Vulnerability detection methods, systems, cloud host systems, electronic devices and storage media

Abstract

This application provides a vulnerability detection method, system, cloud host system, electronic device, and storage medium. The vulnerability detection method includes: responding to a vulnerability detection operation, accessing the cloud host to be detected, the private network where the cloud host is located, and the public network connected to the private network through a cloud open interface; obtaining the host network information of the cloud host through the private network and the public network; obtaining the host asset fingerprint of the cloud host; and if the host network information is obtained, determining the vulnerability scan result corresponding to the cloud host based on the host asset fingerprint and the host network information.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a vulnerability detection method, system, cloud host system, electronic device and storage medium. Background Technology

[0002] With the rise of working from home, related cloud products have emerged, such as cloud servers. A cloud server is a host that runs in a Virtual Private Cloud (VPC). By defining a private network, cloud servers can be isolated from each other, ensuring user data security and privacy.

[0003] However, with the development of cloud servers and the continuous increase in their number, how to comprehensively and accurately perform vulnerability scanning on cloud servers has become a technical problem that needs to be solved by existing technologies. Summary of the Invention

[0004] In view of this, embodiments of this application provide a vulnerability detection scheme to at least partially solve the above-mentioned problems.

[0005] According to a first aspect of the embodiments of this application, a vulnerability detection method is provided, comprising: responding to a vulnerability detection operation, accessing a cloud host to be detected, a private network where the cloud host is located, and a public network connected to the private network through a cloud open interface; obtaining host network information of the cloud host through the private network and the public network; obtaining a host asset fingerprint of the cloud host; and if the host network information is obtained, determining a vulnerability scan result corresponding to the cloud host based on the host asset fingerprint and the host network information.

[0006] Optionally, in any embodiment of this application, the method further includes: determining the vulnerabilities existing in the cloud host based on the vulnerability scanning results; and prioritizing the vulnerabilities according to a preset priority order, wherein vulnerabilities existing in the public network have a higher priority than vulnerabilities existing in the private network, and vulnerabilities existing in the private network have a higher priority than vulnerabilities existing in the cloud host.

[0007] Optionally, in any embodiment of this application, the host network information includes: private network interface data corresponding to the private network and public network interface data corresponding to the public network; if the host network information is obtained, determining the vulnerability scanning result corresponding to the cloud host based on the host asset fingerprint and the host network information includes: associating the private network interface data, the public network interface data, and the host asset fingerprint based on the host network interface data in the host asset fingerprint to obtain global data; performing vulnerability scanning based on the global data to obtain the vulnerability scanning result of the cloud host.

[0008] Optionally, in any embodiment of this application, the step of associating the private network interface data, the public network interface data, and the host asset data based on the host network interface data in the host asset fingerprint to obtain global data includes: associating the host asset fingerprint, the private network interface data, and the public network interface data that occur at the same time and have the same associated network general interface to obtain the global data.

[0009] Optionally, in any embodiment of this application, the private network interface data includes: a private network interface identifier and the time when the private network interface is invoked; the public network interface data includes: a public network interface identifier and the time when the public network interface is invoked; the host network interface data includes: the invoked host network interface and the time when the host network interface is invoked. Associating the host asset fingerprint, the private network interface data, and the public network interface data that occur at the same time and on the same network port to obtain the global data includes: if the time when the private network interface is invoked, the time when the public network interface is invoked, and the time when the host network interface is invoked are within the same time period, and the private network interface identifier, the public network interface identifier, and the host network interface are associated with the same common network interface, then associating the data transmitted by the private network interface, the data transmitted by the public network interface, and the data sent or received through the host network interface to obtain the global data.

[0010] Optionally, in any embodiment of this application, the method further includes: displaying the vulnerability scan results in a preset graphical user interface, and displaying the host asset fingerprint, the private network interface data, the public network interface data and their corresponding occurrence times associated with the detected vulnerability.

[0011] Optionally, in any embodiment of this application, obtaining the host network information of the cloud host through the private network and the public network includes: performing network simulation attacks on the private network and the public network, and determining the cloud host network information of the cloud host with network vulnerabilities based on the network simulation attack results; if the host network information is obtained, determining the vulnerability scanning result corresponding to the cloud host based on the host asset fingerprint and the host network information includes: performing vulnerability scanning on the host asset fingerprint of the cloud host associated with the cloud host network information based at least on the vulnerability information corresponding to the network simulation attack, and obtaining the vulnerability scanning result of the cloud host.

[0012] According to a third aspect of the embodiments of this application, a cloud host system is provided, including: a cloud host, a private network where the cloud host is located, a public network connected to the private network, and a vulnerability detection system. The cloud host is deployed in the private network and communicates with the public network connected to the private network. The vulnerability detection system is used to respond to vulnerability detection operations by accessing the cloud host to be detected, the private network, and the public network through a cloud open interface; obtaining host network information of the cloud host through the private network and the public network; obtaining host asset fingerprint of the cloud host; and if the host network information is obtained, determining the vulnerability scanning result corresponding to the cloud host based on the host asset fingerprint and the host network information.

[0013] According to a fourth aspect of the embodiments of this application, a vulnerability detection system is provided, comprising: a host access module, configured to, in response to a vulnerability detection operation, access a cloud host to be detected through a cloud open interface; a network access module, configured to, in response to a vulnerability detection operation, access a private network where the cloud host is located and a public network connected to the private network through the cloud open interface; a network data acquisition module, configured to acquire host network information of the cloud host through the private network and the public network; a host fingerprint asset determination module, configured to acquire a host asset fingerprint of the cloud host; and a scanning module, configured to, if the host network information is acquired, determine the vulnerability scanning result corresponding to the cloud host based on the host asset fingerprint and the host network information.

[0014] According to a fifth aspect of the present application, an electronic device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, wherein the executable instruction causes the processor to perform an operation corresponding to the method described above.

[0015] According to a sixth aspect of the embodiments of this application, a computer storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the method described above.

[0016] According to the vulnerability detection scheme provided in this application embodiment, cloud hosts and their associated private and public networks can be accessed through cloud open interfaces, thereby automatically obtaining private network interface data, public network interface data, and host asset fingerprints. Vulnerability scanning can be performed through public networks, private networks, and host asset data, enabling comprehensive and accurate identification of vulnerabilities. Furthermore, by prioritizing vulnerabilities based on their network location (public network, private network, or cloud host), relevant personnel can accurately understand the vulnerability exposure level and perform vulnerability remediation according to priority, improving efficiency. In addition, the host fingerprint assets associated with the vulnerability, the private network interface data, the public network interface data, and their corresponding occurrence time can be comprehensively displayed, allowing staff to more intuitively determine the source of the vulnerability and facilitate vulnerability handling. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a schematic diagram of an exemplary system for which the vulnerability detection method of the present application is applicable;

[0019] Figure 2 This is a flowchart illustrating the steps of a vulnerability detection method according to Embodiment 1 of this application;

[0020] Figure 3 This is a flowchart illustrating the steps of a vulnerability detection method according to Embodiment 2 of this application;

[0021] Figure 4 This is a structural block diagram of a vulnerability detection device according to Embodiment 3 of this application;

[0022] Figure 5 This is a structural block diagram of a vulnerability detection device according to Embodiment 4 of this application;

[0023] Figure 6 This is a schematic diagram of the structure of an electronic device according to Embodiment 5 of this application. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art should fall within the protection scope of the embodiments of this application.

[0025] The specific implementation of the embodiments of this application will be further described below with reference to the accompanying drawings.

[0026] Figure 1 An exemplary system for a vulnerability detection method applicable to embodiments of this application is shown. For example... Figure 1 As shown, the system 100 may include a cloud server 102, a communication network 104, and / or one or more user devices 106. Figure 1 The example in the text shows multiple user devices.

[0027] The cloud server 102 can be any suitable device for storing information, data, programs, and / or any other suitable type of content, including but not limited to distributed storage system devices, server clusters, computing cloud server clusters, etc. In some embodiments, the cloud server 102 can perform any suitable function. For example, in some embodiments, the cloud server 102 can be used to implement cloud hosts and deploy systems for vulnerability scanning of cloud hosts. As an optional example, in some embodiments, the cloud server 102 can be used to deploy private networks or public networks, and deploy cloud hosts in private networks. As another example, in some embodiments, the cloud server 102 can be used to deploy security management areas for vulnerability scanning.

[0028] In some embodiments, the communication network 104 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 104 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The user equipment 106 can be connected to the communication network 104 via one or more communication links (e.g., communication link 112), and the communication network 104 can be linked to the cloud server 102 via one or more communication links (e.g., communication link 114). The communication link can be any communication link suitable for transmitting data between the user equipment 106 and the cloud server 102, such as a network link, a dial-up link, a wireless link, a hardwired link, any other suitable communication link, or any suitable combination of such links.

[0029] User device 106 may include any one or more user devices suitable for receiving and displaying vulnerability scan results or operating a cloud host. In some embodiments, user device 106 may include any suitable type of device. For example, in some embodiments, user device 106 may include mobile devices, tablet computers, laptop computers, desktop computers, wearable computers, game consoles, media players, vehicle entertainment systems, and / or any other suitable type of user device.

[0030] Based on the above system, this application provides a vulnerability detection method for cloud hosts, which will be described below through several embodiments.

[0031] See Figure 2 The figure shows a flowchart of a vulnerability detection method provided in this embodiment, which includes:

[0032] S201. In response to the vulnerability detection operation, the system accesses the cloud host being detected, the private network where the cloud host is located, and the public network connected to the private network through the cloud open interface.

[0033] Vulnerability detection operations can be triggered by relevant personnel, automatically by the system performing the vulnerability detection operation, or by users renting cloud servers; all of these are within the scope of protection of this application.

[0034] Vulnerability detection operations can be used to indicate the cloud host being detected, as well as to indicate the start and end times of vulnerability detection, the type of vulnerability to be detected, etc., all of which are within the scope of protection of this application.

[0035] In this embodiment, cloud hosts are generally deployed in cloud products, such as servers. Cloud products generally provide cloud open interfaces (OpenAPIs). Different cloud product interfaces have different uses. For example, different types of cloud hosts can be accessed through different cloud product interfaces. Cloud products may also include cloud open interfaces for accessing the network, etc. This embodiment does not limit this.

[0036] Since vulnerabilities are generally exploited through network data, once a vulnerability detection operation is triggered, it can respond by accessing the cloud host, the private network where the cloud host resides, and the public network connected to the private network through the corresponding cloud open interface, thereby performing a comprehensive vulnerability detection on the cloud host at the network level.

[0037] Optionally, in this embodiment, in response to the vulnerability detection operation, accessing the detected cloud host through the cloud open interface may specifically include: in response to the vulnerability detection operation, establishing a communication connection with the cloud host by calling the cloud host interface in the cloud open interface, and establishing an association relationship between the cloud host's identifier and the cloud host's identifier.

[0038] Specifically, it can establish automatic identification and association relationships with the IP address, domain name, and other identifiers of cloud hosts, thereby enabling the subsequent receipt of host asset fingerprints.

[0039] Optionally, in this embodiment, in response to the vulnerability detection operation, access to the private network where the detected cloud host resides is via the cloud open interface. Specifically, this may include: in response to the vulnerability detection operation, establishing a private connection communication with the private network by calling the private network open interface in the cloud open interface. This enables communication between the vulnerability detection system and the private network (VPC), providing a network connectivity foundation for subsequent network scanning. Specifically, the private network open interface may be the VPC OpenAPI.

[0040] S202. Obtain the host network information of the cloud host through the private network and the public network;

[0041] In this embodiment, host network information is used to determine vulnerabilities that exist on the cloud host at both the public and private network layers. Host network information can be obtained in various ways, and the host network information obtained through different methods may differ.

[0042] Specifically, in this embodiment, host network data can be obtained by scanning the network interfaces of public and private networks. The host network data includes private network interface data corresponding to the private network and public network interface data corresponding to the public network.

[0043] In this embodiment, partial scans can be performed on the private network and the public network respectively to obtain private network interface data associated with private network vulnerabilities and public network interface data associated with public network vulnerabilities; alternatively, a full scan can be performed on the private network and the public network to obtain private network interface data and public network interface data.

[0044] Private network interface data may specifically include: private network interface identifier, the time when the private network interface was invoked, and the data transmitted by the private network interface.

[0045] Public network interface data may specifically include: public network interface identifier, the time when the public network interface was invoked, and the data transmitted by the public network interface.

[0046] Specifically, in this embodiment, network simulation attacks can be performed on the private network and the public network. Based on the results of the network simulation attacks, the network information of the cloud hosts with network vulnerabilities can be determined. The cloud host network information may include the identification information of the cloud host with network vulnerabilities, and may also include the configuration information of the cloud host, etc. This embodiment does not limit this.

[0047] If no network information of the cloud host is obtained after performing network simulation attacks on the private network and the public network, it means that the cloud host does not have the network vulnerability corresponding to the network simulation attack. In the subsequent step S203, the host asset fingerprint can be scanned to determine whether the cloud host has other network vulnerabilities besides the network vulnerability corresponding to the network simulation attack.

[0048] S203. Obtain the host asset fingerprint of the cloud host.

[0049] In this embodiment, a client can be installed on the cloud host. The client can periodically scan the cloud host and report the host asset fingerprint. The host asset fingerprint can specifically include the cloud host's account and host network interface data. The host network interface data can specifically include: the invoked host network interface, the time of the host network interface invocation, the data sent or received through the host network interface, and data storage and retrieval information in the cloud host. The data storage and retrieval information in the cloud host can specifically include the data storage location and the process of sending or receiving data by invoking the host network interface.

[0050] S204. If the host network information is obtained, the vulnerability scan result corresponding to the cloud host is determined based on the host asset fingerprint and the host network information.

[0051] The solution provided in this embodiment can combine private and public networks to obtain host network information, and then combine the host network information with the host asset fingerprint of the cloud host to determine the vulnerability scanning results corresponding to the cloud host, which can comprehensively and accurately identify vulnerabilities.

[0052] In one implementation, if the host network data includes private network interface data corresponding to a private network and public network interface data corresponding to a public network, then step S204 may include: associating the private network interface data, the public network interface data, and the host asset fingerprint based on the host network interface data in the host asset fingerprint to obtain global data; and performing vulnerability scanning based on the global data to obtain the vulnerability scanning results of the cloud host.

[0053] Based on the network interfaces existing in the host asset fingerprint, private network interface data, and public network interface data, these three can be correlated to obtain global data. Global data can include global data corresponding to the process of network data being sent from the cloud host to the private network and then transmitted outwards via the public network, or global data corresponding to the process of network data being transmitted from the public network to the private network and then to the cloud host for storage. Obtaining global data ensures the integrity of the data used for vulnerability detection, thereby reducing the possibility of missing vulnerabilities during subsequent vulnerability detection.

[0054] Optionally, in this embodiment, the step of associating the private network interface data, the public network interface data, and the host asset fingerprint based on the host network interface data in the host asset fingerprint to obtain global data includes: associating the host asset fingerprint, the private network interface data, and the public network interface data that occur at the same time and have the same associated general network interface to obtain the global data.

[0055] Optionally, in this embodiment, the private network interface data includes: a private network interface identifier and the time when the private network interface is invoked; the public network interface data includes: a public network interface identifier and the time when the public network interface is invoked; the host network interface data includes: the invoked host network interface and the time when the host network interface is invoked. Associating the host asset fingerprint, the private network interface data, and the public network interface data that occur at the same time and on the same network port to obtain the global data includes: if the time when the private network interface is invoked, the time when the public network interface is invoked, and the time when the host network interface is invoked are within the same time period, and the private network interface identifier, the public network interface identifier, and the host network interface are associated with the same common network interface, then associating the data transmitted by the private network interface, the data transmitted by the public network interface, and the data sent or received through the host network interface to obtain the global data.

[0056] For example, data from private network interface data, public network interface data, and host asset fingerprints that occur within the same 5-minute period and are also associated with port 80 of the network general interface can be correlated to obtain global data corresponding to port 80 within that 5-minute period.

[0057] In addition, when making specific associations, we can further associate them according to the data transmission, processing, storage and other processes to obtain more detailed global data. The obtained global data can be used to characterize the process of data arriving at the cloud host through the public network interface and private network interface, as well as the process of data being stored in the cloud host and the process of using the data in the cloud host.

[0058] In another implementation, if a network simulation attack is performed on the private network and the public network, and the network information of the cloud host with network vulnerabilities is determined based on the network simulation attack results, then step S204 may include: at least based on the network vulnerability corresponding to the network simulation attack, performing vulnerability scanning on the host asset fingerprint of the cloud host associated with the cloud host network information to obtain the vulnerability scanning results of the cloud host.

[0059] Specifically, in this embodiment, vulnerability scanning can be performed based on a preset vulnerability scanning library to obtain vulnerability scanning results.

[0060] Vulnerability scan results may include: network data where vulnerabilities were detected, the network location where vulnerabilities were detected, the time when the data was transmitted through the network interface, and fingerprints of other host assets, private interface data, or public network interface data associated with the data.

[0061] Optionally, in this embodiment, the method further includes: determining the vulnerabilities existing on the cloud host based on the vulnerability scan results; and prioritizing the vulnerabilities according to a preset priority order, wherein vulnerabilities existing on the public network have a higher priority than vulnerabilities existing on the private network, and vulnerabilities existing on the private network have a higher priority than vulnerabilities existing on the cloud host. Prioritizing vulnerabilities based on their network location allows staff to fix them according to priority, improving efficiency.

[0062] Optionally, in this embodiment, the method further includes:

[0063] S205. Display the vulnerability scan results in the preset graphical user interface.

[0064] While displaying the vulnerability scan results, it can also display the host fingerprint assets associated with the detected vulnerabilities, the private network interface data, the public network interface data, and their corresponding occurrence times.

[0065] By showing vulnerability scan results to staff and users, staff can gain a more accurate and detailed understanding of vulnerability information, thereby improving the efficiency of vulnerability handling.

[0066] Figure 2 The dashed line in the text indicates that step S205 is an optional step.

[0067] The solution provided in this embodiment can access cloud hosts and their associated private and public networks through cloud open interfaces, thereby automatically obtaining private network interface data, public network interface data, and host asset fingerprints. Based on these data, vulnerabilities can be comprehensively and accurately identified. Furthermore, by prioritizing vulnerabilities based on their network location (public network, private network, or cloud host), relevant personnel can accurately understand the vulnerability exposure level and prioritize vulnerability remediation, improving efficiency. Additionally, the solution comprehensively displays the host fingerprint assets associated with the vulnerability, the private network interface data, the public network interface data, and their corresponding occurrence time, allowing staff to more intuitively determine the source of the vulnerability and facilitate vulnerability handling.

[0068] See Figure 3 The figure shows a scenario diagram of a vulnerability scanning method provided in this embodiment, which includes:

[0069] S301. In response to the vulnerability detection operation, the vulnerability detection system accesses the cloud host being detected through the cloud open interface, establishes a communication connection with the cloud host, and establishes an association relationship between the system and the identifier of the cloud host.

[0070] Specifically, by establishing a communication connection with the cloud host, the automatic identification and association of assets such as the cloud host's IP and domain name assets can be achieved. These assets can include: cloud host identifier, cloud host's private network (VPC), cloud host's corresponding load balancer instance (SLB), cloud host's elastic IP (EIP), cloud host's domain name system (DNS), etc.

[0071] S302. Scan the cloud server using the client and report the server asset fingerprint to the vulnerability detection system.

[0072] S303. The vulnerability detection system receives host asset fingerprint data, wherein the host asset fingerprint includes at least host network interface data.

[0073] The host network interface data may specifically include the host network interface and the data transmitted through the host network interface, and may also include the time information of the data transmission.

[0074] Host asset fingerprints can include information such as the user account logged in on the cloud host, the processes associated with the data on the cloud host, the host network interface used for data transmission, the software packages on the cloud host, and the OS version of the cloud host.

[0075] S304. The vulnerability detection system responds to vulnerability detection operations by accessing the private network where the cloud host is located and the public network connected to the private network through the cloud open interface.

[0076] In this embodiment, the VPC OpenAPI enables network connectivity between the vulnerability detection system and the private network where the cloud host resides, as well as the public network that the private network connects to. This allows the vulnerability detection system to obtain private network interface data corresponding to the private network, and public network interface data corresponding to the public network.

[0077] S305 The vulnerability detection system performs remote scanning of public and private networks to obtain private network interface data corresponding to the private network and public network interface data corresponding to the public network.

[0078] It should be noted that the above steps S301-S303 and steps S304-S305 can be executed in parallel or in sequence, both of which are within the scope of protection of this application.

[0079] S306. Based on the host network interface data in the host asset fingerprint, associate the private network interface data, public network interface data, and host asset fingerprint to obtain global data.

[0080] S307. Perform a vulnerability scan based on the global data to obtain the vulnerability scan results of the cloud host.

[0081] Specifically, in this embodiment, vulnerability scanning can be performed based on a preset vulnerability scanning library to obtain vulnerability scanning results. The vulnerability library can specifically be a common vulnerability database (CVE).

[0082] S308. Display the vulnerability scan results in a preset graphical user interface, as well as the host fingerprint assets associated with the detected vulnerability, the private network interface data, the public network interface data, and their corresponding occurrence times.

[0083] Specifically, the interface displays detected vulnerabilities in a table, with each row corresponding to a vulnerability. Vulnerability priorities are indicated by icons, and multiple columns of data display the associated host fingerprint assets, private network interface data, public network interface data, and their corresponding occurrence times. Specifically, it can display the time and interface name of the data transmitted via the public network interface, the time and interface name transmitted via the private network interface, the time and interface name transmitted via the host network interface, the data's storage location on the cloud host, and the processes using the data on the cloud host.

[0084] See Figure 4 The figure shows a schematic diagram of the structure of a vulnerability detection system provided in this embodiment. As shown, it includes:

[0085] The host access module 401 is used to respond to vulnerability detection operations and access the cloud host being detected through the cloud open interface;

[0086] The network access module 402 is used to respond to vulnerability detection operations by accessing the private network where the cloud host is located and the public network connected to the private network through the cloud open interface.

[0087] The network data acquisition module 403 is used to acquire the host network information of the cloud host through the private network and the public network;

[0088] The host fingerprint asset determination module 404 is used to obtain the host asset fingerprint of the cloud host;

[0089] The scanning module 405 is used to determine the vulnerability scan result corresponding to the cloud host based on the host asset fingerprint and the host network information if the host network information is obtained.

[0090] The specific implementation of each module in the system can be found in the corresponding steps and units described in the above method embodiments, and has corresponding beneficial effects, which will not be repeated here. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the devices and modules described above can be referred to the corresponding process descriptions in the foregoing method embodiments, and will not be repeated here.

[0091] See Figure 5 The figure shows a schematic diagram of the structure of a cloud host system provided in this embodiment. As shown, it includes: a cloud host 501, a private network 502 corresponding to the cloud host, a public network 503 connected to the private network, and a vulnerability detection system 504.

[0092] The cloud host 501 is deployed in the private network 502 and communicates with the outside world through the public network 503.

[0093] The vulnerability detection system 504 is used to respond to vulnerability detection operations by accessing the cloud host 501 being detected, the private network 502 where the cloud host 501 is located, and the public network 503 connected to the private network 502 through the cloud open interface; obtaining the host network information of the cloud host through the private network and the public network; obtaining the host asset fingerprint of the cloud host; and if the host network information is obtained, determining the vulnerability scan result corresponding to the cloud host based on the host asset fingerprint and the host network information.

[0094] See Figure 5 In this embodiment, the cloud host 501 may include multiple cloud hosts. The cloud host 501 may be deployed in a private network. Multiple cloud hosts may be deployed in the same or different private networks. This embodiment does not limit this.

[0095] See Figure 5 The bottom right corner shows the open interfaces that the vulnerability detection system can call if it returns a 504 error. Specifically, these may include the cloud host OpenAPI interface, through which the vulnerability detection system can access the cloud host.

[0096] Cloud server 501 is equipped with a client agent that works in conjunction with vulnerability detection system 504. After the vulnerability detection system connects to the cloud server, the client agent installed on the cloud server can collect data from the cloud server and report the host asset fingerprint to the vulnerability detection system. The vulnerability detection system can store host fingerprints and identify the corresponding host asset fingerprint for each cloud server based on the stored host fingerprints through the cloud product asset identification module.

[0097] Similarly, vulnerability detection systems can access private networks via the VPC OpenAPI. Connections between private and public networks can be established using several methods: public network IP, Elastic IP (EIP), gateway, or Server Load Balancer (SLB). When connecting via a public network IP or EIP, access to the public network can be achieved through IP association; when connecting via a gateway or SLB, data forwarding between the private and public networks can be performed through the gateway.

[0098] Similarly, if a connection is established via a public network IP address, it can directly access the public network; if the connection is established via an Elastic IP (EIP), it can access the public network via the EIP OpenAPI; if the connection is established via a load balancer instance, it can access the load balancer instance via the SLB OpenAPI and then access the public network accessed by the load balancer instance. Figure 5 As shown, the load balancing instance (SLB) can be a public SLB set up in a public network or a private SLB set up in a private network; this application does not limit this. Specifically, the cloud host may include a VPC network connectivity module, used to connect to the determined private network after determining the private network corresponding to the cloud host, and then continue to connect to the public network corresponding to the private network.

[0099] After the vulnerability detection system connects to the private network, it can use the scanning module to obtain the private network interface data corresponding to the private network where the cloud host is located, as well as the public network interface data corresponding to the public network. Furthermore, the cloud product asset identification module can merge the private network interface data, public network interface data, and host asset fingerprints to obtain global data.

[0100] The vulnerability detection system can include a vulnerability exposure level assessment module. Based on the CVE vulnerability database and global data, it can scan for vulnerabilities, identify existing vulnerabilities, and prioritize them according to their network location. Specifically, vulnerabilities existing on public networks are marked as high priority; vulnerabilities existing on private networks are marked as medium priority; and vulnerabilities existing on cloud servers are marked as low priority.

[0101] The solution provided in this embodiment can access cloud hosts and their associated private and public networks through cloud open interfaces, and can automatically scan, improving vulnerability detection efficiency. Furthermore, it can combine network data and host asset fingerprints to achieve vulnerability scanning, enabling comprehensive and accurate vulnerability identification. Moreover, by prioritizing the detected locations, relevant personnel can accurately understand the vulnerability exposure level and remediate vulnerabilities according to priority, improving efficiency. Additionally, it can comprehensively display the host fingerprint assets associated with the vulnerability, the private network interface data, the public network interface data, and their corresponding occurrence times, allowing staff to more intuitively determine the source of the vulnerability and facilitate vulnerability handling.

[0102] Reference Figure 6 This document illustrates a schematic diagram of an electronic device according to an embodiment of this application. The specific embodiments of this application do not limit the specific implementation of the electronic device.

[0103] like Figure 6 As shown, the electronic device may include: a processor 602, a communications interface 604, a memory 606, and a communications bus 608.

[0104] in:

[0105] The processor 602, communication interface 604, and memory 606 communicate with each other via communication bus 608.

[0106] Communication interface 604 is used for communication with other electronic devices or servers.

[0107] The processor 602 is used to execute program 610, which can specifically execute the relevant steps in the above-described vulnerability detection method embodiment.

[0108] Specifically, program 610 may include program code that includes computer operation instructions.

[0109] The processor 602 may be a CPU, an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application. The smart device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0110] Memory 606 is used to store program 610. Memory 606 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0111] Program 610 may include multiple computer instructions. Specifically, program 610 may use multiple computer instructions to cause processor 602 to execute the operation corresponding to the vulnerability detection method described in any of the foregoing multiple method embodiments.

[0112] The specific implementation of each step in program 610 can be found in the corresponding steps and units described in the above method embodiments, and has corresponding beneficial effects, which will not be repeated here. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the devices and modules described above can be referred to the corresponding process descriptions in the foregoing method embodiments, and will not be repeated here.

[0113] This application also provides a computer storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in any of the foregoing method embodiments. The computer storage medium includes, but is not limited to, compact disc read-only memory (CD-ROM), random access memory (RAM), floppy disk, hard disk, or magneto-optical disk.

[0114] This application also provides a computer program product, including computer instructions that instruct a computing device to perform an operation corresponding to any of the vulnerability detection methods in the above-described multiple method embodiments.

[0115] Furthermore, it should be noted that the user-related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to sample data used for training the model, data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0116] It should be noted that, depending on the implementation needs, the various components / steps described in the embodiments of this application can be broken down into more components / steps, or two or more components / steps or parts of the operation of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of this application.

[0117] The methods described in the embodiments of this application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code downloaded over a network that is originally stored in a remote recording medium or a non-transitory machine-readable medium and will be stored in a local recording medium. Thus, the methods described herein can be stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an Application Specific Integrated Circuit (ASIC) or a Field Programmable Gate Array (FPGA)). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., Random Access Memory (RAM), Read-Only Memory (ROM), Flash Memory, etc.) capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods described herein. Furthermore, when a general-purpose computer accesses code used to implement the methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for executing the methods shown herein.

[0118] Those skilled in the art will recognize that the units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this application.

[0119] The above embodiments are only used to illustrate the embodiments of this application, and are not intended to limit the embodiments of this application. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of this application. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of this application, and the patent protection scope of the embodiments of this application should be defined by the claims.

Claims

1. A vulnerability detection method, comprising: In response to vulnerability detection operations, the system accesses the cloud host being detected, the private network where the cloud host resides, and the public network connected to the private network through the cloud open interface. The host network information of the cloud host is obtained through the private network and the public network; Obtain the host asset fingerprint of the cloud host; If the host network information is obtained, the vulnerability scan result corresponding to the cloud host is determined based on the host asset fingerprint and the host network information. The host network information includes: private network interface data corresponding to the private network and public network interface data corresponding to the public network; If the host network information is obtained, the vulnerability scan result corresponding to the cloud host is determined based on the host asset fingerprint and the host network information, including: Based on the host network interface data in the host asset fingerprint, the private network interface data, the public network interface data, and the host asset fingerprint are associated to obtain global data; Vulnerability scanning is performed based on the global data to obtain the vulnerability scanning results of the cloud host.

2. The method according to claim 1, wherein, The method further includes: Based on the vulnerability scan results, the vulnerabilities present in the cloud host were determined; The vulnerabilities are prioritized according to a preset priority order, wherein vulnerabilities existing in the public network have a higher priority than vulnerabilities existing in the private network, and vulnerabilities existing in the private network have a higher priority than vulnerabilities existing in the cloud host.

3. The method according to claim 1, wherein, The step of associating the private network interface data, the public network interface data, and the host asset fingerprint based on the host network interface data in the host asset fingerprint to obtain global data includes: The global data is obtained by associating the host asset fingerprint, the private network interface data, and the public network interface data that occur at the same time and share the same common network interface.

4. The method according to claim 3, wherein, The private network interface data includes: a private network interface identifier and the time when the private network interface was invoked; the public network interface data includes: a public network interface identifier and the time when the public network interface was invoked; the host network interface data includes: the invoked host network interface and the time when the host network interface was invoked. The global data is obtained by associating the host asset fingerprint, the private network interface data, and the public network interface data that occur at the same time and on the same network port. This global data includes: If the times when the private network interface is invoked, the times when the public network interface is invoked, and the times when the host network interface is invoked are all within the same time period, and the private network interface identifier, the public network interface identifier, and the host network interface are associated with the same general network interface, then the data transmitted by the private network interface, the data transmitted by the public network interface, and the data sent or received through the host network interface are associated to obtain global data.

5. The method according to claim 3, wherein, The method further includes: The vulnerability scan results are displayed in a preset graphical user interface, along with the host asset fingerprint, private network interface data, public network interface data, and their corresponding occurrence times associated with the detected vulnerabilities.

6. The method according to claim 1, wherein, The step of obtaining the host network information of the cloud host through the private network and the public network includes: Perform network simulation attacks on the private network and the public network, and determine the cloud host network information of the cloud host with network vulnerabilities based on the network simulation attack results; If the host network information is obtained, the vulnerability scan result corresponding to the cloud host is determined based on the host asset fingerprint and the host network information, including: Based at least on the network vulnerabilities corresponding to the network simulated attack, vulnerability scanning is performed on the host asset fingerprint of the cloud host associated with the network information of the cloud host to obtain the vulnerability scanning results of the cloud host.

7. A cloud server system, comprising: The cloud server, the private network on which the cloud server resides, the public network to which the private network connects, and the vulnerability detection system. The cloud host is deployed in the private network and communicates with the public network connected to the private network. The vulnerability detection system is used to respond to vulnerability detection operations by accessing the cloud host being detected, the private network, and the public network through the cloud open interface; The host network information of the cloud host is obtained through the private network and the public network; the host asset fingerprint of the cloud host is obtained. If the host network information is obtained, the vulnerability scan result corresponding to the cloud host is determined based on the host asset fingerprint and the host network information. The host network information includes: private network interface data corresponding to the private network and public network interface data corresponding to the public network; If the host network information is obtained, the vulnerability scan result corresponding to the cloud host is determined based on the host asset fingerprint and the host network information, including: Based on the host network interface data in the host asset fingerprint, the private network interface data, the public network interface data, and the host asset fingerprint are associated to obtain global data; Vulnerability scanning is performed based on the global data to obtain the vulnerability scanning results of the cloud host.

8. A vulnerability detection system, comprising: The host access module is used to respond to vulnerability detection operations by connecting to the cloud host being detected through the cloud open interface; The network access module is used to respond to vulnerability detection operations by accessing the private network where the cloud host is located and the public network connected to the private network through the cloud open interface. The network data acquisition module is used to acquire the host network information of the cloud host through the private network and the public network; The host fingerprint asset determination module is used to obtain the host asset fingerprint of the cloud host; The scanning module is used to determine the vulnerability scanning result corresponding to the cloud host based on the host asset fingerprint and the host network information if the host network information is obtained. The host network information includes: private network interface data corresponding to the private network and public network interface data corresponding to the public network; If the host network information is obtained, the vulnerability scan result corresponding to the cloud host is determined based on the host asset fingerprint and the host network information, including: Based on the host network interface data in the host asset fingerprint, the private network interface data, the public network interface data, and the host asset fingerprint are associated to obtain global data; Vulnerability scanning is performed based on the global data to obtain the vulnerability scanning results of the cloud host.

9. An electronic device, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the operation corresponding to the method as described in any one of claims 1-6.

10. A computer storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in any one of claims 1-6.

Images