A vulnerability detection method, device and system

Abstract

The application relates to the terminal security field, and particularly provides a vulnerability detection method, device and system. The method comprises the following steps: obtaining a to-be-detected vulnerability; judging whether a vulnerability detection script matched with the to-be-detected vulnerability exists in a vulnerability detection script library; when the vulnerability detection script exists in the vulnerability detection script library, obtaining the vulnerability detection script, and detecting the to-be-detected vulnerability based on the vulnerability detection script to obtain a vulnerability detection result; when the vulnerability detection script does not exist in the vulnerability detection script library, performing vulnerability detection through an asset version matching mode to obtain the vulnerability detection result. It can be seen that the method, device and system can improve the comprehensiveness of vulnerability detection, so that the situation of missing detection can be avoided as much as possible, and the application security of a Linux system host is improved.

Description

Technical Field

[0001] The present application relates to the field of terminal security, and more specifically, to a vulnerability detection method, device, and system. Background Art

[0002] With the widespread adoption of Linux systems in the server sector, a vast array of open source software and third-party components has emerged. However, with this widespread adoption, the potential for vulnerabilities increases, making vulnerability detection increasingly difficult. Currently, commonly used vulnerability detection methods often miss many of these vulnerabilities, significantly reducing the security of Linux system applications. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a vulnerability detection method, device and system that can improve the comprehensiveness of vulnerability detection, thereby avoiding missed detections as much as possible, and further improving the application security of the Linux system host.

[0004] A first aspect of the present application provides a vulnerability detection method, the method comprising:

[0005] Get the vulnerability to be detected;

[0006] Determine whether there is a vulnerability detection script matching the vulnerability to be detected in the vulnerability detection script library;

[0007] When the vulnerability detection script exists in the vulnerability detection script library, the vulnerability detection script is obtained, and the vulnerability to be detected is detected based on the vulnerability detection script to obtain a vulnerability detection result;

[0008] When the vulnerability detection script does not exist in the vulnerability detection script library, vulnerability detection is performed by asset version matching to obtain a vulnerability detection result.

[0009] Furthermore, after performing vulnerability detection by asset version matching and obtaining vulnerability detection results, the method further includes:

[0010] Obtain the vulnerability detection script, and detect the vulnerability to be detected based on the vulnerability detection script to obtain a deep detection result;

[0011] Based on the deep detection result, the vulnerability detection result is updated.

[0012] Furthermore, the vulnerability detection is performed by asset version matching to obtain vulnerability detection results, including:

[0013] collecting Linux package information, third-party dependency information, and open source software information corresponding to the vulnerability to be detected;

[0014] performing vulnerability detection based on the Linux package information to obtain a first detection result;

[0015] performing vulnerability detection based on the third-party dependency information to obtain a second detection result;

[0016] performing vulnerability detection based on the open source software information to obtain a third detection result;

[0017] combining the first detection result, the second detection result, and the third detection result to generate a vulnerability detection result.

[0018] Further, the performing vulnerability detection based on the Linux package information to obtain a first detection result comprises:

[0019] determining a Linux distribution version corresponding to the Linux package information;

[0020] determining a vulnerability patch corresponding to the vulnerability to be detected, and obtaining a Linux repair version range corresponding to the vulnerability patch;

[0021] judging whether the Linux distribution version is included in the Linux repair version range;

[0022] if the Linux distribution version is not included in the Linux repair version range, determining that the first detection result is that the Linux package has a vulnerability; the Linux package corresponds to the Linux package information.

[0023] Further, the determining a vulnerability patch corresponding to the vulnerability to be detected, and obtaining a Linux repair version range corresponding to the vulnerability patch comprises:

[0024] obtaining an OVAL document, and determining a vulnerability patch corresponding to the vulnerability to be detected in the OVAL document;

[0025] extracting a Linux repair version range corresponding to the vulnerability patch from the OVAL document.

[0026] Further, the performing vulnerability detection based on the third-party dependency information to obtain a second detection result comprises:

[0027] determining a third-party dependency file corresponding to the third-party dependency information;

[0028] Based on the preset filtering rule and the preset detection whitelist, system files in the third-party dependent file are filtered out to obtain a to-be-resolved dependent file;

[0029] The to-be-resolved dependent file is resolved to obtain an information file;

[0030] The first Maven coordinate of the to-be-resolved file is obtained from the information file;

[0031] A dependent part in the information file is resolved to obtain a resolution result;

[0032] The second Maven coordinate of a third-party dependent package depended on by the to-be-resolved file is determined according to the resolution result;

[0033] The first Maven coordinate and the second Maven coordinate are summarized to obtain a target Maven coordinate;

[0034] Based on the target Maven coordinate, it is judged whether a preset third-party dependent vulnerability data source includes the to-be-detected vulnerability;

[0035] If the third-party dependent vulnerability data source includes the to-be-detected vulnerability, it is determined that the second detection result is that the to-be-detected file exists in the to-be-detected vulnerability.

[0036] Further, the vulnerability detection based on the open source software information obtains a third detection result, including:

[0037] An open source software corresponding to the open source software information is identified;

[0038] Process information corresponding to the open source software is obtained;

[0039] Based on the process information, a software version of the open source software is determined;

[0040] It is judged whether the software version is included in the vulnerability universal enumeration platform information;

[0041] If the software version is included in the vulnerability universal enumeration platform information, it is determined that the third detection result is that the open source software exists in the to-be-detected vulnerability.

[0042] The second aspect of the present application provides a vulnerability detection device, the vulnerability detection device includes:

[0043] An acquisition unit is configured to acquire a to-be-detected vulnerability;

[0044] A judgment unit is configured to judge whether a vulnerability detection script library includes a vulnerability detection script matched with the to-be-detected vulnerability;

[0045] The detection unit is configured to acquire the vulnerability detection script when the vulnerability detection script exists in the vulnerability detection script library, and perform detection on the to-be-detected vulnerability based on the vulnerability detection script to obtain a vulnerability detection result.

[0046] The detection unit is further configured to perform vulnerability detection by asset version matching when the vulnerability detection script does not exist in the vulnerability detection script library, and obtain a vulnerability detection result.

[0047] Further, the vulnerability detection apparatus further includes:

[0048] The detection unit is further configured to acquire the vulnerability detection script after performing vulnerability detection by asset version matching and obtaining a vulnerability detection result, and perform detection on the to-be-detected vulnerability based on the vulnerability detection script to obtain a deep detection result.

[0049] The updating unit is configured to update the vulnerability detection result based on the deep detection result.

[0050] Further, the detection unit includes:

[0051] The acquisition subunit is configured to acquire Linux software package information, third-party dependency information, and open source software information corresponding to the to-be-detected vulnerability.

[0052] The first detection subunit is configured to perform vulnerability detection based on the Linux software package information to obtain a first detection result.

[0053] The second detection subunit is configured to perform vulnerability detection based on the third-party dependency information to obtain a second detection result.

[0054] The third detection subunit is configured to perform vulnerability detection based on the open source software information to obtain a third detection result.

[0055] The generation subunit is configured to combine the first detection result, the second detection result, and the third detection result to generate a vulnerability detection result.

[0056] Further, the first detection subunit includes:

[0057] The first determination module is configured to determine a Linux release version corresponding to the Linux software package information.

[0058] The first determination module is further configured to determine a vulnerability patch corresponding to the to-be-detected vulnerability, and acquire a Linux repair version range corresponding to the vulnerability patch.

[0059] The first judgment module is configured to judge whether the Linux repair version range includes the Linux release version.

[0060] The first determining module is configured to determine that the first detection result is that the Linux software package has a vulnerability when the Linux distribution version is not included in the Linux repair version range.

[0061] Further, the first determining module is specifically configured to obtain an OVAL document and determine a vulnerability patch corresponding to the to-be-detected vulnerability in the OVAL document.

[0062] The first determining module is specifically further configured to extract a Linux repair version range corresponding to the vulnerability patch from the OVAL document.

[0063] Further, the second detection subunit includes:

[0064] The second determining module is configured to determine a third-party dependency file corresponding to the third-party dependency information.

[0065] The filtering module is configured to filter out system files in the third-party dependency file based on a preset filtering rule and a preset detection whitelist to obtain a to-be-analyzed dependency file.

[0066] The parsing module is configured to parse the to-be-analyzed dependency file to obtain an information file.

[0067] The first obtaining module is configured to obtain first Maven coordinates of the to-be-analyzed file from the information file.

[0068] The parsing module is further configured to parse a dependency part in the information file to obtain a parsing result.

[0069] The second determining module is further configured to determine second Maven coordinates of a third-party dependency package on which the to-be-analyzed file depends according to the parsing result.

[0070] The summarizing module is configured to summarize the first Maven coordinates and the second Maven coordinates to obtain target Maven coordinates.

[0071] The second judging module is configured to judge whether a preset third-party dependency vulnerability data source includes the to-be-detected vulnerability based on the target Maven coordinates.

[0072] The second determining module is configured to determine that the second detection result is that the to-be-analyzed file has the to-be-detected vulnerability when the third-party dependency vulnerability data source includes the to-be-detected vulnerability.

[0073] Further, the third detection subunit includes:

[0074] a recognition module, configured to recognize open source software corresponding to the open source software information;

[0075] a second acquisition module, configured to acquire process information corresponding to the open source software;

[0076] a third determination module, configured to determine a software version of the open source software based on the process information;

[0077] a third judgment module, configured to judge whether the software version is included in the vulnerability universal enumeration platform information;

[0078] a third determination module, configured to determine that the third detection result is that the open source software has the to-be-detected vulnerability if the software version is included in the vulnerability universal enumeration platform information.

[0079] The third aspect of the present application provides an electronic device, comprising a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to make the electronic device execute the vulnerability detection method in any one of the first aspect of the present application.

[0080] The fourth aspect of the present application provides a computer readable storage medium, which stores computer program instructions, when the computer program instructions are read and run by a processor, the vulnerability detection method in any one of the first aspect of the present application is executed.

[0081] The beneficial effects of the present application are: improving the comprehensiveness of vulnerability detection, so that it can not only detect application software vulnerabilities with network services through network packet sending, but also collect necessary information for vulnerability detection on terminal hosts, so that the range and type of vulnerability detection are wider, and the flexibility is higher. At the same time, vulnerability detection scripts can be used to be sent to terminal hosts for running, so as to detect vulnerabilities more accurately for some vulnerabilities with preconditions or complex vulnerability detection, thereby improving the accuracy of vulnerability detection. Finally, based on the detected vulnerabilities, the corresponding necessary information collected at the beginning can be located on the terminal host, so as to realize the effect of effectively locating the vulnerability point, and then facilitate timely repair. BRIEF DESCRIPTION OF DRAWINGS

[0082] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0083] Figure 1A flowchart of a vulnerability detection method provided by an embodiment of the present application is shown in FIG. 1.

[0084] Figure 2 An example flowchart of a vulnerability detection method provided by an embodiment of the present application is shown in FIG. 2.

[0085] Figure 3 A structural diagram of a vulnerability detection method provided by an embodiment of the present application is shown in FIG. 3.

[0086] Figure 4 A flowchart of another vulnerability detection method provided by an embodiment of the present application is shown in FIG. 4.

[0087] Figure 5 A flowchart of a Linux software package vulnerability detection method provided by an embodiment of the present application is shown in FIG. 5.

[0088] Figure 6 A flowchart of yet another vulnerability detection method provided by an embodiment of the present application is shown in FIG. 6.

[0089] Figure 7 A flowchart of a third-party dependency vulnerability detection method provided by an embodiment of the present application is shown in FIG. 7.

[0090] Figure 8 A flowchart of still another vulnerability detection method provided by an embodiment of the present application is shown in FIG. 8.

[0091] Figure 9 A flowchart of an open source software vulnerability detection method provided by an embodiment of the present application is shown in FIG. 9.

[0092] Figure 10 A structural diagram of a vulnerability detection device provided by an embodiment of the present application is shown in FIG. 10.

[0093] Figure 11 A structural diagram of another vulnerability detection device provided by an embodiment of the present application is shown in FIG. 11. DETAILED DESCRIPTION

[0094] The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0095] It should be noted that similar reference numerals and letters refer to similar items in the accompanying drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms “first”, “second”, and the like are merely used to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0096] Embodiment 1

[0097] Please refer to Figure 1 , Figure 1A flowchart of a vulnerability detection method provided in the embodiment is shown. The vulnerability detection method includes the following steps.

[0098] S101, obtaining a vulnerability to be detected.

[0099] S102, determining whether there is a vulnerability detection script matched with the vulnerability to be detected in a vulnerability detection script library. If yes, step S103 is performed; if no, step S104 is performed.

[0100] S103, obtaining the vulnerability detection script, and detecting the vulnerability to be detected based on the vulnerability detection script to obtain a vulnerability detection result, and ending the flowchart.

[0101] S104, performing vulnerability detection through asset version matching to obtain a vulnerability detection result, and ending the flowchart.

[0102] As an optional implementation, after the step of performing vulnerability detection through asset version matching to obtain a vulnerability detection result, the method further includes the following steps.

[0103] obtaining a vulnerability detection script, and detecting the vulnerability to be detected based on the vulnerability detection script to obtain a deep detection result;

[0104] updating the vulnerability detection result based on the deep detection result.

[0105] In the embodiment, a proxy program can be deployed on a Linux terminal, and the proxy program implements the above steps.

[0106] Specifically, since there are some complex and special vulnerabilities in the vulnerabilities, the proxy program preferentially calls a corresponding vulnerability detection script in the vulnerability detection script library, and runs the vulnerability detection script on the Linux terminal to implement vulnerability detection on the vulnerability to be detected, so as to obtain a corresponding vulnerability detection result. As can be seen, the method focuses on detecting complex and special vulnerabilities through vulnerability detection scripts, so as to guarantee the accuracy of vulnerability detection. Meanwhile, when the vulnerability detection script does not exist, the asset version matching method can be used for vulnerability detection as a supplement, so as to avoid the problem of missed detection caused by incomplete detection script database, and thus guarantee that the vulnerability to be detected is detected in place.

[0107] The asset version matching manner is specifically: collecting various information in the Linux terminal through the agent program, and submitting the information to the vulnerability detection server, so that the vulnerability detection server checks the existence of the vulnerability according to the known vulnerability information and the various information in the Linux terminal (such as: judging whether the various information in the Linux terminal matches the known vulnerability information), thereby determining whether the Linux terminal has the vulnerability (if the various information in the Linux terminal matches the known vulnerability information, it is determined that the vulnerability exists). It can be seen that this method can directly determine the existence of the vulnerability based on the various information in the Linux terminal, thereby ensuring the normal detection of the vulnerability when the vulnerability detection script does not exist, thereby improving the detection rate of the vulnerability and improving the overall vulnerability detection effect.

[0108] Please refer to Figure 2 , Figure 2 An example flowchart of a vulnerability detection method is shown. Among them, Figure 2 corresponding to steps S101-S104 disclosed in embodiment 1. Specifically, step S103 corresponds to the right half of Figure 2 corresponding to the left half of Figure 2 corresponding to the part of the flowchart in the figure based on Linux software package information, third-party dependency information and open source software information. Among them,

[0109] In the part corresponding to step S103, the method can send the vulnerability to be detected to the vulnerability detection server, so that the vulnerability detection server searches for the vulnerability detection script corresponding to the vulnerability to be detected in the vulnerability detection script library, and when the vulnerability detection server searches for the vulnerability detection script corresponding to the vulnerability to be detected in the vulnerability detection script library, the vulnerability detection script is sent to the vulnerability detection system (the execution subject of the method), so that the vulnerability detection system detects the vulnerability based on the vulnerability detection script. The vulnerability to be detected, thereby obtaining the vulnerability detection result.

[0110] In the part corresponding to step S104, the method first collects Linux software package information, third-party dependency information and open source software information, and when the collection is completed, sends the collected information to the vulnerability detection server, so that the vulnerability detection server detects the matching of the collected information based on the known vulnerability information in the preset vulnerability library (i.e. the vulnerability library data in the figure, which is the vulnerability information pulled by the vulnerability detection server in the vulnerability library), and further determines the vulnerability detection result based on the matching detection result.

[0111] Please refer to Figure 3 , Figure 3 An example flowchart of a vulnerability detection method is shown. Among them, Figure 3As shown in the figure, the system overall structure includes a target terminal (i.e. a Linux terminal) and a vulnerability detection server, wherein the target terminal can be installed with an agent program, which is used to implement the steps in this embodiment in real time. Specifically, the agent program can be used to collect and report terminal information required for vulnerability detection, and receive and execute vulnerability detection scripts.

[0112] As for the vulnerability detection server, the vulnerability detection server is independent of the target terminal. The vulnerability detection server is mainly used to receive the terminal information reported by the target terminal and pull vulnerability database data, and process them; at the same time, it is also used to obtain the to-be-detected vulnerability, determine whether the vulnerability detection script exists, and issue the vulnerability detection script.

[0113] Based on Figure 3 It can be seen that this method installs an agent program on the Linux terminal, and implements the steps in this embodiment based on the agent program, so as to avoid using network packet detection from the bottom mechanism. At the same time, since the agent program is set on the Linux terminal, this method can detect operating system and system component vulnerabilities, third-party component dependency vulnerabilities, and open source software vulnerabilities, thereby solving the problem that the traditional method can only detect software vulnerabilities with network monitoring services. In addition, this method can also implement batch deep detection through vulnerability detection scripts, so that the method can effectively detect vulnerabilities when facing complex exploitation methods, harsh preconditions, or vulnerabilities that have taken mitigation measures, thereby ensuring the accuracy of vulnerability detection.

[0114] In this embodiment, the execution subject of the method can be a computer, a server, or other computing devices, which are not limited in this embodiment.

[0115] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or other smart devices, which are not limited in this embodiment.

[0116] It can be seen that implementing the vulnerability detection method described in this embodiment can improve the comprehensiveness of vulnerability detection, so that it can not only detect application software vulnerabilities with network services through network packet detection, but also collect vulnerability detection necessary information on the terminal host to perform vulnerability detection, so that the range and type of vulnerability detection are wider and more flexible. At the same time, vulnerability detection scripts can be used to be issued to the terminal host for running, so that some vulnerabilities with exploitation preconditions or complex vulnerability detection can be detected more accurately, thereby improving the accuracy of vulnerability detection. Finally, the corresponding necessary information collected at the beginning can be located on the terminal host based on the detected vulnerability, so as to achieve the effect of effectively locating the vulnerability point, thereby facilitating timely repair.

[0117] Embodiment 2

[0118] Please refer to Figure 4 , Figure 4 A flowchart of a vulnerability detection method provided in this embodiment is shown. The vulnerability detection method includes the following steps.

[0119] S201, obtaining a vulnerability to be detected.

[0120] S202, when there is no vulnerability detection script in the vulnerability detection script library that matches the vulnerability to be detected, collecting Linux package information, third-party dependency information, and open source software information corresponding to the vulnerability to be detected.

[0121] S203, determining a Linux distribution version corresponding to the Linux package information.

[0122] In this embodiment, in the process of determining the Linux distribution version corresponding to the Linux package information, the method can first determine the Linux package format, and then determine the Linux distribution version corresponding to the Linux package information based on the Linux package format. The Linux package format includes rpm (RedHat Package Manager) and dpkg (Debian Package).

[0123] In this embodiment, the rpm format is generally used in redhat / suse distribution versions. The method can obtain the Linux distribution version corresponding to the Linux package information by calling the rpm program interface or reading the rpm database (the directory address of the rpm database is generally / var / lib / rpm, stored in the Berkeley DB format).

[0124] In this embodiment, the dpkg format is generally used in debian distribution versions. The method can obtain the Linux distribution version corresponding to the Linux package information by calling the dpkg program interface or reading the dpkg database (the directory address of the dpkg database is generally / var / lib / dpkg, stored in the text file format).

[0125] S204, obtaining an OVAL document and determining a vulnerability patch corresponding to the vulnerability to be detected in the OVAL document.

[0126] In this embodiment, the method can obtain OVAL (Open Vulnerability and Assessment Language) documents from different Linux distribution versions. The documents contain vulnerability patches and Linux package information related to the vulnerability patches pushed by different Linux distribution versions.

[0127] S205. Extract the Linux repair version range corresponding to the vulnerability patch from the OVAL document.

[0128] In this embodiment, the method can extract vulnerability patch information from the obtained OVAL document and obtain the Linux package repair version range corresponding to the vulnerability patch.

[0129] S206. Determine whether the Linux distribution version is included in the Linux repair version range.

[0130] In this embodiment, the method can determine whether the Linux distribution version falls within the repair version range. Specifically, if it falls within, it means that the vulnerability has been modified; otherwise, it means that the vulnerability exists.

[0131] S207. If the Linux distribution version is included in the Linux repair version range, determine that the first detection result is that the Linux package has no vulnerability; if the Linux distribution version is not included in the Linux repair version range, determine that the first detection result is that the Linux package has a vulnerability; the Linux package corresponds to the Linux package information.

[0132] Please refer to Figure 5 , Figure 5 a flowchart of a Linux package vulnerability detection process is shown, which matches steps S203-S207.

[0133] S208. Perform vulnerability detection based on third-party dependency information to obtain a second detection result.

[0134] S209. Perform vulnerability detection based on open source software information to obtain a third detection result.

[0135] S210. Combine the first detection result, the second detection result, and the third detection result to generate a vulnerability detection result.

[0136] As an optional implementation, after the step of combining the first detection result, the second detection result, and the third detection result to generate a vulnerability detection result, the method further includes:

[0137] obtain a vulnerability detection script and detect the vulnerability to be detected based on the vulnerability detection script to obtain a deep detection result;

[0138] Based on the deep detection result, the vulnerability detection result is updated.

[0139] In this embodiment, the execution subject of the method can be a computer, a server, or the like computing device, which is not limited in this embodiment.

[0140] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or the like smart device, which is not limited in this embodiment.

[0141] It can be seen that the vulnerability detection method described in this embodiment can improve the comprehensiveness of vulnerability detection, so that it can not only detect application software vulnerabilities with network services through network packet sending, but also collect necessary information for vulnerability detection on terminal hosts to detect vulnerabilities, so that the range and type of vulnerability detection are wider and more flexible. At the same time, vulnerability detection scripts can be used to be sent to terminal hosts for running, so as to detect vulnerabilities more accurately for some vulnerabilities with preconditions or complex vulnerability detection, thereby improving the accuracy of vulnerability detection. Finally, the corresponding necessary information collected at the beginning can be located on the terminal host based on the detected vulnerabilities, so as to achieve the effect of effectively locating the vulnerability point, thereby facilitating timely repair.

[0142] Embodiment 3

[0143] Please refer to Figure 6 , Figure 6 A flowchart of a vulnerability detection method provided in this embodiment is shown. The vulnerability detection method includes:

[0144] S301, obtaining a vulnerability to be detected.

[0145] S302, when there is no vulnerability detection script in the vulnerability detection script library that matches the vulnerability to be detected, collecting Linux software package information, third-party dependency information, and open source software information corresponding to the vulnerability to be detected.

[0146] S303, performing vulnerability detection based on the Linux software package information to obtain a first detection result.

[0147] S304, determining a third-party dependency file corresponding to the third-party dependency information.

[0148] For example, when the third-party dependency is Java software, the method can first obtain all running processes in the Linux terminal; then, filter out Java processes from all running processes; and then, obtain jar packages referenced by the Java processes from the file descriptors referenced by the Java processes (the jar package is a third-party dependency file).

[0149] S305, filtering system files in the third-party dependent file based on the preset filtering rule and the preset detection whitelist to obtain a to-be-analyzed dependent file.

[0150] In this embodiment, when the third-party dependent file is a jar package, the method can filter the jar package based on the detection whitelist to obtain a pom.xml file to be analyzed. The rule of the whitelist filtering is to filter out system jar packages referenced by a Java process to avoid the system jar packages from participating in a vulnerability detection process of the third-party dependent jar package.

[0151] S306, analyzing the to-be-analyzed dependent file to obtain an information file.

[0152] In this embodiment, when the to-be-analyzed file is a pom.xml file, the method can analyze the pom.xml file to obtain a dependencies block in the pom.xml file and take the dependencies block as the information file.

[0153] In this embodiment, the pom.xml file is a basic work unit of a Maven project (a packaging tool of a jar package), and the file contains basic information of a project, is used to describe how to build the project, and declares project dependencies.

[0154] S307, obtaining a first Maven coordinate of the to-be-analyzed file from the information file.

[0155] In this embodiment, the method can analyze each dependency block obtained by the analysis again to obtain a first Maven coordinate including a group ID, an artifact ID, and a version. The first Maven coordinate is a Maven coordinate of the jar package (i.e., the third-party dependent file), and the coordinate is used to uniquely determine information of the jar package.

[0156] S308, analyzing a dependent part in the information file to obtain an analysis result.

[0157] S309, determining a second Maven coordinate of a third-party dependent package depended on by the to-be-analyzed file according to the analysis result.

[0158] In this embodiment, the method can analyze the dependent part in the pom.xml file to obtain a second Maven coordinate of a third-party dependent package depended on by the current jar package (i.e., the third-party dependent file). The Maven coordinate includes a group ID, an artifact ID, and a version of the third-party dependent package.

[0159] S310, aggregate the first Maven coordinate and the second Maven coordinate to obtain a target Maven coordinate.

[0160] S311, based on the target Maven coordinate, determine whether the preset third-party dependency vulnerability data source includes the to-be-detected vulnerability.

[0161] In this embodiment, the method can first determine the consistency of the comparison subject by using the groupID and artifactID, and then compare the versions to determine whether the versions are the same, so as to determine whether the third-party dependency vulnerability data source includes the to-be-detected vulnerability. If the current jar package or the third-party dependency package depended by the jar package is vulnerable, it is directly determined that the to-be-parsed file has the to-be-detected vulnerability; otherwise, it is determined that the to-be-parsed file does not have the to-be-detected vulnerability.

[0162] S312, if the third-party dependency vulnerability data source includes the to-be-detected vulnerability, it is determined that the second detection result is that the to-be-parsed file has the to-be-detected vulnerability; if the third-party dependency vulnerability data source does not include the to-be-detected vulnerability, it is determined that the second detection result is that the to-be-parsed file does not have the to-be-detected vulnerability.

[0163] Please refer to Figure 7 , Figure 7 a third-party dependency vulnerability detection flowchart is shown. Specifically, Figure 7 a Java software vulnerability detection flowchart is shown. The flowchart matches steps S304-S312.

[0164] S313, performing vulnerability detection based on the open source software information to obtain a third detection result.

[0165] S314, combining the first detection result, the second detection result, and the third detection result to generate a vulnerability detection result.

[0166] As an optional implementation, after the step of combining the first detection result, the second detection result, and the third detection result to generate a vulnerability detection result, the method further includes:

[0167] obtaining a vulnerability detection script, and detecting the to-be-detected vulnerability based on the vulnerability detection script to obtain a deep detection result;

[0168] updating the vulnerability detection result based on the deep detection result.

[0169] In this embodiment, the execution subject of the method can be a computer, a server, or other computing devices, which are not limited in this embodiment.

[0170] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer or the like smart device, and the embodiment is not limited in this aspect.

[0171] It can be seen that the vulnerability detection method described in this embodiment can improve the comprehensiveness of vulnerability detection, so that it can not only detect the vulnerabilities of application software with network services through network packet sending, but also collect necessary information for vulnerability detection on a terminal host to perform vulnerability detection, so that the range and types of vulnerability detection are wider and the flexibility is higher. At the same time, the vulnerability detection script can be used to be sent to the terminal host for running, so as to detect vulnerabilities more accurately for some vulnerabilities with preconditions or complex vulnerability detection, thereby improving the accuracy of vulnerability detection. Finally, the corresponding necessary information collected at the beginning can be located on the terminal host based on the detected vulnerabilities, so as to achieve the effect of effectively locating the vulnerability points, thereby facilitating timely repair.

[0172] Embodiment 4

[0173] Please refer to Figure 8 , Figure 8 A flowchart of a vulnerability detection method provided in this embodiment is shown. The vulnerability detection method includes the following steps.

[0174] S401, obtaining a vulnerability to be detected.

[0175] S402, when there is no vulnerability detection script in the vulnerability detection script library that matches the vulnerability to be detected, collecting Linux software package information, third-party dependency information and open source software information corresponding to the vulnerability to be detected.

[0176] S403, performing vulnerability detection based on the Linux software package information to obtain a first detection result.

[0177] S404, performing vulnerability detection based on the third-party dependency information to obtain a second detection result.

[0178] S405, identifying open source software corresponding to the open source software information.

[0179] S406, obtaining process information corresponding to the open source software.

[0180] In this embodiment, the method can first obtain all running processes in the Linux terminal, and filter out open source software processes from all running processes, such as MySQL service processes, Apache HTTPD service processes, Apache Tomcat service processes and the like.

[0181] S407, determining the software version of the open source software based on the process information.

[0182] In this embodiment, the method can obtain the version information of the open source software through an open source software process. The obtaining method is different for different open source software. For example:

[0183] (1) When facing a static open source software, the method can obtain the version information by reading the version information in the process file.

[0184] (2) When facing a dynamic open source software, the method can obtain the version information by dynamically running the related version parameters of the open source software process file.

[0185] S408, judge whether the software version is included in the vulnerability universal enumeration platform information.

[0186] In this embodiment, the method can obtain CPE information matched with the to-be-detected vulnerability, and determine whether the software version of the open source software is included in the CPE information. If yes, it means that the open source software has a vulnerability; otherwise, it means that the open source software does not have a vulnerability.

[0187] In this embodiment, the CPE information is a method of naming software applications, operating systems and hardware in a standardized manner. Generally, when NVD (National Vulnerability Database) publishes vulnerability-related CVE information (Common Vulnerabilities and Exposures), it also publishes CPE information affected by the vulnerability CVE.

[0188] S409, if the software version is included in the vulnerability universal enumeration platform information, it is determined that the third detection result is that the open source software has the to-be-detected vulnerability; if the software version is not included in the vulnerability universal enumeration platform information, it is determined that the third detection result is that the open source software does not have the to-be-detected vulnerability.

[0189] Please refer to Figure 9 , Figure 9 An open source software vulnerability detection flowchart is shown, which matches steps S405-S409.

[0190] S410, combining the first detection result, the second detection result and the third detection result, a vulnerability detection result is generated.

[0191] As an optional implementation, after the step of combining the first detection result, the second detection result and the third detection result to generate the vulnerability detection result, the method further includes:

[0192] Obtain a vulnerability detection script, and detect the to-be-detected vulnerability based on the vulnerability detection script to obtain a deep detection result;

[0193] Update the vulnerability detection result based on the deep detection result.

[0194] In this embodiment, the execution subject of the method can be a computer, a server, or the like computing device, which is not limited in this embodiment.

[0195] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or the like smart device, which is not limited in this embodiment.

[0196] It can be seen that by implementing the vulnerability detection method described in this embodiment, the comprehensiveness of vulnerability detection can be improved, so that it can not only detect application software vulnerabilities with network services through network packet sending, but also collect necessary information for vulnerability detection on terminal hosts to perform vulnerability detection, so that the range and types of vulnerability detection are wider and more flexible. At the same time, vulnerability detection scripts can be used to be sent to terminal hosts for running, so as to detect vulnerabilities more accurately for some vulnerabilities with preconditions or complex vulnerability detection, thereby improving the accuracy of vulnerability detection. Finally, the corresponding necessary information collected at the beginning can be located on the terminal host based on the detected vulnerabilities, so as to achieve the effect of effectively locating the vulnerability point, thereby facilitating timely repair.

[0197] Embodiment 5

[0198] This embodiment provides an example flow of a vulnerability detection method, which is as follows:

[0199] S501, build an environment.

[0200] Specifically, two Linux terminal hosts (A terminal host and B terminal host) and one vulnerability detection server are selected. The A terminal host is installed with an Ubuntu 22.04.3LTS (Jammy Jellyfish) operating system, and a policykit-1 software package exists on the A terminal host, the version of the software package is 0.105-31, and a jar package containing a log4j2 third-party dependency is built using springboot, and the version of log4j2 is 2.14.0. The B terminal host does not limit the Linux operating system distribution, and an Apache HTTPD service is deployed and installed on the B terminal host, the installation version is 2.4.49, and Apache Activemq is installed, the installation version is 5.11.0, and the Fileserver web application (file service WEB application) in Activemq is closed.

[0201] S502, collect information on the A and B terminal hosts using a proxy program.

[0202] Specifically, the A terminal host is used to collect Linux software package information and third-party dependency information;

[0203] The B terminal host is used to collect open source software information.

[0204] S503, collecting and analyzing scheduling.

[0205] Specifically as follows: (1) judging that the A terminal host belongs to the debian distribution, the A terminal host obtains the policykit-1 package information through the dpkg program interface or / var / lib / dpkg database, obtains the package name, architecture, version and description information.

[0206] (2) the A terminal host obtains all running processes, filters out the Java process, obtains the jar package file referenced by the process file descriptor, filters out the executable jar package referenced by springboot through whitelist filtering, parses the POM file in the jar package, extracts the dependency information therein, obtains the dependency log4j2 component of the jar package, and obtains the groupId, artifactId and version of the dependency.

[0207] (3) the A terminal host obtains all running processes, filters out the open source software service processes: Apache HTTPD, Apache Activemq, and obtains the open source software version information.

[0208] S504, obtaining the collection result.

[0209] The collection result is shown in Table 1.

[0210] Table 1 collection result

[0211]

[0212] S505, pulling vulnerability library information.

[0213] Specifically, the vulnerability library information can refer to Table 2.

[0214] Table 2 database information

[0215]

[0216] S506, performing vulnerability detection.

[0217] Specifically as follows: (1) the version of the software package policykit-1 on the A terminal host is 0.105-31, which is less than 0.105-31.1, so there is a vulnerability CVE-2021-4034.

[0218] (2) A terminal host depends on the log4j-core version on the terminal host, which is 2.14.0, and is in the interval [2.13.0, 2.15.0), so there is a vulnerability CVE-2021-44228.

[0219] (3) The open source software Apache HTTPD version on the B terminal host is 2.4.49, which meets the assets described in the vulnerability CPE, so there is a vulnerability CVE-2021-41773.

[0220] (4) The open source software Apache Activemq version on the B terminal host is 5.11.0, which meets the assets described in the vulnerability CPE, so there is a vulnerability CVE-2016-3088.

[0221] S507, retrieve the vulnerability detection script library.

[0222] Specifically, (1) the vulnerability detection script is detected on the vulnerability detection server, and it is found that there is a vulnerability detection script of CVE-2016-3088.

[0223] (2) is issued to the B terminal host and is run through the proxy program.

[0224] (3) The vulnerability detection script finds that the Fileserver web application (file service WEB application) in the Apache Activemq affected by the vulnerability CVE-2016-3088 on the B terminal host is closed, which causes the key condition of the vulnerability not to be met, and the vulnerability does not exist.

[0225] (4) The proxy program reports the result to the vulnerability detection script library.

[0226] S508, the output of the vulnerability detection script library can obtain the final result.

[0227] Specifically, (1) the A terminal host has vulnerabilities CVE-2021-4034 and CVE-2021-44228;

[0228] (2) The B terminal host has a vulnerability CVE-2021-41773.

[0229] In this embodiment, the execution subject of the method can be a computer, a server, or the like. In this embodiment, no limitation is made to this.

[0230] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or the like. In this embodiment, no limitation is made to this.

[0231] It can be seen that the vulnerability detection method described in the embodiment can improve the comprehensiveness of vulnerability detection, so that it can not only detect the vulnerability of application software with network service through network packet sending, but also collect necessary information for vulnerability detection on the terminal host to detect the vulnerability, so that the range and type of vulnerability detection are wider and the flexibility is higher. At the same time, the vulnerability detection script can be used to be sent to the terminal host for running, so as to detect the vulnerability more accurately for some vulnerabilities with preconditions or complex vulnerability detection, thereby improving the accuracy of vulnerability detection. Finally, the corresponding necessary information collected at the beginning can be located on the terminal host based on the detected vulnerability, so as to realize the effect of effectively locating the vulnerability point, thereby facilitating timely repair.

[0232] Embodiment 6

[0233] Please refer to Figure 10 , Figure 10 The vulnerability detection device provided in the embodiment is shown in a structural schematic diagram. As shown in Figure 10 , the vulnerability detection device comprises:

[0234] The acquisition unit 610 is configured to acquire a vulnerability to be detected.

[0235] The judgment unit 620 is configured to judge whether there is a vulnerability detection script matched with the vulnerability to be detected in the vulnerability detection script library.

[0236] The detection unit 630 is configured to acquire the vulnerability detection script when there is the vulnerability detection script in the vulnerability detection script library, and detect the vulnerability to be detected based on the vulnerability detection script to obtain a vulnerability detection result.

[0237] The detection unit 640 is further configured to perform vulnerability detection in a manner of asset version matching when there is no vulnerability detection script in the vulnerability detection script library to obtain a vulnerability detection result.

[0238] In the embodiment, the explanation and description of the vulnerability detection device can refer to the description in the embodiment 1 or the embodiment 2, and the embodiment will not be described any more.

[0239] It can be seen that the implementation of the vulnerability detection device described in this embodiment can improve the comprehensiveness of vulnerability detection, so that it can not only detect vulnerabilities in application software with network services through network packet transmission, but also perform vulnerability detection by collecting the necessary information for vulnerability detection on the terminal host, thereby making the scope and types of vulnerability detection wider and more flexible. At the same time, it is also possible to use vulnerability detection scripts to be sent to the terminal host for execution, so as to detect vulnerabilities more accurately for some applications that have vulnerability exploitation preconditions or more complex vulnerability detection, thereby improving the accuracy of vulnerability detection. Finally, it is also possible to locate the corresponding necessary information originally collected on the terminal host based on the detected vulnerability, thereby achieving the effect of effectively locating the vulnerability point, thereby facilitating timely repair.

[0240] Example 7

[0241] Please see Figure 11 , Figure 11 This is a schematic diagram of the structure of a vulnerability detection device provided in this embodiment. Figure 11 As shown, the vulnerability detection device includes:

[0242] An acquisition unit 610 is used to acquire a vulnerability to be detected;

[0243] The determination unit 620 is configured to determine whether there is a vulnerability detection script matching the vulnerability to be detected in the vulnerability detection script library;

[0244] The detection unit 630 is configured to obtain the vulnerability detection script when a vulnerability detection script exists in the vulnerability detection script library, and detect the vulnerability to be detected based on the vulnerability detection script to obtain a vulnerability detection result;

[0245] The detection unit 640 is further configured to perform vulnerability detection by asset version matching to obtain vulnerability detection results when the vulnerability detection script does not exist in the vulnerability detection script library.

[0246] As an optional implementation, the vulnerability detection device further includes:

[0247] The detection unit 640 is further configured to perform vulnerability detection by asset version matching, obtain a vulnerability detection script after obtaining a vulnerability detection result, and detect the vulnerability to be detected based on the vulnerability detection script to obtain a deep detection result;

[0248] The updating unit 650 is configured to update the vulnerability detection result based on the deep detection result.

[0249] As an optional implementation, the detection unit 640 includes:

[0250] The collection sub-unit 641 is configured to collect Linux package information, third-party dependency information, and open source software information corresponding to the vulnerability to be detected.

[0251] The first detection sub-unit 642 is configured to perform vulnerability detection based on the Linux package information, to obtain a first detection result.

[0252] The second detection sub-unit 643 is configured to perform vulnerability detection based on the third-party dependency information, to obtain a second detection result.

[0253] The third detection sub-unit 644 is configured to perform vulnerability detection based on the open source software information, to obtain a third detection result.

[0254] The generation sub-unit 645 is configured to combine the first detection result, the second detection result, and the third detection result, to generate a vulnerability detection result.

[0255] As an optional implementation, the first detection sub-unit 642 includes:

[0256] The first determination module is configured to determine a Linux release version corresponding to the Linux package information.

[0257] The first determination module is further configured to determine a vulnerability patch corresponding to the vulnerability to be detected, and to obtain a Linux repair version range corresponding to the vulnerability patch.

[0258] The first judgment module is configured to determine whether the Linux release version is included in the Linux repair version range.

[0259] The first determination module is configured to determine that the first detection result is that the Linux package has a vulnerability when the Linux release version is not included in the Linux repair version range.

[0260] As an optional implementation, the first determination module is specifically configured to obtain an OVAL document, and to determine the vulnerability patch corresponding to the vulnerability to be detected in the OVAL document.

[0261] The first determination module is specifically further configured to extract the Linux repair version range corresponding to the vulnerability patch from the OVAL document.

[0262] As an optional implementation, the second detection sub-unit 643 includes:

[0263] The second determination module is configured to determine a third-party dependency file corresponding to the third-party dependency information.

[0264] The filtering module is configured to filter out system files in the third-party dependent file based on a preset filtering rule and a preset detection whitelist, to obtain a to-be-resolved dependent file.

[0265] The resolving module is configured to resolve the to-be-resolved dependent file, to obtain an information file.

[0266] The first obtaining module is configured to obtain, from the information file, a first Maven coordinate of the to-be-resolved file.

[0267] The resolving module is further configured to resolve a dependent part in the information file, to obtain a resolving result.

[0268] The second determining module is further configured to determine, according to the resolving result, a second Maven coordinate of a third-party dependent package on which the to-be-resolved file depends.

[0269] The summarizing module is configured to summarize the first Maven coordinate and the second Maven coordinate, to obtain a target Maven coordinate.

[0270] The second judging module is configured to judge, based on the target Maven coordinate, whether the preset third-party dependent vulnerability data source includes the to-be-detected vulnerability.

[0271] The second determining module is configured to determine that the second detection result is that the to-be-detected vulnerability exists in the to-be-resolved file, when the third-party dependent vulnerability data source includes the to-be-detected vulnerability.

[0272] As an optional implementation, the third detection subunit 644 includes:

[0273] The identifying module is configured to identify an open source software corresponding to the open source software information.

[0274] The second obtaining module is configured to obtain process information corresponding to the open source software.

[0275] The third determining module is configured to determine a software version of the open source software based on the process information.

[0276] The third judging module is configured to judge whether the software version is included in the vulnerability universal enumeration platform information.

[0277] The third determining module is configured to determine that the third detection result is that the to-be-detected vulnerability exists in the open source software, when the software version is included in the vulnerability universal enumeration platform information.

[0278] In this embodiment, the explanation and description of the vulnerability detection device can refer to the description in Embodiment 1 or Embodiment 2, and no more details are added in this embodiment.

[0279] It can be seen that the vulnerability detection device described in the embodiment can improve the comprehensiveness of vulnerability detection, so that it can not only detect the vulnerability of application software with network service through network packet sending, but also collect necessary information for vulnerability detection on the terminal host to detect the vulnerability, so that the range and type of vulnerability detection are wider and the flexibility is higher. At the same time, the vulnerability detection script can be used to be sent to the terminal host for running, so as to detect the vulnerability more accurately for some vulnerabilities with preconditions or complex vulnerability detection, thereby improving the accuracy of vulnerability detection. Finally, the corresponding necessary information collected at the beginning can be located on the terminal host based on the detected vulnerability, so as to realize the effect of effectively locating the vulnerability point, thereby facilitating timely repair.

[0280] The embodiment of the present application provides an electronic device, comprising a memory and a processor, the memory is used for storing a computer program, and the processor runs the computer program to make the electronic device execute the vulnerability detection method in the embodiment 1 or the embodiment 2 of the present application.

[0281] The embodiment of the present application provides a computer readable storage medium, which stores computer program instructions, and the computer program instructions are read and run by a processor to execute the vulnerability detection method in the embodiment 1 or the embodiment 2 of the present application.

[0282] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are only schematic. For example, the flowchart and block diagram in the drawings show the possible implementation architecture, function and operation of the device, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from those described in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for executing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0283] In addition, each functional module in the various embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0284] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0285] The above only describes the embodiments of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0286] The above only describes the embodiments of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0287] It should be noted that, in this document, relational terms such as first and second, and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without limitation, an element preceded by "comprises... a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1. A vulnerability detection method, characterized in that: The method comprises: Get the vulnerability to be detected; Determine whether there is a vulnerability detection script matching the vulnerability to be detected in the vulnerability detection script library; When the vulnerability detection script exists in the vulnerability detection script library, the vulnerability detection script is obtained, and the vulnerability to be detected is detected based on the vulnerability detection script to obtain a vulnerability detection result; When the vulnerability detection script does not exist in the vulnerability detection script library, vulnerability detection is performed by asset version matching to obtain vulnerability detection results; The vulnerability detection is performed by matching asset versions to obtain vulnerability detection results, including: Collect Linux software package information, third-party dependency information, and open source software information corresponding to the vulnerability to be detected; Perform vulnerability detection based on the Linux software package information to obtain a first detection result; Perform vulnerability detection based on the third-party dependency information to obtain a second detection result; Perform vulnerability detection based on the open source software information to obtain a third detection result; Combining the first detection result, the second detection result, and the third detection result to generate a vulnerability detection result; The performing vulnerability detection based on the third-party dependency information to obtain a second detection result includes: Determining a third-party dependency file corresponding to the third-party dependency information; Based on the preset filtering rules and the preset detection whitelist, the system files in the third-party dependent files are filtered out to obtain the dependent files to be parsed; Parsing the dependency file to be parsed to obtain an information file; Obtain the first Maven coordinate of the dependency file to be parsed from the information file; Parsing the dependency part in the information file to obtain a parsing result; Determine the second Maven coordinates of the third-party dependency package that the dependency file to be parsed depends on according to the parsing result; Summarizing the first Maven coordinates and the second Maven coordinates to obtain the target Maven coordinates; Based on the target Maven coordinates, determining whether a preset third-party dependency vulnerability data source includes the vulnerability to be detected; If the third-party dependency vulnerability data source includes the vulnerability to be detected, then it is determined that the second detection result is that the vulnerability to be detected exists in the dependency file to be parsed.

2. The vulnerability detection method according to claim 1, wherein: After performing vulnerability detection by asset version matching and obtaining vulnerability detection results, the method further includes: Obtain the vulnerability detection script, and detect the vulnerability to be detected based on the vulnerability detection script to obtain a deep detection result; Based on the deep detection result, the vulnerability detection result is updated.

3. The vulnerability detection method according to claim 1, wherein: The performing vulnerability detection based on the Linux software package information to obtain a first detection result includes: Determine the Linux distribution version corresponding to the Linux software package information; Determine a vulnerability patch corresponding to the vulnerability to be detected, and obtain a Linux repair version range corresponding to the vulnerability patch; Determine whether the Linux distribution version is included in the Linux repair version range; If the Linux repair version range does not include the Linux distribution version, then the first detection result is determined to be that a vulnerability exists in the Linux software package; and the Linux software package corresponds to the Linux software package information.

4. The vulnerability detection method according to claim 3, characterized in that: Determining a vulnerability patch corresponding to the vulnerability to be detected and obtaining a Linux repair version range corresponding to the vulnerability patch includes: Obtain an OVAL document, and determine a vulnerability patch corresponding to the vulnerability to be detected in the OVAL document; Extract the Linux repair version range corresponding to the vulnerability patch from the OVAL document.

5. The vulnerability detection method according to claim 1, wherein: The performing vulnerability detection based on the open source software information to obtain a third detection result includes: Identifying the open source software corresponding to the open source software information; Obtaining process information corresponding to the open source software; determining a software version of the open source software based on the process information; Determining whether the vulnerability general enumeration platform information includes the software version; If the vulnerability general enumeration platform information includes the software version, it is determined that the third detection result is that the open source software has the vulnerability to be detected.

6. A vulnerability detection device, characterized in that: The vulnerability detection device comprises: An acquisition unit, used to acquire vulnerabilities to be detected; A determination unit, configured to determine whether there is a vulnerability detection script matching the vulnerability to be detected in a vulnerability detection script library; a detection unit, configured to obtain the vulnerability detection script when the vulnerability detection script exists in the vulnerability detection script library, and detect the vulnerability to be detected based on the vulnerability detection script to obtain a vulnerability detection result; The detection unit is further configured to, when the vulnerability detection script does not exist in the vulnerability detection script library, perform vulnerability detection by asset version matching to obtain a vulnerability detection result; Wherein, the detection unit includes: A collection subunit, used to collect Linux software package information, third-party dependency information, and open source software information corresponding to the vulnerability to be detected; A first detection subunit is configured to perform vulnerability detection based on Linux software package information to obtain a first detection result; A second detection subunit is configured to perform vulnerability detection based on the third-party dependency information to obtain a second detection result; A third detection subunit is used to perform vulnerability detection based on the open source software information to obtain a third detection result; A generating subunit, configured to generate a vulnerability detection result by combining the first detection result, the second detection result, and the third detection result; Wherein, the second detection subunit includes: A second determining module is used to determine a third-party dependency file corresponding to the third-party dependency information; The filtering module is used to filter out system files from third-party dependency files based on preset filtering rules and a preset detection whitelist, and obtain dependency files to be parsed; The parsing module is used to parse the dependent files to be parsed and obtain information files; A first acquisition module is used to obtain the first Maven coordinates of the dependency file to be parsed from the information file; The parsing module is also used to parse the dependency part in the information file and obtain the parsing result; The second determination module is further used to determine the second Maven coordinates of the third-party dependency package that the dependency file to be parsed depends on according to the parsing result; A summarizing module, configured to summarise the first Maven coordinates and the second Maven coordinates to obtain the target Maven coordinates; The second judgment module is used to judge whether the preset third-party dependency vulnerability data source includes the vulnerability to be detected based on the target Maven coordinates; The second determination module is configured to determine, when the third-party dependency vulnerability data source includes the vulnerability to be detected, that the second detection result is that the vulnerability to be detected exists in the dependency file to be parsed.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the vulnerability detection method according to any one of claims 1 to 5.

8. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the vulnerability detection method according to any one of claims 1 to 5 is executed.

Images