Vulnerability scanner performance analysis method and device, equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to a vulnerability scanner performance analysis method and device, equipment and a storage medium. According to the method, the scanning data of the vulnerability scanner are integrated to obtain the scanning data with relatively high identification degree, so that the efficiency of subsequent dimension performance analysis is improved, dimension performance analysis is performed on the integrated scanning data, the operation performance of the vulnerability scanner is quantified through specific numerical values, the scanning data influencing the vulnerability scanner is determined, and the accuracy of dimension performance analysis is improved. Therefore, subsequent performance optimization is facilitated, the technical problem that performance analysis and quantification of the vulnerability scanner are difficult to realize in the prior art is avoided, and the efficiency of monitoring the performance of the vulnerability scanner is also improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability scanner performance analysis method, device, equipment and storage medium. Background Art

[0002] In traditional technology, in order to realize vulnerability detection of website nodes, manual testing is mainly used. However, the efficiency of manual testing is too low, so a solution of automated testing through vulnerability scanners has been derived.

[0003] Among them, a complete vulnerability scan through a vulnerability scanner involves crawling the target website connection and scanning each connection for various vulnerabilities. The scan of each vulnerability also needs to consider the type of target website and make various deformations to the attacking malicious code. Therefore, each scan will issue tens of thousands or even hundreds of thousands of requests. It is difficult to monitor the status of these vulnerability scanning requests, and the status of the vulnerability scanning request directly affects the performance of the vulnerability scanner, so the running performance of the vulnerability scanner cannot be monitored.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a vulnerability scanner performance analysis method, device, equipment and storage medium, aiming to solve the technical problem that it is difficult to implement performance analysis of vulnerability scanners and quantify them in the prior art.

[0006] To achieve the above object, the present invention provides a vulnerability scanner performance analysis method, the method comprising the following steps:

[0007] Get scan data from vulnerability scanners;

[0008] integrating the scan data;

[0009] Perform dimensional performance analysis on the integrated scan data to obtain analysis results;

[0010] The scanning performance of the vulnerability scanner is determined according to the analysis result.

[0011] Optionally, the scanning data includes: communication data and scanner parameters;

[0012] The integrating the scan data comprises:

[0013] Sorting the scanned data based on a preset sorting rule;

[0014] Generate a data statistics table based on the sorted scan data;

[0015] The communication data and the scanner parameters are stored in the data statistics table correspondingly to obtain a scanning data statistics table;

[0016] Accordingly, the dimensional performance analysis is performed on the integrated scan data to obtain the analysis results, including:

[0017] Perform dimensional performance analysis on the scan data statistical table to obtain analysis results.

[0018] Optionally, sorting the scanned data based on a preset sorting rule includes:

[0019] Obtain the scanner module type and concurrency number in the scan data;

[0020] Determine respectively a first sorting rule corresponding to the scanner module type and a second sorting rule corresponding to the concurrency number;

[0021] The scan data is sorted according to any one of the first sorting rule or the second sorting rule.

[0022] Optionally, performing dimensional performance analysis on the scan data statistics table to obtain analysis results includes:

[0023] Determine the variable factors in the scanning data statistical table;

[0024] Calculate the similarity between the variable factors of each scan data in the scan data statistical table;

[0025] When the similarity is less than a preset threshold, determining the target scanning data;

[0026] A dimensional performance analysis is performed based on the target scanning data to obtain an analysis result.

[0027] Optionally, performing dimensional performance analysis according to the target scanning data includes:

[0028] Calculate the single communication time consumption according to the communication data;

[0029] Compare the single communication time of each target scanning data, and generate performance analysis results based on the comparison results.

[0030] Optionally, obtaining scanning data of a vulnerability scanner includes:

[0031] Establish a communication connection with the target website;

[0032] Performing vulnerability scanning on the target website based on the communication connection;

[0033] After the vulnerability scan is completed, the scan data of the vulnerability scanner is read through the plugin interface of the vulnerability scanner.

[0034] Optionally, establishing a communication connection with a target website includes:

[0035] Obtain the domain name information, IP address and port information of the target website;

[0036] Detecting whether the domain name information is associated with the IP address;

[0037] If so, a communication connection with the target website is established according to the plugin interface of the vulnerability scanner and the port information.

[0038] Optionally, the performing vulnerability scanning on the target website based on the communication connection includes:

[0039] Obtaining the website type of the target website;

[0040] Generate a target attack case based on the website type and a preset detection signature;

[0041] Sending a target attack use case to the target website based on the communication connection, and receiving response data fed back by the target website based on the target attack use case;

[0042] A vulnerability scanning result for the target website is determined according to the response data.

[0043] Optionally, determining a vulnerability scanning result for the target website according to the response data includes:

[0044] Extracting a response characteristic code of the response data;

[0045] Matching the response signature with a vulnerability signature database;

[0046] When the match is successful, it is determined that the target website has a vulnerability.

[0047] Optionally, the performing vulnerability scanning on the target website based on the communication connection further includes:

[0048] Obtaining a resource locator of the target website;

[0049] Performing fingerprint recognition on the resource locator to obtain fingerprint information of the target website;

[0050] The scanning module corresponding to the fingerprint information is called to perform vulnerability scanning on the target website.

[0051] Optionally, after determining the scanning performance of the vulnerability scanner according to the analysis result, the method further includes:

[0052] generating a parameter adjustment strategy according to the analysis results;

[0053] The scanner parameters of the vulnerability scanner are adjusted according to the parameter adjustment strategy, wherein the parameter adjustment strategy includes: adjusting at least one of the concurrency number of scanning modules, the number of module requests, and the request ratio in the vulnerability scanner.

[0054] In addition, to achieve the above-mentioned purpose, the present invention also proposes a vulnerability scanner performance analysis device, the vulnerability scanner performance analysis device comprising:

[0055] Optionally, the integration module is used to sort the scan data based on a preset sorting rule;

[0056] Generate a data statistics table based on the sorted scan data;

[0057] The communication data and the scanner parameters are stored in the data statistics table correspondingly to obtain a scanning data statistics table;

[0058] Accordingly, the dimensional performance analysis is performed on the integrated scan data to obtain the analysis results, including:

[0059] Perform dimensional performance analysis on the scan data statistical table to obtain analysis results.

[0060] Optionally, the integration module is used to obtain the scanner module type and concurrency number in the scan data;

[0061] Determine respectively a first sorting rule corresponding to the scanner module type and a second sorting rule corresponding to the concurrency number;

[0062] The scan data is sorted according to any one of the first sorting rule or the second sorting rule.

[0063] Optionally, the integration module is used to determine the variable factors in the scanning data statistical table;

[0064] Calculate the similarity between the variable factors of each scan data in the scan data statistical table;

[0065] When the similarity is less than a preset threshold, determining the target scanning data;

[0066] A dimensional performance analysis is performed based on the target scanning data to obtain an analysis result.

[0067] Optionally, the integration module is used to calculate a single communication time consumption according to the communication data;

[0068] Compare the single communication time of each target scanning data, and generate performance analysis results based on the comparison results.

[0069] Optionally, the acquisition module is further used to establish a communication connection with the target website;

[0070] Performing vulnerability scanning on the target website based on the communication connection;

[0071] After the vulnerability scan is completed, the scan data of the vulnerability scanner is read through the plugin interface of the vulnerability scanner.

[0072] Optionally, the acquisition module is further used to acquire the domain name information, IP address and port information of the target website;

[0073] Detecting whether the domain name information is associated with the IP address;

[0074] If so, a communication connection with the target website is established according to the plugin interface of the vulnerability scanner and the port information.

[0075] In addition, to achieve the above-mentioned purpose, the present invention also proposes a vulnerability scanner performance analysis device, which includes: a memory, a processor, and a vulnerability scanner performance analysis program stored in the memory and executable on the processor, and the vulnerability scanner performance analysis program is configured to implement the steps of the vulnerability scanner performance analysis method described above.

[0076] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a vulnerability scanner performance analysis program is stored. When the vulnerability scanner performance analysis program is executed by a processor, the steps of the vulnerability scanner performance analysis method described above are implemented.

[0077] The present invention discloses a vulnerability scanner performance analysis method, which comprises: obtaining scanning data of a vulnerability scanner; integrating the scanning data; performing dimensional performance analysis on the integrated scanning data to obtain analysis results; and determining the scanning performance of the vulnerability scanner according to the analysis results. Compared with the prior art, the present invention integrates the scanning data of the vulnerability scanner to obtain scanning data with higher recognition, thereby facilitating improving the efficiency of subsequent dimensional performance analysis, and performs dimensional performance analysis on the integrated scanning data, quantifies the operating performance of the vulnerability scanner through specific numerical values, and determines the scanning data that has an impact on the vulnerability scanner, so as to facilitate subsequent performance optimization, thereby avoiding the technical problems of being difficult to implement performance analysis and quantification of the vulnerability scanner in the prior art, and also improving the efficiency of monitoring the performance of the vulnerability scanner. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 It is a structural diagram of a vulnerability scanner performance analysis device in a hardware operating environment involved in an embodiment of the present invention;

[0079] Figure 2 It is a flowchart of the first embodiment of the vulnerability scanner performance analysis method of the present invention;

[0080] Figure 3 It is a flow chart of the second embodiment of the vulnerability scanner performance analysis method of the present invention;

[0081] Figure 4 A schematic diagram of a flow chart of a third embodiment of a vulnerability scanner performance analysis method according to the present invention;

[0082] Figure 5 It is a structural block diagram of the first embodiment of the vulnerability scanner performance analysis device of the present invention.

[0083] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0084] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0085] Reference Figure 1 , Figure 1 The figure is a schematic diagram of the structure of a vulnerability scanner performance analysis device in a hardware operating environment according to an embodiment of the present invention.

[0086] like Figure 1 As shown, the vulnerability scanner performance analysis device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0087] Those skilled in the art will understand that Figure 1The structure shown in the figure does not constitute a limitation on the vulnerability scanner performance analysis device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0088] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a vulnerability scanner performance analysis program.

[0089] exist Figure 1 In the vulnerability scanner performance analysis device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the vulnerability scanner performance analysis device of the present invention can be set in the vulnerability scanner performance analysis device, and the vulnerability scanner performance analysis device calls the vulnerability scanner performance analysis program stored in the memory 1005 through the processor 1001, and executes the vulnerability scanner performance analysis method provided by the embodiment of the present invention.

[0090] The embodiment of the present invention provides a vulnerability scanner performance analysis method, referring to Figure 2 , Figure 2 The figure is a flow chart of a first embodiment of a vulnerability scanner performance analysis method according to the present invention.

[0091] In this embodiment, the vulnerability scanner performance analysis method includes the following steps:

[0092] Step S10: Obtain scanning data from the vulnerability scanner.

[0093] It should be noted that the executor of the method of this embodiment can be a device with data collection, data processing and network communication functions, such as: a control computer, a server, a mobile terminal and other devices, and can also be other devices that can achieve the same or similar functions. This embodiment does not impose specific restrictions on this. In this embodiment and the following embodiments, the control computer will be used as an example for explanation.

[0094] It is worth mentioning that a complete vulnerability scan involves crawling the target website connections and scanning each connection for various vulnerabilities. The scan of each vulnerability also needs to consider the type of target website and make various deformations of the attacking malicious code. Therefore, each scan will issue tens of thousands or even hundreds of thousands of requests. How to solve the problems of which requests are slow, which are unnecessary requests, which vulnerabilities are slow to scan, etc. among these requests is more conducive to analyzing the performance of the scanner.

[0095] In addition, the scanning performance of vulnerability scanners is also one of the important capabilities for evaluating scanners. Without the quantification of scanning data, it is impossible to conduct more effective scanner performance analysis.

[0096] In order to solve the above problems, this solution quantifies the various indicators of the scanner, so as to see the scanning data of the scanner on each connection and each module of the target website or system, including the crawler delay, the scanner delay, the number of requests issued by the scanner and other data, and conducts dimensional performance analysis to determine the impact of each dimension on the performance of the dimensional scanner.

[0097] It can be understood that vulnerability scanning refers to a security detection behavior that detects security vulnerabilities of designated remote or local computer systems based on a vulnerability database through broadcasting or scanning, and discovers exploitable vulnerabilities. Among them, vulnerability scanners include different types of vulnerability scanning behaviors such as network vulnerability scanning, host vulnerability scanning, and database vulnerability scanning.

[0098] It should be noted that the scanning data includes: communication data and scanner parameters, wherein the communication data includes: the time interval of each communication, the communication duration, the number of communication requests, the proportion of communication requests of each scanning module and the communication time of each module, and the scanner parameters include: the existing scanning modules, the concurrency number of each scanning module, etc. This embodiment does not impose specific restrictions on this.

[0099] Step S20: Integrate the scan data.

[0100] It should be understood that integrating scan data refers to the process of sorting the scan data of the vulnerability scanner according to certain rules and storing the corresponding data accordingly. After integrating the scan data, a scan data statistics table can be obtained to facilitate the subsequent dimensional performance analysis and quantify the impact of different scanner parameters on the scan performance.

[0101] Further, the scanning data includes: communication data and scanner parameters;

[0102] The integrating the scan data comprises:

[0103] Sorting the scanned data based on a preset sorting rule;

[0104] Generate a data statistics table based on the sorted scan data;

[0105] The communication data and the scanner parameters are stored in the data statistics table correspondingly to obtain a scanning data statistics table;

[0106] Accordingly, the dimensional performance analysis is performed on the integrated scan data to obtain the analysis results, including:

[0107] Perform dimensional performance analysis on the scan data statistical table to obtain analysis results.

[0108] It should be noted that the preset sorting rule refers to sorting the scan data according to the category of the scanner module or according to the concurrency size relationship of each scanning module. The scan data can also be sorted according to other scanner parameters. This embodiment does not impose specific restrictions on this.

[0109] Further, the sorting of the scanned data based on a preset sorting rule includes:

[0110] Obtain the scanner module type and concurrency number in the scan data;

[0111] Determine respectively a first sorting rule corresponding to the scanner module type and a second sorting rule corresponding to the concurrency number;

[0112] The scan data is sorted according to any one of the first sorting rule or the second sorting rule.

[0113] It can be understood that in this embodiment, the scanner module types include: but are not limited to: XSS or SQLiBlind, etc. The concurrency number refers to the number of requests that simultaneously access the target website. In this embodiment, it can be set to: 10, 100 or 200 parameters, or other concurrency parameters, etc. This embodiment does not impose specific restrictions on this.

[0114] Accordingly, the first sorting rule may be to integrate the scan data corresponding to the same type of scanner modules according to the type of XSS or SQLiBlind scanner modules, or to arrange them in the order of XSS-SQLiBlind; the second sorting rule may be to sort the scan data from a smaller concurrent number to a larger concurrent number, or to sort the scan data from a larger concurrent number to a smaller concurrent number, and this embodiment does not impose any specific restrictions on this.

[0115] In a specific implementation, the scan data can also be sorted according to the size of the total number of requests, the total time consumed, or other scanner parameters. This embodiment does not impose any specific restrictions on this. Refer to Table 1, which is a statistical table of sorted scan data, which is a statistical table obtained by sorting the scan data according to the number of concurrency and the total number of requests.

[0116] Table 1

[0117]

[0118] Step S30: Perform dimensional performance analysis on the integrated scan data to obtain analysis results.

[0119] It should be noted that the dimensional performance analysis of the integrated scan data can be performed on the scan data statistical table mentioned above, that is, a comparative analysis is performed based on the data in the scan data statistical table that only has one variable or has a causal relationship, so as to determine the performance impact of each scanner parameter on the vulnerability scanner.

[0120] Furthermore, the dimensional performance analysis is performed on the scan data statistics table to obtain the analysis result, including:

[0121] Determine the variable factors in the scanning data statistical table;

[0122] Calculate the similarity between the variable factors of each scan data in the scan data statistical table;

[0123] When the similarity is less than a preset threshold, determining the target scanning data;

[0124] A dimensional performance analysis is performed based on the target scanning data to obtain an analysis result.

[0125] It should be noted that the variable factors may be scanner parameters, including but not limited to: the total number of requests, the number of concurrent requests, and the type of scanner module.

[0126] It should be noted that the scanning performance of the vulnerability scanner in this embodiment can be quantified by the time consumption of a single scan, that is, the shorter the time consumption of a single scan request, the better the scanning performance, and the longer the time consumption of a single scan request, the worse the scanning performance.

[0127] In the specific implementation, it is impossible to control that there is only one variable in a set of scan data, and the other data are exactly the same. Therefore, the difficulty of dimensional analysis can be reduced by treating data with high similarity as the same data. For example, compared with the data in the third row of Table 1 and the fifth row of Table 1, only the concurrency number has a lower similarity. Therefore, these two sets of data can be used as target scan data, and the concurrency number can be used as the target variable factor. When performing dimensional performance analysis on them, it is found that when the scan vulnerabilities are the same, a higher concurrency number has a significant effect on improving the scanning performance. However, due to the influence of the target machine and network factors, there is an upper limit to the performance improvement of the concurrency number, and a higher concurrency number will lead to more timed requests. Therefore, in the case of high concurrency, the stability of the scanning results will be reduced.

[0128] In addition, comparing the third row of data with the fourth row of data in Table 1, the scanner module category and the corresponding number of requests are used as variable factors. The number of requests issued by some scanning modules accounts for a relatively high proportion. The modules with a higher number of requests can be optimized, for example: reducing the number of requests, thereby reducing the time consumption of a single request, so as to achieve the purpose of performance optimization.

[0129] Further, the performing dimensional performance analysis according to the target scanning data includes:

[0130] Calculate the single communication time consumption according to the communication data;

[0131] Compare the single communication time of each target scanning data, and generate performance analysis results based on the comparison results.

[0132] Step S40: determining the scanning performance of the vulnerability scanner according to the analysis result.

[0133] The present embodiment discloses a vulnerability scanner performance analysis method, which includes: obtaining scanning data of a vulnerability scanner; integrating the scanning data; performing dimensional performance analysis on the integrated scanning data to obtain analysis results; and determining the scanning performance of the vulnerability scanner based on the analysis results. The present embodiment integrates the scanning data of the vulnerability scanner to obtain scanning data with higher recognition, thereby improving the efficiency of subsequent dimensional performance analysis, and performs dimensional performance analysis on the integrated scanning data. The operating performance of the vulnerability scanner is quantified by specific numerical values, and the scanning data that affects the vulnerability scanner is determined to facilitate subsequent performance optimization. This avoids the technical problems of being difficult to implement and quantify the performance analysis of the vulnerability scanner in the prior art, and also improves the efficiency of monitoring the performance of the vulnerability scanner.

[0134] refer to Figure 3 , Figure 3 It is a flow chart of a second embodiment of a vulnerability scanner performance analysis method of the present invention.

[0135] Based on the above first embodiment, in this embodiment, step S10 includes:

[0136] Step S101: Establishing a communication connection with a target website.

[0137] It should be noted that this embodiment is for vulnerability scanning of websites. In order to realize vulnerability scanning between the target website, a communication channel can generally be established between the plug-in interface on the vulnerability scanner and the target website to facilitate the subsequent transmission of scanning requests and response data.

[0138] Further, in order to establish a communication connection with a target website, the establishing of a communication connection with the target website includes:

[0139] Obtain the domain name information, IP address and port information of the target website;

[0140] Detecting whether the domain name information is associated with the IP address;

[0141] If so, a communication connection with the target website is established according to the plugin interface of the vulnerability scanner and the port information.

[0142] It is worth noting that IP address refers to a unified address format provided by the IP protocol. In order to distinguish hundreds of millions of hosts on the Internet, people assign a special address to each host, called an IP address, which specifically refers to the IP address of the target website server in this embodiment; there is a mapping relationship between domain name information and IP address, and the domain name and IP address can be a one-to-many relationship. A server can only have one IP address, but can have multiple domain names, for example: www.XXX.com, etc. Port information can refer to the port number, and there is no corresponding relationship between the ports used by the control computer and the target website during communication.

[0143] In addition, the plugin interface of the vulnerability scanner is used to interact with external data to facilitate vulnerability scanning.

[0144] In the specific implementation, since one IP address can correspond to multiple domain names, when establishing a communication connection remotely, in order to avoid connecting to the wrong website, it is necessary to associate and verify the obtained IP address and domain name information. After the verification is passed, a communication connection is established with the target website through the port information publicly disclosed by the target website.

[0145] Step S102: performing vulnerability scanning on the target website based on the communication connection.

[0146] It is understandable that the process of scanning the target website for vulnerabilities may be to first send a communication request to the target website. This communication request may be a set attack behavior or other communication requests that can achieve the same or similar effects. The attack behavior may be one or more of the following attack behaviors: SQL injection, XSS cross-site scripting, remote overflow attack, file inclusion, Bash vulnerability attack, remote command execution, directory traversal, sensitive file access, and command / code injection. This embodiment does not impose any specific restrictions on this.

[0147] After the target website receives the communication request from the control computer, it will feedback a response information to the control computer according to the communication request. Finally, the control computer will verify whether the corresponding association conditions are met based on the received response information. The communication request may include a preset detection feature code, and the response information may include a response feature code generated by the target website according to the preset detection feature code. Finally, if there is a mapping relationship between the preset detection feature code and the response feature code, it means that the communication is normal and there are no loopholes.

[0148] Further, determining the vulnerability scanning result of the target website according to the response data includes:

[0149] Extracting a response characteristic code of the response data;

[0150] Matching the response signature with a vulnerability signature database;

[0151] When the match is successful, it is determined that the target website has a vulnerability.

[0152] The vulnerability feature database stores a large number of detection feature codes and corresponding response feature codes, and may also include a function for generating a response feature code corresponding to the detection feature code, which is not specifically limited in this embodiment.

[0153] Further, the performing vulnerability scanning on the target website based on the communication connection further includes:

[0154] Obtaining a resource locator of the target website;

[0155] Performing fingerprint recognition on the resource locator to obtain fingerprint information of the target website;

[0156] The scanning module corresponding to the fingerprint information is called to perform vulnerability scanning on the target website.

[0157] It should be noted that the vulnerability scanner crawls the resource locator (uniform resource locator; URL) of the target website and stores it in the queue to be scanned, performs web fingerprint recognition on the URL in the queue to be scanned to obtain the fingerprint information of the target website, and can also call the scanning module corresponding to the website fingerprint information to scan the website to be detected, wherein the fingerprint information includes information such as the operating system type, the web server used, the database type, and the scripting language of the web application. By identifying different types of plug-ins for scanning based on different website fingerprint information, a lot of scanning time is saved and the vulnerability scanning efficiency is improved.

[0158] In a specific implementation, vulnerability scanning of the target website based on the fingerprint information can be performed to determine whether the MD5 value of the target website corresponding to the scan resource locator is the same as the MD5 value recorded during the last scan. If they are the same, the website corresponding to the URL has not changed. If they are not the same, the website corresponding to the URL has changed, and a vulnerability exists.

[0159] Step S103: After the vulnerability scan is completed, the scan data of the vulnerability scanner is read through the plugin interface of the vulnerability scanner.

[0160] This embodiment first establishes a communication connection with the target website, and performs a vulnerability scan on the target website based on the communication connection to achieve subsequent vulnerability scanning data acquisition. At the same time, it can also identify whether the target website has abnormal vulnerabilities and the number of vulnerabilities, or detect whether the vulnerability scanner has abnormal scanning requests, thereby improving the efficiency of vulnerability scanning.

[0161] refer to Figure 4 , Figure 4 It is a flowchart diagram of a third embodiment of a vulnerability scanner performance analysis method of the present invention.

[0162] Based on the above second embodiment, in this embodiment, after step S40, the following is further included:

[0163] Step S50: generating a parameter adjustment strategy according to the analysis result.

[0164] It should be noted that the parameter adjustment strategy can be to adjust the concurrency number in the vulnerability scanner, the number of requests of each scanner module, and the proportion of module requests according to the performance analysis results, and this embodiment does not impose specific restrictions on this.

[0165] Step S60: adjusting the scanner parameters of the vulnerability scanner according to the parameter adjustment strategy, wherein the parameter adjustment strategy includes: adjusting at least one of the concurrency number of scanning modules in the vulnerability scanner, the number of module requests, and the request ratio.

[0166] In the specific implementation, taking Table 1 as an example, it can be found that when scanning the same vulnerability, a higher concurrency number has a significant effect on improving the scanning performance. However, due to the influence of the target machine and network factors, there is an upper limit to the performance improvement of the concurrency number, and a higher concurrency number will lead to more timeout requests. Therefore, in the case of high concurrency, the stability of the scanning results will be reduced. Therefore, the concurrency number can be adjusted to an appropriate value, for example: 200, and this embodiment does not impose specific restrictions on this.

[0167] In addition, the number of requests issued by some scanning modules accounts for a relatively high proportion. The number of requests of scanning modules with a high number of requests or a high proportion of requests can be reduced to reduce the overall request time and improve the operating performance of the scanner.

[0168] This embodiment determines a parameter adjustment strategy for the vulnerability scanner according to the analysis result, so as to adjust the scanner parameters of the vulnerability scanner, improve the performance of the vulnerability scanner, and improve the vulnerability scanning efficiency.

[0169] In addition, an embodiment of the present invention further proposes a storage medium, on which a vulnerability scanner performance analysis program is stored. When the vulnerability scanner performance analysis program is executed by a processor, the steps of the vulnerability scanner performance analysis method described above are implemented.

[0170] Since the storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought by the technical solutions of the above embodiments, which will not be described one by one here.

[0171] Reference Figure 5 , Figure 5 It is a structural block diagram of the first embodiment of the vulnerability scanner performance analysis device of the present invention.

[0172] like Figure 5 As shown, the vulnerability scanner performance analysis device proposed in the embodiment of the present invention includes:

[0173] The acquisition module 10 is used to acquire scanning data of the vulnerability scanner.

[0174] The integration module 20 is used to integrate the scan data.

[0175] The analysis module 30 is used to perform dimensional performance analysis on the integrated scan data to obtain analysis results.

[0176] The analysis module 30 is further configured to determine the scanning performance of the vulnerability scanner according to the analysis result.

[0177] In one embodiment, the integration module 20 is further used to sort the scan data based on a preset sorting rule; generate a data statistics table based on the sorted scan data; store the communication data and the scanner parameters in the data statistics table corresponding to each other to obtain a scan data statistics table; accordingly, performing dimensional performance analysis on the integrated scan data to obtain an analysis result, including: performing dimensional performance analysis on the scan data statistics table to obtain an analysis result.

[0178] In one embodiment, the integration module 20 is also used to obtain the scanner module type and the concurrency number in the scan data; respectively determine a first sorting rule corresponding to the scanner module type and a second sorting rule corresponding to the concurrency number; and sort the scan data according to either the first sorting rule or the second sorting rule.

[0179] In one embodiment, the integration module 20 is also used to determine the variable factors in the scanning data statistical table; calculate the similarity between the variable factors of each scanning data in the scanning data statistical table; when the similarity is less than a preset threshold, determine the target scanning data; perform dimensional performance analysis based on the target scanning data to obtain an analysis result.

[0180] In one embodiment, the integration module 20 is further used to calculate a single communication time consumption according to the communication data; compare the single communication time consumption of each target scanning data, and generate a performance analysis result according to the comparison result.

[0181] In one embodiment, the acquisition module 10 is also used to establish a communication connection with a target website; perform a vulnerability scan on the target website based on the communication connection; and after the vulnerability scan is completed, read the scan data of the vulnerability scanner through the plugin interface of the vulnerability scanner.

[0182] In one embodiment, the acquisition module 10 is also used to obtain the domain name information, IP address and port information of the target website; detect whether the domain name information corresponds to the IP address; if so, establish a communication connection with the target website based on the vulnerability scanner plug-in interface and the port information.

[0183] In one embodiment, the acquisition module 10 is also used to obtain the website type of the target website; generate a target attack use case based on the website type and a preset detection feature code; send the target attack use case to the target website based on the communication connection, and receive response data fed back by the target website based on the target attack use case; determine the vulnerability scanning result of the target website based on the response data.

[0184] In one embodiment, the acquisition module 10 is further used to extract a response feature code of the response data; match the response feature code with a vulnerability feature database; and when the match is successful, determine that a vulnerability exists in the target website.

[0185] In one embodiment, the acquisition module 10 is further used to acquire the resource locator of the target website; perform fingerprint recognition on the resource locator to obtain fingerprint information of the target website; and call a scanning module corresponding to the fingerprint information to perform vulnerability scanning on the target website.

[0186] In one embodiment, the analysis module 30 is also used to generate a parameter adjustment strategy based on the analysis results; adjust the scanner parameters of the vulnerability scanner according to the parameter adjustment strategy, and the parameter adjustment strategy includes: adjusting at least one of the concurrency number of the scanning module in the vulnerability scanner, the number of module requests, and the request ratio.

[0187] The present embodiment discloses a vulnerability scanner performance analysis method, which includes: obtaining scanning data of a vulnerability scanner; integrating the scanning data; performing dimensional performance analysis on the integrated scanning data to obtain analysis results; and determining the scanning performance of the vulnerability scanner based on the analysis results. The present embodiment integrates the scanning data of the vulnerability scanner to obtain scanning data with higher recognition, thereby improving the efficiency of subsequent dimensional performance analysis, and performs dimensional performance analysis on the integrated scanning data. The operating performance of the vulnerability scanner is quantified by specific numerical values, and the scanning data that affects the vulnerability scanner is determined to facilitate subsequent performance optimization. This avoids the technical problems of being difficult to implement and quantify the performance analysis of the vulnerability scanner in the prior art, and also improves the efficiency of monitoring the performance of the vulnerability scanner.

[0188] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0189] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0190] In addition, for technical details not fully described in this embodiment, reference can be made to the vulnerability scanner performance analysis method provided in any embodiment of the present invention, and will not be repeated here.

[0191] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0192] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0193] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0194] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0195] The present invention discloses A1, a vulnerability scanner performance analysis method, the vulnerability scanner performance analysis method comprising:

[0196] Get scan data from vulnerability scanners;

[0197] integrating the scan data;

[0198] Perform dimensional performance analysis on the integrated scan data to obtain analysis results;

[0199] The scanning performance of the vulnerability scanner is determined according to the analysis result.

[0200] A2. The vulnerability scanner performance analysis method as described in A1, wherein the scanning data includes: communication data and scanner parameters;

[0201] The integrating the scan data comprises:

[0202] Sorting the scanned data based on a preset sorting rule;

[0203] Generate a data statistics table based on the sorted scan data;

[0204] The communication data and the scanner parameters are stored in the data statistics table correspondingly to obtain a scanning data statistics table;

[0205] Accordingly, the dimensional performance analysis is performed on the integrated scan data to obtain the analysis results, including:

[0206] Perform dimensional performance analysis on the scan data statistical table to obtain analysis results.

[0207] A3. The vulnerability scanner performance analysis method as described in A2, wherein the scanning data is sorted based on a preset sorting rule, comprising:

[0208] Obtain the scanner module type and concurrency number in the scan data;

[0209] Determine respectively a first sorting rule corresponding to the scanner module type and a second sorting rule corresponding to the concurrency number;

[0210] The scan data is sorted according to any one of the first sorting rule or the second sorting rule.

[0211] A4. The vulnerability scanner performance analysis method as described in A2, wherein the dimensional performance analysis is performed on the scanning data statistics table to obtain the analysis result, including:

[0212] Determine the variable factors in the scanning data statistical table;

[0213] Calculate the similarity between the variable factors of each scan data in the scan data statistical table;

[0214] When the similarity is less than a preset threshold, determining the target scanning data;

[0215] A dimensional performance analysis is performed based on the target scanning data to obtain an analysis result.

[0216] A5. The vulnerability scanner performance analysis method as described in A4, wherein the dimensional performance analysis is performed according to the target scanning data, comprising:

[0217] Calculate the single communication time consumption according to the communication data;

[0218] Compare the single communication time of each target scanning data, and generate performance analysis results based on the comparison results.

[0219] A6. The vulnerability scanner performance analysis method as described in A1, wherein obtaining scanning data of the vulnerability scanner comprises:

[0220] Establish a communication connection with the target website;

[0221] Performing vulnerability scanning on the target website based on the communication connection;

[0222] After the vulnerability scan is completed, the scan data of the vulnerability scanner is read through the plugin interface of the vulnerability scanner.

[0223] A7. The vulnerability scanner performance analysis method as described in A6, wherein establishing a communication connection with a target website comprises:

[0224] Obtain the domain name information, IP address and port information of the target website;

[0225] Detecting whether the domain name information is associated with the IP address;

[0226] If so, a communication connection with the target website is established according to the plugin interface of the vulnerability scanner and the port information.

[0227] A8. The vulnerability scanner performance analysis method as described in A6, wherein the vulnerability scanning of the target website based on the communication connection comprises:

[0228] Obtaining the website type of the target website;

[0229] Generate a target attack case based on the website type and a preset detection signature;

[0230] Sending a target attack use case to the target website based on the communication connection, and receiving response data fed back by the target website based on the target attack use case;

[0231] A vulnerability scanning result for the target website is determined according to the response data.

[0232] A9. The vulnerability scanner performance analysis method as described in A8, wherein determining the vulnerability scanning result of the target website according to the response data comprises:

[0233] Extracting a response characteristic code of the response data;

[0234] Matching the response signature with a vulnerability signature database;

[0235] When the match is successful, it is determined that the target website has a vulnerability.

[0236] A10. The vulnerability scanner performance analysis method as described in A6, wherein the vulnerability scanning of the target website based on the communication connection further includes:

[0237] Obtaining a resource locator of the target website;

[0238] Performing fingerprint recognition on the resource locator to obtain fingerprint information of the target website;

[0239] The scanning module corresponding to the fingerprint information is called to perform vulnerability scanning on the target website.

[0240] A11. The vulnerability scanner performance analysis method as described in any one of A1 to A10, after determining the scanning performance of the vulnerability scanner according to the analysis result, further comprising:

[0241] generating a parameter adjustment strategy according to the analysis results;

[0242] The scanner parameters of the vulnerability scanner are adjusted according to the parameter adjustment strategy, wherein the parameter adjustment strategy includes: adjusting at least one of the concurrency number of scanning modules, the number of module requests, and the request ratio in the vulnerability scanner.

[0243] The present invention also discloses B12, a vulnerability scanner performance analysis device, the vulnerability scanner performance analysis device comprising:

[0244] The acquisition module is used to obtain the scanning data of the vulnerability scanner;

[0245] An integration module, used for integrating the scan data;

[0246] An analysis module is used to perform dimensional performance analysis on the integrated scan data to obtain analysis results;

[0247] The analysis module is also used to determine the scanning performance of the vulnerability scanner according to the analysis results.

[0248] B13. The vulnerability scanner performance analysis device as described in B12, wherein the integration module is used to sort the scan data based on a preset sorting rule;

[0249] Generate a data statistics table based on the sorted scan data;

[0250] The communication data and the scanner parameters are stored in the data statistics table correspondingly to obtain a scanning data statistics table;

[0251] Accordingly, the dimensional performance analysis is performed on the integrated scan data to obtain the analysis results, including:

[0252] Perform dimensional performance analysis on the scan data statistical table to obtain analysis results.

[0253] B14, the vulnerability scanner performance analysis device as described in B13, wherein the integration module is used to obtain the scanner module type and concurrency number in the scanning data;

[0254] Determine respectively a first sorting rule corresponding to the scanner module type and a second sorting rule corresponding to the concurrency number;

[0255] The scan data is sorted according to any one of the first sorting rule or the second sorting rule.

[0256] B15, the vulnerability scanner performance analysis device as described in B13, wherein the integration module is used to determine the variable factors in the scanning data statistics table;

[0257] Calculate the similarity between the variable factors of each scan data in the scan data statistical table;

[0258] When the similarity is less than a preset threshold, determining the target scanning data;

[0259] A dimensional performance analysis is performed based on the target scanning data to obtain an analysis result.

[0260] B16, the vulnerability scanner performance analysis device as described in B15, wherein the integration module is used to calculate the single communication time consumption according to the communication data;

[0261] Compare the single communication time of each target scanning data, and generate performance analysis results based on the comparison results.

[0262] B17, the vulnerability scanner performance analysis device as described in B12, wherein the acquisition module is further used to establish a communication connection with the target website;

[0263] Performing vulnerability scanning on the target website based on the communication connection;

[0264] After the vulnerability scan is completed, the scan data of the vulnerability scanner is read through the plugin interface of the vulnerability scanner.

[0265] B18. The vulnerability scanner performance analysis device as described in B17, wherein the acquisition module is further used to acquire the domain name information, IP address and port information of the target website;

[0266] Detecting whether the domain name information is associated with the IP address;

[0267] If so, a communication connection with the target website is established according to the plugin interface of the vulnerability scanner and the port information.

[0268] The present invention also discloses C19, a vulnerability scanner performance analysis device, which includes: a memory, a processor, and a vulnerability scanner performance analysis program stored in the memory and executable on the processor, wherein the vulnerability scanner performance analysis program is configured to implement the vulnerability scanner performance analysis method described above.

[0269] The present invention also discloses D20, a storage medium, on which a vulnerability scanner performance analysis program is stored. When the vulnerability scanner performance analysis program is executed by a processor, the vulnerability scanner performance analysis method as described above is implemented.

Claims

1. A vulnerability scanner performance analysis method, characterized in that: The vulnerability scanner performance analysis method comprises: Get scan data from vulnerability scanners; integrating the scan data; Perform dimensional performance analysis on the integrated scan data to obtain analysis results; The scanning performance of the vulnerability scanner is determined according to the analysis result.

2. The vulnerability scanner performance analysis method according to claim 1, characterized in that: The scanning data includes: communication data and scanner parameters; The integrating the scan data comprises: Sorting the scanned data based on a preset sorting rule; Generate a data statistics table based on the sorted scan data; The communication data and the scanner parameters are stored in the data statistics table correspondingly to obtain a scanning data statistics table; Accordingly, the dimensional performance analysis is performed on the integrated scan data to obtain the analysis results, including: Perform dimensional performance analysis on the scan data statistical table to obtain analysis results.

3. The vulnerability scanner performance analysis method according to claim 2, characterized in that: The sorting of the scanned data based on a preset sorting rule includes: Obtain the scanner module type and concurrency number in the scan data; Determine respectively a first sorting rule corresponding to the scanner module type and a second sorting rule corresponding to the concurrency number; The scan data is sorted according to any one of the first sorting rule or the second sorting rule.

4. The vulnerability scanner performance analysis method according to claim 2, characterized in that: The performing dimensional performance analysis on the scan data statistics table to obtain analysis results includes: Determine the variable factors in the scanning data statistical table; Calculate the similarity between the variable factors of each scan data in the scan data statistical table; When the similarity is less than a preset threshold, determining the target scanning data; A dimensional performance analysis is performed based on the target scanning data to obtain an analysis result.

5. The vulnerability scanner performance analysis method according to claim 4, characterized in that: The performing dimensional performance analysis according to the target scanning data includes: Calculate the single communication time consumption according to the communication data; Compare the single communication time of each target scanning data, and generate performance analysis results based on the comparison results.

6. The vulnerability scanner performance analysis method according to claim 1, characterized in that: The step of obtaining scanning data of the vulnerability scanner includes: Establish a communication connection with the target website; Performing vulnerability scanning on the target website based on the communication connection; After the vulnerability scan is completed, the scan data of the vulnerability scanner is read through the plugin interface of the vulnerability scanner.

7. The vulnerability scanner performance analysis method according to claim 6, characterized in that: The establishing of a communication connection with the target website includes: Obtain the domain name information, IP address and port information of the target website; Detecting whether the domain name information is associated with the IP address; If so, a communication connection with the target website is established according to the plugin interface of the vulnerability scanner and the port information.

8. A vulnerability scanner performance analysis device, characterized in that: The vulnerability scanner performance analysis device comprises: The acquisition module is used to obtain the scanning data of the vulnerability scanner; An integration module, used for integrating the scan data; An analysis module is used to perform dimensional performance analysis on the integrated scan data to obtain analysis results; The analysis module is also used to determine the scanning performance of the vulnerability scanner according to the analysis results.

9. A vulnerability scanner performance analysis device, characterized in that: The vulnerability scanner performance analysis device includes: a memory, a processor, and a vulnerability scanner performance analysis program stored in the memory and executable on the processor, wherein the vulnerability scanner performance analysis program is configured to implement the vulnerability scanner performance analysis method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a vulnerability scanner performance analysis program, and when the vulnerability scanner performance analysis program is executed by the processor, the vulnerability scanner performance analysis method according to any one of claims 1 to 7 is implemented.

Images