Vulnerability repairing method and device based on security verification technology, equipment and medium
By introducing security verification technology into the full life cycle management of vulnerabilities, combined with vulnerability scanning and repair processes, the problems of cumbersome steps and insufficient automation management in the existing technology are solved, and efficient vulnerability repair is achieved.
Patent Information
- Application Number
- CN202411291866.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-14
- Publication Date
- 2024-12-13
AI Technical Summary
In the entire life cycle management of vulnerabilities, the verification technology and vulnerability repair cannot be combined, resulting in cumbersome steps and no automated management of vulnerabilities involved, resulting in large workloads for vulnerabilities.
Using vulnerability repair methods based on security verification technology, including obtaining missed scan reports, creating repair work orders, vulnerability repair and work order status modification stages, verifying verification vulnerabilities through pre-set security verification technology, generating repair work orders and performing Fixed, and finally modified the ticket status to completed.
It improves the accuracy and efficiency of vulnerability repair, reduces the number and difficulty of vulnerabilities that need to be handled, and reduces the time cost and task of fixing vulnerabilities.
Smart Images
Figure CN119128912A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data processing technology, and in particular to a vulnerability repair method, device, equipment and medium based on security verification technology. Background Art
[0002] For vulnerability management platforms, functions include vulnerability scan result integration, vulnerability analysis and correlation, and vulnerability reporting and notification. For verification products, functions include vulnerability simulation and detection, and attack behavior simulation.
[0003] In the process of implementing the present invention, the inventors found that the prior art has the following defects: At present, in the process of vulnerability life cycle management, especially in the process of not actually taking different response measures for different verification results, the verification technology and vulnerability repair cannot be combined, resulting in cumbersome steps. In addition, the verification technology is mainly used in the auxiliary verification process, but the automated management process of vulnerabilities is not involved, resulting in a large workload for vulnerability repair. Summary of the invention
[0004] The present invention provides a vulnerability repair method, device, equipment and medium based on security verification technology to improve the accuracy and efficiency of vulnerability repair and reduce the number and difficulty of vulnerabilities to be processed.
[0005] According to one aspect of the present invention, a vulnerability repair method based on security verification technology is provided, which includes:
[0006] Among them, the vulnerability repair method based on security verification technology includes the vulnerability scan report acquisition stage, the repair work order creation stage, the vulnerability repair stage and the work order status modification stage;
[0007] Obtain the current missed scan report corresponding to the target vulnerability scanner, perform a low-risk vulnerability elimination operation on the current missed scan report, and obtain the current vulnerability to be verified;
[0008] The current vulnerability to be verified is verified by using a preset security verification technology to obtain a current first undefendable vulnerability, and generate a current first repair work order;
[0009] The safety verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage;
[0010] The vulnerability in the current first repair work order is repaired by a preset vulnerability repair method, the vulnerability repair operation of the current first repair work order is completed, and the status of the current first repair work order is modified to a completed status.
[0011] According to another aspect of the present invention, a vulnerability repair device based on security verification technology is provided, which includes:
[0012] Among them, the vulnerability repair method based on security verification technology includes the vulnerability scan report acquisition stage, the repair work order creation stage, the vulnerability repair stage and the work order status modification stage;
[0013] The current vulnerability determination module to be verified is used to obtain the current missed scan report corresponding to the target vulnerability scanner, and perform a low-risk vulnerability elimination operation on the current missed scan report to obtain the current vulnerability to be verified;
[0014] A current first repair work order generating module is used to verify the current vulnerability to be verified through a preset security verification technology, obtain the current first undefendable vulnerability, and generate the current first repair work order;
[0015] The safety verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage;
[0016] The status modification module of the current first repair work order is used to repair the vulnerability in the current first repair work order through a preset vulnerability repair method, complete the vulnerability repair operation of the current first repair work order, and modify the status of the current first repair work order to a completed status.
[0017] According to another aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the vulnerability repair method based on security verification technology described in any embodiment of the present invention is implemented.
[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the vulnerability repair method based on security verification technology described in any embodiment of the present invention when executed.
[0019] The technical solution of the embodiment of the present invention, the vulnerability repair method based on the security verification technology includes a leak scan report acquisition stage, a repair work order creation stage, a vulnerability repair stage and a work order status modification stage; by obtaining the current leak scan report corresponding to the target vulnerability scanner, the current leak scan report is subjected to a low-risk vulnerability elimination operation to obtain the current vulnerability to be verified; the current vulnerability to be verified is verified by a pre-set security verification technology to obtain the current first undefendable vulnerability and generate the current first repair work order; wherein the security verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage; the vulnerability in the current first repair work order is repaired by a pre-set vulnerability repair method to complete the vulnerability repair operation of the current first repair work order, and the status of the current first repair work order is modified to a completed state, which solves the problem of cumbersome steps caused by the inability to combine the verification technology and vulnerability repair in the prior art. The accuracy and efficiency of vulnerability repair are improved, the number and difficulty of vulnerabilities to be processed are reduced, and the time cost and task volume of vulnerability repair are reduced.
[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0022] Figure 1 is a flow chart of a vulnerability repair method based on security verification technology provided according to Embodiment 1 of the present invention;
[0023] Figure 2 is a flowchart of another vulnerability repair method based on security verification technology provided according to Embodiment 2 of the present invention;
[0024] Figure 3 is a schematic diagram of the structure of a vulnerability repair device based on security verification technology provided according to Embodiment 3 of the present invention;
[0025] Figure 4 It is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. DETAILED DESCRIPTION
[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0027] It should be noted that the terms "target", "current", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0028] Embodiment 1
[0029] Figure 1 A flowchart of a vulnerability repair method based on security verification technology is provided in Example 1 of the present invention. This embodiment is applicable to the situation of time consumption prediction of distributed task resources. The method can be executed by a vulnerability repair device based on security verification technology, and the vulnerability repair device based on security verification technology can be implemented in the form of hardware and / or software.
[0030] Correspondingly, such as Figure 1 As shown, the method includes:
[0031] The vulnerability repair method based on security verification technology includes a vulnerability scan report acquisition stage, a repair work order creation stage, a vulnerability repair stage, and a work order status modification stage.
[0032] S110, obtaining a current vulnerability scan report corresponding to a target vulnerability scanner, performing a low-risk vulnerability elimination operation on the current vulnerability scan report, and obtaining a current vulnerability to be verified.
[0033] The current vulnerability scan report may include multiple current vulnerabilities and current vulnerability levels corresponding to the current vulnerabilities. Specifically, the current vulnerability levels may include high-risk vulnerabilities, medium-risk vulnerabilities, and low-risk vulnerabilities.
[0034] Among them, the current vulnerability to be verified may be the vulnerability to be verified after eliminating low-risk vulnerabilities.
[0035] Optionally, obtaining a current missed scan report corresponding to a target vulnerability scanner, performing a low-risk vulnerability elimination operation on the current missed scan report, and obtaining a current vulnerability to be verified, includes: obtaining a current missed scan report corresponding to a target vulnerability scanner; and performing a low-risk vulnerability elimination operation on each current vulnerability according to the current vulnerability level, and obtaining at least one current vulnerability to be verified.
[0036] In this embodiment, since the current vulnerability level may include high-risk vulnerabilities, medium-risk vulnerabilities, and low-risk vulnerabilities, it is assumed that the current vulnerability scan report includes 100 current vulnerabilities, specifically, 20 high-risk vulnerabilities, 30 medium-risk vulnerabilities, and 50 low-risk vulnerabilities. After the low-risk vulnerability elimination operation, 50 current vulnerabilities to be verified (i.e., including 20 high-risk vulnerabilities and 30 medium-risk vulnerabilities) can be obtained.
[0037] S120: Verify the current vulnerability to be verified by using a preset security verification technology to obtain a current first undefendable vulnerability, and generate a current first repair work order.
[0038] The security verification technology is added after the missed scan report acquisition stage and before the repair work order creation stage.
[0039] In this embodiment, since the vulnerability repair method based on the security verification technology includes the leak scan report acquisition stage, the repair work order creation stage, the vulnerability repair stage and the work order status modification stage, the security verification technology is now added after the leak scan report acquisition stage and before the repair work order creation stage.
[0040] The current first undefendable vulnerability may be an undefendable vulnerability verified by using a security verification technology after the vulnerability scan report acquisition stage and before the repair work order creation stage.
[0041] Optionally, the current vulnerability to be verified is verified through a pre-set security verification technology to obtain the current first undefendable vulnerability and generate the current first repair work order, including: respectively obtaining the vulnerability model corresponding to each of the current vulnerabilities to be verified; matching the vulnerability model in each current vulnerability to be verified with the vulnerability exploitation technique library corresponding to the security verification technology in turn to obtain the target vulnerability technique corresponding to each current vulnerability to be verified; wherein the vulnerability exploitation technique library is composed of vulnerability models and vulnerability techniques; instructing the attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability technique to obtain the current first undefendable vulnerability; and generating the current first repair work order according to the current first undefendable vulnerability.
[0042] The vulnerability model may be a type of model that describes the current vulnerability to be verified. Different current vulnerabilities to be verified may correspond to different vulnerability models, and different vulnerability models correspond to different attack methods. The vulnerability exploitation method library may be a database composed of vulnerability models and vulnerability methods.
[0043] Specifically, by matching the vulnerability model corresponding to the current vulnerability to be verified with the vulnerability model in the vulnerability exploitation technique library. In detail, assuming that the vulnerability model corresponding to the current vulnerability to be verified can be matched with the vulnerability model in the vulnerability exploitation technique library, the corresponding target vulnerability technique can be determined. Assuming that the vulnerability model corresponding to the current vulnerability to be verified cannot be matched with the vulnerability model in the vulnerability exploitation technique library, the current vulnerability to be verified and the vulnerability model can be determined to be fed back to the user, and the corresponding target vulnerability technique is matched through manual analysis, and the new vulnerability model and target vulnerability technique are jointly stored in the vulnerability exploitation technique library.
[0044] Optionally, the instructing the attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability technique to obtain the current first undefendable vulnerability, including: instructing the attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability technique to obtain an attack verification processing result; instructing the vulnerability management platform to analyze the attack verification processing result, if the attack verification processing result is an unsuccessful attack processing result, then the current first defensible vulnerability is obtained, and a current first defensible vulnerability work order is generated according to the current first defensible vulnerability, and the status of the current first defensible vulnerability work order is modified to a suspended repair status; if the attack verification processing result is a successful attack processing result, then the current first undefendable vulnerability is obtained.
[0045] In this embodiment, after the current vulnerability to be verified and the corresponding target vulnerability technique are determined, the attack verification processing result can be obtained by instructing the attack robot to perform an operation of simulating a system attack.
[0046] Furthermore, the attack verification processing result can be analyzed and processed through the vulnerability management platform. Specifically, if the attack verification processing result is an unsuccessful attack processing result, it means that the system can defend against the vulnerability, and the current first defensible vulnerability can be obtained. Accordingly, a current first defensible vulnerability work order can be generated based on multiple current first defensible vulnerabilities, and the status of the current first defensible vulnerability work order can be modified to a suspended repair status.
[0047] Correspondingly, if the attack verification processing result is a successful attack processing result, it means that the system cannot defend against the vulnerability, and the current first undefendable vulnerability is obtained. Then, the current first undefendable vulnerability needs to be repaired.
[0048] S130. Repair the vulnerability in the current first repair work order by using a preset vulnerability repair method, complete the vulnerability repair operation of the current first repair work order, and change the status of the current first repair work order to a completed status.
[0049] In this embodiment, after obtaining the current first repair work order, the vulnerability needs to be repaired by the vulnerability repair method, and the vulnerability repair operation of the current first repair work order can be completed. After determining that the repair is completed, the status of the current first repair work order needs to be modified to a completed state.
[0050] The technical solution of the embodiment of the present invention, the vulnerability repair method based on the security verification technology includes a leak scan report acquisition stage, a repair work order creation stage, a vulnerability repair stage and a work order status modification stage; by obtaining the current leak scan report corresponding to the target vulnerability scanner, the current leak scan report is subjected to a low-risk vulnerability elimination operation to obtain the current vulnerability to be verified; the current vulnerability to be verified is verified by a pre-set security verification technology to obtain the current first undefendable vulnerability and generate the current first repair work order; wherein the security verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage; the vulnerability in the current first repair work order is repaired by a pre-set vulnerability repair method to complete the vulnerability repair operation of the current first repair work order, and the status of the current first repair work order is modified to a completed state, which solves the problem of cumbersome steps caused by the inability to combine the verification technology and vulnerability repair in the prior art. The accuracy and efficiency of vulnerability repair are improved, the number and difficulty of vulnerabilities to be processed are reduced, and the time cost and task volume of vulnerability repair are reduced.
[0051] Embodiment 2
[0052] Figure 2 A flowchart of another vulnerability repair method based on security verification technology is provided for the second embodiment of the present invention. This embodiment is optimized based on the above embodiments. In this embodiment, after obtaining the current leak scan report corresponding to the target vulnerability scanner, performing a low-risk vulnerability elimination operation on the current leak scan report, and obtaining the current vulnerability to be verified, it also includes the creation of the current second repair work order.
[0053] Correspondingly, such as Figure 2 As shown, the method includes:
[0054] The vulnerability repair method based on the security verification technology includes a leak scan report acquisition stage, a repair work order creation stage, a vulnerability repair stage and a work order status modification stage. In this embodiment, the security verification technology is added to the vulnerability repair stage.
[0055] S210: Obtain a current vulnerability scan report corresponding to the target vulnerability scanner, and perform a low-risk vulnerability elimination operation on the current vulnerability scan report to obtain a current vulnerability to be verified.
[0056] S220: Create a current second repair work order according to the current vulnerability to be verified.
[0057] The current second repair work order may be a repair work order formed according to a plurality of current vulnerabilities to be verified.
[0058] S230: Perform attack verification processing on the current second repair work order through a preset security verification technology to obtain the current second undefendable vulnerability.
[0059] The current second undefendable vulnerability may be an undefendable vulnerability screened out by adding security verification technology in the vulnerability repair phase and performing verification processing on the current vulnerability to be verified in the current second repair work order.
[0060] In this embodiment, similarly, it is necessary to obtain the vulnerability model corresponding to each of the current vulnerabilities to be verified in the current second repair work order respectively; match the vulnerability model in each current vulnerability to be verified with the vulnerability exploitation technique library corresponding to the security verification technology in turn, and obtain the target vulnerability technique corresponding to each current vulnerability to be verified; instruct the attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability technique, and obtain the current second undefendable vulnerability.
[0061] S240: repair the current second undefendable vulnerability by using a preset vulnerability repair method, complete the repair operation of the current second undefendable vulnerability, and modify the status of the current second repair work order to a completed status.
[0062] In this embodiment, after obtaining the current second undefendable vulnerability, the vulnerability needs to be repaired by a vulnerability repair method, and the current second undefendable vulnerability repair operation can be completed. After determining that the repair is completed, the status of the current second repair work order needs to be modified to a completed state.
[0063] Optionally, it also includes: after receiving the status of the current first repair work order or the current second repair work order as completed, instructing the target vulnerability scanner to scan again, obtain a second vulnerability scan report, and perform vulnerability detection processing on the second vulnerability report to obtain a vulnerability detection processing result.
[0064] In this embodiment, after the current first repair work order or the current second repair work order is repaired, a re-scan operation needs to be performed through the target vulnerability scanner to obtain a re-scan report. Further, the re-vulnerability report can be subjected to vulnerability detection processing to determine whether there is still a vulnerability.
[0065] Optionally, after performing vulnerability detection processing on the second vulnerability report and obtaining the vulnerability detection processing result, it also includes: if the vulnerability detection processing result is that no vulnerability is detected, determining that the second vulnerability scan report has completed the vulnerability repair; if the vulnerability detection processing result is that a vulnerability is detected, returning to execute the low-risk vulnerability elimination operation on the second vulnerability scan report to obtain the operation of the current vulnerability to be verified.
[0066] In this embodiment, if the vulnerability detection processing result is that no vulnerability is detected, it means that the vulnerability has been repaired, and a result of another leak scan reporting that the vulnerability has been repaired can be obtained.
[0067] Furthermore, if the vulnerability detection processing result is a detected vulnerability, the missed scan report is returned to execute the low-risk vulnerability elimination operation to obtain the current vulnerability to be verified, that is, the security verification technology can be added after the missed scan report acquisition stage and before the repair work order creation stage; or the security verification technology can be added in the vulnerability repair stage to perform the vulnerability repair operation of the missed scan report again.
[0068] The technical solution of the embodiment of the present invention obtains the current leak report corresponding to the target vulnerability scanner, performs low-risk vulnerability elimination operation on the current leak report, and obtains the current vulnerability to be verified; creates the current second repair work order according to the current vulnerability to be verified; performs attack verification processing on the current second repair work order through a pre-set security verification technology to obtain the current second undefendable vulnerability; performs repair processing on the current second undefendable vulnerability through a pre-set manual vulnerability repair method, completes the repair operation of the current second undefendable vulnerability, and modifies the status of the current second repair work order to a completed state. Adding security verification technology to the vulnerability repair stage can improve the accuracy and efficiency of vulnerability repair, reduce the number and difficulty of vulnerabilities to be processed, and reduce the time cost and workload of repairing vulnerabilities.
[0069] Embodiment 3
[0070] Figure 3 This is a schematic diagram of the structure of a vulnerability repair device based on security verification technology provided in the third embodiment of the present invention. The vulnerability repair device based on security verification technology provided in this embodiment can be implemented by software and / or hardware, and can be configured in a terminal device or server to implement a vulnerability repair method based on security verification technology in the embodiment of the present invention. Figure 3 As shown, the device includes: a current vulnerability to be verified determining module 310, a current first repair work order generating module 320 and a current first repair work order status modifying module 330.
[0071] Among them, the vulnerability repair method based on security verification technology includes the vulnerability scan report acquisition stage, the repair work order creation stage, the vulnerability repair stage and the work order status modification stage;
[0072] The current vulnerability determination module 310 is used to obtain the current missed scan report corresponding to the target vulnerability scanner, and perform a low-risk vulnerability elimination operation on the current missed scan report to obtain the current vulnerability to be verified;
[0073] The current first repair work order generating module 320 is used to verify the current vulnerability to be verified through a preset security verification technology, obtain the current first undefendable vulnerability, and generate the current first repair work order;
[0074] The safety verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage;
[0075] The status modification module 330 of the current first repair work order is used to repair the vulnerability in the current first repair work order through a preset vulnerability repair method, complete the vulnerability repair operation of the current first repair work order, and modify the status of the current first repair work order to a completed status.
[0076] The technical solution of the embodiment of the present invention, the vulnerability repair method based on the security verification technology includes a leak scan report acquisition stage, a repair work order creation stage, a vulnerability repair stage and a work order status modification stage; by obtaining the current leak scan report corresponding to the target vulnerability scanner, the current leak scan report is subjected to a low-risk vulnerability elimination operation to obtain the current vulnerability to be verified; the current vulnerability to be verified is verified by a pre-set security verification technology to obtain the current first undefendable vulnerability and generate the current first repair work order; wherein the security verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage; the vulnerability in the current first repair work order is repaired by a pre-set vulnerability repair method to complete the vulnerability repair operation of the current first repair work order, and the status of the current first repair work order is modified to a completed state, which solves the problem of cumbersome steps caused by the inability to combine the verification technology and vulnerability repair in the prior art. The accuracy and efficiency of vulnerability repair are improved, the number and difficulty of vulnerabilities to be processed are reduced, and the time cost and task volume of vulnerability repair are reduced.
[0077] Based on the above embodiments, the current vulnerability determination module 310 to be verified can be specifically used to: obtain a current vulnerability scan report corresponding to the target vulnerability scanner; wherein the current vulnerability scan report includes multiple current vulnerabilities and current vulnerability levels corresponding to the current vulnerabilities; the current vulnerability levels include high-risk vulnerabilities, medium-risk vulnerabilities and low-risk vulnerabilities; according to the current vulnerability level, perform a low-risk vulnerability elimination operation on each of the current vulnerabilities to obtain at least one current vulnerability to be verified.
[0078] On the basis of the above embodiments, the current first repair work order generation module 320 can be specifically used to: respectively obtain the vulnerability model corresponding to each of the current vulnerabilities to be verified; match the vulnerability model in each current vulnerability to be verified with the vulnerability exploitation technique library corresponding to the security verification technology in turn, and obtain the target vulnerability technique corresponding to each current vulnerability to be verified; wherein the vulnerability exploitation technique library is composed of vulnerability models and vulnerability techniques; instruct the attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability technique, and obtain the current first undefendable vulnerability; generate the current first repair work order according to the current first undefendable vulnerability.
[0079] On the basis of the above embodiments, the current first repair work order generation module 320 can also be specifically used to: instruct the attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability method, and obtain the attack verification processing result; instruct the vulnerability management platform to analyze the attack verification processing result. If the attack verification processing result is an unsuccessful attack processing result, the current first defensible vulnerability is obtained, and the current first defensible vulnerability work order is generated according to the current first defensible vulnerability, and the status of the current first defensible vulnerability work order is modified to a suspended repair status; if the attack verification processing result is a successful attack processing result, the current first undefensible vulnerability is obtained.
[0080] On the basis of the above embodiments, it also includes a current second repair work order creation module, which can be specifically used for: obtaining the current missed scan report corresponding to the target vulnerability scanner, performing a low-risk vulnerability elimination operation on the current missed scan report, and obtaining the current vulnerability to be verified, and then creating a current second repair work order according to the current vulnerability to be verified; performing an attack verification process on the current second repair work order through a preset security verification technology to obtain the current second undefendable vulnerability; wherein the security verification technology is added in the vulnerability repair stage; repairing the current second undefendable vulnerability through a preset vulnerability repair method, completing the repair operation of the current second undefendable vulnerability, and modifying the status of the current second repair work order to a completed status.
[0081] On the basis of the above embodiments, it also includes a vulnerability detection processing result determination module, which can be specifically used to: after receiving the status of the current first repair work order or the current second repair work order as completed, instruct the target vulnerability scanner to perform another scan to obtain a second missed scan report, and perform vulnerability detection processing on the second vulnerability report to obtain a vulnerability detection processing result.
[0082] On the basis of the above embodiments, it also includes a vulnerability detection processing result analysis module, which can be specifically used for: after the vulnerability detection processing is performed on the second vulnerability report to obtain the vulnerability detection processing result, if the vulnerability detection processing result is that no vulnerability is detected, it is determined that the vulnerability repair has been completed in the second leak scan report; if the vulnerability detection processing result is that a vulnerability is detected, the second leak scan report is returned to execute a low-risk vulnerability elimination operation to obtain the operation of the current vulnerability to be verified.
[0083] The vulnerability repair device based on security verification technology provided in the embodiment of the present invention can execute the vulnerability repair method based on security verification technology provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
[0084] Embodiment 4
[0085] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement the fourth embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0086] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0087] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0088] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a vulnerability repair method based on security verification technology.
[0089] In some embodiments, the vulnerability repair method based on security verification technology can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the vulnerability repair method based on security verification technology described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the vulnerability repair method based on security verification technology in any other appropriate manner (for example, by means of firmware).
[0090] The method includes: wherein, the vulnerability repair method based on security verification technology includes a leak scan report acquisition stage, a repair work order creation stage, a vulnerability repair stage and a work order status modification stage; obtaining the current leak scan report corresponding to the target vulnerability scanner, performing a low-risk vulnerability elimination operation on the current leak scan report, and obtaining the current vulnerability to be verified; verifying the current vulnerability to be verified through a pre-set security verification technology, obtaining the current first undefendable vulnerability, and generating the current first repair work order; wherein, the security verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage; repairing the vulnerability in the current first repair work order through a pre-set vulnerability repair method, completing the vulnerability repair operation of the current first repair work order, and modifying the status of the current first repair work order to a completed status.
[0091] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0092] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0093] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0094] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0095] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0096] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0097] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
[0098] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
[0099] Embodiment 5
[0100] Embodiment 5 of the present invention also provides a computer-readable storage medium, wherein the computer-readable instructions are used to execute a vulnerability repair method based on security verification technology when executed by a computer processor, the method comprising: wherein the vulnerability repair method based on security verification technology comprises a leak report acquisition stage, a repair work order creation stage, a vulnerability repair stage and a work order status modification stage; obtaining a current leak report corresponding to a target vulnerability scanner, performing a low-risk vulnerability elimination operation on the current leak report, and obtaining a current vulnerability to be verified; verifying the current vulnerability to be verified through a preset security verification technology, obtaining a current first undefendable vulnerability, and generating a current first repair work order; wherein the security verification technology is added after the leak report acquisition stage and before the repair work order creation stage; repairing the vulnerability in the current first repair work order through a preset vulnerability repair method, completing the vulnerability repair operation of the current first repair work order, and modifying the status of the current first repair work order to a completed status.
[0101] Of course, the computer-readable storage medium provided in the embodiment of the present invention has computer executable instructions that are not limited to the method operations described above, and can also execute related operations in the vulnerability repair method based on security verification technology provided in any embodiment of the present invention.
[0102] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FLASH), a hard disk or an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.
[0103] It is worth noting that in the embodiment of the vulnerability repair device based on security verification technology mentioned above, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.
[0104] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A vulnerability repair method based on security verification technology, characterized in that: include: Among them, the vulnerability repair method based on security verification technology includes the vulnerability scan report acquisition stage, the repair work order creation stage, the vulnerability repair stage and the work order status modification stage; Obtain the current missed scan report corresponding to the target vulnerability scanner, perform a low-risk vulnerability elimination operation on the current missed scan report, and obtain the current vulnerability to be verified; The current vulnerability to be verified is verified by using a preset security verification technology to obtain a current first undefendable vulnerability, and generate a current first repair work order; The safety verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage; The vulnerability in the current first repair work order is repaired by a preset vulnerability repair method, the vulnerability repair operation of the current first repair work order is completed, and the status of the current first repair work order is modified to a completed status.
2. The method according to claim 1, characterized in that: The step of obtaining a current vulnerability scan report corresponding to the target vulnerability scanner and performing a low-risk vulnerability elimination operation on the current vulnerability scan report to obtain a current vulnerability to be verified includes: Get the current vulnerability scan report corresponding to the target vulnerability scanner; The current vulnerability scan report includes multiple current vulnerabilities and current vulnerability levels corresponding to the current vulnerabilities; the current vulnerability levels include high-risk vulnerabilities, medium-risk vulnerabilities and low-risk vulnerabilities; According to the current vulnerability level, a low-risk vulnerability elimination operation is performed on each current vulnerability to obtain at least one current vulnerability to be verified.
3. The method according to claim 2, characterized in that The method of verifying the current vulnerability to be verified by using a preset security verification technology to obtain the current first undefendable vulnerability and generate the current first repair work order includes: Respectively obtain vulnerability models corresponding to the currently to-be-verified vulnerabilities; Matching the vulnerability model in each currently to-be-verified vulnerability with the vulnerability exploitation technique library corresponding to the security verification technology in turn, to obtain the target vulnerability techniques corresponding to each currently to-be-verified vulnerability; The vulnerability exploitation method library is composed of vulnerability models and vulnerability methods; Instruct the attack robot to perform attack verification according to each current vulnerability to be verified and the corresponding target vulnerability method, and obtain the current first undefendable vulnerability; A current first repair work order is generated according to the current first undefendable vulnerability.
4. The method according to claim 3, characterized in that The instructing attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability method, and obtain the current first undefendable vulnerability, including: Instruct the attack robot to perform attack verification processing according to each current vulnerability to be verified and the corresponding target vulnerability method, and obtain the attack verification processing result; Instruct the vulnerability management platform to analyze the attack verification processing result. If the attack verification processing result is an unsuccessful attack processing result, a current first defensible vulnerability is obtained, and a current first defensible vulnerability work order is generated according to the current first defensible vulnerability, and the status of the current first defensible vulnerability work order is modified to a suspended repair status; If the attack verification processing result is a successful attack processing result, the current first undefendable vulnerability is obtained.
5. The method according to claim 4, characterized in that After obtaining the current missed scan report corresponding to the target vulnerability scanner and performing a low-risk vulnerability elimination operation on the current missed scan report to obtain the current vulnerability to be verified, the method further includes: Create the current second repair work order based on the current vulnerability to be verified; Through the pre-set security verification technology, the current second repair work order is subjected to attack verification processing to obtain the current second undefendable vulnerability; Wherein, the security verification technology is added during the vulnerability repair phase; The current second undefendable vulnerability is repaired by a preset vulnerability repair method, the repair operation of the current second undefendable vulnerability is completed, and the status of the current second repair work order is modified to a completed status.
6. The method according to claim 5, characterized in that Also includes: After receiving that the status of the current first repair work order or the current second repair work order is completed, instruct the target vulnerability scanner to scan again to obtain a second leak report, and perform vulnerability detection processing on the second vulnerability report to obtain a vulnerability detection processing result.
7. The method according to claim 6, characterized in that After performing vulnerability detection processing on the second vulnerability report to obtain a vulnerability detection processing result, the method further includes: If the vulnerability detection processing result is that no vulnerability is detected, it is determined that the vulnerability repair has been completed by the second leak scan report; If the vulnerability detection processing result is that a vulnerability is detected, the second leak scan report is returned to perform a low-risk vulnerability elimination operation to obtain an operation of the current vulnerability to be verified.
8. A vulnerability repair device based on security verification technology, characterized in that: include: Among them, the vulnerability repair method based on security verification technology includes the vulnerability scan report acquisition stage, the repair work order creation stage, the vulnerability repair stage and the work order status modification stage; The current vulnerability determination module to be verified is used to obtain the current missed scan report corresponding to the target vulnerability scanner, and perform a low-risk vulnerability elimination operation on the current missed scan report to obtain the current vulnerability to be verified; A current first repair work order generating module is used to verify the current vulnerability to be verified through a preset security verification technology, obtain the current first undefendable vulnerability, and generate the current first repair work order; The safety verification technology is added after the leak scan report acquisition stage and before the repair work order creation stage; The status modification module of the current first repair work order is used to repair the vulnerability in the current first repair work order through a preset vulnerability repair method, complete the vulnerability repair operation of the current first repair work order, and modify the status of the current first repair work order to a completed status.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the vulnerability repair method based on security verification technology as described in any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the vulnerability repair method based on security verification technology as described in any one of claims 1 to 7 when executed.