Portable device for realizing asset identification and vulnerability management of transformer substation

Abstract

The invention discloses a portable device for realizing asset identification and vulnerability management of a transformer substation, which relates to the technical field of network security and comprises a port scanning module, an asset identification engine module, a vulnerability detection sub-module and a vulnerability verification sub-module, the vulnerability detection sub-module is used for matching the target information obtained from the target host by the asset identification engine module with a preset vulnerability information library, and obtaining non-precise vulnerability information of the target information; the vulnerability verification sub-module is used for extracting a simulation attack plug-in corresponding to the imprecise vulnerability information from a preset plug-in library according to a vulnerability range in the imprecise vulnerability information, and is also used for verifying the imprecise vulnerability information and judging to obtain accurate vulnerability information existing in the target host; according to the portable device, the working efficiency can be improved, loophole checking and repairing work can be responded in real time, meanwhile, the work can be more professionally and accurately carried out through device enabling, and the safety of a power grid is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more particularly, to a portable device for realizing substation asset identification and vulnerability management. Background Art

[0002] At present, the network security space is diversified and complex. For security issues caused by security vulnerabilities in the network space, scanning for system vulnerabilities is carried out to prevent them before they happen. The traditional vulnerability scanning framework has some limitations in terms of the speed, accuracy, vulnerability identification, applicability and practicality of vulnerability scanning. In recent years, port scanning technology has become more and more mature, and a number of excellent lightweight scanning engines such as Masscan have emerged. Masscan is known as the fastest vulnerability scanner at the time. It can scan the entire network in a few minutes without restrictions on network bandwidth environment and scanning host system configuration. It is a very fast and efficient scanner. The disadvantage is that as an extremely fast scanner, masscan can only have excellent efficiency when scanning ports, and needs to be expanded in other aspects such as vulnerability scanning.

[0003] At present, there are many companies in China that specialize in security technology, such as 360, Green Alliance, and Knowsec, all of which have made outstanding contributions in vulnerability scanning. Among them, Knowsec's ZoomEye has created a world-class cyberspace scanning engine. Other large, medium and small companies have also established a series of cyberspace security teams to specialize in various problems in the security field. The well-known 360 Security is also second to none in vulnerability scanning, but 360 is more familiar with stand-alone scanning and data collection, rather than the network host scanning mentioned here.

[0004] Due to the large scale, high complexity and diversity of the network, network vulnerabilities have also become larger in number, more diverse and more hidden. New problems continue to emerge and new technologies need to be constantly updated. For relatively closed systems such as substations, current vulnerability scanning systems generally have problems such as slow update speed, high scanning false alarm rate, and difficulty in updating and upgrading. Summary of the invention

[0005] The purpose of the present invention is to provide a portable device for realizing substation asset identification and vulnerability management, which can solve the problems of the growing scale of network security supervision of power monitoring systems and the increasing difficulty of supervision, as well as the problems of many categories of network security inspections and complicated equipment in power monitoring systems, the immaturity of existing verification technologies, and extremely high security risks of information systems and control systems; it also solves the problems of high professional threshold for network security verification of power monitoring systems and the need to improve the standardization of verification.

[0006] The above technical objectives of the present invention are achieved through the following technical solutions:

[0007] The present application provides a portable device for realizing substation asset identification and vulnerability management, comprising:

[0008] Port scanning module, used by users to detect host survival and development ports of surviving hosts;

[0009] The asset identification engine module is used to identify the open services of the surviving host in combination with the preset asset fingerprint database. The open services include the operating system, database and middleware.

[0010] The vulnerability scanning engine module includes a vulnerability detection submodule and a vulnerability verification submodule; the vulnerability detection submodule is used to match the target information obtained by the asset identification engine module from the target host with the preset vulnerability information library, and obtain the imprecise vulnerability information of the target information; the vulnerability verification submodule is used to extract the simulated attack plug-in corresponding to the imprecise vulnerability information from the preset plug-in library according to the vulnerability range in the imprecise vulnerability information, and is also used to verify the imprecise vulnerability information, and obtain the precise vulnerability information of the target host based on the verification result.

[0011] The beneficial effect of the present invention is: in this solution, through the advantages of related technologies such as fingerprint extraction, asset identification and vulnerability scanning, the tasks of substation asset verification and vulnerability management are effectively solved. The portable device can not only improve work efficiency and respond to vulnerability verification and repair work in real time, but also empower the device to make the work more professional and accurate, thereby ensuring the safety of the power grid.

[0012] Based on the above technical solution, the present invention can also be improved as follows.

[0013] Furthermore, the portable device further comprises:

[0014] The data encryption module is used to encrypt the public key using the RSA asymmetric encryption algorithm, and is also used to decrypt and obtain the data key by the recipient using the corresponding private key.

[0015] Furthermore, the asset fingerprint database is established in the following way: based on the preset universal fingerprint library, through the automated fingerprint collection tool, and relying on the specific substation, the asset fingerprint database of the smart substation is established, specifically:

[0016] By distinguishing different types of operating systems and different types of service versions in a specific substation, a specific data packet is constructed using the characteristics of the network protocol in the specific substation. The key information of the specific data packet is obtained through analysis of the specific data packet, and an asset fingerprint database is established based on the key information. The key information includes serial number, confirmation number, and window size.

[0017] Furthermore, the vulnerability information library is established in the following way: based on the preset general vulnerability library, and superimposed with the vulnerability information of the operating system, database and middleware unique to the specific substation, a vulnerability information library for assets is established; wherein the general vulnerability library is specifically:

[0018] Obtain an Excel spreadsheet containing the relationship between CVEs and KBs from the Microsoft Security Response Center, use the Microsoft Update Catalog or Microsoft Support Resources to identify the subsequent patches of each KB to build a cumulative relationship between each KB, and map each CVE to its directly related KB, identify all subsequent patches containing the corresponding KB, and build a linked list of Windows patches and vulnerabilities;

[0019] The vulnerability information library is specifically as follows: constructing a detection data packet that exploits the ambiguity in the network protocol to induce the target system's unique behavior when processing network requests. The detection data packet includes TCP type, UDP type and ICMP type; based on the detection data packet and the general vulnerability library, the vulnerability information of the operating system unique to a specific substation is superimposed to form a vulnerability information library for the specific substation. The operating systems include the DAMO system, the LINSI system and the KYLIN system.

[0020] Furthermore, for each database and each operating system, a specific weak password library is formed in the following manner:

[0021] Part of the information of each database is generated by using the first weak password library of open source weak password blasting software, and the other part of the information of each database is generated by a script according to the habits of a specific user group. The first weak password library and the first weak password library are superimposed to form a specific weak password library. The specific weak password library is used to provide a remote login and remote connection system for each database and each operating system, as well as to provide support for weak password scanning.

[0022] Furthermore, the above user performs host survival detection and development port detection of surviving hosts based on the TCP three-way handshake principle, specifically:

[0023] The port scanning module performs port scanning through semi-connected TCP SYN scanning and sends a probe data packet to the target system to request the establishment of a SYN connection. If no SYN / ACK data packet is received and a RST data packet is received, the return result is that the port of the target system is not open; if a SYN / ACK data packet is received and the return result is that the port of the target system is open, the module stops replying to SYN / ACK data packets and sends a RST data packet to terminate the connection request.

[0024] Furthermore, the above identification of the open services of the surviving host is an asset identification method based on a programmable mode, specifically:

[0025] Based on the generated demand instructions, the user writes identification scripts and identification templates that correspond to the demand instructions and can match and classify according to the characteristics of the assets.

[0026] Furthermore, when the port scanning module is used to implement data packet grouping, multi-thread concurrency, data packet sending and data packet return data parsing, wherein:

[0027] Packet grouping is used to construct a specific type of packet using a semi-connected TCP SYN scan, and send a probe packet to the target system to request the establishment of a SYN connection, and determine the port open information of the target system based on the returned result;

[0028] Multi-threaded concurrency: by establishing a thread pool and using multi-threaded mode to concurrently scan multiple hosts;

[0029] Data packet return data analysis is performed by sending a specifically constructed data packet to the target host and parsing the return data packet. If no SYN / ACK data packet is received and a RST data packet is received, the return result that the port of the target system is not open is obtained; if a SYN / ACK data packet is received, the return result that the port of the target system is open is obtained.

[0030] Furthermore, when the asset identification engine module is used to implement open service asset and version detection, operating system asset and version detection, and Web asset detection, wherein:

[0031] Open service asset and version detection: construct a detection data packet that uses the ambiguity in the network protocol to elicit the target system's unique behavior when processing network requests. The detection data packet includes TCP type, UDP type, and ICMP type. The return data packet of the detection data packet is analyzed in combination with the asset fingerprint database to determine the assets and versions of the open services.

[0032] The asset and version detection of the operating system uses the characteristics of the network protocol in a specific substation to construct a specific data packet, obtains the key information of the specific data packet through analysis of the specific data packet, and analyzes the key information to realize the asset and version detection of the operating system. The key information includes the sequence number, confirmation number, window size, TCP flag, ICMP code and TTL value.

[0033] Web asset detection obtains service component features and uses the preset Web fingerprint library to identify the type of website, service components, and version information. Non-HTTP protocols obtain the connection baner information of the port, while HTTP or HTTPS protocols use keywords in web pages, Md5 values ​​of feature files, and keyword matching of returned message information.

[0034] Furthermore, when the vulnerability scanning engine module implements suspected matching, vulnerability verification, weak password cracking and host local scanning, the following steps are performed:

[0035] Suspected match: Based on the identified asset type and the vulnerability fingerprint in the asset fingerprint database, suspected matches of asset vulnerabilities are performed and inaccurate vulnerability information is given;

[0036] Vulnerability verification: send the corresponding POC to the target host for vulnerability verification based on the inaccurate vulnerability information, and provide the confirmed vulnerability information on the corresponding assets;

[0037] Weak password cracking: when identifying the open services of surviving hosts or the existing weak passwords of remote connections, the weak password dictionary in the vulnerability information database is used to crack the weak passwords of assets and provide matching weak password information;

[0038] Host local scan: if the host has a remote connection weak password, execute the remote connection weak password to remotely log in to the host, and perform local vulnerability scan on the corresponding host and elevate relevant vulnerability information.

[0039] Compared with the prior art, the present invention has at least the following beneficial effects:

[0040] In this application, the device first establishes two basic databases, namely the asset fingerprint library and the vulnerability library. The asset fingerprint library is collected based on existing public information. According to the types of operating systems, middleware, databases, network devices, security devices, Web systems, etc., for different types of equipment or systems, corresponding library table structures are established for storage and maintenance. At the same time, combined with the characteristics of smart substation equipment, through automated fingerprint collection tools, relying on pilot substations, the smart substation asset fingerprint library is incrementally superimposed. Remote management and maintenance of the fingerprint library is achieved by calling the API interface. In order to ensure the security of the system and enable users to access related resources without stateful authorization, the API interface adopts the bearer token mode signature authentication; the vulnerability library consists of three parts: vulnerability fingerprint information, POC and weak passwords. The vulnerability fingerprint information stores vulnerability information that has appeared in various versions of related systems or databases, middleware, etc. This part of the content can be collected by crawling online platforms; part of the information in the weak password database can be obtained from the weak password library of the open source weak password cracking software, and the other part can be automatically generated by scripts based on the habits of specific user groups. The two parts of data are superimposed together to form the weak password library information; the POC verification plug-in library can determine the suspected vulnerabilities of the assets identified in the asset scanning phase through the vulnerability fingerprint library, in order to further confirm whether these suspected vulnerabilities actually exist in the assets.

[0041] In this application, online surviving hosts are confirmed by sending ICMP messages, and a list of surviving hosts is formed. The device cooperates with multi-threading technologies such as thread pools to break through the traditional TCP / IP protocol stack's restrictions on the upper limit of the number of connections at the same time, and uses the SYN semi-connection method to perform open port detection scanning. Send a TCP SYN connection establishment request data packet from its own designated port to the target designated port, and wait for the other party to return a response data packet. If the SYN bit and ACK bit are set in the response data packet, it proves that the target port is open; if the received reply data packet is a RST connection reset data packet, it proves that the other party's port is inactive. In other words, using this method, the port scan can be completed as long as the effective part of establishing the connection is completed, which greatly improves the scanning speed compared to the traditional full connection scan.

[0042] In this application, on the basis of open port scanning, for the already open ports, the device uses fingerprint feature matching and feature matching based on machine learning to detect assets and versions for operating systems, databases, middleware and Web systems, etc., to determine the specific application and version information running on the open port of the target host, complete network asset scanning and identification, and form fingerprint information such as IP, PORT, middleware, database and operating system of a specific network. Based on this information, the vulnerability scanning engine is divided into two submodules, namely, a vulnerability detection submodule and a vulnerability verification submodule. The function of the vulnerability detection submodule is to extract the information collected by the previous initial information collection module, mainly the information collected by the operating system detection submodule and the port service confirmation submodule, and feature match the obtained information with the vulnerability information in the vulnerability library to obtain the approximate range of the vulnerability contained in the target host; the function of the vulnerability verification submodule is to extract the simulated attack plug-in corresponding to the vulnerability from the plug-in library according to the vulnerability range analyzed by the vulnerability detection submodule, and then verify the possible vulnerability of the target host, and judge whether the target host has this vulnerability according to the result of the verification.

[0043] In this application, the portable device for substation asset identification and vulnerability management forms an organic whole with the network asset identification function and asset vulnerability detection through the technical solution. The two are no longer independent, but are linked to each other under the action of the detection algorithm, and the whole process does not require the participation of network management personnel. Through this device, the assets of the substation can be accurately checked, the vulnerabilities can be verified, and the continuously updated vulnerabilities can be verified and repaired in a plug-in manner, which solves the problem of time-consuming and labor-intensive work in the past. At the same time, the corresponding substation data can be presented on a unified management and control system, which is convenient for the provincial company-level units to fully grasp the safety status of the substation. At the same time, the work ideas and methods have been innovated, and the idea of ​​empowering the substation staff with the device has not only improved work efficiency and saved manpower and material costs, but also made the substation more professional when carrying out this work. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0045] Figure 1 is a schematic diagram of a portable device according to an embodiment of the present invention;

[0046] Figure 2 Flow chart of the RSA algorithm in an embodiment of the present invention.

[0047] Marks and corresponding parts names in the attached drawings:

[0048] 1. Asset fingerprint library; 2. Vulnerability library; 3. Access interface module; 4. Asset identification engine; 5. Vulnerability scanning engine; 6. Task management module; 7. System database; 8. Data encryption and decryption module; 9. Device front-end interface. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0050] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0052] In the description of the embodiments of the present invention, it should be noted that if the terms "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the accompanying drawings, or is the orientation or position relationship in which the product of the invention is usually placed when used. It is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0053] In addition, the terms "horizontal", "vertical", "overhanging" and the like do not mean that the components must be absolutely horizontal or overhanging, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0054] In the description of the embodiments of the present invention, "plurality" means at least 2.

[0055] In the description of the embodiments of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0056] Embodiment 1: This embodiment provides a portable device for realizing substation asset identification and vulnerability management, including:

[0057] The port scanning module is used by users to detect host survival and development ports of surviving hosts.

[0058] Optionally, when the port scanning module is used to implement data packet grouping, multi-thread concurrency, data packet sending, and data packet return data parsing, wherein:

[0059] Packet assembly is used to construct a specific type of packet using semi-connected TCP SYN scanning, and send a probe packet to the target system to request to establish a SYN connection, and determine the port opening information of the target system based on the returned result; multi-threaded concurrency is achieved by establishing a thread pool and scanning multiple hosts concurrently in a multi-threaded manner; packet return data parsing is achieved by sending a specifically constructed packet to the target host and parsing the returned packet. If no SYN / ACK data packet is received and a RST data packet is received, the return result that the port of the target system is not open is obtained; if a SYN / ACK data packet is received, the return result that the port of the target system is open is obtained.

[0060] Furthermore, the above-mentioned device may also include an asset identification engine module, which is used to identify the open services of the surviving host in combination with a preset asset fingerprint database, and the open services include an operating system, a database and middleware.

[0061] Optionally, when the asset identification engine module is used to implement open service asset and version detection, operating system asset and version detection, and Web asset detection, wherein:

[0062] Open service asset and version detection: construct a detection data packet that uses the ambiguity in the network protocol to elicit the target system's unique behavior when processing network requests. The detection data packet includes TCP type, UDP type and ICMP type, and analyzes the return data packet of the detection data packet in combination with the asset fingerprint database to determine the assets and versions of the open service; operating system asset and version detection: construct a specific data packet using the characteristics of the network protocol in a specific substation, obtain the key information of the specific data packet through the analysis of the specific data packet, and analyze the key information to realize the asset and version detection of the operating system. The key information includes the sequence number, confirmation number, window size, TCP flag, ICMP code and TTL value. Web asset detection: obtain the service component characteristics and use the preset Web fingerprint library to identify the type of website, service component and version information; among them, non-HTTP protocol is to obtain the connection baner information of the port, and HTTP or HTTPS protocol uses the keyword matching of the keywords in the web page, the Md5 value of the feature file and the returned message information.

[0063] Optionally, the asset fingerprint database is established in the following manner: based on a preset universal fingerprint library, an automated fingerprint collection tool is used to establish an asset fingerprint database of a smart substation in dependence on a specific substation, specifically:

[0064] By distinguishing different types of operating systems and different types of service versions in a specific substation, a specific data packet is constructed using the characteristics of the network protocol in the specific substation. The key information of the specific data packet is obtained through analysis of the specific data packet, and an asset fingerprint database is established based on the key information. The key information includes serial number, confirmation number, and window size.

[0065] Furthermore, the above-mentioned device can also include a vulnerability scanning engine module, including a vulnerability detection submodule and a vulnerability verification submodule; the vulnerability detection submodule is used to match the target information obtained by the asset identification engine module from the target host with a preset vulnerability information library, and obtain imprecise vulnerability information of the target information; the vulnerability verification submodule is used to extract the simulated attack plug-in corresponding to the imprecise vulnerability information from the preset plug-in library according to the vulnerability range in the imprecise vulnerability information, and is also used to verify the imprecise vulnerability information, and obtain the precise vulnerability information existing in the target host based on the verification result.

[0066] Optionally, when the vulnerability scanning engine module implements suspected matching, vulnerability verification, weak password cracking and host local scanning, the following steps are performed:

[0067] Suspected match: perform suspected match of asset vulnerabilities based on the identified asset type and combined with the vulnerability fingerprint in the asset fingerprint database, and provide inaccurate vulnerability information; vulnerability verification: send the corresponding POC to the target host for vulnerability verification based on the inaccurate vulnerability information, and provide the vulnerability information confirmed on the corresponding asset; weak password cracking: identify the open services of the surviving host or the existing remote connection weak passwords, combine the weak password dictionary in the vulnerability information library to crack the asset weak passwords, and provide the matching weak password information; host local scan: if the host has a remote connection weak password, execute the remote connection weak password to remotely log in to the host, and perform local vulnerability scan on the corresponding host and escalate the relevant vulnerability information.

[0068] Optionally, the vulnerability information library is established in the following manner: based on a preset general vulnerability library, and superimposed with vulnerability information of operating systems, databases and middleware specific to a specific substation, a vulnerability information library for assets is established; wherein the general vulnerability library is specifically:

[0069] Obtain an Excel spreadsheet containing the relationship between CVE and KB from the Microsoft Security Response Center, use the Microsoft Update Catalog or Microsoft support resources to identify the subsequent patches of each KB to build a cumulative relationship between each KB, and map each CVE with its directly related KB, identify all subsequent patches containing the corresponding KB, and build a Windows patch and vulnerability association list; the vulnerability information library is specifically as follows: construct a detection data packet that uses the ambiguity in the network protocol to induce the target system's unique behavior when processing network requests. The detection data packet includes TCP type, UDP type and ICMP type; based on the detection data packet and the general vulnerability library, the vulnerability information of the operating system unique to a specific substation is superimposed to form a vulnerability information library for the specific substation. The operating systems include the DAMO system, the LINSI system, and the KYLIN system.

[0070] Optionally, a specific weak password library is formed for each database and each operating system in the following manner:

[0071] Part of the information of each database is generated by using the first weak password library of open source weak password blasting software, and the other part of the information of each database is generated by a script according to the habits of a specific user group. The first weak password library and the first weak password library are superimposed to form a specific weak password library. The specific weak password library is used to provide a remote login and remote connection system for each database and each operating system, as well as to provide support for weak password scanning.

[0072] Optionally, the above user performs host survival detection and development port detection of surviving hosts based on the TCP three-way handshake principle, specifically:

[0073] The port scanning module performs port scanning through semi-connected TCP SYN scanning and sends a probe data packet to the target system to request the establishment of a SYN connection. If no SYN / ACK data packet is received and a RST data packet is received, the return result is that the port of the target system is not open; if a SYN / ACK data packet is received and the return result is that the port of the target system is open, the module stops replying to SYN / ACK data packets and sends a RST data packet to terminate the connection request.

[0074] Optionally, the above identification of open services of surviving hosts is an asset identification method based on a programmable mode, specifically:

[0075] Based on the generated demand instructions, the user writes identification scripts and identification templates that correspond to the demand instructions and can match and classify according to the characteristics of the assets.

[0076] Optionally, the portable device further comprises:

[0077] The data encryption module is used to encrypt the public key using the RSA asymmetric encryption algorithm, and is also used to decrypt and obtain the data key by the recipient using the corresponding private key.

[0078] Embodiment 2: The embodiment of the present application provides a substation asset identification and vulnerability management method, the substation asset identification and vulnerability management method comprising:

[0079] S1, through the automated fingerprint collection tool, based on the general fingerprint library and relying on specific substations, establishes a fingerprint library specific to smart substation assets.

[0080] Furthermore, through the automated fingerprint collection tool, based on the general fingerprint library, relying on specific substations, a specific fingerprint library for smart substation assets is established, including: using the characteristics of the network protocol to construct a specific data packet to stimulate the target system to respond, thereby capturing its behavioral characteristics. By analyzing key information such as the sequence number, confirmation number, and window size in the returned data packet, the module can distinguish different operating systems and service versions, and then establish a fingerprint library containing rich features, which can not only improve the accuracy of asset identification, but also provide a solid foundation for subsequent vulnerability scanning and management.

[0081] S2, on the basis of the general vulnerability library, superimposes the vulnerability information of the substation-specific operating system, database, and middleware to establish a specific vulnerability information library for assets.

[0082] Furthermore, based on the general vulnerability library, the vulnerability information of the substation-specific operating system, database, and middleware is superimposed to establish a specific vulnerability information library for assets, including:

[0083] Establishment of a common vulnerability library: Build a linked list of Windows patches and vulnerabilities, obtain an Excel spreadsheet containing the relationship between CVE and KB from the Microsoft Security Response Center (MSRC), use the Microsoft Update Catalog or Microsoft Support resources to identify the subsequent patches of each KB, and build a cumulative relationship between KBs, and finally map each CVE with its directly related KB, and identify all subsequent patches containing these KBs.

[0084] Establishment of a specific vulnerability library: construct various types of detection data packets, including TCP, UDP, and ICMP, which are designed to exploit the ambiguity in the network protocol specifications to elicit the unique behavior of the target system when processing network requests. On the basis of the general vulnerability library, the vulnerability information of the substation-specific systems such as DAMO, LINSI, and QILIN is superimposed to form a substation-specific vulnerability library.

[0085] S3, a system that provides remote login and connection for databases and operating systems, forms a specific weak password library to support weak password scanning.

[0086] Furthermore, for systems that provide remote login and connection to databases and operating systems, a specific weak password library is formed to support weak password scanning, including: part of the database information can use the weak password library of open source weak password cracking software, and the other part can be automatically generated by scripts based on the habits of specific user groups. The two parts of data are superimposed together to form weak password library information. Support for weak password scanning is provided for systems that provide remote login and connection to databases and operating systems.

[0087] S4 is a semi-connected host survival detection and port scanning method based on the TCP three-way handshake principle.

[0088] Among them, asset identification methods based on programmable patterns;

[0089] Furthermore, the programmable model-based asset identification method includes: users set up template engines through custom scripts to achieve flexibility and scalability of asset identification. Users can write specific identification scripts according to their needs, which can match and classify assets according to their characteristics. New identification templates and scripts can be easily integrated into existing systems without large-scale modifications to the infrastructure. Users have full control over the identification logic and process, which can be fine-tuned to adapt to complex network environments.

[0090] Among them, the above-mentioned vulnerability matching and verification method based on asset fingerprint.

[0091] Furthermore, the vulnerability matching and verification method based on asset fingerprint includes: for general vulnerability detection, it provides more than 20 built-in vulnerability detection types such as weak passwords and NetBios information. After setting the vulnerability type to be detected, you can load the plug-in to detect the vulnerabilities in the host at the specified address and generate a scan report. The generated scan report not only contains the number of surviving hosts under the specified address, but also divides them into the number of vulnerabilities, the number of warnings, and the number of prompts according to the severity of the problem. It also provides detailed descriptions of the corresponding ports / services, detailed descriptions of security vulnerabilities and their solutions for the security issues that have occurred.

[0092] Furthermore, the semi-connected host survival detection and port scanning method based on the TCP three-way handshake principle includes: using the TCP three-way handshake, the port scan adopts the semi-connected TCP SYN scan, and sends a detection data packet to the target system to request to establish a SYN connection. If no SYN / ACK confirmation message is received, but a RST data packet is received, it is known that the port is not open. If a SYN / ACK message is received and it is confirmed that the target system service port is open, the SYN data packet is no longer replied to complete the three-way handshake, but a RST data packet is sent to terminate the connection request.

[0093] Specifically, through custom data structures, the connection between the current scanning host and the external host is established and maintained, breaking through the limitation of the number of connections of the operating system protocol stack. Combined with multi-threading, concurrent scanning of a large number of hosts can be achieved, improving scanning efficiency.

[0094] The embodiment of the present application also provides a portable device for substation asset identification and vulnerability management of a substation network asset identification and vulnerability management method. The portable device for substation asset identification and vulnerability management includes:

[0095] Port scanning module allows users to detect host survival and development ports of surviving hosts.

[0096] Furthermore, the port scanning module includes: data packet grouping, multi-thread concurrency, data packet sending, and data packet return data analysis.

[0097] Packet grouping uses the TCP SYN scanning principle to construct a specific type of packet, sends a probe packet to the target system to request a SYN connection, and determines the port openness based on the returned result.

[0098] Various types of probe packets, including TCP, UDP, and ICMP, are designed to exploit ambiguities in network protocol specifications to elicit unique behaviors of the target system when processing network requests.

[0099] Multi-threaded concurrent sending, using multi-threaded mode, establishing a thread pool, and concurrently scanning multiple hosts to improve scanning performance.

[0100] Data packet return data analysis, by sending a series of specially constructed data packets to the target host, through the analysis of the return data packets, if no SYN / ACK confirmation message is received, but a RST data packet is received, it is known that the port is not open. If a SYN / ACK message is received, it is confirmed that the target system service port is open.

[0101] The asset identification engine module, combined with the asset fingerprint database, identifies the open services of the surviving hosts, including the operating system, database, and middleware.

[0102] Furthermore, the asset identification engine module includes: open service asset and version detection, operating system asset and version detection, and Web asset detection.

[0103] Open service asset and version detection, constructing various types of detection data packets, including TCP, UDP and ICMP. These data packets are designed to exploit the ambiguity in the network protocol specifications to elicit the unique behavior of the target system when processing network requests. Combined with the analysis of the returned data packets by the asset fingerprint library, the type and version of the open asset can be determined.

[0104] Operating system asset and version detection, by sending a series of specifically constructed data packets to the target host, different operating systems will exhibit unique behavior patterns when processing network data packets. The operating system can be identified by analyzing the sequence number, confirmation number, window size, TCP flag, ICMP code and TTL value of the returned network traffic.

[0105] Web asset detection, by obtaining service component features, uses the Web fingerprint library to identify the type of website, service components, and version information. Non-HTTP protocols generally obtain port connection baner information, while HTTP or HTTPS protocols usually use "keywords in web pages", "MD5 values ​​of feature files", and "keyword matching of returned message information".

[0106] The vulnerability scanning engine module is divided into a vulnerability detection submodule and a vulnerability verification submodule. The function of the vulnerability detection submodule is to match the information obtained by the asset identification engine with the vulnerability library to obtain the imprecise vulnerability information contained in the target; the function of the vulnerability verification submodule is to extract the simulated attack plug-in corresponding to the vulnerability from the plug-in library according to the vulnerability range analyzed by the vulnerability detection submodule, and then verify the imprecise vulnerability of the target host, and determine the precise vulnerability situation of the target host based on the verification results.

[0107] Furthermore, the vulnerability scanning engine modules include: suspected matching, vulnerability verification, weak password cracking, and host local scanning.

[0108] Suspected match: Based on the asset type, suspected matches of asset vulnerabilities are performed based on the vulnerability fingerprints in the vulnerability library, and suspected match information is given.

[0109] Vulnerability verification: For the suspected vulnerabilities in the previous step, the corresponding POC is sent to the target host for vulnerability verification, and the confirmed vulnerability information on the corresponding assets is given.

[0110] Weak password cracking: For databases and SSH of open services, we use the weak password dictionary in the vulnerability library to crack weak passwords of assets and provide matching weak password information.

[0111] Host local scan: If the host has weak passwords such as SSH, you can remotely log in to the host, perform local vulnerability scans on the corresponding host, and obtain relevant vulnerability information.

[0112] Data encryption module, in the portable device for substation asset identification and vulnerability management, the data encryption module is a key component to ensure the security of data transmission and storage. The module adopts the RSA asymmetric encryption algorithm and uses the public key in the certificate for encryption. The recipient uses the corresponding private key to decrypt and obtain the data key.

[0113] Example 3: Figure 1 As shown, the portable device for substation asset identification and vulnerability management provided in the embodiment of the present application includes: an asset fingerprint library 1, a vulnerability library 2, an access interface module 3, an asset identification engine 4, a vulnerability scanning engine 5, a task management module 6, a system database 7, a data encryption and decryption module 8, and a device front-end interface 9.

[0114] Asset fingerprint library 1. Different manufacturers and different platforms have more or less differences in the process of implementing the same standard, which makes it possible to identify asset types. These differences are called fingerprint information of assets of different manufacturers, different platforms, different types, and different versions. By accumulating fingerprint information, a "fingerprint library" is gradually formed. Relying on existing public information, the device collects general fingerprint information according to types such as operating systems, middleware, databases, network devices, security devices, and Web systems, and at the same time superimposes substation-specific asset fingerprints to establish corresponding library table structures for storage and maintenance.

[0115] Vulnerability library 2 consists of three parts: vulnerability fingerprint information, POC and weak passwords. The vulnerability fingerprint information stores vulnerability information that has appeared in various versions of related systems or databases, middleware, etc. The weak password database provides support for password cracking of open service databases, SSH, etc. The POC verification plug-in library mainly confirms suspected asset vulnerabilities.

[0116] Access interface module 3, remote management and maintenance of the fingerprint library is achieved by calling the API interface. In order to ensure the security of the system, the API interface requires signature authentication. The specific authentication method can adopt the bearer token mode to grant stateless authorization to users to access related resources.

[0117] Asset Identification Engine 4, Network scanning refers to the behavior of performing specific reading, conjecture verification, or even malicious destruction of the other party's protocol through its own system within a certain period of time according to the protocol adopted by the other party's service, and using the data directly or indirectly returned by the other party as the basis for judging a certain indicator. The asset identification engine is one of the core functions of the device, which is responsible for automatically detecting and classifying assets in the network. Based on a programmable mode, this module allows users to set the template engine through custom scripts to achieve flexibility and scalability of asset identification. Users can write specific identification scripts according to their needs, which can match and classify according to the characteristics of assets.

[0118] Vulnerability scanning engine 5, in the asset identification stage, has formed fingerprint information such as IP, PORT, middleware, database and operating system of a specific network. Based on this information, the vulnerability scanning engine is divided into two submodules, namely vulnerability detection submodule and vulnerability verification submodule. The function of the vulnerability detection submodule is to extract the information collected by the previous initial information collection module, mainly the information collected by the operating system detection submodule and the port service confirmation submodule, and perform feature matching on the obtained information with the vulnerability information in the vulnerability library to obtain the approximate range of the vulnerabilities contained in the target host; the function of the vulnerability verification submodule is to extract the simulated attack plug-in corresponding to the vulnerability from the plug-in library according to the vulnerability range analyzed by the vulnerability detection submodule, and then verify the possible vulnerabilities of the target host, and judge whether the target host has this vulnerability according to the verification results.

[0119] Task management module 6, the task management module mainly provides support for the front end, receives the user's front-end request, performs parameter exception processing, and calls the corresponding back-end function module to meet the user's needs. This module mainly manages four types of tasks: asset scanning and identification, vulnerability scanning, vulnerability verification, and vulnerability repair.

[0120] System database 7, based on the MySQL database, establishes the table structure of the database, and mainly stores the result data related to the business generated by the device, as well as the data related to the permissions and settings of the system. The business-related data includes: (1) data returned by the asset scanning engine; (2) data returned by the vulnerability scanning engine. The database supports basic functions such as asset management, vulnerability management, and user management at the front desk. At the same time, based on the data in the database, data association queries can be performed, chart report analysis can be performed, reports can be generated, and data import and export functions are supported.

[0121] Data encryption and decryption module 8, in the portable device for substation asset and vulnerability management, it is crucial to ensure the security of data for offline import and export of data. This module is a key component to ensure the security of data transmission and storage. The device uses RSA-based asymmetric encryption to enhance the security of data transmission. The system will use a pair of public and private keys: the public key is used to encrypt the data key, and the private key is used for decryption. The advantage of this method is its high security, because even if the public key is obtained by a third party, the data cannot be decrypted. At the same time, it also solves the security problem of key distribution in symmetric encryption, because the private key is always kept confidential and only held by the recipient. Such a design ensures the security of data during transmission and the reliability of key management.

[0122] Device front-end interface 9, this module mainly provides a visual interface for users to use the functions of the device, including one-click completion, data import / export, photo evidence collection and advanced settings. Among them, "one-click completion" is to facilitate user use. The core functions of the device are encapsulated in the background. Users only need to click the "one-click completion" button to complete all business work. "Data import / export" is to facilitate data interaction between the device's data and other systems or networks. During the data import / export process, the data will be encrypted or decrypted to ensure data security. The "photo evidence collection" function mainly cooperates with the vulnerability verification link to verify local vulnerabilities. By taking pictures of the patch status of the local system and analyzing the photos offline, the local vulnerability status can be determined. "Advanced settings" are some professional settings for using the functions of the device.

[0123] Specifically, the working principle of the present invention is further described below in conjunction with the accompanying drawings.

[0124] 1. Asset Identification Engine

[0125] The active detection method mainly uses network scanning technology. Network scanning refers to an act of performing specific reading, conjecture verification, or even malicious damage to the other party's protocol through one's own system within a certain period of time based on the protocol adopted by the other party's service, and using the data directly or indirectly returned by the other party as the basis for judging a certain indicator.

[0126] The steps for asset identification are:

[0127] (1) Open service assets and version detection (including databases and middleware). This is used to determine the specific application and version information running on the open port of the target host. Version detection is mainly divided into the following steps:

[0128] ① First check whether the ports in the open and openlfiltered states are in the exclusion port list. If they are in the exclusion list, remove the port.

[0129] ② If it is a TCP port, try to establish a TCP connection. Try to wait for a while (usually 6 seconds or more, the specific time can be queried in the file application service fingerprint information library corresponding to the totalwaitms). Usually during the waiting time, the "WelcomeBanner" information sent by the target machine will be received. The IP asset discovery device compares the received Banner with the signature in the NULLprobe in the application service fingerprint information library. Find the name and version information of the corresponding application.

[0130] ③ If the application version cannot be determined through the "Welcome Banner", the IP asset discovery device will try to send other detection packets (that is, select a suitable probe from the application service fingerprint information library) and compare the response packet obtained by the probe with the signature in the database.

[0131] 1) If it is a UDP port, then directly apply the detection package in the service fingerprint information library for detection and matching. According to the result comparison, analyze the UDP application service type.

[0132] 2) If the application is detected to be SSL, openSSL is called to further detect the specific application type running on SSL.

[0133] 3) If the application is detected to be SunRPC, then call the brute-force RPC grinder to further detect the specific service.

[0134] (2) Operating system asset and version detection. Operating system detection uses TCP / IP protocol stack fingerprints to identify different operating systems and devices. In the RFC specification, there are some places that do not have mandatory regulations for the implementation of TCPIP. Therefore, different TCPIP schemes may have their own specific methods to determine the type of operating system based on these differences in details. The specific implementation method is as follows:

[0135] ① Fingerprint feature matching module

[0136] By sending SYN packets or other constructed layer protocol (IP, UDP, ICMP) packets to the target assets, host discovery and port, service, operating system, etc. are identified according to the characteristics of the response packets. Based on the p0fv3 fingerprint library, the operating system fingerprint is divided into two categories (specified and generic), and the g category for fuzzy matching is added. When the s category cannot be accurately matched, in order to avoid directly giving unknown results, the mss, wsize, scale and other fields are allowed to use "*" for fuzzy matching, and then roughly give the major category to which the target operating system belongs.

[0137] ②(2) Feature matching module based on machine learning

[0138] For assets that do not have an exact match for fingerprint features in the first phase, this module is called for a secondary match. This module is based on the operating system fingerprint recognition method of the C4.5 decision tree algorithm classifier. This method uses the hash value of the TCP connection socket to associate the SYN packet and the FIN packet, expands the SYN packet fingerprint in the pof fingerprint library, and adds some features in the FIN packet.

[0139] (3) Web asset detection. Technically, fingerprint feature regular matching can be used. The matching accuracy depends on whether the fingerprint feature extraction of the Web system is targeted and distinguishable. Therefore, for this type of asset detection, the focus can be placed on feature extraction.

[0140] 2. Vulnerability Scanning Engine

[0141] During the asset scanning phase, fingerprint information such as IP, PORT, middleware, database, and operating system of a specific network has been formed. Based on this information, the vulnerability scanning engine is divided into two sub-modules, namely vulnerability detection sub-module and vulnerability verification sub-module. The function of the vulnerability detection sub-module is to extract the information collected by the previous initial information collection module, mainly the information collected by the operating system detection sub-module and the port service confirmation sub-module, and perform feature matching on the obtained information with the vulnerability information in the vulnerability library to obtain the approximate range of vulnerabilities contained in the target host; the function of the vulnerability verification sub-module is to extract the corresponding simulated attack plug-in from the plug-in library according to the vulnerability range analyzed by the vulnerability detection sub-module, and then verify the possible vulnerabilities of the target host, and determine whether the target host has this vulnerability based on the verification results. The working steps of the vulnerability scanning engine are as follows:

[0142] (1) Suspected match. Based on the asset type, the suspected match of the asset vulnerability is performed based on the vulnerability fingerprint in the vulnerability database, and the suspected match information is given;

[0143] (2) Vulnerability verification. For the suspected vulnerability in the previous step, the corresponding POC is sent to the target host for vulnerability verification, and the confirmed vulnerability information on the corresponding asset is given.

[0144] The principle of the vulnerability verification submodule is to call the plug-in library according to the vulnerability number CVE obtained by the vulnerability detection submodule, obtain the plug-in corresponding to the vulnerability according to the CVE number, and then call the plug-in to verify the vulnerability of the target host. The vulnerability verification submodule verifies the vulnerability in the form of a plug-in. The plug-in is actually a program that simulates a hacker attack on the target host. Its principle is to construct a data packet containing vulnerability characteristics, then send the data packet to the target host, and determine whether the vulnerability exists based on the result returned by the target host. Each vulnerability corresponds to a plug-in.

[0145] The associated interface between the vulnerability verification submodule and the plug-in is the plug-in library. The plug-in library stores a unique plug-in number, that is, the vulnerability number CVE number corresponding to the plug-in, as well as the plug-in address and plug-in name. The vulnerability verification submodule can only obtain the actual address of the plug-in through the plug-in library before calling the real plug-in to simulate the attack and verify the vulnerability. Otherwise, even if the CVE number is obtained, the verification submodule does not know which specific plug-in should be called. The specific working steps of the vulnerability verification submodule are as follows:

[0146] ①First, receive the CVE number transmitted by the vulnerability detection submodule;

[0147] ② According to the CVE number, search for the corresponding vulnerable plug-in in the plug-in library and obtain the address and name of the plug-in;

[0148] ③Call the real plug-in according to the obtained plug-in address and name, simulate the attack on the target host, and verify the vulnerability;

[0149] ④ Determine whether the target host has the vulnerability based on the results returned by the plug-in: If so, the vulnerability-related information needs to be stored in the result library.

[0150] (3) Weak password cracking. For databases and SSH of open services, weak password cracking of assets is performed based on the weak password dictionary in the vulnerability database, and matching weak password information is provided;

[0151] (4) Host scanning. If the host has a weak password such as SSH, you can remotely log in to the host, perform a local vulnerability scan on the corresponding host, and obtain relevant vulnerability information.

[0152] 3. Data encryption and decryption module

[0153] The RSA algorithm is used to enhance the security of data transmission, such as Figure 2 As shown, the public key is used to encrypt the data key, while the private key is used to decrypt it.

[0154] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A portable device for realizing substation asset identification and vulnerability management, characterized in that: include: Port scanning module, used by users to detect host survival and development ports of surviving hosts; The asset identification engine module is used to identify the open services of the surviving host in combination with the preset asset fingerprint database. The open services include the operating system, database and middleware. A vulnerability scanning engine module, including a vulnerability detection submodule and a vulnerability verification submodule; The vulnerability detection submodule is used to match the target information obtained by the asset identification engine module from the target host with the preset vulnerability information library, and obtain the imprecise vulnerability information of the target information; the vulnerability verification submodule is used to extract the simulated attack plug-in corresponding to the imprecise vulnerability information from the preset plug-in library according to the vulnerability range in the imprecise vulnerability information, and is also used to verify the imprecise vulnerability information, and obtain the precise vulnerability information existing in the target host according to the verification result.

2. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: The portable device further comprises: The data encryption module is used to encrypt the public key using the RSA asymmetric encryption algorithm, and is also used to decrypt and obtain the data key by the recipient using the corresponding private key.

3. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: The asset fingerprint database is established in the following manner: based on a preset universal fingerprint library, an automated fingerprint collection tool, and relying on a specific substation to establish an asset fingerprint database of a smart substation, specifically: By distinguishing different types of operating systems and different types of service versions in a specific substation, a specific data packet is constructed using the characteristics of the network protocol in the specific substation, key information of the specific data packet is obtained through analysis of the specific data packet, and the asset fingerprint database is established based on the key information, wherein the key information includes a serial number, a confirmation number, and a window size.

4. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: The vulnerability information library is established in the following manner: based on a preset general vulnerability library, and superimposed with vulnerability information of operating systems, databases and middlewares specific to a specific substation, a vulnerability information library for assets is established; wherein the general vulnerability library is specifically: Obtain an Excel spreadsheet containing the relationship between CVEs and KBs from the Microsoft Security Response Center, use the Microsoft Update Catalog or Microsoft Support Resources to identify the subsequent patches of each KB to build a cumulative relationship between each KB, and map each CVE to its directly related KB, identify all subsequent patches containing the corresponding KB, and build a linked list of Windows patches and vulnerabilities; The vulnerability information library is specifically: constructing a detection data packet that utilizes the ambiguity in the network protocol to induce the target system's unique behavior when processing network requests, and the detection data packet includes TCP type, UDP type and ICMP type; based on the detection data packet and the general vulnerability library, the vulnerability information of the operating system unique to a specific substation is superimposed to form the vulnerability information library of the specific substation, and the operating systems include the DAMO system, the LINSI system, and the KYLIN system.

5. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: For each database and each operating system, a specific weak password library is formed in the following way: Part of the information of each database is generated by using the first weak password library of open source weak password blasting software, and the other part of the information of each database is generated by a script according to the habits of a specific user group. The first weak password library and the first weak password library are superimposed to form the specific weak password library. The specific weak password library is used to provide a remote login and remote connection system for each database and each operating system, and to provide support for weak password scanning.

6. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: The user performs host survival detection and the development port detection of the surviving host based on the TCP three-way handshake principle, specifically: The port scanning module performs a semi-connected TCP SYN scan and sends a probe packet to the target system to request the establishment of a SYN connection. If no SYN / ACK data packet is received and a RST data packet is received, the result returned indicates that the port of the target system is not open. If a SYN / ACK data packet is received and the target system's port is open, the system stops replying to SYN / ACK data packets and sends a RST data packet to terminate the connection request.

7. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: Identifying the open services of surviving hosts is an asset identification method based on programmable patterns, specifically: Based on the generated demand instructions, the user writes identification scripts and identification templates that correspond to the demand instructions and can match and classify according to the characteristics of the assets.

8. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: The port scanning module is used to implement data packet grouping, multi-thread concurrency, data packet sending and data packet return data analysis, wherein: The data packet grouping is used to construct a specific type of data packet using a semi-connected TCP SYN scan, and send a probe data packet to the target system to request to establish a SYN connection, and determine the port opening information of the target system according to the returned result; Multi-threaded concurrency: by establishing a thread pool and using multi-threaded mode to concurrently scan multiple hosts; Data packet return data analysis is performed by sending a specifically constructed data packet to the target host and parsing the return data packet. If no SYN / ACK data packet is received and a RST data packet is received, the return result that the port of the target system is not open is obtained; if a SYN / ACK data packet is received, the return result that the port of the target system is open is obtained.

9. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: When the asset identification engine module is used to implement open service asset and version detection, operating system asset and version detection, and Web asset detection, wherein: Open service asset and version detection: construct a detection data packet that uses the ambiguity in the network protocol to elicit the target system's unique behavior when processing network requests. The detection data packet includes TCP type, UDP type, and ICMP type. The return data packet of the detection data packet is analyzed in combination with the asset fingerprint database to determine the assets and versions of the open services. The asset and version detection of the operating system uses the characteristics of the network protocol in a specific substation to construct a specific data packet, obtains the key information of the specific data packet through analysis of the specific data packet, and analyzes the key information to realize the asset and version detection of the operating system. The key information includes the sequence number, confirmation number, window size, TCP flag, ICMP code and TTL value. Web asset detection obtains service component features and uses the preset Web fingerprint library to identify the type of website, service components, and version information. Non-HTTP protocols obtain the connection baner information of the port, while HTTP or HTTPS protocols use keywords in web pages, Md5 values ​​of feature files, and keyword matching of returned message information.

10. A portable device for realizing substation asset identification and vulnerability management according to claim 1, characterized in that: The vulnerability scanning engine module implements suspected matching, vulnerability verification, weak password cracking and host local scanning, wherein: Suspected match: Based on the identified asset type and the vulnerability fingerprint in the asset fingerprint database, suspected matches of asset vulnerabilities are performed and inaccurate vulnerability information is given; Vulnerability verification: send the corresponding POC to the target host for vulnerability verification based on the inaccurate vulnerability information, and provide the confirmed vulnerability information on the corresponding assets; Weak password cracking: when identifying the open services of surviving hosts or the existing weak passwords of remote connections, the weak password dictionary in the vulnerability information database is used to crack the weak passwords of assets and provide matching weak password information; Host local scan: if the host has a remote connection weak password, execute the remote connection weak password to remotely log in to the host, and perform local vulnerability scan on the corresponding host and elevate relevant vulnerability information.

Images