Network system vulnerability scanning methods

Abstract

This invention relates to the field of information security and discloses a network system vulnerability scanning method, comprising the following steps: Step 1: Obtain network communication link attributes, connect to the communication network, configure the transmission protocol for the corresponding server, and establish a client; Step 2: Establish a data sending and delivery monitoring mechanism, deploy a scanning plugin, participate in system scanning, set the data collection frequency, collect data according to the set frequency, and record data fluctuation parameters; Step 3: Expand data sending, run the monitoring mechanism, and verify whether the submitted data matches the original data; After abnormal data appears, the user can intervene in time to actively scan, reasonably allocate resources, comprehensively obtain abnormal source information, and analyze it, directly matching the abnormal data with known vulnerabilities. As the vulnerability database is continuously updated, the scanning method is constantly learning, thereby continuously improving the vulnerability finding capability.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method for scanning network system vulnerabilities. Background Technology

[0002] Network vulnerabilities can affect a wide range of hardware and software devices, including the operating system itself and its supporting software, network client and server software, network routers, and security firewalls. In other words, different security vulnerabilities may exist in these different hardware and software devices. Different types of hardware and software devices, different versions of the same device, different systems composed of different devices, and the same system under different configuration conditions will all have their own unique security vulnerabilities.

[0003] In the past few years, most communication network security inspections have relied on traditional methods, such as interviewing maintenance personnel and reviewing equipment documentation. These traditional methods can only identify security risks related to management systems and equipment operation, and cannot effectively prevent or defend against non-traditional security issues such as network attacks and information theft. On the other hand, due to business expansion and accelerated informatization, the number of devices within communication networks, such as routers, firewalls, switches, and host servers, is increasing and becoming more complex and diverse. Continuing to use the old methods would be extremely costly in terms of manpower and inefficient.

[0004] Existing technology 1 (CN115186272A) discloses a software security vulnerability detection method based on text features and functional dependency features. Specifically, it discloses using an adjacency matrix to represent a directed graph with functional dependencies, converting the adjacency matrix into a functional dependency feature vector through singular value decomposition, and using the Local Outlier Detection (LOF) method for anomaly detection to obtain functions containing security vulnerabilities. However, this existing technology cannot examine fluctuations in real time based on data matching relationships, and therefore cannot reflect the network's robustness to fluctuations when facing vulnerabilities.

[0005] Prior art 2 (CN112488716A) discloses an anomaly event detection system; specifically, it discloses that the anomaly event detection result of selecting the optimal business rule subunit based on the judgment value is used as the final result, making the detection result more accurate and the payment more secure. However, this prior art lacks an examination of data matching, cannot reflect data fluctuations, and cannot examine the system's robustness to fluctuations.

[0006] However, existing network system vulnerability scanning methods still have certain shortcomings, such as:

[0007] 1. During real-time scanning, while ensuring that memory usage is not excessive, there is a lack of timely traceability of fluctuating data, and there is a lack of integration with active scanning, resulting in a relatively poor scanning effect. The identification and scanning of the target is limited and not comprehensive. Furthermore, there is a lack of measures to synchronize deep learning during active and real-time scanning.

[0008] 2. The lack of a tagging system for known vulnerability data makes it difficult to quickly identify similar vulnerabilities during subsequent scans, resulting in lengthy vulnerability handling times and hindering timely resolution of vulnerability issues for users. Summary of the Invention

[0009] (a) Technical problems to be solved

[0010] To address the aforementioned shortcomings of existing technologies, this invention provides a network system vulnerability scanning method. This method effectively solves the problems of existing network system vulnerability scanning methods, which, during real-time scanning, lack timely tracing of fluctuating data while ensuring minimal memory consumption. Furthermore, the lack of integration with proactive scanning results in mediocre scanning performance, limited and incomplete target identification, and the absence of synchronized deep learning measures during proactive and real-time scanning. It also lacks labeling and recording measures for known vulnerability data, making it difficult to quickly identify similar vulnerabilities in subsequent scans. This leads to lengthy vulnerability processing times and hinders timely vulnerability resolution for users.

[0011] (II) Technical Solution

[0012] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0013] This invention discloses a method for scanning network system vulnerabilities, comprising the following steps:

[0014] Step 1: Obtain network communication link attributes, connect to the communication network, configure the transmission protocol for the corresponding server, and establish a client;

[0015] Step 2: Establish a monitoring mechanism for data sending and delivery, deploy a scanning plugin to participate in system scanning, set the data collection frequency, collect data according to the set frequency, and record data fluctuation parameters;

[0016] Step 3: Launch data transmission, run the monitoring mechanism, and verify whether the submitted data matches the original data;

[0017] Step 4: When a mismatch occurs, obtain the data fluctuation parameters, determine the node from which the problem originates, and mark the link.

[0018] Step 5: Extract the tagged link information, convert the data format of the tagged information, analyze the abnormal data, and add it to the vulnerability database;

[0019] When analyzing outlier data, the local outlier state of point p is defined as:

[0020]

[0021] Local outlier (LOF) of object p min pts (p) is defined as:

[0022]

[0023] Among them, LOF min pts (p) is the local outlier factor of object p, lrd min pts (p) represents the local anomalous state at point p, lrd min pts (o) represents the local abnormal state at point o, reach-dist min pts (p,o) represents the minimum reachable distance from point o to point p, N min pts (p) represents the smallest neighborhood point of point p, |N min pts (p)| denotes the local minimum reachability density of the neighborhood points of point p;

[0024] Local outlier (LOF) min pts The larger (p) is, the smaller the density of p is compared to the density of its neighboring points, and the higher the probability of an outlier. Based on the probability that object p has an anomaly, we can determine whether it is a vulnerability.

[0025] Step 6: Actively scan the system ports to obtain the ports opened on the target host and the network services on those ports;

[0026] Step 7: Match the obtained port information with the vulnerability database to analyze whether there are any vulnerabilities that meet the matching conditions;

[0027] Step 8: After the scan and analysis are complete, the results will be returned to the client, and a parameter report and a solution report will be generated;

[0028] In Step 2, during the data acquisition process, each sample is added to the most recent M historical data, and then the average value is selected as the current data. The formula is as follows:

[0029] In the formula, P represents the average value of the collected values; M represents the number of historical collections; n represents the starting integer; and Q represents the current collected value.

[0030] Furthermore, in Step 1, the client provides the main interface for operation to the management user, which includes the corresponding menu commands, the security vulnerability types of the server, the list of plugins, and the target host address and port number to be scanned.

[0031] Furthermore, the communication network in Step 1 is used to establish a communication connection with the server, send requests and receive responses from the server. After the user fills in the information required by the server to log in, a connection is established with the server to obtain the number of plugins, the number of parameters and rule information from the server.

[0032] Furthermore, during the system scanning process in Step 2, the user can set the maximum number of concurrent threads during the port scanning process according to their own needs, and determine the target host address, port number, and configuration information of the plugins used.

[0033] Furthermore, the vulnerability types in Step 5 include: Finger abuse, Windows attacks, backdoors, CGI abuse, remote file access, RPC, firewalls, FTP, SMTP, gaining remote root access, and denial of service.

[0034] Furthermore, the method for analyzing abnormal data in Step 5 includes the following steps:

[0035] Step 501: Fill the vulnerability signature into the data packet and then send it to the data source target;

[0036] Step 502: Analyze the response data using string matching;

[0037] Step 503: Search for keywords in the response data that indicate the abnormal data. If they match the characteristic words in the vulnerability database, it means that the abnormal data is a vulnerability and exists.

[0038] Furthermore, the active intervention scanning process in Step 6 includes the following steps:

[0039] Step 601: After receiving the user's login connection request, the scanning plugin verifies the user's login information. If the verification is successful, it accepts the user's connection request and sends the scanning system configuration data to the user. Otherwise, it rejects the user's login request and sends a connection failure message to the user.

[0040] Step 602: The scanning plugin responds to the user's active scanning request, initializes each scanning program, and calls the corresponding scanning program to perform scanning based on the configuration data sent by the user.

[0041] Step 603: Send the current scan status data to the user. During the scanning process, the scanning plugin sends the target host being scanned, the scanning program being used, and the scan progress information to the client.

[0042] Step 604: Users can view the current scanning progress and generate a scanning report through the client.

[0043] Furthermore, in Step 604, the scan report can be customized by the user as needed. The server generates the corresponding report content and format based on the user's customization request and then sends it to the user's end.

[0044] Furthermore, the configuration attributes of the parameter report in Step 8 include specifying the document name, document type, and basic information of the scanned host to be saved. The result report document is saved in txt, doc, or html format.

[0045] Furthermore, the basic information of the scanned host that is saved includes its address, hostname, operating system type, and number of vulnerabilities.

[0046] (III) Beneficial Effects

[0047] Compared with known prior art, the technical solution provided by this invention has the following beneficial effects:

[0048] 1. This invention collects data regularly during the daily operation of the system, analyzes fluctuation data, traces the source of abnormal data, and allows users to allocate resources reasonably according to their needs and system performance without excessive memory consumption. When abnormal data occurs, users can intervene in time to actively scan, comprehensively obtain information on the source of the anomaly, and analyze it. The abnormal data is directly matched with known vulnerabilities. As the vulnerability database is continuously updated, the scanning method is constantly learning, thereby continuously improving the vulnerability finding capability.

[0049] 2. This invention adds a recording measure for tagging known vulnerability data. By filling the vulnerability's signature code into the data packet and sending abnormal data, it actively tests whether known vulnerabilities match abnormal data, thereby shortening the identification time for unknown vulnerabilities. Furthermore, in subsequent scanning processes, it quickly identifies similar vulnerabilities, shortening vulnerability processing time and helping users resolve vulnerability issues in a timely manner.

[0050] 3. This application determines the fluctuation situation based on data matching degree, which can examine the stability of the system under the vulnerability, and thus improve the fluctuation robustness.

[0051] 4. This application uses the average of historical collected values ​​as the current collected value, which can retain historical fluctuation information, so that the system response can reflect the historical performance of system vulnerabilities, which has a traceability and can ensure that historical problems are discovered in a timely manner during subsequent adjustments. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0053] Figure 1 A flowchart illustrating a network system vulnerability scanning method;

[0054] Figure 2 This is a flowchart illustrating the abnormal data analysis method of the present invention;

[0055] Figure 3 This is a flowchart illustrating the active interventional scanning process in this invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0057] The present invention will be further described below with reference to embodiments.

[0058] Example 1

[0059] The network system vulnerability scanning method in this embodiment, such as Figure 1 As shown, it includes the following steps:

[0060] Step 1: Obtain network communication link attributes, connect to the communication network, configure the transmission protocol for the corresponding server, and establish a client;

[0061] Step 2: Establish a monitoring mechanism for data sending and delivery, deploy a scanning plugin to participate in system scanning, set the data collection frequency, collect data according to the set frequency, and record data fluctuation parameters;

[0062] Step 3: Launch data transmission, run the monitoring mechanism, and verify whether the submitted data matches the original data;

[0063] Step 4: When a mismatch occurs, obtain the data fluctuation parameter, determine the source node of the problem, and perform link marking;

[0064] Step 5: Extract the marked link information, convert the data format of the marked information, analyze the abnormal data, and add it to the vulnerability database; When analyzing the abnormal data, define the k-distance (k-distance(p)) of point p as the distance d(p,o) between p and object o ∈ D, such that at least k objects o ∈ D\{p} satisfy d(p,o) < d(p,o). Taking the minimum number of objects MinPts as a parameter, the local abnormal state of p is defined as:

[0065] The local outlier factor (LOF) of object p is defined as:

[0066]

[0067] Object q is called one of the k nearest neighbors of p, denoted as N k (p), and the value of LOF minpts (p) represents the average ratio of the local reachability density of other points in the neighborhood of point p to the local reachability density of point p. The larger the local outlier factor, the smaller the density of p compared to the density of its neighborhood points, and the higher the possibility of being an outlier. Based on the possibility of object p being abnormal, judge whether it is a vulnerability;

[0068] Step 6: Actively intervene and scan the system ports to obtain the ports opened by the target host and the network services on the ports;

[0069] Step 7: Match the obtained port information with the vulnerability database to analyze whether there are vulnerabilities that meet the matching conditions;

[0070] Step 8: After the scanning and analysis are completed, return the results to the client, and generate a parameter report and a solution report;

[0071] Compare the current collected value with the previous collected value. If there is a certain gap between the two and the difference is not within the specified change range, determine that the current collected value is an invalid value, and still select the previous collected value. The maximum change range of the difference is mainly determined by two factors, namely the maximum change rate of the measured quantity and the sampling period, to eliminate the interference of accidental pulses to a certain extent. During the data collection process in Step 2, every time a sampling is performed, add it to the historical collected values of the nearest M times, and then select the average value as the current collected value. The formula is as follows:

[0072] In the formula, P represents the average value of the collected values; M represents the number of historical collections; n represents the starting integer; and Q represents the current collected value.

[0073] In Step 1, the client provides the main interface for operation to the management user, which includes the corresponding menu commands, the types of security vulnerabilities on the server side, the list of plugins, and the target host address and port number to be scanned.

[0074] The communication network in Step 1 is used to establish a communication connection with the server, send requests and receive responses from the server. After the user fills in the information required by the server to log in, a connection is established with the server to obtain the number of plugins, the number of parameters and rule information from the server.

[0075] In Step 2, during the system scan, the user sets the maximum number of concurrent threads during the port scan according to their needs, and determines the target host address, port number, and configuration information of the plugins used.

[0076] The vulnerability types in Step 5 include: Finger abuse, Windows attacks, backdoors, CGI abuse, remote file access, RPC, firewalls, FTP, SMTP, gaining remote root access, and denial of service.

[0077] The configuration attributes of the parameter report in Step 8 include specifying the document name, document type, and basic information of the scanned host to be saved. The result report document is saved in txt, doc, or html format.

[0078] The basic information of the scanned host that is saved includes its address, hostname, operating system type, and number of vulnerabilities.

[0079] In this embodiment, during the daily operation of the system, data is collected and fluctuation data is analyzed regularly to trace the source of abnormal data. Regular data collection allows users to allocate resources reasonably according to their needs and system performance without excessive memory consumption. When abnormal data occurs, users can intervene in time to actively scan, comprehensively obtain information on the source of the anomaly, and analyze it. The abnormal data is directly matched with known vulnerabilities. As the vulnerability database is continuously updated, the scanning method is constantly learning, thereby continuously improving the vulnerability finding capability.

[0080] Example 2

[0081] This embodiment also provides a method for analyzing abnormal data, such as Figure 2 As shown, the method for analyzing abnormal data in Step 5 includes the following steps:

[0082] Step 501: Fill the vulnerability signature into the data packet and then send it to the data source target;

[0083] Step 502: Analyze the response data using string matching;

[0084] Step 503: Search for keywords in the response data that indicate the abnormal data. If they match the characteristic words in the vulnerability database, it means that the abnormal data is a vulnerability and exists.

[0085] In this embodiment, the known vulnerability data is tagged and recorded by filling the vulnerability's feature code into the data packet and sending the abnormal data. This proactively tests whether the known vulnerability matches the abnormal data, thereby shortening the identification time for unknown vulnerabilities. Furthermore, in the subsequent scanning process, similar vulnerabilities are quickly identified, shortening the vulnerability handling time and helping users to resolve vulnerability issues in a timely manner.

[0086] CGI scanning primarily exploits vulnerabilities in web server configuration or design. It involves sending a special URL request to the target port (default port 80) and then parsing the response data for analysis. CGI vulnerabilities target hosts that provide WWW services using the HTTP protocol. The default scanning port is port 80, and the detection process is a standard connection request to the server. After establishing a connection using Sockets, the scanner sends a request to the target port. The content of the "request object" in the program is the pre-constructed vulnerability signature. In this system, the characteristics of each CG1 vulnerability's return information are analyzed, and the signature is received by combining status codes with the return information. For example, for CGI vulnerabilities that can provide attackers with a web service directory, because the consequences of the vulnerability lead to the leakage of the target host's directory information, which includes directory path strings, the presence of "200" or "202" and "..." in the returned data packet can be analyzed. <dir>"As a basis for vulnerability identification;

[0087] Furthermore, considering that the RITT network vulnerability scanning system operates on the Windows platform and the database used by the scanning system is not particularly large, with minimal performance requirements, an Access database on the Windows platform was chosen. There are many technologies for accessing databases on the Windows platform. This system uses ADO to implement access and control of the vulnerability database. ADO technology is based on the OLE DB access interface, inheriting the advantages of OLE DB technology. ADO encapsulates the OLE DB interface and defines ADO objects, simplifying program development. ADO technology belongs to a high-level interface for database access. ADO enables users to write applications to access and manipulate data in the database server through the OLE DB provider. ADO's main advantages are ease of use, speed, low memory consumption, and small disk footprint. ADO uses minimal network traffic in critical application scenarios and minimizes the number of layers between the front end and the data source, all to provide a lightweight, high-performance interface.

[0088] Example 3

[0089] In this embodiment, as Figure 3 As shown, the active intervention scanning process in Step 6 includes the following steps:

[0090] Step 601: After receiving the user's login connection request, the scanning plugin verifies the user's login information. If the verification is successful, it accepts the user's connection request and sends the scanning system configuration data to the user. Otherwise, it rejects the user's login request and sends a connection failure message to the user.

[0091] Step 602: The scanning plugin responds to the user's active scanning request, initializes each scanning program, and calls the corresponding scanning program to perform scanning based on the configuration data sent by the user.

[0092] Step 603: Send the current scan status data to the user. During the scanning process, the scanning plugin sends the target host being scanned, the scanning program being used, and the scan progress information to the client.

[0093] Step 604: Users can view the current scanning progress and generate a scanning report through the client.

[0094] In Step 604, the scan report can be customized by the user as needed. The server generates the corresponding report content and format according to the user's customization request and then sends it to the user's terminal.

[0095] In this embodiment, the execution of each plugin is completed through a server-side plugin interpreter. This interpreter can be compiled and run independently, improving execution speed and facilitating script expansion. Plugins are typically created as dynamic link libraries (DLLs), meaning they can only run within the host program and cannot run independently. Users can freely add or remove existing plugins without recompiling and linking the application. The simplest way to use plugins is through DLLs to achieve collaboration with the main program. An interface for writing plugins is provided for scanning plugins. All script test plugins are stored in a specific folder. For detected vulnerabilities, the scanning engine dynamically calls the corresponding test plugin by sending specific packets to a designated port on the target system. The return value is then used to analyze and determine whether the host port is open or has vulnerabilities. Users can write corresponding test scripts for newly discovered vulnerabilities.

[0096] Example 4

[0097] In this embodiment, the vulnerability database contains vulnerability information for various operating systems. It centralizes common system vulnerability characteristics and corresponding countermeasures, the current vulnerability status of network systems, system security configuration strategies related to system vulnerability analysis and countermeasures, and instructions on how to detect vulnerabilities. Because new vulnerabilities are constantly emerging, this database needs frequent updates to detect newly discovered vulnerabilities. Since a discovered vulnerability requires a series of procedural authentication processes, it typically takes a certain amount of time before it officially becomes an entry in a CVE. Therefore, the number of vulnerabilities described in a CVE is less than the number currently discovered; it does not include all currently discovered vulnerabilities. If a plugin detects a vulnerability that is already an entry in a CVE, it is identified using a CVE name, thus ensuring the vulnerability database is compatible with CVEs. The description of each vulnerability is insufficient based solely on the information in the CVE; therefore, the vulnerability information in this system is primarily built on a vulnerability database that is strictly compatible with CVEs, combined with information from the plugin library.

[0098] In summary, this invention collects data regularly during the daily operation of the system, analyzes fluctuation data, traces the source of abnormal data, and allows users to allocate resources reasonably according to their needs and system performance without excessive memory consumption. When abnormal data occurs, users can intervene in time to actively scan, comprehensively obtain information on the source of the anomaly, and analyze it. The abnormal data is directly matched with known vulnerabilities. As the vulnerability database is continuously updated, the scanning method is constantly learning, thereby continuously improving the vulnerability finding capability.

[0099] The system uses a tagging and recording method for known vulnerability data. This involves embedding vulnerability signatures into data packets and sending abnormal data to proactively test whether known vulnerabilities match abnormal data, thus shortening the identification time for unknown vulnerabilities. Furthermore, in subsequent scans, it quickly identifies similar vulnerabilities, reducing vulnerability processing time. This is achieved by sending a special URL request to the target port (default port 80) and then parsing the response data. CGI vulnerabilities target hosts that provide WWW services using the HTTP protocol. The default scanning port is port 80, and the detection process is a standard process of initiating a connection request to the server. After establishing a connection using Sockets, the scanner sends a request to the target port. The content of the "request object" in the program is the pre-constructed vulnerability signature. In this system, the characteristics of the return information for each CG1 vulnerability are specifically analyzed, and the signature is received by combining status codes with the return information. For example, for CGI vulnerabilities that can provide attackers with a WEB service directory, because the consequences of the vulnerability will lead to the leakage of the target host's directory information, which includes directory path strings, the presence of "200" or "202" and "..." in the return data packet can be checked simultaneously. <dir>"As a basis for vulnerability identification;

[0100] Furthermore, considering that the RITT network vulnerability scanning system operates on the Windows platform and the database used by the scanning system is not particularly large, with minimal performance requirements, an Access database on the Windows platform was adopted. There are many technologies for accessing databases on the Windows platform. In this system, ADO is used to implement access and control of the vulnerability database. ADO technology is based on the OLE DB access interface, inheriting the advantages of OLE DB technology. ADO encapsulates the OLE DB interface and defines ADO objects, simplifying program development. ADO technology belongs to a high-level interface for database access. ADO enables users to write applications to access and manipulate data in the database server through the OLE DB provider. ADO's main advantages are ease of use, speed, low memory consumption, and small disk footprint. ADO uses minimal network traffic in critical application scenarios and uses the fewest layers between the front end and the data source, all to provide a lightweight, high-performance interface.

[0101] Each plugin is executed through a server-side plugin interpreter. This interpreter can be compiled and run independently, improving execution speed and facilitating script expansion. Plugins are typically created as dynamic link libraries (DLLs), meaning they can only run within the host program and cannot operate independently. Users can freely add or remove existing plugins without recompiling and linking the application. The simplest way to use plugins is through DLLs to achieve collaboration with the main program. An interface for writing plugins is provided for scanning. All script test plugins are stored in a specific folder. For detected vulnerabilities, the scanning engine dynamically calls the corresponding test plugin by sending specific packets to a designated port on the target system. The return value is then used to analyze and determine whether the host port is open or vulnerable. Users can write corresponding test scripts for newly discovered vulnerabilities.

[0102] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.< / dir> < / dir>

Claims

1. A network system vulnerability scanning method, characterized in that, Includes the following steps: Step 1: Obtain network communication link attributes, connect to the communication network, configure the transmission protocol for the corresponding server, and establish a client; Step 2: Establish a monitoring mechanism for data sending and delivery, deploy a scanning plugin to participate in system scanning, set the data collection frequency, and collect data according to the set frequency. Each time a sample is taken, it is added to the most recent M historical collection values, and then the average value is selected as the current collection value. Record data fluctuation parameters; During the system scan, users can set the maximum number of concurrent threads during the port scan according to their needs, and determine the target host address, port number, and configuration information of the plugins used. Step 3: Launch data transmission, run the monitoring mechanism, and verify whether the submitted data matches the original data; Step 4: When a mismatch occurs, obtain the data fluctuation parameters, determine the node from which the problem originates, and mark the link. Step 5: Extract the tagged link information, convert the data format of the tagged information, analyze the abnormal data and add it to the vulnerability database; when analyzing the abnormal data, the local abnormal state of object p is: Local outlier (LOF) of object p min pts (p) is defined as: Among them, LOF min pts (p) is the local outlier factor of object p. lrd min pts (p) This indicates a local abnormal state at point p. lrd min pts (o) This indicates a local abnormal state at point o. reach-dist min pts (p,o) This represents the minimum reachable distance from point o to object p. N min pts (p) Represents the smallest neighborhood point of object p, | N min pts (p) | represents the local minimum reachability density of the neighborhood points of object p; Local outlier (LOF) min pts The larger (p) is, the smaller the density of object p is compared to the density of its neighboring points, and the higher the probability of an anomaly. Based on the probability of an anomaly in object p, we can determine whether it is a vulnerability. The analysis method for abnormal data also includes the following steps: Step 501: Fill the vulnerability signature into the data packet and then send it to the data source target; Step 502: Analyze the response data using string matching; Step 503: Search the response data for keywords that indicate the abnormal data. If they match the feature words in the vulnerability database, it means that the abnormal data is a vulnerability and exists. Step 6: Actively scan the system ports to obtain the ports opened on the target host and the network services on those ports; Step 7: Match the obtained port information with the vulnerability database to analyze whether there are any vulnerabilities that meet the matching conditions; Step 8: After the scan and analysis are complete, the results will be returned to the client, and a parameter report and a solution report will be generated.

2. The network system vulnerability scanning method according to claim 1, characterized in that, In Step 1, the client provides the main interface for management users, which includes corresponding menu commands, the types of security vulnerabilities on the server side, a list of plugins, and the target host address and port number to be scanned.

3. The network system vulnerability scanning method according to claim 1, characterized in that, The communication network in Step 1 is used to establish a communication connection with the server, send requests and receive responses from the server. After the user fills in the information required by the server to log in, a connection is established with the server to obtain the number of plugins, parameters and rules information from the server.

4. The network system vulnerability scanning method according to claim 1, characterized in that, The vulnerability types in Step 5 include: Finger abuse, Windows attacks, backdoors, CGI abuse, remote file access, RPC, firewalls, FTP, SMTP, gaining remote root access, and denial of service.

5. The network system vulnerability scanning method according to claim 1, characterized in that, The active interventional scanning process in Step 6 includes the following steps: Step 601: After receiving the user's login connection request, the scanning plugin verifies the user's login information. If the verification is successful, it accepts the user's connection request and sends the scanning system configuration data to the user. Otherwise, it rejects the user's login request and sends a connection failure message to the user. Step 602: The scanning plugin responds to the user's active scanning request, initializes each scanning program, and calls the corresponding scanning program to perform scanning based on the configuration data sent by the user. Step 603: Send the current scan status data to the user. During the scanning process, the scanning plugin sends the target host being scanned, the scanning program being used, and the scan progress information to the client. Step 604: Users can view the current scanning progress and generate a scanning report through the client.

6. The network system vulnerability scanning method according to claim 5, characterized in that, In Step 604, the scan report allows users to customize the content as needed. The server generates the corresponding report content and format based on the user's customization request and then sends it to the user's end.

7. The network system vulnerability scanning method according to claim 1, characterized in that, The configuration properties of the parameter report in Step 8 include specifying the document name, document type, and basic information of the scanned host to be saved. The result report document is saved in txt, doc, or html format.

8. The network system vulnerability scanning method according to claim 7, characterized in that, The system saves basic information about the scanned host, including its address, hostname, operating system type, and number of vulnerabilities.

Images