A computer cloud data storage vulnerability diagnosis method and system

Abstract

The present application discloses a computer cloud data storage vulnerability diagnosis method, including: obtaining defects fixed by historical update versions of all cloud data storage databases, generating a vulnerability information library; obtaining diagnosis request information, the diagnosis request information including tenant identification and verification information; based on the access permission list, according to the tenant identification, obtaining the corresponding cloud data storage address, determining the cloud data storage database corresponding to the cloud data storage address as the database to be diagnosed; according to the type of the database to be diagnosed, determining the corresponding script library in the vulnerability information library; according to the access permission list, remotely logging into the database to be diagnosed, executing the vulnerability diagnosis statements of the corresponding script library in sequence, and obtaining the execution result; judging whether the execution result meets the vulnerability condition according to the defined vulnerability matching rule, if so, marking the execution result as a vulnerability and adding it to the vulnerability diagnosis result. In this way, mutual isolation between different tenants is achieved, and the security and efficiency of vulnerability diagnosis are improved.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a computer cloud data storage vulnerability diagnosis method and system. Background Art

[0002] Computer cloud data vulnerability diagnosis is mainly to discover known risks in the database. In the prior art, to detect database vulnerabilities, configuration files are usually used to execute script files to remotely obtain permissions, remotely obtain information, remotely execute commands, remotely operate data, and perform denial of service attacks. However, the method of using script files to remotely send instructions and obtain remote terminal database program configuration files will occupy the target host's configuration file, resulting in the target host database program being unable to be used normally in a short period of time, slow detection speed, and affecting the safe and normal operation of the software. Summary of the invention

[0003] The present application provides a computer cloud data storage vulnerability diagnosis method and system, thereby avoiding the risk of database service interruption, achieving mutual isolation between different tenants, and improving the security and efficiency of vulnerability diagnosis.

[0004] The present application provides a computer cloud data storage vulnerability diagnosis method, which is applied to a cloud server, and the cloud server is connected to a tenant terminal through a preset API interface, including:

[0005] Obtain defects fixed in historical update versions of all cloud data storage databases corresponding to cloud service providers;

[0006] Generate corresponding vulnerability diagnosis information according to the historical defects of each cloud data storage database to obtain a vulnerability information library;

[0007] Obtain the diagnostic request information sent by the tenant, which includes the tenant ID and verification information;

[0008] When the verification is passed, based on the preset access permission list and the tenant identifier in the diagnosis request information, the cloud data storage address corresponding to the tenant identifier is obtained, and the cloud data storage database corresponding to the cloud data storage address is determined as the database to be diagnosed, and the cloud data storage address corresponds to the cloud data storage database one by one;

[0009] According to the type of database to be diagnosed, a corresponding script library is determined in the vulnerability information library, and the script library includes vulnerability diagnosis statements and defined vulnerability matching rules for various database types;

[0010] According to the access permission list, remotely log in to the database to be diagnosed, execute the vulnerability diagnosis statements of the corresponding script library in the database to be diagnosed in sequence, and obtain the execution results;

[0011] The execution result is judged whether it meets the vulnerability condition according to the vulnerability matching rules defined in the corresponding script library. If so, the execution result is marked as a vulnerability and the vulnerability information related to the execution result is added to the vulnerability diagnosis result.

[0012] Preferably, the vulnerability diagnosis information includes vulnerability name, cloud data storage database type, threat type, diagnostic statement and matching rules; each cloud data storage database is provided with a corresponding access permission list, and the access permission list includes a tenant identifier, a cloud data storage address corresponding to the tenant identifier, a cloud data storage database corresponding to the cloud data storage address, and connection parameters.

[0013] Preferably, the remotely logging into the database to be diagnosed according to the access permission list includes:

[0014] Remotely log in to the database to be diagnosed according to the connection parameters corresponding to the tenant ID in the access permission list.

[0015] Preferably, the tenant identifier corresponds one-to-one to the verification information, and the verification information includes an API key pre-determined with the cloud service provider.

[0016] Preferably, the vulnerability diagnosis result is set as a data structure or a database table, including vulnerability type, threat type, discovery time, and affected database instance.

[0017] Preferably, after the verification information of the diagnostic request information is passed, a unique task ID is generated for the diagnostic request information, and a visual window interface associated with the task ID is generated; the vulnerability diagnosis result is associated with the task ID, and the vulnerability diagnosis result is synchronized to the corresponding visual window interface in real time.

[0018] Preferably, the visual window interface includes the corresponding task ID, diagnosis status, and vulnerability diagnosis results;

[0019] When executing the vulnerability diagnosis statements of the corresponding script library in the database to be diagnosed in sequence, when all vulnerability diagnosis statements are executed, the diagnosis status is set to "completed", otherwise, the diagnosis status is set to "diagnosing";

[0020] The cloud server is also used to transmit the task ID to the corresponding tenant. The tenant sends a query request to the cloud server based on the received task ID. The query request includes the task ID. The cloud server returns the corresponding visualization window interface to the tenant based on the received query request.

[0021] Preferably, the cloud service adds the task IDs corresponding to the received diagnostic request information to the task queue in order, and the cloud service is also provided with a task caller, and the task scheduler is used to monitor the task queue and allocate tasks according to a preset scheduling strategy;

[0022] The diagnosis request information also includes the diagnosis purpose, and the urgency level corresponding to each diagnosis request information is obtained according to a preset diagnosis urgency level table.

[0023] Preferably, the task allocation according to a preset scheduling strategy includes:

[0024] Set the initial state of the task scheduler, including the scheduling period, task queue length, working node list, and corresponding load status and maximum number of parallel operations;

[0025] Arrange the task IDs in the task queue in the order in which the diagnostic request information is received;

[0026] According to the scheduling cycle of the task scheduler, check and update the load status of each working node in the task queue and working node list;

[0027] Determine the priority score of the task ID according to the diagnostic request information corresponding to the task ID;

[0028] According to the priority score corresponding to the task ID and the load status score of the working node, the matching score between the task ID and each working node is obtained;

[0029] Among the worker nodes whose number of tasks being executed is less than the maximum number of parallel tasks, the task ID is assigned to the worker node with the highest matching score for the task ID. The load status of the worker node is updated and the assigned task ID is removed from the task queue.

[0030] Preferably, judging whether the execution result meets the vulnerability condition according to the vulnerability matching rule defined in the corresponding script library, and if so, marking the execution result as a vulnerability and adding the vulnerability information related to the execution result to the vulnerability diagnosis result, includes:

[0031] According to the vulnerability matching rules defined in the corresponding script library, it is first determined whether the execution result meets the vulnerability conditions. If so, the execution result is feature extracted to obtain a feature vector;

[0032] Construct a neural network model, input the feature vector into the trained neural network model, and perform secondary judgment;

[0033] According to the probability distribution vector output by the neural network model, it is judged whether the execution result meets the vulnerability condition. If the second judgment meets the vulnerability condition, the corresponding vulnerability type and information related to the vulnerability type are added to the vulnerability diagnosis result;

[0034] The training data set is formed by using the data in the known vulnerability information database, and a unique label vector is randomly assigned to each known vulnerability type therein, and the training data set and the corresponding label vector are used to train the neural network model;

[0035] Among them, the probability distribution vector output by the neural network model represents the probability value of the input execution result belonging to each known vulnerability type; if the probability value of a certain vulnerability type exceeds the probability threshold, the input execution result is judged to belong to the corresponding vulnerability type, otherwise, the execution result that is initially judged to meet the vulnerability conditions fails the second judgment.

[0036] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0037] Remotely log in to the database to be diagnosed through connection parameters without occupying the configuration file of the target host, and execute diagnostic statements only through the target host connection interface, avoiding the risk of database service interruption and improving the speed and security of the diagnostic process; through tenant identification and access permission list customized by cloud service provider, the cloud data storage address corresponding to each tenant can be accurately located, and all data in the cloud data storage address can be defined as the database to be diagnosed, ensuring the isolation of data and operations between different tenants, preventing data confusion and unauthorized access, and improving overall data security.

[0038] Tenants can track the progress and status of diagnostic tasks in real time through the visual window interface provided by the cloud server, realize real-time task monitoring, improve the transparency and immediacy of the service, and enhance the tenant experience and service quality.

[0039] By setting up a task scheduler, the load status of all working nodes can be monitored, and the task ID corresponding to the diagnostic request information can be dynamically allocated according to the load situation, ensuring the balanced use of resources among the various working nodes and improving the overall diagnostic efficiency; by setting priority scores according to the diagnostic purposes corresponding to different diagnostic request information and calculating the matching scores based on the load status of the working nodes, high-priority tasks can be processed first, ensuring that critical tasks can be completed in a timely manner and improving the response efficiency and reliability of the diagnosis. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of a flow chart of a computer cloud data storage vulnerability diagnosis method according to an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of a process of allocating tasks according to a preset scheduling strategy according to an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of a flow chart of judging whether an execution result meets a vulnerability condition according to a vulnerability matching rule defined in a corresponding script library according to an embodiment of the present invention;

[0043] Figure 4 4 is a structural block diagram of a computer cloud data storage vulnerability diagnosis system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To facilitate the understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0045] It should be noted that the terms “vertical”, “horizontal”, “up”, “down”, “left”, “right” and similar expressions used in this document are only for illustrative purposes and do not represent the only implementation method.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more related listed items. Embodiment 1

[0047] Considering that in actual application scenarios, cloud service providers provide multiple database services to multiple tenants. In traditional shared database environments, data from different tenants may be stored in the same database or table, which poses a risk of data leakage and misoperation. In addition, traditional diagnosis usually requires running diagnostic scripts on the target host to occupy the target host's configuration files, causing the database service to be unavailable during the diagnosis period.

[0048] In an embodiment of the present invention, each tenant corresponds to a database instance, which is stored in a corresponding cloud data storage address. The cloud service provider wants to regularly perform vulnerability diagnosis on the database instance to ensure data security.

[0049] Figure 1 It is a flowchart of a computer cloud data storage vulnerability diagnosis method according to an embodiment of the present invention.

[0050] like Figure 1 As shown, a computer cloud data storage vulnerability diagnosis method is applied to a cloud server, and the cloud server is connected to a tenant through a preset API interface, including the following steps:

[0051] S101, obtaining defects fixed by historical update versions of all cloud data storage databases corresponding to the cloud service provider.

[0052] S102, generating corresponding vulnerability diagnosis information according to the historical defects of each cloud data storage database to obtain a vulnerability information library, wherein the vulnerability diagnosis information includes vulnerability name, cloud data storage database type, threat type, diagnosis statement and matching rule.

[0053] S103, obtaining the diagnosis request information sent by the tenant, where the diagnosis request information includes the tenant identifier and verification information.

[0054] The tenant identifier corresponds to the verification information one by one, and the verification information includes the API key determined in advance with the cloud service provider.

[0055] S104, when the verification is passed, based on the preset access permission list and the tenant identifier in the diagnosis request information, the cloud data storage address corresponding to the tenant identifier is obtained, and the database corresponding to the cloud data storage address is determined as the database to be diagnosed, and the cloud data storage address corresponds to the cloud data storage database one by one.

[0056] Each cloud data storage database is provided with a corresponding access permission list, and the access permission list includes a tenant identifier, a cloud data storage address corresponding to the tenant identifier, a cloud data storage database corresponding to the cloud data storage address, and connection parameters.

[0057] The cloud data storage database corresponding to the cloud data storage address can be accessed through the connection parameters corresponding to the cloud data storage address. The access permission list is formulated by the cloud service provider.

[0058] Specifically, the connection parameters include the database host name, port number, and database name.

[0059] S105, according to the type of the database to be diagnosed, determine the corresponding script library in the pre-established vulnerability information library, wherein the script library includes vulnerability diagnosis statements and defined vulnerability matching rules for various database types.

[0060] The vulnerability diagnosis statements for various database types are any one or more of SQL statements and NoSQL statements.

[0061] S106, remotely log in to the database to be diagnosed according to the connection parameters corresponding to the tenant identifier in the access permission list, and execute the vulnerability diagnosis statements of the corresponding script library in the database to be diagnosed in sequence to obtain the execution results.

[0062] Specifically, a remote connection is made to the database to be diagnosed through JDBC (Java Database Connectivity) according to the connection parameters.

[0063] S107, judging whether the execution result meets the vulnerability condition according to the vulnerability matching rule defined in the corresponding script library, if so, marking the execution result as a vulnerability and adding the vulnerability information related to the execution result to the vulnerability diagnosis result.

[0064] The vulnerability diagnosis result is set as any one of the data structures or database tables, including vulnerability type, threat type, discovery time, and affected database instance.

[0065] Specifically, after obtaining the execution result, the execution result is parsed, and the raw data of the execution result is converted into a preset data format for subsequent comparison with the vulnerability matching rules. Among them, the vulnerability matching rules defined in the script library are formulated based on the characteristics of the known vulnerability information library, which can be specific error messages, abnormal system responses, and non-compliant configuration settings; the vulnerability matching rules can be regular expressions, string matching, and numerical range judgments, which are used to search for matching patterns in the execution results. Further, the execution result is compared with the vulnerability matching rules. If there is information in the execution result that matches the pattern of the vulnerability matching rule, it is determined to meet the vulnerability conditions.

[0066] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0067] By pre-establishing a vulnerability information library and script library, specific types of vulnerabilities can be quickly located and diagnosed, avoiding the time-consuming process of scanning and testing configurations one by one in traditional methods.

[0068] Remotely log in to the database to be diagnosed through connection parameters without occupying the configuration file of the target host. The diagnostic statement can be executed only through the target host connection interface, avoiding the risk of database service interruption and improving the speed and security of the diagnostic process.

[0069] Through tenant identification and the access permission list customized by the cloud service provider, the cloud data storage address corresponding to each tenant can be accurately located, and all data in the cloud data storage address can be defined as a database to be diagnosed, ensuring the isolation of data and operations between different tenants, preventing data confusion and unauthorized access, and improving overall data security. Embodiment 2

[0070] In actual application scenarios, multiple tenants store data in the database of a cloud service provider. Due to the sensitivity and importance of the data, cloud service providers pay great attention to the security of the database. However, traditional diagnostic services usually do not provide real-time task progress and status information. After submitting a diagnostic request, tenants often need to wait for a long time to obtain the results. During the diagnosis period, they cannot understand the progress, which lacks transparency and immediacy for tenants.

[0071] The embodiments of the present application are optimized based on the above embodiments.

[0072] In some embodiments, in step S103, when the verification information of the diagnosis request information passes, the cloud service generates a unique task ID for the diagnosis request information, and simultaneously generates a visual window interface associated with the task ID.

[0073] In some embodiments, in step S107, the vulnerability diagnosis result is associated with the task ID, and the vulnerability diagnosis result is synchronized to the visualization window interface in real time.

[0074] In some embodiments, the visual window interface includes the corresponding task ID, diagnostic status, and vulnerability diagnostic results. Among them, the vulnerability diagnostic statements of the corresponding script library are executed in sequence in the database to be diagnosed. When all vulnerability diagnostic statements are executed, the diagnostic status is set to "completed", otherwise, the diagnostic status is set to "diagnosing".

[0075] Specifically, the cloud server transmits the task ID to the corresponding tenant, and the tenant sends a query request to the cloud server based on the received task ID, and the query request includes the task ID. The cloud server returns the corresponding visual window interface to the tenant based on the received query request, so that the tenant can query the task progress in real time.

[0076] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0077] Tenants can track the progress and status of diagnostic tasks in real time through the visual window interface provided by the cloud server, realize real-time task monitoring, improve the transparency and immediacy of the service, and enhance the tenant experience and service quality. Embodiment 3

[0078] When the cloud server faces diagnostic request information from multiple tenants, there may be an uneven resource allocation problem for the execution of vulnerability diagnostic statements. Due to different resource configurations, the loads of several working nodes vary greatly. Some working nodes may be overloaded, while other working nodes may be limited, resulting in low resource utilization, which may affect the response time of the diagnostic task.

[0079] The embodiments of the present application are optimized based on the above embodiments.

[0080] In some embodiments, the cloud server adds the task IDs corresponding to the received diagnostic request information to the task queue in sequence. The cloud server is also provided with a task caller and a task scheduler for monitoring the task queue and allocating tasks according to a preset scheduling strategy.

[0081] In some embodiments, the diagnosis request information also includes a diagnosis purpose, and the urgency corresponding to each diagnosis request information is obtained according to a preset diagnosis urgency table, wherein the diagnosis urgency table includes a diagnosis purpose and a corresponding urgency, and the urgency includes high, medium, and low.

[0082] For example, when the diagnostic purpose is to face industry or government compliance upgrades, the corresponding urgency level is high.

[0083] In some embodiments, tasks are assigned according to a preset scheduling strategy, such as Figure 2 As shown, the specific steps include:

[0084] S201, setting the initial state of the task scheduler, including the scheduling period, task queue length, working node list, and corresponding load status and maximum parallel quantity.

[0085] Among them, the scheduling cycle can be set to 30 seconds, the upper limit of the task queue length is set to 1000, the work node list includes 10 work nodes, which can be set according to the resources of the cloud server, and the maximum parallel number is the maximum number of concurrent executions of each work node, which can be set to 5.

[0086] S202, arranging the task IDs in the task queue in the order in which the diagnosis request information is received.

[0087] S203, according to the scheduling cycle of the task scheduler, checking and updating the load status of each working node in the task queue and the working node list.

[0088] S204: Determine the priority score of the task ID according to the diagnosis request information corresponding to the task ID.

[0089] Specifically, the service level agreements signed between different tenants and cloud service providers are different. The higher the service level, the higher the corresponding priority, and the initial score is determined according to the tenant ID;

[0090] According to the urgency of the diagnosis request information, the initial score is adjusted to obtain the priority score corresponding to the task ID;

[0091] Specifically, if the urgency level corresponding to the diagnosis request information is high, the first score is increased based on the initial score; if the urgency level is low, the first score is reduced based on the initial score; otherwise, the initial score is used as the priority score.

[0092] S205, obtaining a matching score between the task ID and each working node according to the priority score corresponding to the task ID and the load status score of the working node.

[0093] For example, the load status score of a working node is between 0 and 10, 0 means idle and 10 means fully loaded. Assuming that the priority score of a task ID is 8 and the load status score of a working node is 5, the matching score is obtained using the following calculation formula: S=P*0.6-W*0.4, where S is the matching score, P is the priority score, and W is the load status score of the working node. Therefore, the matching score between the task ID and the working node is 2.8.

[0094] S206, among the work nodes whose number of tasks being executed is less than the maximum number of parallel tasks, select and assign the task ID to the work node with the highest matching score with the task ID, update the load status of the work node, and remove the assigned task ID from the task queue.

[0095] Specifically, after receiving the assigned task ID, the working node remotely logs into the corresponding database to be detected according to the corresponding diagnosis request information and starts to perform vulnerability diagnosis, that is, starts to execute the content of step 106.

[0096] S207, repeat steps S203 to S206 until all task IDs in the task queue are removed.

[0097] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0098] By setting up a task scheduler, the load status of all working nodes can be monitored, and the task ID corresponding to the diagnostic request information can be dynamically allocated according to the load situation, ensuring the balanced utilization of resources among various working nodes and improving the overall diagnostic efficiency.

[0099] By setting priority scores according to the diagnostic purposes corresponding to different diagnostic request information and calculating the matching scores based on the load status of the working node, high-priority tasks can be processed first, ensuring that critical tasks can be completed in a timely manner and improving the response efficiency and reliability of the diagnosis. Embodiment 4

[0100] In the first embodiment, the vulnerability matching rules traditionally defined in the script library may often have a high false positive rate, and a single judgment method may reduce the accuracy of vulnerability diagnosis.

[0101] The embodiments of the present application are optimized based on the above embodiments.

[0102] In some embodiments, Figure 3 As shown, step S107 also includes:

[0103] S301, according to the vulnerability matching rules defined in the corresponding script library, initially determine whether the execution result meets the vulnerability conditions, and if so, extract features from the execution result to obtain a feature vector.

[0104] Specifically, the execution results are preprocessed, which may include removing irrelevant information, standardizing data formats, processing missing values, etc.; key features are extracted from the preprocessed execution results, which may include the type of SOL statements, the structure of returned data, abnormal response time, error messages, etc. The key features can reflect the behavioral patterns of the execution results.

[0105] S302, constructing a neural network model, inputting the feature vector into the trained neural network model, and performing secondary judgment.

[0106] Among them, a training data set is formed using data from a known vulnerability information library, and a unique label vector is randomly assigned to each known vulnerability type. The label vector can be generated by one-hot encoding to ensure that each vulnerability type has a corresponding label vector. Furthermore, the training data set and the corresponding label vector are used to train the neural network model.

[0107] S303, judging whether the execution result meets the vulnerability condition according to the probability distribution vector output by the neural network model, and if the secondary judgment meets the vulnerability condition, adding the corresponding vulnerability type and information related to the vulnerability type to the vulnerability diagnosis result.

[0108] Specifically, the probability distribution vector output by the neural network model represents the probability value of the input execution result belonging to each known vulnerability type; a probability threshold is set, and if the probability value of a certain vulnerability type exceeds the probability threshold, the input execution result is judged to belong to the corresponding vulnerability type. Otherwise, the execution result that is initially judged to meet the vulnerability conditions fails the second judgment, and an error message is sent to the relevant technical personnel to analyze the execution result.

[0109] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0110] By combining the initial judgment and the secondary judgment based on the neural network model, the accuracy of vulnerability diagnosis can be significantly improved, and the false alarm rate of the initial judgment based on rule matching can be avoided. The neural network model can accurately and efficiently identify real vulnerabilities by learning the known vulnerability database. In actual applications, it can adapt to new vulnerability patterns and maintain the effectiveness of diagnosis by regularly updating the training data set. Embodiment 5

[0111] Figure 4 It is a structural block diagram of a computer cloud data storage vulnerability diagnosis system according to an embodiment of the present invention.

[0112] like Figure 4 As shown, the computer cloud data storage vulnerability diagnosis system includes: a construction module, an acquisition module and a matching module.

[0113] Specifically, a module is constructed to obtain defects fixed in historical update versions of all cloud data storage databases corresponding to cloud service providers; corresponding vulnerability diagnosis information is generated according to the historical defects of each cloud data storage database to obtain a vulnerability information library; wherein the vulnerability diagnosis information includes vulnerability name, cloud data storage database type, threat type, diagnosis statement and matching rule.

[0114] An acquisition module is used to obtain the diagnosis request information sent by the tenant end, the diagnosis request information includes the tenant identification and verification information; when the verification is passed, based on the preset access permission list, according to the tenant identification in the diagnosis request information, the cloud data storage address corresponding to the tenant identification is obtained, and the database corresponding to the cloud data storage address is determined as the database to be diagnosed, and the cloud data storage address corresponds to the cloud data storage database one by one; wherein each cloud data storage database is provided with a corresponding access permission list, the access permission list includes the tenant identification, the cloud data storage address corresponding to the tenant identification, the cloud data storage database corresponding to the cloud data storage address, and the connection parameters.

[0115] A matching module is used to remotely log in to the database to be diagnosed according to the connection parameters corresponding to the tenant identifier in the access permission list, and execute the vulnerability diagnosis statements of the corresponding script library in the database to be diagnosed in sequence to obtain the execution result; according to the vulnerability matching rules defined in the corresponding script library, it is judged whether the execution result meets the vulnerability condition. If so, the execution result is marked as a vulnerability and the vulnerability information related to the execution result is added to the vulnerability diagnosis result; wherein the vulnerability diagnosis result is set to any one of the data structures or database tables, including vulnerability type, threat type, discovery time, and affected database instance.

[0116] It should be noted that, for other specific implementations of the computer cloud data storage vulnerability diagnosis system of the embodiment of the present invention, reference may be made to the above-mentioned computer cloud data storage vulnerability diagnosis method.

[0117] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A computer cloud data storage vulnerability diagnosis method, characterized in that: Applied to the cloud server, the cloud server is connected to the tenant through a preset API interface, including: Obtain defects fixed in historical update versions of all cloud data storage databases corresponding to cloud service providers; Generate corresponding vulnerability diagnosis information according to the historical defects of each cloud data storage database to obtain a vulnerability information library; Obtain the diagnostic request information sent by the tenant, which includes the tenant ID and verification information; When the verification is passed, based on the preset access permission list and the tenant identifier in the diagnosis request information, the cloud data storage address corresponding to the tenant identifier is obtained, and the cloud data storage database corresponding to the cloud data storage address is determined as the database to be diagnosed, and the cloud data storage address corresponds to the cloud data storage database one by one; According to the type of database to be diagnosed, a corresponding script library is determined in the vulnerability information library, and the script library includes vulnerability diagnosis statements and defined vulnerability matching rules for various database types; According to the access permission list, remotely log in to the database to be diagnosed, execute the vulnerability diagnosis statements of the corresponding script library in the database to be diagnosed in sequence, and obtain the execution results; Determine whether the execution result meets the vulnerability condition according to the vulnerability matching rules defined in the corresponding script library. If so, mark the execution result as a vulnerability and add the vulnerability information related to the execution result to the vulnerability diagnosis result; After the verification information of the diagnosis request information is passed, a unique task ID is generated for the diagnosis request information, and a visualization window interface associated with the task ID is generated; the vulnerability diagnosis result is associated with the task ID, and the vulnerability diagnosis result is synchronized to the corresponding visualization window interface in real time; The cloud server adds the task IDs corresponding to the received diagnostic request information to the task queue in order. The cloud server is also provided with a task caller, and the task scheduler is used to monitor the task queue and allocate tasks according to a preset scheduling strategy. The diagnosis request information also includes the diagnosis purpose, and the urgency level corresponding to each diagnosis request information is obtained according to the preset diagnosis urgency level table; The task allocation according to the preset scheduling strategy includes: Set the initial state of the task scheduler, including the scheduling period, task queue length, working node list, and corresponding load status and maximum number of parallel operations; Arrange the task IDs in the task queue in the order in which the diagnostic request information is received; According to the scheduling cycle of the task scheduler, check and update the load status of each working node in the task queue and working node list; Determine the priority score of the task ID according to the diagnostic request information corresponding to the task ID; According to the priority score corresponding to the task ID and the load status score of the working node, the matching score between the task ID and each working node is obtained; Among the worker nodes whose number of tasks being executed is less than the maximum number of parallel tasks, the task ID is assigned to the worker node with the highest matching score for the task ID. The load status of the worker node is updated and the assigned task ID is removed from the task queue.

2. The computer cloud data storage vulnerability diagnosis method according to claim 1, characterized in that: The vulnerability diagnosis information includes vulnerability name, cloud data storage database type, threat type, diagnostic statement and matching rule; each cloud data storage database is provided with a corresponding access permission list, and the access permission list includes a tenant identifier, a cloud data storage address corresponding to the tenant identifier, a cloud data storage database corresponding to the cloud data storage address and connection parameters.

3. The computer cloud data storage vulnerability diagnosis method according to claim 2, characterized in that: The remotely logging into the database to be diagnosed according to the access permission list includes: Remotely log in to the database to be diagnosed according to the connection parameters corresponding to the tenant ID in the access permission list.

4. The computer cloud data storage vulnerability diagnosis method according to claim 1, characterized in that: The tenant identification corresponds one-to-one to the verification information, and the verification information includes an API key pre-determined with the cloud service provider.

5. The computer cloud data storage vulnerability diagnosis method according to claim 1, characterized in that: The vulnerability diagnosis result is set as a data structure or a database table, including vulnerability type, threat type, discovery time, and affected database instance.

6. The computer cloud data storage vulnerability diagnosis method according to claim 1, characterized in that: The visual window interface includes the corresponding task ID, diagnosis status, and vulnerability diagnosis results; When executing the vulnerability diagnosis statements of the corresponding script library in the database to be diagnosed in sequence, when all vulnerability diagnosis statements are executed, the diagnosis status is set to "completed", otherwise, the diagnosis status is set to "diagnosing"; The cloud server is also used to transmit the task ID to the corresponding tenant. The tenant sends a query request to the cloud server based on the received task ID. The query request includes the task ID. The cloud server returns the corresponding visualization window interface to the tenant based on the received query request.

7. The computer cloud data storage vulnerability diagnosis method according to claim 1, characterized in that: The step of judging whether the execution result meets the vulnerability condition according to the vulnerability matching rule defined in the corresponding script library, and if so, marking the execution result as a vulnerability and adding the vulnerability information related to the execution result to the vulnerability diagnosis result includes: According to the vulnerability matching rules defined in the corresponding script library, it is first determined whether the execution result meets the vulnerability conditions. If so, the execution result is feature extracted to obtain a feature vector; Construct a neural network model, input the feature vector into the trained neural network model, and perform secondary judgment; According to the probability distribution vector output by the neural network model, it is judged whether the execution result meets the vulnerability condition. If the second judgment meets the vulnerability condition, the corresponding vulnerability type and information related to the vulnerability type are added to the vulnerability diagnosis result; The training data set is formed by using the data in the known vulnerability information database, and a unique label vector is randomly assigned to each known vulnerability type therein, and the training data set and the corresponding label vector are used to train the neural network model; Among them, the probability distribution vector output by the neural network model represents the probability value of the input execution result belonging to each known vulnerability type; if the probability value of a certain vulnerability type exceeds the probability threshold, the input execution result is judged to belong to the corresponding vulnerability type, otherwise, the execution result that is initially judged to meet the vulnerability conditions fails the second judgment.

Images