Vulnerability determination method and electronic device

Abstract

The embodiment of the present application discloses a vulnerability determination method, including obtaining software information of a target application software, matching the software information with a vulnerability database, and obtaining first vulnerability information of the target application software. Then, the first vulnerability information is matched with a patch database to obtain a patch file corresponding to the first vulnerability information. The patch file is compared with the source code file of the target application software to obtain a target patch file and a target vulnerability corresponding to the target patch file, wherein the target vulnerability represents an unrepaired vulnerability. By comparing the software information of the target application software with the vulnerability database and the patch database, unrepaired vulnerabilities and patch files can be determined so that users can download the patch file to repair the unrepaired vulnerabilities, thereby improving the efficiency of vulnerability repair.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to a vulnerability determination method and electronic device. Background Art

[0002] With the rapid development of computer technology and the widespread application of information technology by enterprises, security incidents such as network attacks and data leaks are becoming more frequent. In order to improve the security of computer information, various vulnerability scanning tools have emerged. Vulnerability scanning refers to a security detection behavior that detects the security vulnerabilities of computer systems through scanning and other means based on vulnerability databases to discover vulnerabilities. Through vulnerability scanning, vulnerabilities in computer systems and application software can be quickly identified.

[0003] However, current vulnerability scanning technology can only identify vulnerabilities that have been published in the vulnerability database, but cannot determine whether the vulnerability has been fixed. Based on this, users can only download all patch files to fix the vulnerability, resulting in low efficiency in vulnerability repair. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a vulnerability determination method and an electronic device so that a user can identify unrepaired vulnerabilities, thereby improving the efficiency of vulnerability repair.

[0005] In a first aspect, an embodiment of the present application provides a vulnerability determination method, the method comprising:

[0006] Acquire software information of target application software; the software information is used to identify the target application software;

[0007] Based on matching the software information with a vulnerability database, obtaining first vulnerability information of the target application software; wherein the vulnerability database includes vulnerability information of published vulnerabilities of application software;

[0008] Matching the first vulnerability information with a patch database to obtain a patch file corresponding to the first vulnerability information; wherein the patch database includes patch file information corresponding to the released vulnerabilities of the application software;

[0009] The patch file is compared with the source code file of the target application software to determine the target patch file and the target vulnerability corresponding to the target patch file; wherein the target patch file is a patch file that is not used to repair the source code file of the target application software; the target vulnerability represents an unrepaired vulnerability. By comparing the software information of the target application software with the vulnerability database and the patch database, the unrepaired vulnerability and patch file can be determined, so that the user can download the patch file to repair the unrepaired vulnerability, thereby improving the efficiency of vulnerability repair.

[0010] In a possible implementation, the acquiring software information of the target application software includes:

[0011] Obtaining a software package of the target application software;

[0012] The software package is parsed to obtain software information of the software package; wherein the software information includes a first software identifier and a first version identifier.

[0013] In a possible implementation, the vulnerability information in the vulnerability database includes a second software identifier, a second version identifier, and a first vulnerability identifier corresponding to the application software with a published vulnerability;

[0014] The step of obtaining first vulnerability information of the target application software based on matching the application software information with a vulnerability database includes:

[0015] Matching the first software identifier and the first version identifier of the software package with the second software identifier and the second version identifier in the vulnerability database to determine a first target software identifier and a first target version identifier;

[0016] Determine a first target vulnerability identifier based on the first target software identifier and the first target version identifier;

[0017] The first target software identifier, the first target version identifier, and the first target vulnerability identifier are determined as the first vulnerability information. The vulnerability information of the published vulnerabilities of the application software is stored in the vulnerability database, including the second software identifier, the second version identifier, and the first vulnerability identifier, so that the vulnerability information of different application software can be determined based on different identifiers, and the storage and search of vulnerabilities can be facilitated.

[0018] In a possible implementation, the patch file information includes a third software identifier, a third version identifier, a second vulnerability identifier, and a patch file identifier corresponding to the application software with a published vulnerability;

[0019] The matching the first vulnerability information with a patch database to obtain a patch file corresponding to the first vulnerability information includes:

[0020] Matching the first target software identifier, the first target version identifier, and the first target vulnerability identifier with the third software identifier, the third version identifier, and the second vulnerability identifier in the patch database to determine the second target software identifier, the second target version identifier, and the second target vulnerability identifier;

[0021] Determine a target patch file identifier based on the second target software identifier, the second target version identifier, and the second target vulnerability identifier;

[0022] Obtain the patch file corresponding to the target patch file identifier.

[0023] The patch file information of the published vulnerabilities is stored in the patch database, including the third software identifier, the third version identifier, the second vulnerability identifier and the patch file identifier, and the correspondence between the application software, the vulnerability and the patch file is determined, so as to facilitate the search for the patch file corresponding to the vulnerability of the application software based on the identifier.

[0024] In a possible implementation, the method further includes:

[0025] Establishing an initial vulnerability information table based on software information of the target application software;

[0026] Add the first vulnerability information to the vulnerability information table to obtain a first vulnerability information table;

[0027] Based on the target vulnerability, repair information is added to the first vulnerability information table to obtain a vulnerability information table, wherein the repair information is used to indicate whether the vulnerability has been repaired.

[0028] By establishing a vulnerability information table to store the software information of the target application software and the vulnerability repair information, users can intuitively understand the vulnerability information related to the application software in the form of a table. Later, the vulnerability database and patch database can be directly matched according to the vulnerability information table to obtain the unrepaired vulnerabilities and corresponding patch files to improve the efficiency of vulnerability repair.

[0029] In a possible implementation, the method further includes:

[0030] Regularly collecting statistics on vulnerability information and / or patch file information of the target application software;

[0031] The vulnerability database is updated according to the statistical vulnerability information, and / or the patch database is updated according to the statistical patch file information.

[0032] In actual applications, there may be more than one user using the target application software, so it is possible to periodically obtain vulnerability information discovered when external devices use the target application software, as well as patch file information for repairing the vulnerabilities, and update the vulnerability database based on the vulnerability information obtained statistically, and update the patch database based on the patch file information obtained statistically, thereby making the vulnerability information and patch file information of the target application software more complete.

[0033] In a possible implementation, the method further includes:

[0034] The vulnerability information table is matched with an updated vulnerability database and / or an updated patch database, and the vulnerability information and / or repair information in the vulnerability information table is updated.

[0035] In a possible implementation, the method further includes:

[0036] Based on the vulnerability data information corresponding to the target patch file, searching whether there is a matching storage directory;

[0037] If it exists, storing the target patch file in the storage directory;

[0038] If it does not exist, a new directory is created based on the vulnerability data information corresponding to the target patch file, and the target patch file is stored in the new directory.

[0039] In a possible implementation, the method further includes:

[0040] Acquire the target patch file from the storage directory or the new directory;

[0041] The target vulnerability is repaired based on the target patch file.

[0042] Since the storage directory or the new directory only stores patch files for unpatched vulnerabilities, the target patch file can be directly obtained from the storage directory or the new directory, thereby patching the target vulnerability based on the target patch file, thereby improving the efficiency of vulnerability patching.

[0043] In a second aspect, an embodiment of the present application provides a vulnerability determination device, the device comprising:

[0044] A first acquisition unit, configured to acquire software information of a target application software; the software information is used to identify the target application software;

[0045] A first matching unit, configured to obtain first vulnerability information of the target application software by matching the software information with a vulnerability database; wherein the vulnerability database includes vulnerability information of published vulnerabilities of the application software;

[0046] A second matching unit is used to match the first vulnerability information with a patch database to obtain a patch file corresponding to the first vulnerability information; wherein the patch database includes patch file information corresponding to the vulnerabilities that have been released by the application software;

[0047] The second acquisition unit is used to compare the patch file with the source code file of the target application software to obtain the target patch file and the target vulnerability corresponding to the target patch file; wherein the target vulnerability represents an unrepaired vulnerability.

[0048] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising: a memory and a processor;

[0049] The memory is coupled to the processor; the memory is used to store program instructions; the processor is used to call the program instructions so that the computing device executes the vulnerability determination method described in any one of the implementations of the first aspect above.

[0050] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the vulnerability determination method described in any one of the implementations of the first aspect above.

[0051] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program / instructions. When the computer program / instructions are executed by a processor, the vulnerability determination method described in any one of the implementation methods of the first aspect is implemented.

[0052] It can be seen that the embodiments of the present application have the following beneficial effects:

[0053] In the above implementation of the embodiment of the present application, in order to scan and repair the vulnerabilities of the target application software, the software information of the target application software can be obtained, and the software information is used to identify the target application software. Based on the software information, the first vulnerability information of the target application software is obtained by matching with the vulnerability database. Among them, the vulnerability database includes the vulnerability information of the vulnerabilities that have been published by the application software. That is, the application software information is matched with each vulnerability information in the vulnerability database to determine the first vulnerability information of the target application software. Then the first vulnerability information is matched with the patch database to obtain the patch file corresponding to the first vulnerability information, wherein the patch database includes the patch file information corresponding to the vulnerabilities that have been published by the application software. That is, the first vulnerability information is matched with each patch file information in the patch database to determine the patch file corresponding to the first vulnerability information. The patch file determined above is compared with the source code file of the target application software to obtain the target patch file and the target vulnerability corresponding to the target patch file, the target vulnerability means the vulnerability that has not been repaired, and the target patch file is the patch file that repairs the target vulnerability. Through the method provided in this application, the software information of the target application software is compared with the vulnerability database and the patch database, and the unrepaired vulnerabilities and patch files can be determined, so that users can download the patch files to repair the unrepaired vulnerabilities, thereby improving the efficiency of vulnerability repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. It is obvious that the drawings described below are only some embodiments provided in the present application, and a person skilled in the art can also obtain other drawings based on these drawings.

[0055] Figure 1 A flowchart of a vulnerability determination method provided in an embodiment of the present application;

[0056] Figure 2 A flowchart of another vulnerability determination method provided in an embodiment of the present application;

[0057] Figure 3 A flow chart of a method for updating a vulnerability database and a patch database provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of a vulnerability determination device provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The described embodiments are only exemplary implementation methods of the present application, not all implementation methods. Those skilled in the art can combine the embodiments of the present application to obtain other embodiments without creative work, and these embodiments are also within the scope of protection of the present application.

[0061] With the rapid development of computer technology and the widespread application of information technology by enterprises, security incidents such as network attacks and data leaks are becoming more frequent. In order to improve the security of computer information, various vulnerability scanning tools have emerged. Vulnerability scanning refers to a security detection behavior that detects the security vulnerabilities of computer systems through scanning and other means based on vulnerability databases to discover vulnerabilities. Through vulnerability scanning, vulnerabilities in computer systems and application software can be quickly identified.

[0062] For example, for application software, vulnerability scanning technology can only identify the vulnerabilities of the application software that have been published in the vulnerability database, but cannot determine whether these vulnerabilities have been fixed. Therefore, users can only download all patch files to fix the vulnerabilities, resulting in low efficiency in vulnerability repair.

[0063] Based on this, the embodiment of the present application provides a vulnerability scanning method so that users can identify unrepaired vulnerabilities, thereby improving the efficiency of vulnerability repair. In specific implementation, in order to realize vulnerability scanning and repair of target application software, the software information of the target application software can be obtained, and the first vulnerability information of the target application software can be obtained based on the software information and the vulnerability database. Among them, the vulnerability database includes vulnerability information of the vulnerabilities that have been published by the application software. That is, the application software information is matched with each vulnerability information in the vulnerability database to determine the first vulnerability information of the target application software. Then the first vulnerability information is matched with the patch database to obtain the patch file corresponding to the first vulnerability information, wherein the patch database includes the patch file information corresponding to the vulnerabilities that have been published by the application software. That is, the first vulnerability information is matched with each patch file information in the patch database to determine the patch file corresponding to the first vulnerability information. The patch file determined above is compared with the source code file of the target application software to obtain the target patch file and the target vulnerability corresponding to the target patch file, the target vulnerability means the vulnerability that has not been repaired, and the target patch file is the patch file that repairs the target vulnerability. Through the method provided in this application, the software information of the target application software is compared with the vulnerability database and the patch database, and the unrepaired vulnerabilities and patch files can be determined, so that users can download the patch files to repair the unrepaired vulnerabilities, thereby improving the efficiency of vulnerability repair.

[0064] In order to facilitate the understanding of the technical solution provided by the embodiments of the present application, a detailed introduction will be given below with reference to the accompanying drawings.

[0065] See also Figure 1 , Figure 1 A flow chart of a vulnerability scanning method provided in an embodiment of the present application.

[0066] The method may be executed by a processing device, wherein the processing device may be a device with a vulnerability scanning function, and may be a terminal or a server.

[0067] The method may include the following steps:

[0068] S101: Acquire software information of target application software.

[0069] The software information can be used to uniquely identify the target application software. Optionally, the software information of the target application software can be obtained by the following method: obtaining the software package of the target application software, parsing the software package, and obtaining the software information of the software package.

[0070] The software package may be a source package or a binary package of the target application software. The source package includes the source code of the target application software, and the binary package represents an executable program after the source package is compiled. Since the target application software may correspond to different versions after functional updates, the application software information corresponding to the target application software may be stored when the software package is stored.

[0071] By parsing the software package, the application software information corresponding to the target application software in the software package is obtained. In a possible implementation, the application software information may include information such as a first software identifier and a first version identifier. Among them, the first software identifier can be used to distinguish different application software. That is, each application software uniquely corresponds to a software identifier. For example, the first software identifier can be the name of the target application software, or other symbols used to uniquely identify the target application software. The first version identifier can represent the identifiers corresponding to different versions of the target application software. Specifically, the application software information of the target application software can be expressed as "A software, version II".

[0072] It should be noted that the application software information of the target application software is not limited to the above two representation methods, and other conceivable implementation methods are also within the protection scope of this application.

[0073] S102: Acquire first vulnerability information of the target application software based on matching the software information with the vulnerability database.

[0074] The vulnerability database includes vulnerability information of all published vulnerabilities of application software. By matching the application software information of the software package with the vulnerability information in the vulnerability database, the target vulnerability information corresponding to the target application software can be obtained.

[0075] In a possible implementation, the vulnerability database may be a vulnerability database for the target application software, that is, it may only include vulnerability information of the published vulnerabilities of the target application software. Alternatively, the vulnerability database may also represent a vulnerability database for multiple application software, including vulnerability information of the published vulnerabilities of each application software. That is, the vulnerability information includes the first vulnerability information. The above two situations may be introduced separately below.

[0076] (I) The vulnerability database includes vulnerability information of multiple application software vulnerabilities that have been published

[0077] In a possible implementation, when the vulnerability database includes vulnerability information of multiple application software's published vulnerabilities, it is necessary to classify and manage different application software. For example, the vulnerability database can manage the vulnerability information of application software according to software identification, version identification, vulnerability identification, etc.

[0078] Among them, the software identifier can represent the unique identifier corresponding to each application software, which is used to distinguish different application software. For example, the software identifier can be a software name or other symbols, which corresponds to the application software one by one. The version identifier is used to represent different versions of the same application software, and different versions can be application software that has undergone vulnerability repairs or functional updates. The version identifiers of different application software are also different. The vulnerability identifier can be used to distinguish multiple vulnerabilities found in each version of an application software, and a vulnerability can be uniquely identified through the vulnerability identifier. For example, version II of application software A corresponds to two vulnerabilities, and vulnerability 1 and vulnerability 2 can be used to represent these two vulnerabilities.

[0079] Based on this, the first vulnerability information of the target application software can be obtained in the following manner: the vulnerability database includes multiple second software identifiers, multiple second version identifiers and multiple first vulnerability identifiers, and the first software identifier and the first version identifier of the software package are matched with the multiple second software identifiers and the second version identifiers in the vulnerability database to determine the first target software identifier and the first target version identifier. That is, the second software identifier that matches the first software identifier can be determined as the first target software identifier, and the second version identifier that matches the first version identifier can be determined as the first target version identifier. Then, based on the first target software identifier and the first target version identifier, the first target vulnerability identifier is determined. Specifically, since the second software identifier, the second version identifier and the first vulnerability identifier in the vulnerability database have an associated relationship, after determining the first target software identifier and the first target version identifier, the first vulnerability identifier associated with the first target software identifier and the first target version identifier can be determined as the first target vulnerability identifier. The first target vulnerability identifier can be one or more vulnerability identifiers, that is, one or more vulnerabilities that have been released by the target application software are determined.

[0080] In a possible implementation, when storing vulnerability information of different application software, a progressive storage method can be used. For example, for application software A, the software identifier is determined to be application software A, and then all versions of application software A are obtained, and the version identifiers of each version are determined to be version I, version II, ..., and stored in association with application software A. In this storage method, it is impossible to distinguish which application software it belongs to based on the version identifier alone. Based on this, after determining the first target software identifier, all second version identifiers associated with the first target software identifier can be determined, and then among all the associated second version identifiers, the second version identifier that matches the first version identifier is determined as the first target version identifier.

[0081] In a possible implementation, the way in which the vulnerability database stores the first vulnerability information (vulnerability information) can be seen in Table 1, which shows the stored field names and field types. Among them, the field content corresponding to the field name represents the second software identifier, the field content corresponding to the field version represents the second version identifier, and the field content corresponding to the field cve_num represents the first vulnerability identifier, and the field types are all in string format. It should be noted that the field name is only used to identify the specific field content corresponding to the name field as the second software identifier, and does not limit the field content (second software identifier) ​​to name.

[0082] Table 1

[0083] Fields type name string version string cve_num string

[0084] (II) The vulnerability database only includes the first vulnerability information of the target application software's published vulnerabilities

[0085] In a possible implementation, when the vulnerability database includes only the first vulnerability information of the published vulnerability of the target application software, there is no need to store the software identifier of the target application software, that is, it can be managed according to vulnerability information such as version identifier and vulnerability identifier.

[0086] In a specific implementation, multiple second version identifiers and multiple first vulnerability identifiers can be obtained from the vulnerability database, and then the first version identifier of the software package can be matched with the multiple second version identifiers to determine the second version identifier that matches the first version identifier as the first target version identifier. Then, based on the association relationship between the second version identifier and the first vulnerability identifier, the first vulnerability identifier associated with the first target version identifier is determined as the first target vulnerability identifier.

[0087] S104: Match the first vulnerability information with a patch database to obtain a patch file corresponding to the target vulnerability information.

[0088] Among them, the patch database includes patch file information corresponding to the published vulnerabilities of the application software. The patch file can be a patch, which usually refers to a software update or repair used to solve known vulnerabilities, errors, other security or functional issues. By matching the first vulnerability information of the target application software with the patch file information in the patch database, all patch files used to repair the vulnerability represented by the vulnerability information can be obtained. That is, one vulnerability can correspond to one or more patch files.

[0089] In a possible implementation, the patch database may also be a patch database for the target application software, that is, it may only include patch file information for the published vulnerabilities of the target application software. Alternatively, the patch database may also be a patch database for multiple application software, including patch file information for the published vulnerabilities of each application software. The above two situations may be introduced separately below.

[0090] (I) The patch database includes patch file information for vulnerabilities released by multiple application software

[0091] In a possible implementation, when the patch database includes patch file information of multiple application software's published vulnerabilities, it is necessary to classify and manage different application software. For example, when storing patch file information, it can be divided into software identification, version identification, vulnerability identification, and patch file identification.

[0092] Among them, the software identifier can represent the unique identifier corresponding to each application software, which is used to distinguish different application software, and the software identifier corresponds to the application software one by one. The version identifier is used to represent different versions of the same application software, and the different versions may be application software that has undergone vulnerability repairs or functional updates. Each version of the application software may find multiple vulnerabilities, and the vulnerability identifier can be used to distinguish multiple vulnerabilities of a version, and each vulnerability identifier can uniquely identify a vulnerability. For any vulnerability (vulnerability identifier), multiple patch files may be used for repair or functional update, that is, the patch file identifier can be used to distinguish multiple patch files corresponding to a vulnerability, and each patch file identifier can uniquely identify a patch file.

[0093] Specifically, the patch file corresponding to the first vulnerability information can be obtained in the following manner: the patch database includes multiple third software identifiers, multiple third version identifiers, multiple second vulnerability identifiers and multiple patch file identifiers, and the first target software identifier, the first target version identifier and the first target vulnerability identifier of the target vulnerability information can be matched with multiple third software identifiers, third version identifiers and second vulnerability identifiers in the patch database to determine the second target software identifier, the second target version identifier and the second target vulnerability identifier. That is, the third software identifier matching the first target software identifier can be determined as the second target software identifier, the third version identifier matching the first target version identifier can be determined as the second target version identifier, and the second vulnerability identifier matching the first target vulnerability identifier can be determined as the second target vulnerability identifier. And based on the second target software identifier, the second target version identifier and the second target vulnerability identifier, the target patch file identifier is determined. Since the third software identifier, the third version identifier, the second vulnerability identifier and the patch file identifier in the patch database have an associated relationship, after determining the second target software identifier, the second target version identifier and the second target vulnerability identifier, the patch file identifier associated with the second target software identifier, the second target version identifier and the second target vulnerability identifier can be determined as the target patch file identifier. The target patch file identifier may be one or more patch file identifiers, so that the patch file corresponding to the target patch file identifier may be obtained.

[0094] In a possible implementation, the patch database stores patch file information in a manner as shown in Table 2, which shows the stored field names and field types. The field content corresponding to the field name represents the third software identifier, the field content corresponding to the field version represents the third version identifier, and the field content corresponding to the field cve_num represents the second vulnerability identifier, and the field types are all string strings. The field content corresponding to the field patch_num represents the patch file identifier, and the field type is an integer int.

[0095] Table 2

[0096] Fields type name string version string cve_num string patch_num int

[0097] (II) The patch database only includes patch file information for vulnerabilities that have been released for the target application software

[0098] In a possible implementation, when the patch database only includes patch file information of published vulnerabilities of the target application software, there is no need to store the software identifier of the target application software, that is, it can be managed based on patch file information such as version identifier, vulnerability identifier, patch file identifier, etc.

[0099] In specific implementation, multiple third version identifiers, multiple second vulnerability identifiers, and multiple patch file identifiers can be obtained from the patch database, and then the first target version identifier and the first target vulnerability identifier of the first vulnerability information can be matched with the multiple third version identifiers and the second vulnerability identifiers in the patch database, and the third version identifier that matches the first target version identifier is determined as the second target version identifier, and the second vulnerability identifier that matches the first target vulnerability identifier is determined as the second target vulnerability identifier. Then, based on the association relationship between the third version identifier, the second vulnerability identifier, and the patch file identifier in the patch database, the patch file identifier associated with the second target version identifier and the second target vulnerability identifier is determined as the target patch file identifier.

[0100] S105: Compare the patch file with the source code file of the target application software to obtain the target patch file and the target vulnerability corresponding to the target patch file.

[0101] A patch file can represent the content of repairing the code of the target application software. For any patch file, the patch file is compared with the related content in the source code file of the target application software. If the related content of the patch file is different from that of the source code file, it means that the patch file has not been used to repair the corresponding vulnerability, and the related content in the source code file has not been modified according to the patch file. The patch file can be determined as the target patch file, and the target vulnerability corresponding to the target patch file, that is, the vulnerability that has not been repaired, can be obtained.

[0102] In specific implementation, according to the above embodiments, after obtaining the target patch file, the patch file identifier corresponding to the target patch file can be determined, and then the vulnerability identifier associated with the patch file identifier can be determined based on the patch file information, and the vulnerability corresponding to the vulnerability identifier is the target vulnerability.

[0103] After determining the unpatched target vulnerability and the corresponding target patch file, the target patch file can be sent to the user, and the user can download and execute the target patch file to repair the unpatched vulnerability so as to use the target application software normally.

[0104] By using the method provided in the embodiment of the present application, the application software information of the software package is compared with the vulnerability database and the patch database, and the unrepaired vulnerabilities and the corresponding patch files can be determined, so that the user can only download the patch files of the unrepaired vulnerabilities and repair the unrepaired vulnerabilities, thereby improving the efficiency of vulnerability repair.

[0105] In a possible implementation, a vulnerability information table for the target application software can also be established based on the application software information of the target application software, the first vulnerability information and the determined target vulnerability, so that all published vulnerabilities of the target application software and the repair information of each published vulnerability, that is, the repaired vulnerabilities and the unrepaired vulnerabilities, can be intuitively understood based on the vulnerability information table.

[0106] In a specific implementation, firstly, an initial vulnerability information table is established based on the software information of the target application software. For example, the initial vulnerability information table includes the first software identifier and the first version identifier of the target application software. Then, after determining the first vulnerability information of the target application software, the first vulnerability information can be added to the initial vulnerability information table to obtain the first vulnerability information table. For example, the first target vulnerability identifier corresponding to the target application software is added to the initial vulnerability information table to obtain the first vulnerability information table. Then, for the target vulnerability corresponding to the method of the above embodiment, repair information is added to the first vulnerability information table to obtain the vulnerability information table. Among them, the repair information can be indicated as the vulnerability has been repaired or the vulnerability has not been repaired.

[0107] According to the above embodiment, the patch file corresponding to the target application software is compared with the source code file, and the obtained target patch file is represented as a patch file of the unrepaired vulnerability of the target application software, so it can be determined that the target vulnerability represents an unrepaired vulnerability, so the repair information corresponding to the target vulnerability is unrepaired, and the repair information corresponding to other vulnerabilities included in the first vulnerability information of the target application software is repaired. In a possible implementation, as shown in Table 3, the vulnerability information table may include the software identification field name, the version identification field version, the vulnerability identification field cve_num, and the repair information field is_repair of the target application software, wherein the value of the field is_repair includes false and true, false indicates unrepaired, and true indicates repaired. The repair information field is_repair corresponding to the target vulnerability determined according to the above embodiment has a value of false, indicating that the target vulnerability is an unrepaired vulnerability. The repair information field is_repair corresponding to other published vulnerabilities of the target application software other than the target vulnerability has a value of true, indicating a repaired vulnerability.

[0108] Table 3

[0109] Fields type name string version string cve_num string is_repair bool

[0110] The vulnerability information table reflects the first vulnerability information of the target application software and the repair information of the published vulnerability. Optionally, the patch file identifier corresponding to the published vulnerability can be added to the vulnerability information table based on the patch file information corresponding to the first vulnerability information, so as to facilitate the understanding of the patch file information used to repair each published vulnerability.

[0111] Based on this, the present application embodiment also provides a vulnerability determination method. Figure 2 As shown, it is a flow chart of another vulnerability scanning method provided in an embodiment of the present application.

[0112] The method may include the following steps:

[0113] S201: parsing the software package of the target application software to obtain software information;

[0114] The software information may include a software identifier and a version identifier of the target application software.

[0115] S202: Establishing an initial vulnerability information table based on software information;

[0116] S203: Acquire first vulnerability information of the target application software based on matching the initial vulnerability information table with the vulnerability database, and update the vulnerability information table according to the first vulnerability information to obtain a first vulnerability information table;

[0117] The first vulnerability information may include a software identifier, a version identifier, and an associated vulnerability identifier. That is, the first vulnerability information may be added to the initial vulnerability information table to obtain a first vulnerability information table, which includes published vulnerabilities of the target application software.

[0118] S204: Matching the first vulnerability information table with the patch database to determine at least one patch file and a corresponding target vulnerability;

[0119] The patch database may include software identifiers, version identifiers, vulnerability identifiers, and patch file identifiers. Each patch file identifier uniquely corresponds to a patch file for repairing the vulnerability.

[0120] S205: Update the repair information in the first vulnerability information table according to the target vulnerability to obtain a vulnerability information table.

[0121] S206: Send the vulnerability information table and the patch file to the user.

[0122] The repair information may indicate whether the published vulnerability of the target application software has been repaired. The specific implementation process may refer to the above method embodiment, which will not be described in detail here.

[0123] Through the method provided in the above embodiment, a vulnerability information table of the target application software can be established in advance, and then the vulnerability database and patch database can be intuitively matched according to the vulnerability information table to automatically obtain unrepaired vulnerabilities and corresponding patch files to improve the efficiency of vulnerability repair.

[0124] In a possible implementation, after obtaining at least one patch file of the target application software, the patch file may also be stored in a corresponding directory so that the user can find the corresponding patch file from the directory.

[0125] In specific implementation, you can search for a matching storage directory based on the vulnerability data information corresponding to the target patch file, such as software ID, version ID, vulnerability ID, etc. If it exists, the target patch file is stored in the matching storage directory; if it does not exist, a new directory is created based on the vulnerability data information corresponding to the target patch file, and the target patch file is stored in the new directory.

[0126] Since the storage directory or the new directory only stores patch files for unpatched vulnerabilities, the target patch file can be directly obtained from the storage directory or the new directory later, thereby patching the target vulnerability based on the target patch file.

[0127] In a possible implementation, since the vulnerability database stores the vulnerability information of the target application software and the patch database stores the patch file information of the target application software, in actual applications, there may be more than one user using the target application software, so the vulnerability information found when the external device uses the target application software and the patch file information for repairing the vulnerability can be obtained at regular intervals, and then the vulnerability database is updated according to the statistically obtained vulnerability information, and the patch database is updated according to the statistically obtained patch file information. For specific implementation, see Figure 3 As shown, it is a flow chart of a method for updating a vulnerability database and a patch database provided in an embodiment of the present application.

[0128] The method may include the following steps:

[0129] S301: Setting a timing statistics cycle;

[0130] S302: searching for associated vulnerability data to be processed and patch files to be processed according to the software identifier of the target application software at each regular statistical period;

[0131] S303: Compare the vulnerability data to be processed with the vulnerability information in the vulnerability database, and determine target vulnerability data in the vulnerability data to be processed that is different from the vulnerability information;

[0132] S304: Establish vulnerability information corresponding to the target vulnerability data and update the vulnerability database;

[0133] The vulnerability information may include the software identifier, version identifier and vulnerability identifier corresponding to the target vulnerability data. The software identifier is the existing software identifier of the target application software. The version identifier is determined according to the version of the target application software corresponding to the target vulnerability data. If it is an existing version of the target application software, the version identifier is the existing version identifier. If it is a new version of the target application software, a new version identifier is established for the target vulnerability data.

[0134] S305: Obtaining a patch file associated with the target vulnerability data;

[0135] S306: Determine whether there is a storage directory matching the patch file;

[0136] S307: If it does not exist, create a storage directory in the patch database to store the patch file;

[0137] The storage directory may include a software identifier, a version identifier, and a vulnerability identifier corresponding to the patch file.

[0138] S308: Create patch file information corresponding to the patch file and update the patch database;

[0139] The patch file information may include a software identifier, a version identifier, a vulnerability identifier, and a patch file identifier corresponding to the patch file.

[0140] S309: Compare the patch file to be processed with the patch database, determine the target patch file that does not exist in the patch database, and store the target patch file in a matching storage directory;

[0141] The target patch file may represent a new patch file corresponding to a previously released vulnerability of the target application software.

[0142] S310: Create patch file information according to the vulnerability information corresponding to the target patch file, and update the patch database according to the patch file information.

[0143] Through the method provided by the embodiment of the present application, the vulnerability database and the patch database can be updated regularly to improve the comprehensiveness of the target application software vulnerability repair. Subsequently, the vulnerability information table can also be matched with the updated vulnerability database and / or the updated patch database to update the vulnerability information and / or repair information in the vulnerability information table.

[0144] Based on the above method embodiment, the embodiment of the present application also provides a vulnerability scanning device.

[0145] See also Figure 4 , which is a schematic diagram of a vulnerability scanning device provided in an embodiment of the present application.

[0146] The apparatus 400 may include:

[0147] The first acquisition unit 401 is used to acquire software information of the target application software;

[0148] A first matching unit 402 is used to match the software information with a vulnerability database to obtain first vulnerability information of the target application software; wherein the vulnerability database includes vulnerability information of published vulnerabilities of application software;

[0149] The second matching unit 403 is used to match the first vulnerability information with a patch database to obtain a patch file corresponding to the first vulnerability information; wherein the patch database includes patch file information corresponding to the released vulnerabilities of the application software;

[0150] The second acquisition unit 404 is used to compare the patch file with the source code file of the target application software to obtain the target patch file and the target vulnerability corresponding to the target patch file; wherein the target vulnerability represents an unrepaired vulnerability.

[0151] In a possible implementation, the first acquisition unit 401 is specifically configured to acquire the software package of the target application software; parse the software package to acquire software information of the software package; wherein the software information includes a first software identifier and a first version identifier.

[0152] In a possible implementation, the vulnerability information in the vulnerability database includes a second software identifier, a second version identifier, and a first vulnerability identifier corresponding to the application software of the published vulnerability, and the first matching unit 402 is specifically used to match the first software identifier and the first version identifier of the software package with the second software identifier and the second version identifier in the vulnerability database to determine a first target software identifier and a first target version identifier; determine a first target vulnerability identifier based on the first target software identifier and the first target version identifier; and determine the first target software identifier, the first target version identifier, and the first target vulnerability identifier as the first vulnerability information.

[0153] In a possible implementation, the patch file information includes a third software identifier, a third version identifier, a second vulnerability identifier and a patch file identifier corresponding to the application software of the published vulnerability. The second matching unit 403 is specifically used to match the first target software identifier, the first target version identifier and the first target vulnerability identifier with the third software identifier, the third version identifier and the second vulnerability identifier in the patch database to determine the second target software identifier, the second target version identifier and the second target vulnerability identifier; determine the target patch file identifier based on the second target software identifier, the second target version identifier and the second target vulnerability identifier; and obtain the patch file corresponding to the target patch file identifier.

[0154] In a possible implementation, the device 400 also includes: an establishment unit, used to establish an initial vulnerability information table based on the software information of the target application software; add the first vulnerability information to the vulnerability information table to obtain a first vulnerability information table; based on the target vulnerability, add repair information in the first vulnerability information table to obtain a vulnerability information table, and the repair information is used to indicate whether the vulnerability has been repaired.

[0155] In a possible implementation, the device 400 also includes: an update unit, which is used to periodically collect statistics on vulnerability information and / or patch file information of the target application software; update the vulnerability database according to the statistical vulnerability information, and / or update the patch database according to the statistical patch file information.

[0156] In a possible implementation, the updating unit is further configured to match the vulnerability information table with an updated vulnerability database and / or an updated patch database, and update the vulnerability information and / or repair information in the vulnerability information table.

[0157] In one possible implementation, the device 400 also includes: a storage unit, which is used to search whether there is a matching storage directory based on the vulnerability data information corresponding to the target patch file; if it exists, the target patch file is stored in the storage directory; if it does not exist, a new directory is created based on the vulnerability information corresponding to the target patch file, and the target patch file is stored in the new directory.

[0158] In a possible implementation, the device 400 further includes: a repair unit, configured to obtain the target patch file from the storage directory or the new directory; and repair the target vulnerability based on the target patch file.

[0159] Based on the above method embodiment and device embodiment, the present application embodiment further provides an electronic device, which will be described below in conjunction with the accompanying drawings.

[0160] See also Figure 5 , Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present application.

[0161] The device 500 includes: a memory 501 and a processor 502; the memory 501 and the processor 502 are coupled;

[0162] The memory 501 is used to store program instructions;

[0163] The processor 502 is used to call the program instructions so that the computing device executes the vulnerability determination method described in the above method embodiment.

[0164] In addition, an embodiment of the present application also provides a computer-readable storage medium, which is used to store a computer program, and the computer program is used to execute the vulnerability determination method described in the above method embodiment.

[0165] It should be noted that the technical features of the higher-level means provided in the embodiments of the present application are clear to those skilled in the art, and the problems to be solved by the higher-level means are also clear. The means for obtaining the corresponding features can be selected by those skilled in the art according to specific implementation requirements. The means provided in this application should not be regarded as a limitation on the solution or as the only means of implementation.

[0166] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can refer to each other. In particular, for the system or device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only exemplary, in which the units or modules described as separate components may or may not be physically separated, and the components displayed as units or modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units, and some or all of the units or modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0167] The flow chart and block diagram in the accompanying drawings illustrate the system architecture, function and operation that may be realized according to the method, device and equipment of various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0168] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0169] It should also be noted that, in this application, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0170] The steps of the method or algorithm described in conjunction with the embodiments disclosed in this application can be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0171] The above description of the disclosed embodiments enables professionals and technicians in the field to implement or use the present application. Various modifications to these embodiments will be apparent to professionals and technicians in the field, and the general principles defined in this application can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown in the present application, but will conform to the widest range consistent with the principles and novel features disclosed in the present application.

Claims

1. A vulnerability determination method, characterized in that: The method comprises: Acquire software information of target application software; the software information is used to identify the target application software; Based on matching the software information with a vulnerability database, obtaining first vulnerability information of the target application software; wherein the vulnerability database includes vulnerability information of published vulnerabilities of application software; Matching the first vulnerability information with a patch database to obtain at least one patch file corresponding to the first vulnerability information; wherein the patch database includes patch file information corresponding to the vulnerabilities that have been published by the application software; the first vulnerability information includes vulnerability information corresponding to each vulnerability that has been published by the target application software, and the first vulnerability information includes vulnerability information of the vulnerabilities that have been published and fixed by the target application software and vulnerability information of the vulnerabilities that have been published but not fixed by the target application software; the at least one patch file includes patch files corresponding to the vulnerabilities that have been published and fixed by the target application software and patch files corresponding to the vulnerabilities that have been published but not fixed by the target application software; Compare the at least one patch file with the source code file of the target application software, use the patch file with different vulnerability repair content from the source code file as the target patch file, and determine the target patch file and the target vulnerability corresponding to the target patch file; wherein the target vulnerability represents an unrepaired vulnerability, the target vulnerability is a vulnerability that has been released but not repaired in the target application software, and the target patch file is a patch file corresponding to the target vulnerability.

2. The method according to claim 1, characterized in that The step of obtaining software information of the target application software includes: Obtaining a software package of the target application software; The software package is parsed to obtain software information of the software package; wherein the software information includes a first software identifier and a first version identifier.

3. The method according to claim 2, characterized in that The vulnerability information in the vulnerability database includes a second software identifier, a second version identifier, and a first vulnerability identifier corresponding to the application software for which the vulnerability has been published; The step of obtaining first vulnerability information of the target application software based on matching the software information with a vulnerability database includes: Matching the first software identifier and the first version identifier of the software package with the second software identifier and the second version identifier in the vulnerability database to determine a first target software identifier and a first target version identifier; Determine a first target vulnerability identifier based on the first target software identifier and the first target version identifier; The first target software identifier, the first target version identifier, and the first target vulnerability identifier are determined as the first vulnerability information.

4. The method according to claim 3, characterized in that The patch file information includes a third software identifier, a third version identifier, a second vulnerability identifier, and a patch file identifier corresponding to the application software of the published vulnerability; The matching the first vulnerability information with a patch database to obtain a patch file corresponding to the first vulnerability information includes: Matching the first target software identifier, the first target version identifier, and the first target vulnerability identifier with the third software identifier, the third version identifier, and the second vulnerability identifier in the patch database to determine the second target software identifier, the second target version identifier, and the second target vulnerability identifier; Determine a target patch file identifier based on the second target software identifier, the second target version identifier, and the second target vulnerability identifier; Obtain the patch file corresponding to the target patch file identifier.

5. The method according to claim 1, characterized in that The method further comprises: Establishing an initial vulnerability information table based on software information of the target application software; Add the first vulnerability information to the vulnerability information table to obtain a first vulnerability information table; Based on the target vulnerability, repair information is added to the first vulnerability information table to obtain a vulnerability information table, wherein the repair information is used to indicate whether the vulnerability has been repaired.

6. The method according to claim 5, characterized in that The method further comprises: Regularly collecting statistics on vulnerability information and / or patch file information of the target application software; The vulnerability database is updated according to the statistical vulnerability information, and / or the patch database is updated according to the statistical patch file information.

7. The method according to claim 6, characterized in that The method further comprises: The vulnerability information table is matched with an updated vulnerability database and / or an updated patch database, and the vulnerability information and / or repair information in the vulnerability information table is updated.

8. The method according to claim 1, characterized in that The method further comprises: Based on the vulnerability data information corresponding to the target patch file, searching whether there is a matching storage directory; If it exists, storing the target patch file in the storage directory; If it does not exist, a new directory is created based on the vulnerability information corresponding to the target patch file, and the target patch file is stored in the new directory.

9. The method according to claim 8, characterized in that The method further comprises: Acquire the target patch file from the storage directory or the new directory; The target vulnerability is repaired based on the target patch file.

10. An electronic device, characterized in that: The electronic device comprises a memory and a processor; The memory is coupled to the processor; the memory is used to store program instructions; the processor is used to call the program instructions so that the electronic device executes the vulnerability determination method as described in any one of claims 1-9.

Images