A host vulnerability scanning method, apparatus, device, and storage medium

Abstract

This application discloses a host vulnerability scanning method, apparatus, device, and storage medium, relating to the field of vulnerability scanning technology. The method includes: acquiring network vulnerability scanning requests transmitted from a test server, unpacking the resulting request data fragments, integrating these fragments to obtain an integrated scanning request; encapsulating the integrated scanning request to obtain an encapsulated scanning request; and pushing the encapsulated scanning request up to the kernel network stack of the test server through a network protocol layer, so that the test server actively reads and responds to the encapsulated scanning request from the kernel network stack to complete the corresponding network vulnerability scanning service. Therefore, this invention, by acquiring network vulnerability scanning requests transmitted from a test server using a host vulnerability scanning device, integrating and encapsulating the network vulnerability scanning requests, and pushing them up to the kernel network stack, can reduce the host performance consumption of the test server.

Description

Technical Field

[0001] This invention relates to the field of vulnerability scanning technology, and in particular to a host vulnerability scanning method, apparatus, device, and storage medium. Background Technology

[0002] Vulnerability scanning involves scanners directly detecting and analyzing security vulnerabilities in a target network or host to discover security risks and potential exploitable vulnerabilities. Current vulnerability scanning systems can be categorized into host vulnerability scanning and network vulnerability scanning based on the scanning target. Host vulnerability scanning typically employs a more passive, non-destructive method to detect vulnerabilities. While host vulnerability scanning currently has low network overhead and can scan a large number of vulnerabilities, the proxy program running on the server under test still consumes server performance, and this performance overhead increases proportionally with the speed of the testing service. Network vulnerability scanning, on the other hand, consumes significant network bandwidth and network stack resources on the server under test, which can impact normal business operations. Both mainstream vulnerability testing methods experience severe impacts on the normal business operations of the system under test when the testing load is high. Therefore, it is necessary to solve the problem of efficiently and accurately scanning for host vulnerabilities while ensuring normal business access for the user server being scanned. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a host vulnerability scanning method, apparatus, device, and storage medium that can reduce the host performance consumption of the server under test. The specific solution is as follows:

[0004] In a first aspect, this application discloses a host vulnerability scanning method, applied to a host vulnerability scanning device, comprising:

[0005] Obtain the request data fragments obtained by unpacking the network vulnerability scanning request transmitted by the test server to the server to be tested.

[0006] The requested data fragments are integrated to obtain an integrated scan request;

[0007] The integrated scan request is encapsulated to obtain an encapsulated scan request;

[0008] The encapsulated scan request is pushed up to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from the kernel network stack and respond to the encapsulated scan request to complete the corresponding network vulnerability scanning business.

[0009] Optionally, the host vulnerability scanning device is connected to the server under test via a preset physical connection method; the preset physical connection method includes USB port connection and network port connection.

[0010] Optionally, the host vulnerability scanning device is connected to the upstream router of the server under test via a wired / wireless means, so as to obtain the request data fragments obtained by unpacking the network vulnerability scanning request transmitted by the test server to the server under test from the upstream router of the server under test.

[0011] Optionally, the step of integrating the various request data fragments to obtain the integrated scan request includes:

[0012] The request data fragments are cached, and the cached request data fragments are reassembled according to preset protocol packet assembly rules to obtain an integrated scan request.

[0013] Optionally, the step of reassembling the cached request data fragments into integrated scan requests based on preset protocol packet assembly rules includes:

[0014] The data segments in the cached request data fragment are parsed and matched and compared according to preset message rules;

[0015] The request data fragments are packaged based on the matching results to obtain an integrated scan request.

[0016] Optionally, the step of forwarding the encapsulated scan request to the kernel network stack of the server under test through the network protocol layer includes:

[0017] The encapsulated scan request is directly copied to the local socket buffer via memory mapping;

[0018] A network interrupt is triggered by a virtual network card to push the encapsulated scan request stored in the socket buffer to the kernel network stack of the server under test.

[0019] Secondly, this application discloses a host vulnerability scanning device, applied to a host vulnerability scanning equipment, comprising:

[0020] The information acquisition module is used to acquire the request data fragments obtained after unpacking the network vulnerability scanning request transmitted by the test server to the server to be tested.

[0021] The information integration module is used to integrate the various request data fragments to obtain an integrated scan request;

[0022] The information encapsulation module is used to encapsulate the integrated scan request to obtain an encapsulated scan request;

[0023] The information upload module is used to push the encapsulated scan request to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from the kernel network stack and respond to the encapsulated scan request to complete the corresponding network vulnerability scanning business.

[0024] Optionally, the information integration module includes:

[0025] A data caching unit is used to cache the requested data fragments;

[0026] The data matching unit is used to parse the data segments in the cached request data fragments and match and compare the data segments according to preset message rules;

[0027] The data packet assembly unit is used to assemble the requested data fragments based on the matching results to obtain an integrated scan request.

[0028] Thirdly, this application discloses an electronic device, including:

[0029] Memory, used to store computer programs;

[0030] A processor for executing the computer program to implement the aforementioned host vulnerability scanning method.

[0031] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned host vulnerability scanning method.

[0032] As can be seen, in this application, the network vulnerability scanning request transmitted by the test server is first obtained by unpacking the request data segments into individual request data segments; these request data segments are then integrated to obtain an integrated scanning request; the integrated scanning request is then encapsulated to obtain an encapsulated scanning request; and the encapsulated scanning request is then pushed up to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from and respond to the encapsulated scanning request from the kernel network stack to complete the corresponding network vulnerability scanning service. That is, a host vulnerability scanning device is used to obtain the network vulnerability scanning request for the server under test; then, the request data segments are integrated and encapsulated in the host vulnerability scanning device; finally, the encapsulated scanning request is pushed up to the kernel network stack of the server under test through the network protocol layer. In this way, by maximizing the preprocessing of the network vulnerability scanning request, the host performance consumption of the server under test can be reduced. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0034] Figure 1 This application discloses a schematic diagram of a network vulnerability scanning principle.

[0035] Figure 2 This application discloses a network topology diagram for network vulnerability scanning.

[0036] Figure 3 This is a flowchart of a host vulnerability scanning method disclosed in this application;

[0037] Figure 4 This application discloses a network topology diagram for network vulnerability scanning.

[0038] Figure 5 This application discloses a network vulnerability scanning data packet flow diagram;

[0039] Figure 6 This application discloses a network vulnerability scanning data packet flow diagram;

[0040] Figure 7 This is a schematic diagram of the structure of a host vulnerability scanning device disclosed in this application;

[0041] Figure 8 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0042] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0043] Vulnerability scanning involves scanners directly detecting and analyzing security vulnerabilities in a target network or host to uncover security risks and potential exploitability by attackers. Current vulnerability scanning systems can be categorized into host vulnerability scanning and network vulnerability scanning based on their scanning targets. Host vulnerability scanning typically employs a more passive, non-destructive method to detect system vulnerabilities. This method primarily involves installing an agent or service on the target system to examine the correctness and integrity of key configuration files and the permissions of other important files and programs, analyzing the system's internal security status to detect risks and vulnerabilities on the computer. Typical host vulnerability scanning uses a server / agent approach. Figure 1 As shown, the server issues various scanning commands to the agents in each scanning node. The agents scan the local system and send the scan results back to the server. The main advantages of host-based vulnerability scanning are: a large number of vulnerabilities scanned, centralized management, and relatively low network traffic load requirements. However, this method of installing agent services for host scanning can still consume a lot of system resources on servers with high load or low performance, causing the tested system to be unable to provide services normally. Figure 2 As shown, network vulnerability scanning is currently a commonly used method, accepted by most customers due to its convenience (no software installation required) and security (the testing process is the same as normal access). However, because network vulnerability scanning uses the same scanning method and path as normal access, high-frequency scanning tests often encounter situations where excessive bandwidth consumption affects the normal business access of the tested user. This creates an awkward situation where, although the process involves vulnerability scanning, the results are equivalent to the effects of a hacker attack. To overcome the impact of vulnerability scanning on the server under test, the industry commonly uses empirical values ​​to reduce the scanning concurrency and the number of concurrent connections. However, this approach has the drawback of significantly reducing the overall scanning speed, which may become unacceptably long for servers with poor performance. This application will introduce a host vulnerability scanning method that can reduce the host performance consumption of the server under test.

[0044] See Figure 3 As shown in the figure, this application discloses a host vulnerability scanning method, applied to a host vulnerability scanning device, including:

[0045] Step S11: Obtain the request data fragments obtained by unpacking the network vulnerability scanning request for the server to be tested transmitted by the test server.

[0046] In this embodiment, during the process of the test server sending a network vulnerability scanning request to the server under test, the TCP / IP protocol (Transmission Control Protocol / Internet Protocol) may experience packet fragmentation due to the small MTU (Maximum Transmission Unit) of intermediate routes. It should be noted that TCP packets are fragmented at the transport layer due to the MSS (Maximum Segment Size), which is indirectly determined by the minimum MTU of the entire communication link, minus the TCP packet header. UDP packets (User Datagram Protocol) are fragmented at the network layer due to the MTU. Therefore, although only one request is sent at a time from the probe service generated by the test host, the link layer of the server under test may receive multiple packets. Thus, the host vulnerability scanning device in this invention obtains the request data fragments obtained after the network vulnerability scanning request is disassembled. Figure 4 As shown, in one specific embodiment, the host vulnerability scanning device connects to the server under test via a preset physical connection method; the preset physical connection method includes a USB port connection and a network port connection. For the USB port connection, by installing a driver, a virtual network card is added to the server under test. The virtual network card is generally similar in form to currently available USB network cards, but differs from a USB network card in two aspects: the host vulnerability scanning device caches and assembles data passing through the device before sending it to the server under test; the host vulnerability scanning device has a fixed IP address, and the test server actually sends data directly to this device, which then performs the probing. For the network port connection, the device-side logic is largely the same as the USB-side logic, the difference being that the physical connection method changes from a USB port to a network cable connection. The driver writing method also changes from writing a USB device driver to writing a network card driver. In another specific embodiment, the host vulnerability scanning device is connected to the upstream router of the server under test via a wired / wireless connection, so as to obtain the request data fragments obtained by unpacking the network vulnerability scanning request transmitted by the test server for the server under test from the upstream router of the server under test. In this way, the request data fragments can be directly obtained, thereby reducing the memory consumption of the server under test.

[0047] Step S12: Integrate the requested data fragments to obtain the integrated scan request.

[0048] In this embodiment, the step of integrating the various request data segments to obtain an integrated scan request includes: caching the request data segments and performing packet assembly processing on the cached request data segments based on preset protocol packet assembly rules to obtain an integrated scan request. Specifically, performing packet assembly processing on the cached request data segments based on preset protocol packet assembly rules to obtain an integrated scan request includes: parsing the data segments in the cached request data segments and matching and comparing the data segments according to preset message rules; and performing packet assembly processing on the request data segments based on the matching results to obtain an integrated scan request. It should be noted that the preset protocol packet assembly rules do not assemble packets according to the largest possible single packet. Instead, they parse the data segments in the request data segments, then match and compare them according to preset test message rules, and then assemble the data packets as individual test messages to obtain the integrated scan request. For example, some test messages use the HTTP (Hypertext Transfer Protocol) protocol. These packets contain HTTP headers and bodies, and are assembled according to the length of the data fields in the header. Similarly, UDP and other packet-based protocols are also assembled from individual packets. It should be noted that this device, like high-performance network cards, possesses RFS (Receive Flow Steering) and RPS (Receive Packet Steering) functions.

[0049] Step S13: Encapsulate the integrated scan request to obtain an encapsulated scan request.

[0050] In this embodiment, the integrated scan request is encapsulated to obtain an encapsulated scan request. That is, the fragmented packets caused by the small MTU of the intermediate routing in the TCP / IP protocol are first reassembled, and the reassembled packets are re-encapsulated according to the TCP / IP protocol.

[0051] Step S14: The encapsulated scan request is pushed up to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from the kernel network stack and respond to the encapsulated scan request to complete the corresponding network vulnerability scanning service.

[0052] In this embodiment, the encapsulated scan request is directly copied to the local socket buffer via memory mapping; a network interrupt is triggered by the virtual network card to push the encapsulated scan request stored in the socket buffer to the kernel network stack of the server under test; that is, it is subsequently bypassed by DMA (Direct Memory Access) and directly transferred into the socket buffer via memory mapping, and the kernel network interrupt handling module is triggered by the virtual network card driver.

[0053] Under normal circumstances, the packet flow graph of a network scan is as follows: Figure 5 As shown, it should be noted that TCP packets are fragmented at the transport layer due to the MSS (Maximum Segment Size). The MSS is indirectly determined by the minimum MTU (Maximum Transmission Unit) of the entire communication link, minus the TCP packet header. UDP packets are fragmented at the network layer due to the MTU. Therefore, although a single probe from the test host sends only one request, the link layer of the server under test may receive multiple packets. Under heavy load on the server's business logic, these packets may require inter-CPU data transfer to complete the packet reassembly before returning to the transport / network layer due to interrupt handling by different CPUs. This overhead significantly consumes the CPU performance and network bandwidth of the server under test. The optimization effect of this application is similar to the underlying idea of ​​existing jumbo frame acceleration technology, both aiming to increase system throughput and optimize system performance while maintaining hardware resource capabilities by minimizing the number of IP packet fragments. Unlike jumbo frame technology, which requires all nodes in the network topology to support a large MTU, this application does not require MTU values ​​for nodes along the route. Since the fundamental purpose of this application is not to accelerate network data packet transmission, real-time and efficient responses from the sender and receiver are not necessary. The test server only needs to return values ​​indicating the existence of all network vulnerability test cases; if they exist, the relevant information should be recorded for later retrieval. Given this characteristic, such as... Figure 6As shown, the data link in this application actually completes a process of receiving network vulnerability data from the cloud, and caching and assembling the test data (due to network topology) multiple times via TCP / IP packetization in kernel mode. After packetization, the kernel is directly notified to unpack the data and trigger the business application response. The host vulnerability scanning device, in actual use, is located between the test host and the server under test. By buffering and integrating the network vulnerability scanning information sent by the test host, it then bypasses DMA and directly transmits the data into the Socket Buffer via memory mapping, triggering the kernel network interrupt handling module through the virtual network card driver. It is particularly noteworthy that, because the driver implements this through memory mapping, the data resides in kernel space during the packet assembly process, eliminating the need for additional user-mode to kernel-mode data copying or additional user-mode to kernel-mode switching for subsequent kernel processing. The server under test directly reads the data already packetized according to the network vulnerability scanning rules from the kernel. The entire data retrieval process from the link layer to the socket layer involves only pointer offsetting by the kernel, without data copying, thus significantly reducing overhead. Therefore, the overhead of network vulnerability scanning is only generated by the business logic triggered by subsequent data packets of vulnerability scanning, and this performance overhead is an inherent overhead that cannot be avoided regardless of the vulnerability scanning method.

[0054] As can be seen, in this embodiment, the network vulnerability scanning request transmitted by the test server is first obtained by unpacking the request data segments into individual request data segments; these request data segments are then integrated to obtain an integrated scan request; the integrated scan request is then encapsulated to obtain an encapsulated scan request; and the encapsulated scan request is then pushed up to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from and respond to the encapsulated scan request from the kernel network stack to complete the corresponding network vulnerability scanning business. That is, a host vulnerability scanning device is used to obtain the network vulnerability scanning request for the server under test; then, the request data segments are integrated and encapsulated in the host vulnerability scanning device; finally, the encapsulated scan request is pushed up to the kernel network stack of the server under test through the network protocol layer. In this way, by maximizing the preprocessing of the network vulnerability scanning request, the host performance consumption of the server under test can be reduced, enabling high-speed scanning and reusing real-time updated database resources in the cloud without disrupting the business logic of the system under test.

[0055] refer to Figure 7 The present application also discloses a host vulnerability scanning device, applied to a host vulnerability scanning equipment, comprising:

[0056] Information acquisition module 11 is used to acquire the request data fragments obtained after unpacking the network vulnerability scanning request of the server to be tested transmitted by the test server.

[0057] Information integration module 12 is used to integrate the various request data fragments to obtain an integrated scan request;

[0058] Information encapsulation module 13 is used to encapsulate the integrated scan request to obtain an encapsulated scan request;

[0059] The information upload module 14 is used to push the encapsulated scan request to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from the kernel network stack and respond to the encapsulated scan request to complete the corresponding network vulnerability scanning business.

[0060] As can be seen, in this embodiment, the network vulnerability scanning request transmitted by the test server is first obtained by unpacking the request data segments into individual request data segments; these request data segments are then integrated to obtain an integrated scanning request; the integrated scanning request is then encapsulated to obtain an encapsulated scanning request; and the encapsulated scanning request is then pushed up to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from and respond to the encapsulated scanning request from the kernel network stack to complete the corresponding network vulnerability scanning service. That is, a host vulnerability scanning device is used to obtain the network vulnerability scanning request for the server under test, and then the request data segments are integrated and encapsulated in the host vulnerability scanning device. Finally, the encapsulated scanning request is pushed up to the kernel network stack of the server under test through the network protocol layer. In this way, by maximizing the preprocessing of the network vulnerability scanning request, the host performance consumption of the server under test can be reduced.

[0061] In some specific embodiments, the information integration module 12 may specifically include:

[0062] A data caching unit is used to cache the requested data fragments;

[0063] The data matching unit is used to parse the data segments in the cached request data fragments and match and compare the data segments according to preset message rules;

[0064] The data packet assembly unit is used to assemble the requested data fragments based on the matching results to obtain an integrated scan request.

[0065] In some specific embodiments, the information uploading module 14 may specifically include:

[0066] The request copy unit is used to directly copy the encapsulated scan request to the local socket buffer via memory mapping.

[0067] The request upthrow unit is used to trigger a network interrupt through the virtual network card to throw the encapsulated scan request stored in the socket buffer to the kernel network stack of the server under test.

[0068] Furthermore, embodiments of this application also disclose an electronic device, Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0069] Figure 8 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the host vulnerability scanning method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0070] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0071] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0072] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the host vulnerability scanning method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0073] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed host vulnerability scanning method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0074] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0075] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0076] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0077] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0078] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A host vulnerability scanning method, characterized in that, Applications in host vulnerability scanning devices include: Obtain the request data fragments obtained by unpacking the network vulnerability scanning request transmitted by the test server to the server to be tested. The request data segments are integrated to obtain an integrated scan request; wherein, the integration of the request data segments to obtain an integrated scan request includes: caching the request data segments, and performing packet assembly processing on the cached request data segments based on a preset protocol packet assembly rule to obtain an integrated scan request. The step of assembling the cached request data fragments into integrated scan requests based on preset protocol packet assembly rules includes: parsing data segments in the cached request data fragments and matching and comparing the data segments according to preset message rules; and assembling the request data fragments into integrated scan requests based on the matching results. The test data caused by the network topology will be repeatedly TCP / IP packetized and cached in kernel mode, without depending on the MTU value of the network nodes along the way; The integrated scan request is encapsulated to obtain an encapsulated scan request; The encapsulated scan request is pushed up to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from the kernel network stack and respond to the encapsulated scan request to complete the corresponding network vulnerability scanning business.

2. The host vulnerability scanning method according to claim 1, characterized in that, The host vulnerability scanning device is connected to the server under test via a preset physical connection method; the preset physical connection method includes USB port connection and network port connection.

3. The host vulnerability scanning method according to claim 1, characterized in that, The host vulnerability scanning device is connected to the upstream router of the server under test via wired / wireless means, so as to obtain the request data fragments obtained by unpacking the network vulnerability scanning request transmitted by the test server to the server under test from the upstream router of the server under test.

4. The host vulnerability scanning method according to any one of claims 1 to 3, characterized in that, The step of forwarding the encapsulated scan request to the kernel network stack of the server under test through the network protocol layer includes: The encapsulated scan request is directly copied to the local socket buffer via memory mapping; A network interrupt is triggered by a virtual network card to push the encapsulated scan request stored in the socket buffer to the kernel network stack of the server under test.

5. A host vulnerability scanning device, characterized in that, Applications in host vulnerability scanning devices include: The information acquisition module is used to acquire the request data fragments obtained after unpacking the network vulnerability scanning request transmitted by the test server to the server to be tested. An information integration module is used to integrate the various request data fragments to obtain an integrated scan request; wherein, the integration of the various request data fragments to obtain an integrated scan request includes: caching the request data fragments, and performing packet assembly processing on the cached request data fragments based on a preset protocol packet assembly rule to obtain an integrated scan request; The step of assembling the cached request data fragments into integrated scan requests based on preset protocol packet assembly rules includes: parsing data segments in the cached request data fragments and matching and comparing the data segments according to preset message rules; and assembling the request data fragments into integrated scan requests based on the matching results. The test data caused by the network topology will be repeatedly TCP / IP packetized and cached in kernel mode, without depending on the MTU value of the network nodes along the way; The information encapsulation module is used to encapsulate the integrated scan request to obtain an encapsulated scan request; The information upload module is used to push the encapsulated scan request to the kernel network stack of the server under test through the network protocol layer, so that the server under test can actively read from the kernel network stack and respond to the encapsulated scan request to complete the corresponding network vulnerability scanning business.

6. The host vulnerability scanning device according to claim 5, characterized in that, The information integration module includes: A data caching unit is used to cache the requested data fragments; The data matching unit is used to parse the data segments in the cached request data fragments and match and compare the data segments according to preset message rules; The data packet assembly unit is used to assemble the requested data fragments based on the matching results to obtain an integrated scan request.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the host vulnerability scanning method as described in any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the host vulnerability scanning method as described in any one of claims 1 to 4.

Images