A node device maintenance method, system and storage medium

Abstract

The application relates to a node device maintenance method, system and storage medium, the method comprising: acquiring a node device pool and corresponding vulnerability scanning rules meeting preset selection requirements; acquiring a state flag of a current node device; if the state flag is reinforced, selecting another node device; if the state flag is not reinforced, judging whether the current node device has exploitable vulnerabilities according to the vulnerability scanning rules; if yes, performing vulnerability exploitation on the current node device; updating the vulnerability scanning rules according to characteristic data and attribute data; reinforcing the execution node device according to a corresponding preset reinforcement mode; judging whether there are still exploitable vulnerabilities based on the updated vulnerability scanning rules; and if no, updating the state flag of the corresponding node device to reinforced. The application solves the problem that an inherent vulnerability scanning mechanism cannot effectively adapt to different network environments and differences or changes of node devices, thereby reducing the vulnerability scanning and processing efficiency.

Description

Technical Field

[0001] This application relates to the field of computer network technology, and in particular to a method, system and storage medium for maintaining node devices. Background Technology

[0002] With the increasing popularity of smart terminals and the expansion of network coverage, the application scope and scale of various network devices are also constantly expanding. Network devices and terminals or other network devices can access each other through the network.

[0003] A network comprises numerous network nodes. A network node is a device connected to a network with an independent address and the ability to transmit or receive data. Node devices can be workstations, clients, network users, or personal computers, as well as servers, printers, and other network-connected devices. Every workstation, server, terminal device, and network device—that is, a device with its own unique network address—is a node device. The entire network is composed of these many node devices, connected by communication lines to form a computer network topology.

[0004] In traditional technologies, the maintenance of node devices, especially those with vulnerabilities, relies on vulnerability scanning mechanisms to determine if vulnerabilities exist. If vulnerabilities are found, the corresponding node devices are then addressed. However, with the increasing complexity of network environments, the variety and sheer number of node devices across different networks make it difficult for traditional vulnerability scanning mechanisms to effectively adapt to varying network environments and differences or changes in node devices. This results in relatively low efficiency in vulnerability scanning and subsequent vulnerability handling.

[0005] Therefore, in order to solve the above problems, providing a node device maintenance method, system and storage medium is an urgent problem to be solved by those skilled in the art. Summary of the Invention

[0006] To address the problem that inherent vulnerability scanning mechanisms are difficult to adapt to different network environments and differences or changes in node devices, resulting in relatively low efficiency in vulnerability scanning and subsequent vulnerability handling, this application provides a node device maintenance method, system, and storage medium.

[0007] Firstly, the node device maintenance method provided in this application includes the following steps: A node device pool is formed by acquiring multiple node devices that meet the preset selection requirements; Obtain the vulnerability scanning rules corresponding to the preset selection requirements; Select one of the node devices in the node device pool as the current node device; Obtain the status flag of the current node device; If the status flag is hardened, then select another node device as the current node device, and return to the step of obtaining the status flag of the current node device; If the status flag is "unhardened", then according to the vulnerability scanning rules, it is determined whether the current node device has any exploitable vulnerabilities. If the exploitable vulnerability exists, then the current node device is exploited to create an execution node device; The vulnerability scanning rules are updated based on the feature data and attribute data of the execution node device; According to the preset reinforcement method corresponding to the feature data, the execution node device is reinforced to form a reinforced node device; Based on the updated vulnerability scanning rules, determine whether the hardened node device still has the exploitable vulnerability; If no exploitable vulnerability exists, the status flag of the corresponding node device is updated to "hardened". Select another node device as the current node device and return to the step of obtaining the status flag of the current node device.

[0008] Optionally, obtaining a node device pool consisting of multiple node devices that meet preset selection requirements includes: The preset selection requirements are analyzed in terms of both the category requirements and the total quantity requirements. Obtain the types and proportions of node devices in the aforementioned requirements; Based on the total quantity requirement and the category proportion, obtain the sub-quantity requirement corresponding to each of the node device categories; Based on the type of node device and the number of sub-devices required, a plurality of the corresponding node devices are obtained to form the node device pool.

[0009] Optionally, obtaining a plurality of the node devices to form the node device pool according to the node device type and the sub-quantity requirement includes: Determine whether the number of node devices for each of the aforementioned node device types meets the corresponding sub-quantity requirements; If the number of all node devices is satisfied, then according to the node device type and the sub-quantity requirement, a corresponding number of the node devices are obtained to form the node device pool; If the number of all node devices is insufficient, then the backup selection requirement is obtained as the preset selection requirement, and the steps of parsing the type requirement and total quantity requirement corresponding to the preset selection requirement are returned. If at least one of the node devices does not meet the required quantity, then the corresponding node device type is obtained as the type to be replaced. Obtain all node device types that satisfy the required number of node devices, and construct a matching type table; From the matching category table, select the node device category with the smallest difference in category matching value with the category to be replaced as the replacement category; Obtain the sum of the sub-quantity requirements of both the replaced type and the replaced type, and update the sub-quantity requirement of the replaced type; The replacement category is removed from the matching category table to form a defined category table; Based on the determined category table, the replacement category, and the corresponding sub-quantity requirements, a plurality of the node devices are obtained to form the node device pool.

[0010] Optionally, the step of hardening the execution node device to form a hardened node device according to the preset hardening method corresponding to the feature data includes: Determine whether the feature data contains at least one of the following: sensitive ports, attack characteristics, and abnormal monitoring. If the sensitive interface exists, then obtain the interface type of the sensitive interface; If the interface type is a firmware interface, the preset hardening method is to modify the interface number of the firmware interface; If the interface type is an external service port, the preset hardening method is to close the corresponding external service and occupy the external service port; If the attack characteristics are present, the preset reinforcement method is to perform preset protection processing corresponding to the attack characteristics; If the abnormal monitoring exists, the preset reinforcement method is to disable the monitoring program corresponding to the abnormal monitoring. The execution node device is reinforced according to the preset reinforcement method to form a reinforced node device.

[0011] Optionally, after determining whether the hardened node device still has the exploitable vulnerability based on the updated vulnerability scanning rules, the method further includes: If the exploitable vulnerability still exists, then shut down the external connections of the hardened node device; The reinforced node equipment is re-reinforced using the preset reinforcement method; Determine whether the re-hardened node device still has the exploitable vulnerability; If the exploitable vulnerability exists, then alternative hardening methods are obtained based on the attribute data; The reinforced node device is reinforced using the backup reinforcement method and is used as the node device to be judged. Determine whether the exploitable vulnerability still exists in the node device to be judged. If the exploitable vulnerability still exists, a warning message will be output. The warning message includes the hardened node device and the exploitable vulnerability.

[0012] Optionally, if the status flag is unhardened, determining whether the current node device has an exploitable vulnerability according to the vulnerability scanning rules includes: If the status flag is "unhardened", then obtain the attribute evaluation value of the current node device; The vulnerability rule with the highest matching degree with the attribute evaluation value among the vulnerability scanning rules is selected as the current vulnerability rule. Based on the current vulnerability rules, determine whether the current node device has a corresponding matching vulnerability; If no matching vulnerability exists, the vulnerability rule with the highest matching degree with the current vulnerability rule will be used as the updated current vulnerability rule, and the step of determining whether the current node device has a corresponding matching vulnerability based on the current vulnerability rule will be returned until the preset stopping condition is reached. If the matching vulnerability exists, the exploit rule with the highest matching degree with the matching vulnerability in the vulnerability scanning rules is obtained and used as the current exploit rule; Based on the current exploitation rules, determine whether the matching vulnerability is an exploitable vulnerability; If it is the exploitable vulnerability, then it is determined that the current node device has the exploitable vulnerability; If it is not the exploitable vulnerability, then it is determined that the current node device does not have the exploitable vulnerability.

[0013] Optional, also includes: After a preset time interval, it is determined whether there are any node devices in the node device pool that do not meet the preset performance requirements; If it exists, remove the corresponding node device and update the node device pool; Determine whether the updated node device pool meets the device pool requirements; If it does not meet the requirements, other node devices that meet the preset selection requirements are added to the node device pool until the node device pool meets the requirements of the device pool.

[0014] Optionally, determining whether the updated node device pool meets the device pool requirements includes: The device pool requirements are parsed to obtain the corresponding quantity requirements and rule requirements, including interactive process hiding and communication encryption. Determine whether each node device in the updated node device pool meets the rule requirements; Remove node devices from the node device pool that do not meet the rule requirements; The remaining number of node devices in the node device pool is obtained as the remaining quantity; If the remaining quantity does not meet the quantity requirement, then the node device pool is determined to not meet the device pool requirements; If the remaining quantity meets the quantity requirement, then the node device pool is determined to meet the device pool requirements.

[0015] Secondly, the node device maintenance system provided in this application includes: The first component module is used to obtain multiple node devices that meet the preset selection requirements to form a node device pool; The first acquisition module is used to acquire vulnerability scanning rules corresponding to the preset selection requirements; The first selection module is used to select one of the node devices in the node device pool as the current node device; The second acquisition module is used to acquire the status flag of the current node device; If the status flag is hardened, the first selection module is further configured to select another node device as the current node device, so that the second acquisition module can reacquire the status flag of the current node device. If the status flag is "unhardened", the first judgment module is used to determine whether the current node device has an exploitable vulnerability according to the vulnerability scanning rules. If the exploitable vulnerability exists, the first execution module is used to exploit the vulnerability in the current node device to form an execution node device; The first update module is used to update the vulnerability scanning rules based on the feature data and attribute data of the execution node device; The first reinforcement module is used to reinforce the execution node device according to a preset reinforcement method corresponding to the feature data to form a reinforced node device. The second judgment module is used to determine, based on the updated vulnerability scanning rules, whether the hardened node device still has the exploitable vulnerability; If no exploitable vulnerability exists, the first marking module is used to update the status mark of the corresponding node device to "hardened". The second selection module is used to select another node device as the current node device, so that the second acquisition module can reacquire the status flag of the current node device.

[0016] Thirdly, the storage medium provided in this application stores computer instructions, and when the computer instructions are loaded and executed by a processor, the node device maintenance method described in any of the preceding claims is employed.

[0017] In summary, this application pre-constructs a node device pool that meets preset selection requirements and corresponding vulnerability scanning rules. By determining whether the current node device has been hardened and whether there are exploitable vulnerabilities in the hardened node device, after performing vulnerability exploitation on the current node device with exploitable vulnerabilities, the vulnerability scanning rules are updated based on its feature data and attribute data. After hardening the node device according to the preset hardening method corresponding to the feature data, the updated vulnerability scanning rules are used to determine whether the original exploitable vulnerabilities still exist. This enables the vulnerability scanning rules to be updated in real time according to the gradual progress of the maintenance process, and can effectively select the corresponding hardening method based on the feature data of exploitable vulnerabilities. This allows for the selection of the maintainable range of node devices as needed, thereby solving the problem that the inherent vulnerability scanning mechanism is difficult to effectively adapt to different network environments and differences or changes in node devices, resulting in relatively low efficiency in vulnerability scanning and subsequent vulnerability handling. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 2 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 3 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 4 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 5 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 6 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 7 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 8 This is a flowchart illustrating one embodiment of the node device maintenance method according to this application. Figure 9 This is a structural block diagram of one embodiment of the node device maintenance system of this application. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of this application.

[0020] This application provides a node device maintenance method, such as... Figure 1 As shown, it includes the following steps: S101. Obtain multiple node devices that meet the preset selection requirements to form a node device pool; S102. Obtain the vulnerability scanning rules corresponding to the preset selection requirements; S103. Select one of the node devices in the node device pool as the current node device; S104. Obtain the status flag of the current node device; S105. If the status flag is hardened, select another node device as the current node device and return to the step of obtaining the status flag of the current node device; S106. If the status flag is "unhardened", then determine whether there are exploitable vulnerabilities in the current node device according to the vulnerability scanning rules; S107. If an exploitable vulnerability exists, exploit the vulnerability on the current node device to create an execution node device; S108. Update the vulnerability scanning rules based on the characteristic data and attribute data of the execution node device; S109. Based on the preset reinforcement method corresponding to the feature data, the reinforcement execution node device is formed into a reinforcement node device; S110. Based on the updated vulnerability scanning rules, determine whether there are still exploitable vulnerabilities in the hardened node devices; S111. If no exploitable vulnerability exists, update the status flag of the corresponding node device to "hardened". S112. Select another node device as the current node device and return to the step of obtaining the status flag of the current node device.

[0021] The preset selection requirements in step S101 are preset requirements for the node devices that constitute the node device pool. The specific requirements can be selected according to actual needs. The specific selection method can be to collect all IPs open to the Internet globally, analyze the node devices corresponding to these IPs, and accurately select multiple node devices that meet the specified type, have specified applications, or correspond to specific countries / cities, etc., to form a node device pool that meets the preset selection requirements, thereby determining the selection range of node devices that need to be maintained.

[0022] The vulnerability scanning rules in step S102 are determined based on the specific requirements of the preset selection criteria. The purpose is to match the corresponding vulnerability scanning rules to the node devices within the required scope. Specifically, the vulnerability scanning rules determine whether a node device has vulnerabilities and obtain the specific type of vulnerability during scanning. In this embodiment, the specific types of vulnerabilities include exploitable vulnerabilities and unexploitable vulnerabilities. Exploitable vulnerabilities are those that can be exploited by unauthorized visitors or individuals to leak data or information from the node device, while unexploitable vulnerabilities are the opposite.

[0023] Since there are multiple node devices in the node device pool, in order to better understand the solution of this application, the following description will take the example of a node device maintenance method corresponding to only one process. Of course, in actual application, this node device maintenance method can have multiple parallel processes, which does not directly affect the description logic or step order of the node device maintenance method.

[0024] When selecting the current node device in step S103, it can be considered as a random selection or a selection based on priority rules. For example, in the priority formed by the type of node device, the priority from high to low is central router, central switch, tributary router, tributary switch, computer, mobile phone, etc. In order to avoid performing the same maintenance again on node devices that have already been maintained, especially those that have been hardened, the status flag is obtained in step S104, and the subsequent execution of step S105 or step S106 is selected according to the specific type of status flag.

[0025] If the status flag is "hardened", it means that the current node device has been hardened. Then, proceed to step S105 to select another node device as the current node device and return to obtain the status flag of the current node device, i.e., step S104.

[0026] If the status flag is "not hardened", it means that the current node device has not been hardened. Then, in step S106, the vulnerability scanning rules are used to determine whether there is an exploitable vulnerability in the current node device. Based on the determination result, step S107 or other steps are selected to be executed.

[0027] If no exploitable vulnerability exists, it means that the current node device does not have any exploitable vulnerabilities. You can then choose the next steps to execute based on the actual needs. For example, you can use the default hardening method to harden this node device, or output the information of this node device and mark it as having no exploitable vulnerabilities, or select another node device as the current node device and return to the step of obtaining the status mark of the current node device, i.e., step S104. These steps will not be elaborated here.

[0028] If an exploitable vulnerability exists, it means that the current node device has an exploitable vulnerability. Therefore, step S107 is executed to perform vulnerability exploitation on the current node device, thus creating an execution node device. Execution vulnerability exploitation refers to using unconventional access methods or unconventional processing techniques to exploit the vulnerability, causing the current node device corresponding to the exploitable vulnerability to exhibit a state after the vulnerability has been exploited, thus becoming an execution node device.

[0029] In the node device where the vulnerability is exploited, there will be certain abnormal data, such as abnormal data transmission, abnormal port opening, or execution of abnormal commands. These will all generate abnormal data, which contains some characteristics that can be defined or located, namely the characteristic data in step S108. Although the original or initial vulnerability scanning rules also contain some preset characteristic data, due to the continuous changes in the network environment or device types, the vulnerability scanning rules also need to be changed. At the same time, the attribute data of the node device where the vulnerability is exploited can be used as the content of the changes in the vulnerability scanning rules. Therefore, in step S108, the vulnerability scanning rules are updated according to the characteristic data and attribute data of the executing node device.

[0030] It should be noted that attribute data refers to the network attribute data of node devices, such as device fingerprint, manufacturer, device type, IP address, MAC address, low-to-medium interaction honeypot identification, country, continent, etc., as well as local attribute data, such as firmware version, device model, storage configuration, etc. Feature data varies depending on the situation, such as the type of commands executed by the node device, processor framework, medium-to-high honeypot identification, asset-related vulnerabilities, whether firmware is available, memory allocation characteristics, node device file system, etc. In other words, the corresponding node devices are tagged with feature extraction, including hardware and software, operating system, application products, etc., to facilitate classification, statistics and rapid retrieval.

[0031] To reduce the possibility of exploitable vulnerabilities in execution node devices, they need to be hardened. The specific hardening method is a preset hardening method corresponding to the feature data. After the hardening method is determined, step S109 is executed to harden the execution node device and form a hardened node device.

[0032] For hardened node devices, it is still necessary to determine whether the original exploitable vulnerabilities have been patched or addressed after hardening. Therefore, step S110 needs to be executed, which is to determine whether there are still exploitable vulnerabilities in the hardened node device based on the updated vulnerability scanning rules. Based on the determination result, it is necessary to choose whether to execute step S111 or other steps.

[0033] If no exploitable vulnerability exists, it means that the original exploitable vulnerability of the hardened node device has been fixed or dealt with. Then, the corresponding node device status flag is updated to hardened in step S111. Then, step S112 is executed, which selects another node device as the current node device and returns to the step of obtaining the status flag of the current node device, i.e., S104.

[0034] If exploitable vulnerabilities still exist, subsequent steps can be selected according to actual needs. For example, return to step S108 to repeatedly update the vulnerability scanning rules, or return to step S109 to re-harden this node device, or return to step S110 to re-evaluate exploitable vulnerabilities, etc. Specific choices will not be elaborated here.

[0035] As can be seen from the above, the proposed solution pre-constructs a node device pool that meets the preset selection requirements and corresponding vulnerability scanning rules. By pre-selecting the requirements, the network node device resource collection ensures the number of nodes, the types of node devices, the supported platforms of nodes, and the diversity of nodes. This pre-selection construction method means that the impact of different network environments and differences or changes in node devices on the node maintenance results is relatively small.

[0036] The node device maintenance method provided in this embodiment pre-constructs a node device pool that meets preset selection requirements and corresponding vulnerability scanning rules. By determining whether the current node device has been hardened and whether there are exploitable vulnerabilities in the hardened node device, after performing vulnerability exploitation on the current node device with exploitable vulnerabilities, the vulnerability scanning rules are updated according to its feature data and attribute data. After hardening the node device according to the preset hardening method corresponding to the feature data, the updated vulnerability scanning rules are used to determine whether the original exploitable vulnerabilities still exist. This enables the vulnerability scanning rules to be updated at any time according to the gradual progress of the maintenance process, and can effectively select the corresponding hardening method according to the feature data of exploitable vulnerabilities. This allows for the selection of the maintainable range of node devices as needed, thereby solving the problem that the inherent vulnerability scanning mechanism is difficult to effectively adapt to different network environments and differences or changes in node devices, resulting in relatively low efficiency in vulnerability scanning and subsequent vulnerability processing.

[0037] In one embodiment of this example, such as Figure 2 As shown, step S101, which involves obtaining a node device pool composed of multiple node devices that meet preset selection requirements, includes: S201. Analyze the category requirements and total quantity requirements corresponding to the preset selection requirements; S202. Obtain the types and proportions of node devices in the category requirements; S203. Based on the total quantity requirement and the proportion of different types, obtain the sub-quantity requirements corresponding to each type of device at each node; S204. Based on the type and number of node devices required, obtain multiple corresponding node devices to form a node device pool.

[0038] The category requirement in step S201 refers to the specific categories of node devices required when constructing the node device pool. For example, the categories may include routers, switches, servers, and computers, with the corresponding platform being Windows. The total quantity requirement refers to the total number of all node devices in the node device pool. The node device categories in step S202 directly correspond to the categories in the category requirement. The category weighting refers to the proportion of each category in the node device pool relative to the total quantity. For example, if the node device categories include routers, switches, servers, and computers, their respective proportions are 25%, 25%, 20%, and 30%.

[0039] In step S203, by using the total quantity requirement obtained in step S201 and the type proportion obtained in step S202, the sub-quantity requirements corresponding to each type of node device can be obtained. For example, if the total quantity is 1000, then the sub-quantity requirements for routers, switches, servers and computers are 250, 250, 200 and 300 respectively. Combining the types of node devices obtained in step S201, in step S204, a node device pool consisting of 250 routers, 250 switches, 200 servers and 300 computers can be obtained.

[0040] It should be noted that the category requirements, in addition to the category requirements of the node device itself, can also include the category requirements of the applications used by the node device. For example, a computer may have Photoshop and AutoCAD applications, and a server may have firewall applications. Similarly, the category ratio can also be the category ratio of the applications used by the node device. Specific examples will not be repeated here.

[0041] The node device maintenance method provided in this embodiment obtains the type requirements and total quantity requirements corresponding to the preset selection requirements, as well as the types and proportions of node devices in the type requirements. This enables the construction of the required node device pool according to the types and sub-quantity requirements of node devices, thus satisfying the diversity requirements of the node device pool and improving the applicability of the node device maintenance method.

[0042] In one embodiment of this example, such as Figure 3As shown, step S204, which involves obtaining multiple node devices to form a node device pool based on the type and number of node devices, includes: S301. Determine whether the number of node devices of each type meets the corresponding sub-quantity requirements; S302. If the number of all node devices is satisfied, then according to the type of node device and the sub-quantity requirements, obtain the corresponding number of node devices to form a node device pool; S303. If the number of all node devices is insufficient, obtain the backup selection requirements as the preset selection requirements, and return to the steps of parsing the type requirements and total quantity requirements corresponding to the preset selection requirements; S304. If the number of at least one node device is insufficient, obtain the corresponding node device type as the type to be replaced; S305. Obtain all node device types that meet the required number of node devices and construct a matching type table; S306. From the matching category table, select the node device category with the smallest difference in category matching value with the category to be replaced as the replacement category; S307. Obtain the sum of the sub-quantity requirements of both the replaced type and the replacement type, and update the sub-quantity requirement of the replacement type; S308. Remove the replacement categories from the matching category table to form a defined category table; S309. Based on the determined type table, replacement type, and corresponding sub-quantity requirements, obtain multiple corresponding node devices to form a node device pool.

[0043] In practical applications, due to different network environments and different requirements, the number of some node devices may not meet their corresponding sub-number requirements, which will affect the construction of the node device pool. Therefore, in step S301, it is necessary to determine whether the number of node devices of each type of node device meets the corresponding sub-number requirements, and select to execute step S302, step S303, or step S304 according to the determination result.

[0044] If the number of all node devices is met, it means that a node device pool that meets the preset type requirements can be directly constructed. Then, step S302 is executed to obtain multiple corresponding node devices to form a node device pool according to the node device type and sub-quantity requirements.

[0045] If the number of all node devices is not met, it means that it is very difficult to directly build a node device pool that meets the preset type requirements. In this case, step S303 is executed to obtain the backup selection requirements as the preset selection requirements, and the step of parsing the type requirements and total quantity requirements corresponding to the preset selection requirements is returned, namely step S201.

[0046] If at least one node device quantity is insufficient, it indicates that a node device pool meeting the preset type requirements cannot be directly constructed, and certain processing is required. In step S304, the corresponding node device type is obtained as the replacement type. In step S305, all node device types meeting the quantity requirements are obtained to form a matching type table. From this table, the node device type with the smallest type matching value difference from the replacement type is selected as the replacement type according to step S306. In step S307, the sub-quantity requirements of the replacement type are updated based on the sum of the sub-quantity requirements of both the replacement type and the replacement type. The type matching value is the matching value corresponding to each node device type, which can be pre-set or calculated based on different preset selection requirements.

[0047] Since the sub-quantity requirement of the replacement type has been updated, which includes the sub-quantity of both the replaced type and the replacement type, in order to avoid double counting, it is necessary to perform step S308, that is, to remove the replacement type from the matching type table to form a determined type table, so that the determined type table does not include the replacement type. Then, in step S309, according to the determined type table, the replacement type and the corresponding sub-quantity requirement, the corresponding multiple node devices are obtained to form a node device pool.

[0048] The node device maintenance method provided in this embodiment determines whether the number of node devices of each type meets the corresponding sub-quantity requirements. Based on the determination result, it selects whether to obtain the replacement type. Then, it obtains the sum of the sub-quantity requirements of the replacement type and the replacement type, updates the sub-quantity requirements of the replacement type, and finally obtains multiple node devices to form a node device pool based on the determined type table, the replacement type, and the corresponding sub-quantity requirements. This realizes a specific way to generate a node device pool that meets the preset selection requirements according to different actual situations, thereby improving the applicability of the node device maintenance method.

[0049] In one embodiment of this example, such as Figure 4 As shown, step S109, which involves forming a reinforced node device by reinforcing the execution node device according to the preset reinforcement method corresponding to the feature data, includes: S401. Determine whether the feature data contains at least one of the following: sensitive ports, attack features, and abnormal monitoring. S402. If a sensitive interface exists, obtain the interface type of the sensitive interface; S403. If the interface type is a firmware interface, the default hardening method is to modify the interface number of the firmware interface; S404. If the interface type is an external service port, the default hardening method is to disable the corresponding external service and occupy the external service port; S405. If an attack signature is present, the default reinforcement method is to perform the default protection processing corresponding to the attack signature; S406. If abnormal monitoring exists, the default reinforcement method is to disable the monitoring program corresponding to the abnormal monitoring. S407. Reinforce the execution node equipment according to the preset reinforcement method to form a reinforced node equipment.

[0050] In practical applications, the features corresponding to the feature data may include multiple features, each corresponding to different preset reinforcement methods. Specific types will not be detailed here; this embodiment uses sensitive ports, attack features, and anomaly monitoring as examples. In step S401, it is determined whether at least one of sensitive ports, attack features, and anomaly monitoring exists in the feature data. Based on the determination result, the next step to be executed is selected as either step S402, step S405, or step S406.

[0051] If a sensitive interface exists, proceed to step S402 to obtain the interface type of the sensitive interface, and then select either step S403 or S404 based on the interface type. A sensitive interface refers to a port other than the normal ports used by the node device during normal operation, and is typically a port opened when a vulnerability is exploited. Of course, it could also be a normal port experiencing abnormal connections or traffic significantly exceeding normal levels.

[0052] If the interface type is a firmware interface, it means that the sensitive port is the interface for firmware updates. Then, in step 403, the preset reinforcement method is to modify the interface number of the firmware interface, that is, to prevent external interfaces from updating the firmware, overwriting the implanted engine, and modifying the firmware interface for updates.

[0053] If the interface type is an external service port, it means that the sensitive port is an external service port, such as telnet service (23), ssh service (22), and http service (80). Then, the preset hardening method in step S404 is to close the corresponding external service and occupy the external service port, that is, to forcibly close these service processes and forcibly occupy the ports required when these services are started. This can prevent the node device from being used by other attackers and also prevent the node device owner from accessing the node device from the outside.

[0054] If attack characteristics are present, it means that common attack traces are left in the memory, i.e., there are already traces of attackers. For example, whether the keyword "anime" exists in the process or other executable files. Then, the preset reinforcement method determined in step S405 is to perform preset protection processing corresponding to the attack characteristics, such as firewall software or repair software that is attacking anime malware.

[0055] If abnormal monitoring exists, it indicates that there is abnormal monitoring or a monitoring program that hinders maintenance. In step S406, the preset hardening method is to close the monitoring program corresponding to the abnormal monitoring. For example, the restart function set up in an embedded device to prevent device abnormality is to have a process continuously send a byte of data to the monitoring program. If the sending stops, the device will restart. Therefore, in order to prevent the device from restarting, this monitoring program needs to be closed.

[0056] Based on the specific type or characteristics of the feature data, different preset reinforcement methods are determined, and step S407 is executed to reinforce the execution node device according to the preset reinforcement method to form a reinforced node device. Since the feature data may contain one, two, or all of the following: sensitive ports, attack characteristics, and abnormal monitoring, the preset reinforcement method can be one to three corresponding methods.

[0057] Of course, if two of the preset reinforcement methods conflict, then it can be determined which case has the most weight in the feature data, and the corresponding preset reinforcement method is selected as the fixed preset reinforcement method; or, if there is a sequence of execution between different preset reinforcement methods, then they need to be executed according to the preset execution order.

[0058] The node device maintenance method provided in this embodiment determines whether there is at least one of sensitive ports, attack characteristics, and abnormal monitoring in the feature data, and determines the corresponding preset reinforcement method based on the determination result and reinforces the node device accordingly. This enables the reinforcement of node devices using multiple preset reinforcement methods based on different feature data, thereby improving the reliability of the node device maintenance method.

[0059] In one embodiment of this example, such as Figure 5 As shown, after step S110, which determines whether the hardened node device still has exploitable vulnerabilities based on the updated vulnerability scanning rules, the following steps are also included: S501. If an exploitable vulnerability still exists, shut down the external connections of the hardened node device; S502. Re-strengthen the reinforced node equipment using a pre-set reinforcement method; S503. Determine whether there are exploitable vulnerabilities in the hardened node equipment after re-hardening; S504. If an exploitable vulnerability exists, obtain alternative hardening methods based on the attribute data; S505. The node equipment is reinforced using a backup reinforcement method and is used as the node equipment to be judged; S506. Determine whether the node device to be evaluated still has exploitable vulnerabilities; S507. If an exploitable vulnerability still exists, output a warning message; The warning message included information on hardening node devices and exploitable vulnerabilities.

[0060] After hardening the node device according to the preset hardening method corresponding to different feature data, it is also necessary to determine whether there are still exploitable vulnerabilities in the hardened node device according to the updated vulnerability scanning rules. If there are still exploitable vulnerabilities, it means that the current hardening has not achieved the expected effect and further processing is required. In this embodiment, the external connection of the hardened node device is closed in step S501.

[0061] In step S502, the hardened node device with closed external connections is re-hardened using a preset hardening method. In step S503, it is determined whether there is an exploitable vulnerability in the hardened node device after re-hardening. Based on the determination result, step S504 or step S507 is selected to proceed.

[0062] If no exploitable vulnerabilities are found, it means that the vulnerability scanning rules updated based on the feature data and the corresponding preset hardening methods are effective for this node device. However, the hardening failed due to other node devices connected to the outside or the application itself. Therefore, the hardening was successful after closing the external connection.

[0063] If an exploitable vulnerability exists, it means that the vulnerability scanning rules updated based on the feature data and the corresponding preset hardening methods are not applicable to this node device. In this case, step S504 is executed to obtain the backup hardening method based on the attribute data. In step S505, the node device is hardened again using the backup hardening method. As a node device to be judged, it is judged in step S506 whether there is still an exploitable vulnerability. Based on the judgment result, step S507 or other steps are executed.

[0064] If exploitable vulnerabilities still exist, it means that this node device cannot be effectively hardened according to the hardening method determined by the feature data and attribute data. In this case, the warning message in step S507 is executed. The warning message includes information about the hardened node device and the exploitable vulnerabilities, so as to notify the operator to perform subsequent processing, such as separate analysis or shutting down this node device. If no exploitable vulnerabilities exist, it means that this node device can be effectively hardened according to the hardening method determined by the attribute data. In this case, another node device is selected as the current node device, and the process returns to step S104, which involves obtaining the status flag of the current node device.

[0065] The node device maintenance method provided in this embodiment determines whether there are still exploitable vulnerabilities in a node device that has its external connection closed and has been re-hardened using a preset hardening method. For node devices with exploitable vulnerabilities, the method obtains an alternative hardening method based on attribute data and hardens the device, then determines whether there are still exploitable vulnerabilities. This enables different handling methods when the preset hardening method fails, thereby improving the processing efficiency of the node device maintenance method.

[0066] In one embodiment of this example, such as Figure 6 As shown, step S106, if the status flag is "unhardened," then according to the vulnerability scanning rules, determines whether the current node device has exploitable vulnerabilities, including: S601. If the status flag is "unhardened", then obtain the attribute evaluation value of the current node device; S602. Obtain the vulnerability rule with the highest match degree with the attribute evaluation value from the vulnerability scanning rules, and use it as the current vulnerability rule; S603. Determine whether the current node device has a corresponding matching vulnerability based on the current vulnerability rules; S604. If no matching vulnerability exists, the vulnerability rule with the highest matching degree with the current vulnerability rule will be used as the updated current vulnerability rule, and the step of determining whether the current node device has a corresponding matching vulnerability based on the current vulnerability rule will be returned until the preset stop condition is reached. S605. If a matching vulnerability exists, obtain the exploit rule with the highest matching degree to the matching vulnerability from the vulnerability scanning rules and use it as the current exploit rule; S606. Based on the current exploitation rules, determine whether the matched vulnerability is an exploitable vulnerability; S607. If it is an exploitable vulnerability, then determine that the current node device has an exploitable vulnerability; S608. If it is not an exploitable vulnerability, then it is determined that there is no exploitable vulnerability in the current node device.

[0067] The attribute evaluation value in step S601 is determined based on the attributes of each node device itself. For example, the operating system, application platform, specific software, hardware type and parameters of the node device can all affect its attribute evaluation value.

[0068] In this embodiment, the vulnerability scanning rule is a scanning rule that includes multiple or various vulnerability rules. In step S602, the vulnerability rule with the highest matching degree with the attribute evaluation value needs to be obtained from the vulnerability scanning rules. This rule is then used as the current vulnerability rule that best matches the current node device. In step S603, it is determined whether the current node device has a corresponding matching vulnerability based on this rule. Based on the determination result, step S604 or step S605 is then selected for execution.

[0069] If no matching vulnerability is found, it means that the vulnerability rule with the highest matching degree obtained previously cannot determine the vulnerability present in the current node device. To improve accuracy, vulnerability confirmation is required again. Therefore, step S604 is executed, where the vulnerability rule with the highest matching degree is used as the updated current vulnerability rule, and the process returns to step S603, which determines whether the current node device has a corresponding matching vulnerability based on the current vulnerability rule. If no matching vulnerability is found again, the loop continues. However, after a certain number of loops, the matching degree may become relatively low, and its accuracy may not meet expectations. To reduce unnecessary loops, the above steps are stopped once a preset stopping target is reached. The preset stopping target can be a preset number of loops or a preset loop time; this will not be elaborated further here.

[0070] If a matching vulnerability exists, it means that the vulnerability rule with the highest matching degree obtained previously has successfully identified the vulnerability present in the current node device. In order to improve efficiency, the exploit rule with the highest matching degree among the vulnerability scanning rules obtained in step S605 is executed as the current exploit rule. Based on this, step S606 is executed to determine whether the matching vulnerability is an exploitable vulnerability. Based on the result, it is determined whether the current node device has an exploitable vulnerability, as shown in step S607 or step 608.

[0071] The node device maintenance method provided in this embodiment obtains the vulnerability rule with the highest matching degree with the attribute evaluation value from the vulnerability scanning rules, determines whether the current node device has a matching vulnerability based on it, and takes the exploit rule with the highest matching degree with the matching vulnerability from the vulnerability scanning rules, determines whether the matching vulnerability is an exploitable vulnerability based on it, thereby realizing the determination of the most matching vulnerability rule and exploit rule according to the attributes of the node device, improving the accuracy and processing efficiency of the node device maintenance method.

[0072] In one embodiment of this example, such as Figure 7 As shown, it also includes: S701. After a preset time interval, determine whether there are any node devices in the node device pool that do not meet the preset performance requirements; S702. If it exists, remove the corresponding node device and update the node device pool; S703. Determine whether the updated node device pool meets the device pool requirements; S704. If not, obtain other node devices that meet the preset selection requirements and add them to the node device pool until the node device pool meets the device pool requirements.

[0073] To ensure the survival rate and vitality of the node devices in the node device pool, it is necessary to maintain the node device pool, replenish nodes in a timely manner, and replace node devices with poor performance. Therefore, it is necessary to execute step S701, which is to determine whether there are node devices in the node device pool that do not meet the preset performance requirements after a preset interval. Based on the determination result, select to execute step S702 or other steps.

[0074] If it does not exist, no further action is required; continue with the other steps being performed in the node device maintenance method.

[0075] If such nodes exist, it indicates that the performance of these node devices has deteriorated to the point where they do not meet the preset performance requirements. Therefore, step S702 involves removing the corresponding node devices and updating the node device pool. In this embodiment, updating the node device pool involves reselecting node devices that meet the preset performance requirements and are corresponding to the required number of missing nodes. The preset performance requirements refer to the performance of each node device in the node device pool that meets the preset selection criteria.

[0076] In practical applications, node devices that meet the preset performance requirements are added, but it is still necessary to determine whether the updated node device pool meets the original device pool requirements. Therefore, in step S703, it is determined whether the updated node device pool meets the device pool requirements, and the subsequent execution step S704 or other steps are selected based on the determination result.

[0077] If the requirement is not met, there are several possibilities. For example, the total number of nodes in the updated node device pool may exceed the requirement, or the total number may still not meet the requirement even after adding all node devices that meet the preset performance requirements. In this case, step S704 will be executed to obtain other node devices that meet the preset selection requirements and add them to the node device pool until the node device pool meets the requirements. Specifically, this could involve adding a subset of node devices after removing others, or adding other node devices, such as those that meet a certain performance threshold but do not meet the preset performance requirements. These details will not be elaborated further here.

[0078] If the conditions are met, no further action is required; continue with the other steps being performed in the node device maintenance method.

[0079] The node device maintenance method provided in this embodiment determines whether there are node devices in the node device pool that do not meet the preset performance requirements after a preset time interval, removes the corresponding node devices and updates the node device pool, and determines whether the updated node device pool meets the device pool requirements. It then selects whether to add other node devices that meet the preset selection requirements to the node device pool, thereby supplementing the node device pool and replacing node devices with poor performance, thus ensuring the survival rate of node devices in the node device pool.

[0080] In one embodiment of this example, such as Figure 8 As shown, step S703, which determines whether the updated node device pool meets the device pool requirements, includes: S801. Parse the device pool requirements to obtain the corresponding quantity requirement value and rule requirements, including interaction process hiding and communication encryption; S802. Determine whether each node device in the updated node device pool meets the rule requirements; S803. Remove node devices that do not meet the rule requirements from the node device pool; S804. Obtain the number of remaining node devices in the node device pool as the remaining quantity; S805. If the remaining quantity does not meet the quantity requirement, then the node device pool is determined to be non-compliant with the device pool requirements. S806. If the remaining quantity meets the quantity requirement, then the node device pool is determined to meet the device pool requirements.

[0081] The quantity requirement and rule requirements in step S801 are obtained by parsing the device pool requirements. The quantity requirement refers to the number of node devices required for the node device value, while the rule requirements include hiding the interaction process and encrypting the communication. That is, in order to ensure the concealment of the node devices, it is necessary to hide the process and encrypt the communication between the node device control program and the node device interaction.

[0082] In step S802, it is determined whether each node device in the updated node device pool meets the rule requirements. If the rule requirements are not met, it means that the interaction process of some node devices in the updated node device pool is not hidden and / or the communication is not encrypted. In this case, they need to be removed from the node device pool. Step S803 is then executed to remove node devices that do not meet the rule requirements from the node device pool.

[0083] Since the node device pool itself has a quantity requirement, step S804 needs to be executed, which is to obtain the remaining number of node devices in the node device pool as the remaining quantity and determine whether it meets the quantity requirement. Based on the determination result, it is determined whether the node device pool meets the device pool requirements, as shown in step S805 or step S806.

[0084] The node device maintenance method provided in this embodiment obtains the quantity requirement value and rule requirement in the device pool requirements, and sequentially determines whether the node device pool meets the rule requirement and quantity requirement value, thereby determining whether the node device pool meets the device pool requirements, realizing the specific determination of the device pool requirements, and achieving the effect of improving the accuracy of the node device maintenance method.

[0085] This application also provides a node device maintenance system, such as Figure 9 As shown, it includes: The first component module 1 is used to obtain multiple node devices that meet the preset selection requirements to form a node device pool; The first acquisition module 2 is used to acquire vulnerability scanning rules corresponding to preset selection requirements; The first selection module 3 is used to select one of the node devices in the node device pool as the current node device; The second acquisition module 4 is used to acquire the status flag of the current node device; If the status flag is hardened, the first selection module 3 is also used to select another node device as the current node device so that the second acquisition module 4 can reacquire the status flag of the current node device. If the status flag is "not hardened", the first judgment module 5 is used to determine whether there is an exploitable vulnerability in the current node device according to the vulnerability scanning rules. If an exploitable vulnerability exists, the first execution module 6 is used to exploit the vulnerability on the current node device to form an execution node device. The first update module 7 is used to update the vulnerability scanning rules based on the feature data and attribute data of the execution node device; The first reinforcement module 8 is used to reinforce the execution node device to form a reinforced node device according to the preset reinforcement method corresponding to the feature data; The second judgment module 9 is used to determine whether there are still exploitable vulnerabilities in the hardened node device based on the updated vulnerability scanning rules. If no exploitable vulnerability exists, the first marking module 10 is used to update the status mark of the corresponding node device to "hardened". The second selection module 11 is used to select another node device as the current node device so that the second acquisition module 4 can reacquire the status flag of the current node device.

[0086] The node device maintenance system provided in this application pre-constructs a node device pool that meets preset selection requirements and corresponding vulnerability scanning rules. By determining whether the current node device has been hardened and whether there are exploitable vulnerabilities in the hardened node device, the system performs vulnerability exploitation on the current node device with exploitable vulnerabilities. Based on its characteristic data and attribute data, the system updates the vulnerability scanning rules and hardens the node device according to the preset hardening method corresponding to the characteristic data. After hardening the node device, the system combines the updated vulnerability scanning rules to determine whether the original exploitable vulnerabilities still exist. This allows the system to update the vulnerability scanning rules in real time according to the gradual progress of the maintenance process and effectively select the corresponding hardening method based on the characteristic data of exploitable vulnerabilities. This enables the system to select the maintainable range of node devices as needed, thereby solving the problem that the inherent vulnerability scanning mechanism is difficult to effectively adapt to different network environments and differences or changes in node devices, resulting in relatively low efficiency in vulnerability scanning and subsequent vulnerability processing.

[0087] Furthermore, the node device maintenance system provided in this embodiment can also be configured with other functional modules as needed, or the above functional modules can be divided into multiple functional units in order to achieve the technical effects corresponding to any of the aforementioned node device maintenance methods.

[0088] This application also provides a computer-readable storage medium storing computer instructions. When the computer instructions are loaded and executed by a processor, they employ the node device maintenance method described in any of the preceding claims, and can achieve the technical effects corresponding to the node device maintenance method described in any of the preceding claims.

[0089] It should be noted that the various implementation methods of this embodiment can be adapted to each other, that is, the steps of each implementation method can be combined with the steps of other implementation methods in various ways to achieve the integration of the process or effect of each implementation method. The specific combination methods will not be described in detail here.

[0090] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0091] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0092] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for maintaining node devices, characterized in that, Includes the following steps: A node device pool is formed by acquiring multiple node devices that meet the preset selection requirements; Obtain the vulnerability scanning rules corresponding to the preset selection requirements; Select one of the node devices in the node device pool as the current node device; Obtain the status flag of the current node device; If the status flag is hardened, then another node device is selected as the current node device, and the process returns to the step of obtaining the status flag of the current node device; If the status is marked as unhardened, then according to the vulnerability scanning rules, it is determined whether the current node device has any exploitable vulnerabilities; If the exploitable vulnerability exists, then the current node device is exploited to create an execution node device; The vulnerability scanning rules are updated based on the feature data and attribute data of the execution node device; According to the preset reinforcement method corresponding to the feature data, the execution node device is reinforced to form a reinforced node device; Based on the updated vulnerability scanning rules, determine whether the hardened node device still has the exploitable vulnerability; If no exploitable vulnerability exists, the status flag of the corresponding node device is updated to "hardened". Select another node device as the current node device, and return to the step of obtaining the status flag of the current node device; The step of obtaining a node device pool consisting of multiple node devices that meet preset selection requirements includes: The preset selection requirements are analyzed in terms of both the category requirements and the total quantity requirements. Obtain the types and proportions of node devices in the aforementioned requirements; Based on the total quantity requirement and the category proportion, obtain the sub-quantity requirement corresponding to each of the node device categories; Determine whether the number of node devices for each of the aforementioned node device types meets the corresponding sub-quantity requirements; If the number of all node devices is satisfied, then according to the node device type and the sub-quantity requirement, a corresponding number of the node devices are obtained to form the node device pool; If the number of all node devices is insufficient, then the backup selection requirement is obtained as the preset selection requirement, and the steps of parsing the type requirement and total quantity requirement corresponding to the preset selection requirement are returned. If at least one of the node devices does not meet the required quantity, then the corresponding node device type is obtained as the type to be replaced. Obtain all node device types that satisfy the required number of node devices, and construct a matching type table; From the matching category table, select the node device category with the smallest difference in category matching value with the category to be replaced as the replacement category; Obtain the sum of the sub-quantity requirements of both the replaced type and the replaced type, and update the sub-quantity requirement of the replaced type; The replacement category is removed from the matching category table to form a defined category table; Based on the determined category table, the replacement category, and the corresponding sub-quantity requirements, a plurality of the node devices are obtained to form the node device pool.

2. The node device maintenance method according to claim 1, characterized in that, The step of reinforcing the execution node device to form a reinforced node device according to the preset reinforcement method corresponding to the feature data includes: Determine whether the feature data contains at least one of the following: sensitive ports, attack characteristics, and abnormal monitoring. If the sensitive port exists, then obtain the interface type of the sensitive port; If the interface type is a firmware interface, the preset hardening method is to modify the interface number of the firmware interface; If the interface type is an external service port, the preset hardening method is to close the corresponding external service and occupy the external service port; If the attack characteristics are present, the preset reinforcement method is to perform preset protection processing corresponding to the attack characteristics; If the abnormal monitoring exists, the preset reinforcement method is to disable the monitoring program corresponding to the abnormal monitoring. The execution node device is reinforced according to the preset reinforcement method to form a reinforced node device.

3. The node device maintenance method according to claim 1, characterized in that, After determining whether the hardened node device still has the exploitable vulnerability based on the updated vulnerability scanning rules, the method further includes: If the exploitable vulnerability still exists, then shut down the external connections of the hardened node device; The reinforced node equipment is re-reinforced using the preset reinforcement method; Determine whether the re-hardened node device still has the exploitable vulnerability; If the exploitable vulnerability exists, then alternative hardening methods are obtained based on the attribute data; The reinforced node device is reinforced using the backup reinforcement method and is used as the node device to be judged. Determine whether the exploitable vulnerability still exists in the node device to be judged. If the exploitable vulnerability still exists, a warning message will be output. The warning message includes the hardened node device and the exploitable vulnerability.

4. The node device maintenance method according to claim 1, characterized in that, If the status is marked as unhardened, then determining whether the current node device has exploitable vulnerabilities according to the vulnerability scanning rules includes: If the status is marked as unhardened, then obtain the attribute evaluation value of the current node device; The vulnerability rule with the highest matching degree with the attribute evaluation value among the vulnerability scanning rules is selected as the current vulnerability rule. Based on the current vulnerability rules, determine whether the current node device has a corresponding matching vulnerability; If no matching vulnerability exists, the vulnerability rule with the highest matching degree with the current vulnerability rule will be used as the updated current vulnerability rule, and the step of determining whether the current node device has a corresponding matching vulnerability based on the current vulnerability rule will be returned until the preset stopping condition is reached. If the matching vulnerability exists, the exploit rule with the highest matching degree with the matching vulnerability in the vulnerability scanning rules is obtained and used as the current exploit rule; Based on the current exploitation rules, determine whether the matching vulnerability is an exploitable vulnerability; If it is the exploitable vulnerability, then it is determined that the current node device has the exploitable vulnerability; If it is not the exploitable vulnerability, then it is determined that the current node device does not have the exploitable vulnerability.

5. The node device maintenance method according to claim 1, characterized in that, Also includes: After a preset time interval, it is determined whether there are any node devices in the node device pool that do not meet the preset performance requirements; If it exists, remove the corresponding node device and update the node device pool; Determine whether the updated node device pool meets the device pool requirements; If it does not meet the requirements, other node devices that meet the preset selection requirements are added to the node device pool until the node device pool meets the requirements of the device pool.

6. The node device maintenance method according to claim 5, characterized in that, The step of determining whether the updated node device pool meets the device pool requirements includes: The device pool requirements are parsed to obtain the corresponding quantity requirements and rule requirements, including interactive process hiding and communication encryption. Determine whether each node device in the updated node device pool meets the rule requirements; Remove node devices from the node device pool that do not meet the rule requirements; The remaining number of node devices in the node device pool is obtained as the remaining quantity; If the remaining quantity does not meet the quantity requirement, then the node device pool is determined to not meet the device pool requirements; If the remaining quantity meets the quantity requirement, then the node device pool is determined to meet the device pool requirements.

7. A node device maintenance system, characterized in that, include: The first component module is used to obtain multiple node devices that meet the preset selection requirements to form a node device pool; The first acquisition module is used to acquire vulnerability scanning rules corresponding to the preset selection requirements; The first selection module is used to select one of the node devices in the node device pool as the current node device; The second acquisition module is used to acquire the status flag of the current node device; If the status flag is hardened, the first selection module is further configured to select another node device as the current node device, so that the second acquisition module can reacquire the status flag of the current node device; If the status is marked as unhardened, the first judgment module is used to determine whether the current node device has an exploitable vulnerability according to the vulnerability scanning rules. If the exploitable vulnerability exists, the first execution module is used to exploit the vulnerability in the current node device to form an execution node device; The first update module is used to update the vulnerability scanning rules based on the feature data and attribute data of the execution node device; The first reinforcement module is used to reinforce the execution node device according to a preset reinforcement method corresponding to the feature data to form a reinforced node device. The second judgment module is used to determine, based on the updated vulnerability scanning rules, whether the hardened node device still has the exploitable vulnerability; If no exploitable vulnerability exists, the first marking module is used to update the status mark of the corresponding node device to "hardened". The second selection module is used to select another node device as the current node device, so that the second acquisition module can reacquire the status flag of the current node device. The step of obtaining a node device pool consisting of multiple node devices that meet preset selection requirements includes: The preset selection requirements are analyzed in terms of both the category requirements and the total quantity requirements. Obtain the types and proportions of node devices in the aforementioned requirements; Based on the total quantity requirement and the category proportion, obtain the sub-quantity requirement corresponding to each of the node device categories; Determine whether the number of node devices for each of the aforementioned node device types meets the corresponding sub-quantity requirements; If the number of all node devices is satisfied, then according to the node device type and the sub-quantity requirement, a corresponding number of the node devices are obtained to form the node device pool; If the number of all node devices is insufficient, then the backup selection requirement is obtained as the preset selection requirement, and the steps of parsing the type requirement and total quantity requirement corresponding to the preset selection requirement are returned. If at least one of the node devices does not meet the required quantity, then the corresponding node device type is obtained as the type to be replaced. Obtain all node device types that satisfy the required number of node devices, and construct a matching type table; From the matching category table, select the node device category with the smallest difference in category matching value with the category to be replaced as the replacement category; Obtain the sum of the sub-quantity requirements of both the replaced type and the replaced type, and update the sub-quantity requirement of the replaced type; The replacement category is removed from the matching category table to form a defined category table; Based on the determined category table, the replacement category, and the corresponding sub-quantity requirements, a plurality of the node devices are obtained to form the node device pool.

8. A computer-readable storage medium storing computer instructions, characterized in that, When the computer instructions are loaded and executed by the processor, the node device maintenance method as described in any one of claims 1 to 6 is employed.

Images