are numerous device vulnerability databases, including hundreds of thousands of known open-source vulnerability databases. In existing technologies, vulnerability detection for terminal devices is performed one by one in a fixed order, which is not only inefficient but also makes the vulnerability risk level unclear. This makes it impossible to quickly and effectively detect vulnerabilities in terminal devices, which can seriously affect the normal use of terminal devices and even the overall performance of the entire system.

[0003] Therefore, how to dynamically adjust the vulnerability detection sequence of terminal devices and achieve rapid and effective vulnerability detection of terminal devices is a technical problem that needs to be continuously studied by those skilled in the art. Summary of the Invention

[0004] To address the aforementioned technical problems, embodiments of this application provide a device vulnerability detection method and apparatus, an electronic device, a computer-readable storage medium, and a computer program product.

[0005] According to one aspect of the embodiments of this application, a device vulnerability detection method is provided, comprising: determining fingerprint features corresponding to the device to be detected based on feature information of the device to be detected, wherein the feature information includes device message information of the device to be detected and page information corresponding to a web page loaded in the device to be detected; determining a vulnerability detection sequence of the device to be detected based on the fingerprint features; and performing vulnerability detection on the device to be detected based on the vulnerability detection sequence.

[0006] According to one aspect of the embodiments of this application, determining the fingerprint features corresponding to the device to be detected based on the feature information of the device to be detected includes: The feature vector of the device to be tested is obtained based on the feature information of the device to be tested. The feature vector is matched with a device fingerprint feature library, and the fingerprint feature in the device fingerprint feature library that matches the feature vector is taken as the fingerprint feature corresponding to the device to be detected.

[0007] According to one aspect of the embodiments of this application, obtaining the feature vector of the device to be detected based on the feature information of the device to be detected includes: Send a preset data packet to the device under test to obtain the response message information of the device under test in response to the preset data packet; Extract the corresponding feature vector from the response message information.

[0008] According to one aspect of the embodiments of this application, obtaining the feature vector of the device to be detected based on the feature information of the device to be detected includes: Obtain the page information corresponding to the web page displayed when logging in to the device under test based on preset account information and password information; Extract the corresponding feature vector from the page information corresponding to the web page.

[0009] According to one aspect of the embodiments of this application, the number of feature vectors of the device to be detected includes multiple features; the step of matching the feature vectors with a device fingerprint feature library, so as to take the fingerprint feature in the device fingerprint feature library that matches the feature vector as the fingerprint feature corresponding to the device to be detected, includes: The multiple feature vectors are deduplicated to obtain a feature vector dataset. The fingerprint feature set corresponding to the feature vector dataset is determined from the device fingerprint feature library based on a preset classification algorithm; The fingerprint features corresponding to the device to be detected are matched from the fingerprint feature set.

[0010] According to one aspect of the embodiments of this application, determining the vulnerability detection sequence of the device to be detected based on the fingerprint features includes: Obtain device vulnerability information corresponding to the fingerprint feature from the device vulnerability database. The device vulnerability information includes multiple vulnerabilities and vulnerability risk information corresponding to each vulnerability. The vulnerability detection sequence of the device to be tested is determined based on the vulnerability risk information.

[0011] According to one aspect of the embodiments of this application, performing vulnerability detection on the device to be detected based on the vulnerability detection sequence includes: Perform vulnerability detection on the device to be tested according to the vulnerability detection sequence; Determine whether any new vulnerabilities are discovered during the vulnerability detection process; If the determination is yes, then the correspondence between the new vulnerability and the fingerprint feature corresponding to the device to be detected is written into the device vulnerability database.

[0012] According to one aspect of the embodiments of this application, a device vulnerability detection apparatus is provided, comprising: an acquisition module, configured to determine fingerprint features corresponding to the device under test based on feature information of the device under test, wherein the feature information includes device message information of the device under test and page information corresponding to a web page loaded in the device under test; a determination module, configured to determine a vulnerability detection sequence of the device under test based on the fingerprint features; and a detection module, configured to perform vulnerability detection on the device under test based on the vulnerability detection sequence.

[0013] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device enables the device vulnerability detection method as described above.

[0014] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, on which computer-readable instructions are stored, which, when executed by a computer's processor, cause the computer to perform the device vulnerability detection method as described above.

[0015] According to one aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in the device vulnerability detection method described above.

[0016] In the technical solution provided in the embodiments of this application, the fingerprint features of the device under test are determined by the device message information of the device under test and the page information corresponding to the web page loaded in the device under test. Based on the fingerprint features, the vulnerabilities existing in the device under test and the detection sequence of the vulnerabilities are determined. The vulnerability detection sequence of the device under test is dynamically determined based on the fingerprint features, and then the vulnerability detection of the device under test is performed based on the vulnerability detection sequence. This not only improves the vulnerability detection efficiency but also prioritizes the discovery of high-risk vulnerabilities, ensuring device security.

[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings: Figure 1This is a schematic diagram illustrating the implementation environment of device vulnerability detection, as shown in an exemplary embodiment of this application; Figure 2 This is a flowchart illustrating a device vulnerability detection method in an exemplary embodiment of this application; Figure 3 This is a flowchart illustrating a device vulnerability detection method in an exemplary embodiment; Figure 4 yes Figure 2 The flowchart of step S230 in the illustrated embodiment is shown in an exemplary embodiment; Figure 5 This is an overall flowchart illustrating a device vulnerability detection method as shown in another exemplary embodiment of this application; Figure 6 This is a block diagram illustrating a device vulnerability detection apparatus according to an exemplary embodiment of this application; Figure 7 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0019] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0020] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0021] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0022] In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0023] First, it's important to clarify that the fingerprint feature refers to endpoint fingerprinting. Endpoint fingerprinting is a feature of enterprise network access control products that can discover, classify, and monitor connected devices, including non-traditional network endpoints such as smart card readers, HVAC systems, medical devices, and IP door locks. These endpoints are sometimes also referred to as "dumb devices." Endpoint fingerprinting is particularly useful for controlling access to network dumb devices. Because dumb devices don't interact with the network like intelligent terminals such as computers, they are generally difficult to track. Enterprises often lack a inventory of non-traditional endpoints in their networks, let alone control over their access methods. While the traditional view of network security is to trust all devices in the network, the volatile nature of the network perimeter and increasing mobility mean that this approach is no longer viable. When network devices are not under monitoring, they may gain unauthorized access to the enterprise network and its resources, providing hackers with excellent opportunities to carry out man-in-the-middle attacks. Endpoint fingerprinting collects IP and MAC addresses from terminal devices and checks them against an approved list of addresses to verify that each address is reliable and that the corresponding device has the right to access the network. By analyzing the endpoint fingerprint of a terminal device, a vulnerability detection sequence can be determined, allowing for timely patching of vulnerabilities and protecting the device from hacker attacks.

[0024] As can be seen from the above, for "foolproof devices" such as video surveillance equipment, which are generally difficult to track because they do not interact with networks like computers and other intelligent terminals, there are hundreds of thousands of vulnerabilities. In the current technology, vulnerability detection of terminal devices is carried out one by one in a fixed order. This is not only inefficient, but also makes the vulnerability risk level unclear. It cannot quickly and effectively detect vulnerabilities in terminal devices, which will seriously affect the normal use of terminal devices and even affect the overall performance of the entire system.

[0025] The embodiments of this application determine the vulnerability detection sequence of the terminal to be detected based on the terminal fingerprint, i.e., fingerprint features of the terminal device. For detailed technical details, please refer to the description of the subsequent embodiments, which will not be repeated here.

[0026] Please refer to Figure 1 , Figure 1 This is a schematic diagram of an embodiment environment related to an embodiment of this application. The implementation environment includes a terminal 110 and a server 120, which communicate with each other via wired or wireless means.

[0027] Terminal 110 has at least one vulnerability. In the prior art, vulnerability detection of terminal 110 is performed by performing detection on terminal 110 according to a fixed sequence pre-set by the device. However, the risk level or frequency of occurrence of the vulnerability is different. The fingerprint characteristics of terminal 110 can be determined based on the characteristic information of terminal 110, including message information and web page information.

[0028] Server 120 is used to determine the vulnerabilities existing in terminal 110 and the corresponding vulnerability detection sequence based on the fingerprint characteristics of terminal 110. Specifically, when server 120 obtains the feature information of terminal 110, it analyzes and matches the feature information to obtain the fingerprint characteristics corresponding to terminal 110, determines the vulnerability information corresponding to terminal 110 based on the fingerprint characteristics of terminal 110, and determines the vulnerability detection sequence of terminal 110 based on the vulnerability information.

[0029] It should be noted that terminal 110 can be a non-traditional network terminal such as the aforementioned video surveillance device or air conditioner controller; of course, terminal 110 can also be any electronic device that supports codeless visual configuration functions, such as a smartphone, tablet, laptop, or wearable device, but it is not limited to these. For example, terminal 110 can also be a vehicle-mounted terminal, aircraft, or other devices used in special fields. Terminal 210 can communicate with server 120 through wireless networks such as 3G (third-generation mobile information technology), 4G (fourth-generation mobile information technology), and 5G (fifth-generation mobile information technology), or through a wired network, and this is not restricted here.

[0030] Server 120 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. There are no restrictions on this.

[0031] It should be understood that cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and networks within a wide area network (WAN) or local area network (LAN) to achieve data computing, storage, processing, and sharing. Cloud technology is also a general term for network technologies, information technologies, integration technologies, management platform technologies, and application technologies applied based on the cloud computing business model. These technologies can form resource pools, which can be used on demand, offering flexibility and convenience.

[0032] Figure 2This is a flowchart illustrating a device vulnerability detection method as shown in an exemplary embodiment of this application. The method is applicable to... Figure 1 The implementation environment shown, and by Figure 1 The method is specifically executed by server 120 in the implementation environment shown. This method can also be applied to other implementation environments and executed by devices in other implementation environments, and this embodiment does not limit this.

[0033] The method proposed in this application embodiment will now be described in detail, using a server as an exemplary execution subject. Figure 2 As shown, in an exemplary embodiment, the method includes steps S210 to S230, which are described in detail below: Step S210: Determine the fingerprint features corresponding to the device under test based on the feature information of the device under test. The feature information includes the device message information of the device under test and the page information corresponding to the web page loaded in the device under test.

[0034] It should be noted that the device to be tested in this embodiment refers to the aforementioned terminal device with vulnerabilities. The characteristic information of the device to be tested is obtained by capturing the message information and the page information corresponding to the web homepage content of the device to be tested. The characteristic information includes the device manufacturer, device type, model, hardware version, software version, protocol, message identifier field name, message field quantification characteristics such as length and quantity, as well as the images, username, password, port number, etc. contained in the web homepage. The fingerprint characteristics of the device to be tested are determined by obtaining the characteristic information of the device to be tested.

[0035] Furthermore, the response message information of the device under test based on the received data packet can be obtained. For example, a detection data packet can be sent to the device under test, the data packet of the device under test responding based on the detection data packet can be obtained, and relevant crawling tools can be used to extract information related to the characteristics of the device under test from the response message of the device under test; or the feature information corresponding to the web page information of the device under test can be obtained. For example, the image information, the interface information used, and the thread information used to load the page in the web page when the device under test logs in can be obtained, or the web page information of the device under test in other application scenarios can be obtained.

[0036] Step S220: Determine the vulnerability detection sequence of the device to be detected based on the fingerprint characteristics.

[0037] It should be noted that in this embodiment, a device vulnerability database can be established by pre-constructing vulnerabilities corresponding to device fingerprint features. This can be done by crawling information security sharing platforms, information security vulnerability databases, public vulnerability databases such as CVE and ICSCERT (Industrial Control System Network Emergency Response Team), as well as professional forums related to device security, security announcements from device manufacturers, and completed vulnerability detection reports or obtaining standard documents related to device security.

[0038] By matching the fingerprint features of the device under test with the corresponding device vulnerability information in the device vulnerability database, the vulnerability information includes which vulnerabilities are identified, the risk level of the vulnerabilities, and the frequency of their occurrence. Based on the device vulnerability information corresponding to the fingerprint features of the device under test, the vulnerability detection sequence of the device under test is determined.

[0039] Step S230: Perform vulnerability detection on the device to be tested based on the vulnerability detection sequence.

[0040] It should be noted that in this embodiment, vulnerability detection can be achieved through Proof of Concept (POC) testing. Specifically, POC testing is a verification test for a user's specific application. Based on the performance requirements and expansion needs of the user for the adopted system, real data is run on the selected server to actually measure the amount of user data to be carried and the running time. The amount of data is increased according to the user's future business expansion needs to verify the system and platform's carrying capacity and performance changes.

[0041] For example, a Proof-of-Concept (POC) test is used to run real data of the device under test according to the vulnerability detection sequence of the device under test, and to detect and fix the vulnerabilities of the device under test.

[0042] In this embodiment, the characteristic information of the device under test is obtained by acquiring the device message information of the device under test and the page information corresponding to the loaded web page. The fingerprint characteristics of the device under test are determined based on the characteristic information. The vulnerability detection sequence of the device under test is adjusted and determined based on the vulnerability information corresponding to the fingerprint characteristics. Vulnerability detection is performed on the device under test according to the vulnerability detection sequence. Thus, determining the vulnerability detection sequence based on the vulnerability information corresponding to the device under test not only improves the vulnerability detection efficiency but also prioritizes the discovery of high-risk vulnerabilities, ensuring the safe operation of the device.

[0043] Based on the above embodiments, in one exemplary embodiment provided in this application, the above... Figure 3 The implementation process of step S210 also includes steps S211 and S212, which are described in detail below: Step S211: Obtain the feature vector of the device to be tested based on the feature information of the device to be tested.

[0044] For example, a preset detection data packet can be sent to the device under test to obtain the message information of the response of the device under test based on the preset detection data packet, and the feature information corresponding to the device under test can be extracted from the message information. The feature information of the web page loaded by the device under test can also be obtained, such as the image, username and port number in the web page. The feature information of the device under test can be quantized to obtain the feature vector of the device under test.

[0045] Step S212: Match the feature vector with the device fingerprint feature library, so that the fingerprint feature in the device fingerprint feature library that matches the feature vector is used as the fingerprint feature corresponding to the device to be detected.

[0046] First, it should be noted that in this embodiment, a device fingerprint feature library is pre-built to match the fingerprint features of the device to be detected based on its feature vector. In this embodiment, an open-source fingerprint library can be crawled and tested device information can be added, with long-term updates and maintenance. The device fingerprint features include the correspondence between information such as manufacturer, device type, model, hardware version, software version, protocol, message identifier field name, message field quantification features such as length and quantity, and web page features such as page images, username, password, and port number used.

[0047] For example, by collecting feature information such as manufacturer, device type, model, hardware version, software version, protocol, and message identifier field name from the response message information of the device under test when it receives a preset test data packet, or feature information such as images, username, password, and port contained in the web page loaded by the device under test, the feature vector corresponding to the device under test is obtained by quantifying the feature information of the device under test, and the fingerprint feature corresponding to the device under test is determined by comparing the feature vector with the already constructed device fingerprint feature database.

[0048] In this embodiment, feature information of the device to be tested is extracted and corresponding feature vectors are obtained by quantifying the feature information. Then, the fingerprint features of the device to be tested are obtained by comparing the feature vectors with a pre-built fingerprint feature library. This ensures the comprehensiveness of the feature information of the device to be tested and the accuracy of the fingerprint features of the device to be tested obtained by comparison.

[0049] Based on the above embodiments, in one exemplary embodiment provided in this application, the specific implementation process of step S211 further includes steps S2111 and S2112, which are described in detail below: Step S2111: Send a preset data packet to the device under test to obtain the response message information of the device under test in response to the preset data packet.

[0050] By sending a pre-set data packet to the device under test, the device under test responds with the message information of the data packet. The response message information is obtained by a packet capture tool, and then the feature fields in the corresponding message are extracted by the corresponding information extraction technology.

[0051] For example, banner information extraction technology can be used to extract characteristic fields such as "Server, Cookie, Title, Content-Encoding" from response messages. It's important to note that banner extraction technology obtains information such as the software developer, software name, version, and service type from the banner information. This may contain sensitive information, so obtaining the banner falls under the category of information gathering. The banner information can provide information such as the software developer, software name, service type, and version number. Sometimes, version numbers contain publicly available CVEs (Certificate Vessels), which are publicly known cybersecurity vulnerabilities and exposures. Each item in the list is based on a specific vulnerability or exposure found in a specific software product, not on a general category or type of vulnerability or exposure. The CVE list is designed to facilitate linking to information from vulnerability databases and to compare security tools and services. The CVE list is a collection of CVE identifiers assigned to each vulnerability and exposure, which can be directly exploited. Banner information acquisition is based on establishing a link with the target; only with an established link can the corresponding banner information be obtained. If the target hides the banner information or configures read-blocking settings, the banner cannot be obtained. The extracted feature information is quantified, including calculating the number and length to form a feature vector, and the corresponding feature vector is simply initially labeled using known information and initial recognition results.

[0052] In this embodiment, the response message information of the device under test is obtained by sending a preset data packet to the device under test, and the feature vector corresponding to the device under test is extracted from the message information by the corresponding information extraction technology. In this way, the feature vector of the device under test in the message information of the device under test can be obtained, reducing the dependence on text features and obtaining the feature data of the device under test more comprehensively.

[0053] Based on the above embodiments, in one exemplary embodiment provided in this application, the process of obtaining the feature vector of the device under test based on the feature information of the device under test further includes steps S2111' and S2112', which are described in detail below: Step S2111': Obtain the page information corresponding to the web page displayed when logging in to the device under test based on preset account information and password information.

[0054] The device under test logs in using preset or default account information and corresponding password information, and obtains the page information corresponding to the web page when the device logs in. It should be noted that the web page is built using HTML. Any computer with a web browser can interpret HTML, and the web browser translates HTML into a visual representation of a multimedia web file, including pre-designed background theme styles, page titles, animations, etc. Appropriate extraction techniques are used to extract the corresponding page information from the web page when the device logs in.

[0055] Step S2112': Extract the corresponding feature vector from the page information corresponding to the web page.

[0056] Feature information is extracted from the login page of the device under test using appropriate extraction techniques. The feature information includes, for example, "LOGO image, username, password, port number, etc." The extracted feature information is then used to label the corresponding feature vectors using known information and initial recognition results.

[0057] Therefore, by extracting the web page information of the device under test, comprehensive feature information about the device under test can be obtained from the web page information of the device under test.

[0058] Based on the above embodiments, please refer to Figure 3 In one exemplary embodiment provided in this application, the number of feature vectors of the device to be detected includes multiple vectors, as described above. Figure 3 Step S212 further includes steps S2121 to S2122, which are detailed below: Step S2121: Perform deduplication on multiple feature vectors to obtain a feature vector dataset; As mentioned above, by extracting the feature information from the response message information of the device under test and the page information of the device under test during login, and by quantifying the complex field information to form the corresponding feature vector, and then by performing a simple initial labeling on the response feature vector using the known information and the initial recognition results, multiple feature vectors corresponding to the device under test are obtained.

[0059] Since the multiple feature vectors have been initially labeled based on known information, it is easy to cause the same feature vector to be labeled repeatedly or to have different labels for the same feature vector. Therefore, it is necessary to deduplicate the multiple feature vectors of the device to be detected in order to obtain the feature vector dataset corresponding to the device to be detected.

[0060] Step S2122: Determine the set of fingerprint features corresponding to the feature vector dataset from the device fingerprint feature library based on a preset classification algorithm.

[0061] The deduplicated feature vector dataset of the device to be detected is classified using appropriate machine learning classification algorithms. Specifically, the feature set can be randomly divided into training and validation sets, and random forests, decision trees, multilayer perceptrons, support vector machines, and other learning classification algorithms can be used to classify the feature vector dataset of the device to be detected. The accuracy of the calculation results is analyzed, and the classification algorithm and feature set with the highest accuracy are selected.

[0062] Step S2123: Match the fingerprint features corresponding to the device to be detected from the fingerprint feature set.

[0063] Furthermore, based on the fingerprint feature set obtained from the highest accuracy classification algorithm determined from the feature database according to the above scheme, the fingerprint feature set corresponding to the device to be detected is further matched from the fingerprint feature set.

[0064] In this embodiment, by extracting the quantized feature vector of the device to be detected, compared with directly obtaining the text features of the device to be detected, the dependence on text keywords is reduced and the accuracy of the matching fingerprint features is improved.

[0065] Based on the above embodiments, in one exemplary embodiment provided in this application, the above... Figure 2 Step S220 in the flowchart further includes steps S221 and S222, which are detailed below: Step S221: Obtain device vulnerability information corresponding to fingerprint features from the device vulnerability database. The device vulnerability information includes multiple vulnerabilities and vulnerability risk information corresponding to each vulnerability.

[0066] It should be noted that in this embodiment, component vulnerability features can be collected through distributed crawling, anti-crawling, and update strategies. Vulnerability features include one or more of the following: CVE (Common Vulnerabilities and Exposures) number, title, type, solution, vulnerability name, version, and license information. Alternatively, manual import can be used in conjunction with the import of specific groups of device information or data import under conditions without internet access. The device vulnerability database is constructed by associating various platform repositories through a preset open-source security and compliance governance management platform system, such as information security vulnerability databases; public ICSCERT, professional forums related to the security of monitoring equipment (cameras), security announcements from equipment manufacturers, and completed vulnerability detection reports.

[0067] Based on the established device vulnerability database, vulnerability information corresponding to the fingerprint features of the device under test is compared. Specifically, the fingerprint features can be matched from the device vulnerability database using the manufacturer, device type, model, hardware version, software version, protocol, message identifier field name, or the images, usernames, passwords, and ports contained in the web pages loaded by the device under test. The vulnerability information includes multiple vulnerabilities corresponding to the fingerprint features, the risk level of each vulnerability, and the frequency of occurrence of each vulnerability.

[0068] Step S222: Determine the vulnerability detection sequence for the device to be tested based on the vulnerability risk information.

[0069] As mentioned above, the fingerprint features of the device under test are matched from the device fingerprint feature database using the feature information of the device under test. Then, based on the fingerprint features of the device under test, the vulnerability information of the device under test is obtained from the device vulnerability database. The vulnerability information includes multiple vulnerabilities and the risk information of each vulnerability. Based on this, the vulnerability detection sequence of the device under test is determined according to the risk level and occurrence frequency of each vulnerability using a preset sorting method.

[0070] In this embodiment, a device vulnerability database is established by crawling various open-source platforms for device vulnerabilities and manually inputting the relationship between the fingerprint features and vulnerability information of devices that have already been tested. Based on the fingerprint features of the device to be tested, multiple vulnerabilities corresponding to the device to be tested and the risk information corresponding to each vulnerability can be obtained. By using the multiple vulnerabilities of the device to be tested and the risk information corresponding to each vulnerability, the vulnerability detection sequence of the device to be tested can be determined, which can ensure that high-risk vulnerabilities are repaired first and reduce the false positive rate and false negative rate of vulnerability detection.

[0071] For further details, please refer to Figure 4Based on the above embodiments, in an exemplary embodiment provided in this application, the implementation process of performing vulnerability detection on the device to be detected based on the vulnerability detection sequence further includes steps S231 to S233, which are described in detail below: Step S231: Perform vulnerability detection on the device to be tested according to the vulnerability detection sequence; Based on the fingerprint characteristics of the device under test, multiple vulnerabilities and their corresponding risk information are obtained from the device vulnerability database. Based on the risk information of each vulnerability, the vulnerability detection sequence of the device under test is determined, and vulnerability testing is performed on the device under test using appropriate testing techniques.

[0072] For example, a Proof-of-Concept (POC) verification method is used. Specifically, the POC verification includes verifying the functional coverage of the device under test, the performance of the device under test, the interface applicability of the device under test, and the standardization and completeness of the relevant technical documents of the device under test. The device under test is then tested according to the vulnerability detection sequence of the device under test through the POC verification method.

[0073] Step S232: Determine whether any new vulnerabilities have been discovered during the vulnerability detection process; Step S233: If the determination is yes, then write the correspondence between the new vulnerability and the fingerprint feature corresponding to the device to be detected into the device vulnerability database.

[0074] During the vulnerability detection process on the device under test, monitor whether any new vulnerabilities that are not in the vulnerability detection sequence are found. If a new vulnerability that is not in the vulnerability detection sequence of the device under test is found, it proves that the vulnerability corresponding to the fingerprint feature of the device under test also includes the new vulnerability. Therefore, the new vulnerability is written into the device vulnerability database along with the fingerprint feature corresponding to the device under test.

[0075] In this embodiment, by acquiring new vulnerabilities that are different from the vulnerabilities corresponding to the fingerprint features of the device under test during the vulnerability detection process, and writing the new vulnerabilities in combination with the fingerprint features of the device under test into the device vulnerability database, the accuracy of the data in the vulnerability database is ensured, and the false positive rate and false negative rate of vulnerability detection are reduced.

[0076] Please see Figure 5 , Figure 5 This is an exemplary embodiment of the present application illustrating the overall service flow diagram for device vulnerability detection.

[0077] By acquiring the response message information and the corresponding page information of the loaded web page from the device under test, and quantifying the response message information and web page information to obtain the feature vector corresponding to the device under test, and initially labeling the obtained feature vector based on known information, machine learning algorithms are used to select fingerprint features from the device fingerprint feature database that match the feature vector as the fingerprint features corresponding to the device under test. Based on the fingerprint features corresponding to the device under test, multiple vulnerabilities corresponding to the device under test and the risk information corresponding to each vulnerability are determined from the device vulnerability database. Based on the risk information corresponding to each vulnerability, a vulnerability detection sequence for the device under test is determined, and appropriate techniques are used to perform vulnerability detection on the device under test in sequence. When a new vulnerability different from the vulnerability detection sequence is found during the vulnerability detection process, the new vulnerability is combined with the fingerprint features of the device under test and written into the device vulnerability database to update the vulnerability data in the device vulnerability database. This not only ensures the priority detection of high-risk vulnerabilities but also improves vulnerability detection efficiency and enhances device security.

[0078] Furthermore, in some exemplary embodiments, to further improve the accuracy of the simulated device fingerprint features, a more comprehensive set of factors needs to be considered during the construction of the device fingerprint feature library. These factors include the port used by the device, the device manufacturer, the device hardware version, the device software version, and the communication protocol used by the device. Therefore, machine learning techniques can be employed to construct the device fingerprint feature library.

[0079] It's important to note that Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory, among others. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instruction-based learning.

[0080] Figure 6 This is a block diagram illustrating a device vulnerability detection apparatus according to an exemplary embodiment of this application. The apparatus can be applied to… Figure 1 The implementation environment shown is specifically configured in server 120. This device can also be applied to other exemplary implementation environments and specifically configured in other devices. This embodiment does not limit the implementation environment to which this device is applicable.

[0081] like Figure 6As shown, the device includes: a first determining module 610, used to determine the fingerprint features corresponding to the device under test based on the feature information of the device under test, the feature information including the device message information of the device under test and the page information corresponding to the web page loaded in the device under test; a second determining module 620, used to determine the vulnerability detection sequence of the device under test based on the fingerprint features; and a detection module 630, used to perform vulnerability detection on the device under test based on the vulnerability detection sequence.

[0082] According to one aspect of an embodiment of this application, the first confirming module 610 further includes, The acquisition unit is used to acquire the feature vector of the device to be detected based on the feature information of the device to be detected. The matching unit is used to match the feature vector with the device fingerprint feature library, so as to take the fingerprint feature in the device fingerprint feature library that matches the feature vector as the fingerprint feature corresponding to the device to be detected.

[0083] According to one aspect of an embodiment of this application, the obtaining unit is further specifically used for, Send a preset data packet to the device under test to obtain the response message information of the device under test in response to the preset data packet; Extract the corresponding feature vector from the response message information.

[0084] According to one aspect of an embodiment of this application, the obtaining unit is further specifically used for, Obtain the page information corresponding to the web page displayed when logging in to the device under test based on preset account and password information; Extract the corresponding feature vector from the page information corresponding to the web page.

[0085] According to one aspect of an embodiment of this application, the matching unit is further specifically used for, Multiple feature vectors are deduplicated to obtain a feature vector dataset; The fingerprint feature set corresponding to the feature vector dataset is determined from the device fingerprint feature database based on a preset classification algorithm; The fingerprint features corresponding to the device to be detected are matched from the fingerprint feature set.

[0086] According to one aspect of an embodiment of this application, the second determining unit 620 is specifically used for, Obtain device vulnerability information corresponding to fingerprint features from the device vulnerability database. The device vulnerability information includes multiple vulnerabilities and the vulnerability risk information corresponding to each vulnerability. Determine the vulnerability detection sequence for the device to be tested based on the vulnerability risk information.

[0087] According to one aspect of an embodiment of this application, the detection module 630 is specifically used for, Perform vulnerability detection on the device to be tested according to the vulnerability detection sequence; Determine whether any new vulnerabilities are discovered during the vulnerability detection process; If the determination is yes, the correspondence between the new vulnerability and the fingerprint feature of the device to be detected is written into the device vulnerability database.

[0088] It should be noted that the device vulnerability detection device and the device vulnerability detection method provided in the above embodiments belong to the same concept. The specific operation methods of each module and unit have been described in detail in the method embodiments and will not be repeated here. In practical applications, the device vulnerability detection device provided in the above embodiments can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. This is not a limitation here.

[0089] Embodiments of this application also provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to implement the device vulnerability detection method provided in the above embodiments.

[0090] Figure 7 A schematic diagram of a computer system suitable for implementing the embodiments of this application is shown. It should be noted that... Figure 7 The computer system 1200 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0091] like Figure 7 As shown, the computer system 700 includes a Central Processing Unit (CPU) 701, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on programs stored in Read-Only Memory (ROM) 702 or programs loaded from storage portion 708 into Random Access Memory (RAM) 703. The RAM 703 also stores various programs and data required for system operation. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An Input / Output (I / O) interface 705 is also connected to the bus 704.

[0092] The following components are connected to I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 710 as needed so that computer programs read from it can be installed into storage section 708 as needed.

[0093] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs various functions defined in the system of this application.

[0094] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0095] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0096] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0097] Another aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned device vulnerability detection method. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not assembled into the electronic device.

[0098] Another aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the device vulnerability detection method provided in the various embodiments described above.

[0099] The above description is merely a preferred exemplary embodiment of this application and is not intended to limit the implementation of this application. Those skilled in the art can easily make corresponding modifications or alterations based on the main concept and spirit of this application. Therefore, the scope of protection of this application should be determined by the scope of protection claimed in the claims.

Claims

1. A method for detecting device vulnerabilities, characterized in that, include: Based on the feature information of the device under test, the fingerprint feature corresponding to the device under test is determined. The feature information includes the device message information of the device under test and the page information corresponding to the web page loaded in the device under test. Obtain device vulnerability information corresponding to the fingerprint feature from a device vulnerability database. The device vulnerability information includes multiple vulnerabilities, the risk level of each vulnerability, and the frequency of occurrence. Determine the vulnerability detection sequence of the device to be detected based on the risk level and frequency of occurrence of each vulnerability. Vulnerability detection is performed on the device to be detected based on the vulnerability detection sequence; The step of determining the fingerprint features corresponding to the device under test based on the feature information of the device under test includes: The feature vector of the device to be detected is obtained based on the feature information of the device to be detected, and the number of feature vectors of the device to be detected includes multiple vectors. The multiple feature vectors are deduplicated to obtain a feature vector dataset. The fingerprint feature set corresponding to the feature vector dataset is determined from the device fingerprint feature library based on a preset classification algorithm; The fingerprint features corresponding to the device to be detected are matched from the fingerprint feature set.

2. The method as described in claim 1, characterized in that, The step of obtaining the feature vector of the device under test based on the feature information of the device under test includes: Send a preset data packet to the device under test to obtain the response message information of the device under test in response to the preset data packet; Extract the corresponding feature vector from the response message information.

3. The method as described in claim 1, characterized in that, The step of obtaining the feature vector of the device under test based on the feature information of the device under test includes: Obtain the page information corresponding to the web page displayed when logging in to the device under test based on preset account information and password information; Extract the corresponding feature vector from the page information corresponding to the web page.

4. The method as described in claim 1, characterized in that, The step of performing vulnerability detection on the device under test based on the vulnerability detection sequence includes: Perform vulnerability detection on the device to be tested according to the vulnerability detection sequence; Determine whether any new vulnerabilities are discovered during the vulnerability detection process; If the determination is yes, then the correspondence between the new vulnerability and the fingerprint feature corresponding to the device to be detected is written into the device vulnerability database.

5. A device for detecting device vulnerabilities, characterized in that, include: The first determining module is used to determine the fingerprint features corresponding to the device under test based on the feature information of the device under test. The feature information includes the device message information of the device under test and the page information corresponding to the web page loaded in the device under test. The second determining module is used to obtain device vulnerability information corresponding to the fingerprint feature from a device vulnerability database. The device vulnerability information includes multiple vulnerabilities, the risk level of each vulnerability, and the frequency of occurrence. The module determines the vulnerability detection sequence of the device to be detected based on the risk level and frequency of occurrence of each vulnerability. The detection module is used to perform vulnerability detection on the device under test based on the vulnerability detection sequence; The acquisition unit is used to acquire the feature vector of the device to be detected based on the feature information of the device to be detected, wherein the number of feature vectors of the device to be detected includes multiple vectors. The matching unit is used to perform deduplication processing on multiple feature vectors to obtain a feature vector dataset; determine the fingerprint feature set corresponding to the feature vector dataset from the device fingerprint feature library based on a preset classification algorithm; and match the fingerprint feature corresponding to the device to be detected from the fingerprint feature set.

6. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to implement the device vulnerability detection method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, It stores computer-readable instructions, which, when executed by the computer's processor, cause the computer to perform the device vulnerability detection method according to any one of claims 1 to 4.

Images