System and method for rapidly detecting vulnerabilities based on traffic

Abstract

The invention belongs to the field of data security, and particularly designs a system and method for quickly detecting vulnerabilities based on traffic, and the method comprises the steps: S1, collecting fingerprint rule data, CPE dictionary data and CVE vulnerability data; s2, collecting and filtering traffic by using a switch to obtain traffic data; s3, performing asset identification on the traffic data by using the fingerprint rule data and the CPE dictionary data to obtain a corresponding CPE ID; step S4, querying corresponding vulnerabilities according to the CPE ID obtained in the step S3, and performing vulnerability grading; and S5, generating a vulnerability detection report according to the vulnerability level. By means of the design, medium-high-risk loophole hidden dangers existing in an operation system, middleware, WEB, applications and the like in IDC assets can be rapidly found in a lossless mode based on flow recognition without actively sending a detection packet.

Description

Technical Field

[0001] The present invention belongs to the field of data security, and in particular relates to a system and method for rapid vulnerability detection based on traffic. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent. Network attacks, ransomware, data leaks and other incidents have occurred frequently, causing huge losses to enterprises and individuals. Attackers mainly steal information from servers or destroy network services by exploiting network vulnerabilities. Common attacks against vulnerabilities include application vulnerabilities, deserialization vulnerabilities, database vulnerabilities, web vulnerabilities, etc. Specific attack methods include denial of service attacks (DOS), SQL injection, remote code execution, etc. Fast and accurate network vulnerability detection and protection are crucial to the security of network services. Existing detection solutions mainly use IDS to detect attack traffic that exploits vulnerabilities, or use automated vulnerability scanning tools to detect existing vulnerabilities.

[0003] There are two main methods for mature vulnerability detection: One way is to determine the vulnerability exploitation attack based on traffic, but it cannot accurately determine whether the vulnerability exploitation is successful, and the false positive rate is high. It belongs to the detection of the attack stage, and it cannot determine whether the vulnerability exists, nor can it discover and repair the vulnerability in advance. If the characteristics of the vulnerability attack cannot be updated in time for the latest 1-day vulnerability, it will not be possible to detect new vulnerabilities. Another way is to use scanning tools to perform active vulnerability scanning before the attack occurs. During the vulnerability scanning process, a large number of detection data packets will be sent. The payload sent by the scan will leave dirty data in the database of the scanned system at the least, and will directly cause the business system to crash at the worst. In the IDC computer room, the network traffic is particularly large, and a large number of critical business systems are deployed. Active scanning may cause critical business interruption, and there will be false positives for attack detection that exploits vulnerabilities, and vulnerabilities cannot be discovered in advance.

[0004] How to efficiently and quickly discover potential vulnerabilities based on lossless traffic is a big challenge. Summary of the invention

[0005] In order to solve the above problems, the present application designs a system and method based on traffic-based rapid vulnerability detection, so as to achieve traffic-based identification, without actively sending detection packets, and to quickly and losslessly discover medium- and high-risk vulnerabilities in the operating system, middleware, WEB and applications in IDC assets.

[0006] A system for rapid vulnerability detection based on traffic flow, comprising: Fingerprint rule collection module, fingerprint rule library, CPE dictionary collection module, CPE dictionary library, known vulnerability collection module, known vulnerability library, asset identification module, traffic filtering module, asset library, vulnerability matching module, vulnerability detection report management module; The fingerprint rule collection module is used to collect fingerprint rule data and upload it to the fingerprint rule library; The CPE dictionary collection module is used to collect CPE dictionary data and upload it to the CPE dictionary library; The known vulnerability collection module is used to collect CVE vulnerability data and upload it to the known vulnerability library, namely the CVE vulnerability database; The traffic filtering module is used to collect and filter traffic, and transmit the filtered traffic to the asset identification module; the asset identification module calls the data in the fingerprint rule library and the CPE dictionary library to match the filtered traffic, and obtains the corresponding asset CPE ID, port, manufacturer, product, and version information, and then the asset identification module writes the above asset CPE ID, port, manufacturer, product, and version information into the asset library, and then the asset identification module transmits the obtained CPE ID to the vulnerability matching module; The vulnerability matching module queries the corresponding vulnerability according to the CPE ID obtained by the asset identification module, classifies the vulnerability level, and transmits the obtained vulnerability level to the vulnerability detection report management module, and the vulnerability detection report management module generates a detection report according to the vulnerability level.

[0007] Preferably, the present application also designs a method for rapid vulnerability detection based on traffic flow, comprising the following steps: Step S1, collecting fingerprint rule data, CPE dictionary data, and CVE vulnerability data; Step S2: Use a switch to collect and filter traffic to obtain traffic data; Step S3: Use the fingerprint rule data and the CPE dictionary data to perform asset identification on the traffic data to obtain the corresponding CPE ID; Step S4: query the corresponding vulnerability according to the CPE ID obtained in step S3, and classify the vulnerability level; Step S5: Generate a vulnerability detection report according to the vulnerability level.

[0008] Preferably, in step S1, the method for collecting fingerprint rule data includes: Step S111, collecting fingerprint rules for identifying asset data, and dividing the collected fingerprint rules into three categories, including operating system OS, service Service and application Http; Step S112, extracting relevant fields from the fingerprint rule; Step S113: Create corresponding tables or sets according to the three types of fingerprint rules collected, and construct respective tables according to the extracted fields; Step S114, importing the fingerprint rules parsed in step S113 into the fingerprint rule database; Step S115: Write a script or a scheduled task to regularly fetch new fingerprint rules from public channels and update the new fingerprint rules to the fingerprint rule database.

[0009] Preferably, in step S1, the collection of the CPE dictionary data includes: Step S121, collecting and acquiring a CPE dictionary data set of known assets from public channels; Step S122: extract fields from each CPE dictionary data, including CPE ID, Port, manufacturer, product, and version information; Step S123, selecting a MySQL database to store the CPE dictionary data, and using an ETL tool to import the CPE dictionary data extracted in step S122 into the CPE dictionary database; Step S124: Set a scheduled task to regularly fetch the latest CPE dictionary data from public channels and update it to the CPE dictionary database.

[0010] Preferably, in step S1, the collection of CVE vulnerability data includes: Step S131, collecting known CVE vulnerability data from mainstream vulnerability platforms; Step S132: extract corresponding fields from the collected CVE vulnerability data; Step S133, selecting a MySQL database to store the parsed CVE vulnerability data; Step S134: Set a scheduled task to regularly obtain the latest CVE vulnerability data and update it to the CVE vulnerability database.

[0011] Preferably, the step S2 specifically includes: Step S21, configure the switch to perform port mirroring, copy the traffic of the port to be monitored to a specific monitoring port through the mirroring configuration command of the switch, save the configuration and ensure that the mirroring session runs successfully; Step S22, connect to the target port of the mirror, start capturing traffic through a packet capture tool, and collect traffic data; Step S23: List all IP addresses used in the IDC computer room or determine their subnets, and determine the IP address range of the IDC computer room; Step S24: Filter the collected traffic data.

[0012] Preferably, the step S3 specifically includes: Match the traffic data filtered in step S2 with the fingerprint rule database and the CPE dictionary database to obtain the corresponding asset CPE ID, port, manufacturer, product, and version information; And write the above asset CPE ID, Port, manufacturer, product, and version information into the asset library.

[0013] Preferably, the step S4 specifically includes: Step S41: According to the asset CPE ID obtained in step S3, by traversing the CVE vulnerability database, query and obtain a list of all associated vulnerabilities: Step S42, traverse and query the detailed information of each CVE vulnerability; Step S43: Classify each CVE vulnerability by CVSS score and calculate the vulnerability level.

[0014] Preferably, in step S43, the vulnerability level is defined as: Low level: CVSS score: 0.0 - 3.9; Medium: CVSS score: 4.0 - 6.9; High level: CVSS score: 7.0 - 8.9; Severity Rating: CVSS score: 9.0 - 10.0.

[0015] Preferably, in step S43, the CVSS score of the vulnerability is calculated as follows: If a score is listed in the relevant field of the CVE detailed information, that score is used; If the relevant fields of the CVE details do not list the scores, the CVSS calculator is used to calculate the scores based on the various attributes of the vulnerability.

[0016] The advantages and effects of this application are as follows: 1. Efficient vulnerability detection: The present invention uses sub-identification and vulnerability matching of traffic feature data. Compared with active vulnerability scanning, it greatly reduces the detection traffic and does not need to send any detection traffic throughout the process, which greatly improves the vulnerability detection efficiency.

[0017] 2. Business losslessness: Because it is a passive vulnerability detection, no detection package is sent, which will not cause the business system to crash, avoiding interference with the business system and ensuring business continuity.

[0018] 3. Timely response to the latest vulnerabilities: Because the vulnerability library is updated daily, the latest vulnerabilities can be quickly detected for the latest vulnerability threats without developing vulnerability exploit attack features and POCs, which is impossible with traditional vulnerability scanning.

[0019] 4. The traffic collection method is flexible, and the most appropriate solution can be selected according to the actual environment.

[0020] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application so that it can be implemented in accordance with the contents of the specification, and to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following is a detailed description of the preferred embodiments of the present application in conjunction with the accompanying drawings as follows.

[0021] Based on the detailed description of the specific embodiments of the present application in combination with the accompanying drawings below, those skilled in the art will become more aware of the above and other objects, advantages and features of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings without creative work. In all drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, each element or part is not necessarily drawn according to the actual scale.

[0023] Figure 1 A flow chart of a method for rapid vulnerability detection based on traffic designed for this application; Figure 2 Flowchart of the method for collecting fingerprint rule data designed for this application; Figure 3 Flowchart of the method for collecting CPE dictionary data designed for this application; Figure 4 Flowchart of the CVE vulnerability data collection method designed for this application; Figure 5 A module block diagram of a method for rapid vulnerability detection based on traffic designed for this application. DETAILED DESCRIPTION

[0024] To make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the present application. Obviously, the described embodiment is a part of the embodiment of the present application, rather than all of the embodiments. In the following description, specific details such as specific configuration and components are provided only to help fully understand the embodiments of the present application. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. In addition, for clarity and brevity, the description of known functions and structures is omitted in the embodiment.

[0025] It should be understood that the references to "one embodiment" or "this embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present application. Therefore, the references to "one embodiment" or "this embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0026] In addition, the present application may repeat reference numerals and / or letters in different examples. This repetition is for the purpose of simplicity and clarity, and does not in itself indicate the relationship between the various embodiments and / or settings discussed.

[0027] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" in this article describes another type of association object relationship, indicating that there can be two relationships. For example, A / and B can mean: A exists alone, and A and B exist alone. In addition, the character " / " in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0028] The term "at least one" in this article is merely a description of the association relationship of associated objects, indicating that there may be three relationships. For example, at least one of A and B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0029] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusions.

[0030] Example 1: Please refer to Figure 5 This embodiment mainly introduces a system for rapid vulnerability detection based on traffic flow, including: Fingerprint rule collection module, fingerprint rule library, CPE dictionary collection module, CPE dictionary library, known vulnerability collection module, known vulnerability library, asset identification module, traffic filtering module, asset library, vulnerability matching module, vulnerability detection report management module; The fingerprint rule collection module is used to collect fingerprint rule data and upload it to the fingerprint rule library; The CPE dictionary collection module is used to collect CPE dictionary data and upload it to the CPE dictionary library; The known vulnerability collection module is used to collect CVE vulnerability data and upload it to the known vulnerability library, namely the CVE vulnerability database; The traffic filtering module is used to collect and filter traffic, and transmit the filtered traffic to the asset identification module; the asset identification module calls the data in the fingerprint rule library and the CPE dictionary library to match the filtered traffic, and obtains the corresponding asset CPE ID, port, manufacturer, product, and version information, and then the asset identification module writes the above asset CPE ID, port, manufacturer, product, and version information into the asset library, and then the asset identification module transmits the obtained CPE ID to the vulnerability matching module; The vulnerability matching module queries the corresponding vulnerability according to the CPE ID obtained by the asset identification module, classifies the vulnerability level, and transmits the obtained vulnerability level to the vulnerability detection report management module, and the vulnerability detection report management module generates a detection report according to the vulnerability level.

[0031] Example 2: Based on Example 1, please refer to Figure 1 This embodiment mainly introduces a specific design of a method for rapid vulnerability detection based on traffic flow, including the following steps: Step S1, collecting fingerprint rule data, CPE dictionary data, and CVE vulnerability data; The fingerprint rule data is used to identify the category of assets. For the collection method of fingerprint rules, please refer to Figure 2 ,include: Step S111, collecting fingerprint rules for identifying asset data, and dividing the collected fingerprint rules into three categories, including operating system OS, service Service and application Http; Step S112: extract relevant fields from the fingerprint rule, including name, type, feature description, and version information; like: There is a fingerprint rule whose text record is as follows: plaintext Name: Web server identification; Type: HTTP service; Feature description: Identify the type of Web server through HTTP header; Version information: v1.2.3.

[0032] Python code example for extracting fields You can use regular expressions to extract each field: Python Import # Assume fingerprint rule content fingerprint_rule = """ Name: Web Server Identification Type: HTTP service Feature description: Identify the web server type through HTTP header Version information: v1.2.3 """ # Define regular expression pattern name_pattern = r"name:\s*(.*)" type_pattern = r"Type:\s*(.*)" description_pattern = r"Feature description:\s*(.*)" version_pattern = r"Version information:\s*(.*)" # Extract fields name = re.search(name_pattern, fingerprint_rule).group(1) type_ = re.search(type_pattern, fingerprint_rule).group(1) description = re.search(description_pattern, fingerprint_rule).group(1) version = re.search(version_pattern, fingerprint_rule).group(1) # Output the extracted content print(f"Name: {name}")print(f"Type: {type_}")print(f"Feature description: {description}")print(f"Version information: {version}") Output After running the above code, you will get the following output: plaintext Name: Web Server Identification Type: HTTP service Feature description: Identify the web server type through HTTP header Version information: v1.2.3 Among them, name_pattern, type_pattern, description_pattern and version_pattern are regular expressions used to match each field; re.search(...).group(1) is used to extract the first capture group content of the matching result; This method can automatically extract specific fields in the fingerprint rule text, which is suitable for batch processing of rule sets.

[0033] Step S113: Create corresponding tables or sets according to the three types of fingerprint rules collected, and build respective tables according to the extracted fields; wherein the OS table includes ID, name, version, feature description, etc.; the Service table: fields include ID, service name, version, protocol type, etc.; the HTTP application table: fields include ID, application name, feature description, URL mode, etc.; Step S114, importing the fingerprint rules parsed in step S113 into the fingerprint rule database; Step S115: Write a script or a scheduled task to regularly fetch new fingerprint rules from public channels and update the new fingerprint rules to the fingerprint rule database.

[0034] Please refer to Figure 3 The CPE dictionary data provides a basis for asset identification. The collection of CPE dictionary data includes: Step S121, collecting and acquiring a CPE dictionary data set of known assets from public channels; Step S122: extract fields from each CPE dictionary data, including CPE ID, Port, manufacturer, product, and version information; like: There is a CPE data as follows: plaintext CPE name: cpe:2.3:a:example:example_app:1.0:*:*:*:*:*:*:* Type: Application Publisher: Example Inc. Product Name: Example App Version information: 1.0 Update date: 2023-10-01 Description: This is a sample application to demonstrate the extraction of CPE data.

[0035] Python code example for extracting fields: The following is the Python code to extract each field: Python import re # Assume CPE data content cpe_data = """ CPE name: cpe:2.3:a:example:example_app:1.0:*:*:*:*:*:*:* Type: Application Publisher: Example Inc. Product Name: Example App Version information: 1.0 Update date: 2023-10-01 Description: This is a sample application to demonstrate the extraction of CPE data.

[0036] """ # Define regular expression pattern cpe_name_pattern = r"CPE name:\s*(.*)" type_pattern = r"Type:\s*(.*)" vendor_pattern = r"Publisher:\s*(.*)" product_name_pattern = r"Product Name:\s*(.*)" version_pattern = r"Version information:\s*(.*)" release_date_pattern = r"Update date:\s*(.*)" description_pattern = r"Description:\s*(.*)" # Extract fields cpe_name = re.search(cpe_name_pattern, cpe_data).group(1) type_ = re.search(type_pattern, cpe_data).group(1) vendor = re.search(vendor_pattern, cpe_data).group(1) product_name = re.search(product_name_pattern, cpe_data).group(1) version = re.search(version_pattern, cpe_data).group(1) release_date = re.search(release_date_pattern, cpe_data).group(1) description = re.search(description_pattern, cpe_data).group(1) # Output the extracted contentprint(f"CPE name: {cpe_name}")print(f"Type: {type_}")print(f"Publisher: {vendor}")print(f"Product name: {product_name}")print(f"Version information: {version}")print(f"Update date: {release_date}")print(f"Description: {description}") Output After running the above code, you will get the following output: plaintext CPE name: cpe:2.3:a:example:example_app:1.0:*:*:*:*:*:*:* Type: Application Publisher: Example Inc. Product Name: Example App Version information: 1.0 Update date: 2023-10-01 Description: This is a sample application to demonstrate the extraction of CPE data.

[0037] Each field has a corresponding regular expression that is used to match the content in the data.

[0038] re.search(...).group(1) is used to extract the first captured group content of the matching result.

[0039] This method can effectively extract the required fields from the CPE data text and is suitable for processing multiple CPE data entries.

[0040] Step S123, selecting a MySQL database to store the CPE dictionary data, and using an ETL tool to import the CPE dictionary data extracted in step S122 into the CPE dictionary database; Step S124: Set a scheduled task to regularly fetch the latest CPE dictionary data from public channels and update it to the CPE dictionary database.

[0041] Please refer to Figure 4 , the collection of CVE vulnerability data includes: Step S131, collecting known CVE vulnerability data from mainstream vulnerability platforms; Step S132: extract corresponding fields from the collected CVE vulnerability data, including CVE ID, CPE list, etc.; like: There is a vulnerability data as follows: plaintext CVE ID: CVE-2023-12345 Description: This is a serious vulnerability that affects multiple products.

[0042] CPE List: - cpe:2.3:a:example:example_app:1.0:*:*:*:*:*:*:* - cpe:2.3:a:example:example_app:2.0:*:*:*:*:*:*:* - cpe:2.3:o:example:example_os:1.0:*:*:*:*:*:*:* Update date: 2023-10-01 Python code example for extracting fields Here is the Python code to extract the CVE ID and CPE list: Python import re # Assume the vulnerability data content vulnerability_data = """ CVE ID: CVE-2023-12345 Description: This is a serious vulnerability that affects multiple products.

[0043] CPE List: - cpe:2.3:a:example:example_app:1.0:*:*:*:*:*:*:* - cpe:2.3:a:example:example_app:2.0:*:*:*:*:*:*:* - cpe:2.3:o:example:example_os:1.0:*:*:*:*:*:*:* Update date: 2023-10-01 """ # Define regular expression pattern cve_id_pattern = r"CVE ID:\s*(CVE-\d{4}-\d+)" cpe_list_pattern = r"CPE list:\n((?:- .*\n?)+)" # Extract fields cve_id = re.search(cve_id_pattern, vulnerability_data).group(1) cpe_list_raw = re.search(cpe_list_pattern, vulnerability_data).group(1) # Process CPE list cpe_list = [line.strip().lstrip('- ') for line in cpe_list_raw.strip().split('\n')] # Output the extracted content print(f"CVE ID: {cve_id}")print("CPE list:")for cpe incpe_list: print(f" - {cpe}") Output After running the above code, you will get the following output: plaintext CVE ID: CVE-2023-12345 CPE List: - cpe:2.3:a:example:example_app:1.0:*:*:*:*:*:*:* - cpe:2.3:a:example:example_app:2.0:*:*:*:*:*:*:* - cpe:2.3:o:example:example_os:1.0:*:*:*:*:*:*:* Among them, cve_id_pattern is used to match CVE IDs to ensure the correct format. cpe_list_pattern is used to match the CPE list, using non-capturing groups and multi-line matching to extract all CPE entries. The extracted CPE list is processed to remove the leading characters (such as -) of each line.

[0044] This method can effectively extract CVE ID and CPE list from vulnerability data and is suitable for processing multiple vulnerability data entries.

[0045] Step S133, selecting a MySQL database to store the parsed CVE vulnerability data; Step S134: Set a scheduled task to regularly obtain the latest CVE vulnerability data and update it to the CVE vulnerability database.

[0046] Step S2: Use a switch to collect and filter traffic to obtain traffic data; specifically including: Step S21, configure the switch to perform port mirroring, copy the traffic of the port to be monitored to a specific monitoring port through the mirroring configuration command of the switch, save the configuration and ensure that the mirroring session runs successfully; Step S22, connect to the target port of the mirror, start capturing traffic through a packet capture tool, and collect traffic data; Step S23: List all IP addresses used in the IDC computer room or determine their subnets, and determine the IP address range of the IDC computer room; Step S24, filtering the collected traffic data; Furthermore, use command line tools, such as tcpdump, to filter traffic within a specific IP range through tcpdump -r output.pcap -wfiltered_output.pcap host 192.168.1.0 / 24, where -routput.pcap means reading the file and -w filtered_output.pcap means writing the filtered results to a new file; use Wireshark, by applying a filter, enter a filter expression in the display filter, such as: ip.src ==192.168.1.0 / 24, and the displayed data packets will be automatically updated; export the above filtered traffic data Step S3: Use the fingerprint rule data and the CPE dictionary data to perform asset identification on the traffic data to obtain the corresponding CPE ID; specifically including: The traffic data filtered in step S2 is matched with the fingerprint rule database and the CPE dictionary database to obtain the corresponding asset CPE ID, Port, manufacturer, product, and version information; then the CPE dictionary database is searched to obtain the corresponding CPE ID, and the CPE ID, Port, manufacturer, product, and version information are written into the asset library.

[0047] For the above filtered traffic, fingerprint rule matching is performed: Take mysql as an example: Assume that the traffic data is: "[\x00\x00\x00 8.0.0-0ubuntu0.22.04\x00" The fingerprint rule is: "match mysql m|^[\x00\x00\x00\0a](8\.[0-9]+\.[0-9]+)\0|sProduct / mysql / Version / $1 / Vnedor: / oracle / " By matching the traffic data with the fingerprint rules, we can extract that the manufacturer is "oracle", the product is "mysql", and the version is "8.0.0" Comparing the above asset information with the CPE dictionary, we can get the CPE ID: cpe:2.3:a:oracle:mysql_cluster:8.0.0:*:*:*:*:*:*:*.

[0048] Step S4: query the corresponding vulnerability according to the CPE ID obtained in step S3, and classify the vulnerability level; specifically including: Step S41: According to the asset CPE ID obtained in step S3, by traversing the CVE vulnerability database, query and obtain a list of all associated vulnerabilities: Step S42, traverse and query the detailed information of each CVE vulnerability; Step S43: Classify each CVE vulnerability by CVSS score and calculate the vulnerability level.

[0049] 1. If the relevant field of CVE detailed information lists a score, take that score 2. If the score is not listed in the relevant fields of CVE details, the score is calculated by the CVSS calculator based on the various attributes of the vulnerability (attack vector, attack complexity, user interaction, impact, etc.) like: Fill in the following basic information based on the nature of the vulnerability: Attack Vector (AV): Network (N): The attacker launches the attack through the network.

[0050] Adjacency (A): The attacker needs to be in the same network.

[0051] Local (L): The attacker needs physical access to the device.

[0052] Attack Complexity (AC): Low (L): The attacker does not need specific conditions to perform the attack.

[0053] High (H): The attacker needs certain conditions to successfully attack.

[0054] User Interaction (UI): Not Required (N): The attack does not require user participation.

[0055] Required (R): The attack requires user participation.

[0056] Confidentiality impact (C), integrity impact (I), availability impact (A): None (N): No effect.

[0057] Low (L): Partial impact.

[0058] High (H): Full impact.

[0059] Enter additional information (optional) Scope (S): If the vulnerability affects multiple systems, you can set it to Changed (C), otherwise select Unchanged (U).

[0060] Dependency (E): Select the degree of dependency influence, usually divided into none (N) and yes (Y).

[0061] Calculating the score After filling in all the necessary information, click the "Calculate" button and the calculator will generate a CVSS score and corresponding grade.

[0062] Example Suppose you are calculating the CVSS score of a vulnerability and fill in the following: Attack Vector (AV): Network (N) Attack Complexity (AC): Low (L) User interaction (UI): Not required (N) Confidentiality impact (C): High (H) Integrity impact (I): Medium (M) Availability impact (A): Low (L) After filling in this information, click the Calculate button and the calculator will give the corresponding CVSS score.

[0063] Furthermore, in step S43, the vulnerability level is defined as: Low level: CVSS score: 0.0 - 3.9; Medium: CVSS score: 4.0 - 6.9; High level: CVSS score: 7.0 - 8.9; Severity Rating: CVSS score: 9.0 - 10.0.

[0064] Further, in step S5, a vulnerability detection report may be generated according to the vulnerability level as required, such as: # Vulnerability Detection Report ## 1. Overview - **Generation Date**: 2024-10-22 - **Detection tool**: Nessus - **Detection range**: cpe:2.3:a:example:software:1.0:*:*:*:*:*:*:*:* ## 2. CPE Information - **CPE-ID**: cpe:2.3:a:example:software:1.0:*:*:*:*:*:*:* ## 3. CVE Information - **CVE-ID**: CVE-2024-1234 - **Description**: A remote code execution vulnerability exists in Example software 1.0.

[0065] - **Release Date**: 2024-10-01 - **Affected versions**: 1.0 ## 4. CVSS Information - **CVSS score**: 8.5 - **Evaluation Criteria**: Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), User Interaction: Not Required (UI:N), Impact on Confidentiality: High (C:H), Impact on Integrity: High (I:H), Impact on Availability: High (A:H) - **Vulnerability Level**: High ## 5. Vulnerability Impact Analysis - **Impact Level**: This vulnerability allows an attacker to remotely execute code, potentially leading to complete control of the system.

[0066] - **Repair suggestion**: Please upgrade to software version 1.1 or higher, download link: [Download address] ## 6. Conclusion - **Summary**: Based on the assessment, it is recommended to fix the vulnerability as soon as possible to reduce potential risks.

[0067] The above description is only the preferred embodiment of the present invention, which does not limit the protection scope of the present invention. For those skilled in the art, the present invention can be modified and varied in various ways. Within the spirit and principle of the present invention, any change, modification, replacement, integration and parameter change of these embodiments by conventional substitution or capable of achieving the same function without departing from the principle and spirit of the present invention shall fall within the protection scope of the present invention.

Claims

1. A system for rapid vulnerability detection based on traffic, characterized in that: include: Fingerprint rule collection module, fingerprint rule library, CPE dictionary collection module, CPE dictionary library, known vulnerability collection module, known vulnerability library, asset identification module, traffic filtering module, asset library, vulnerability matching module, vulnerability detection report management module; The fingerprint rule collection module is used to collect fingerprint rule data and upload it to the fingerprint rule library; The CPE dictionary collection module is used to collect CPE dictionary data and upload it to the CPE dictionary library; The known vulnerability collection module is used to collect CVE vulnerability data and upload it to the known vulnerability library, namely the CVE vulnerability database; The traffic filtering module is used to collect and filter traffic, and transmit the filtered traffic to the asset identification module; The asset identification module calls the data in the fingerprint rule library and the CPE dictionary library to match the filtered traffic, and obtains the corresponding asset CPE ID, port, manufacturer, product, and version information. Then the asset identification module writes the above asset CPE ID, port, manufacturer, product, and version information into the asset library, and then the asset identification module transmits the obtained CPE ID to the vulnerability matching module; The vulnerability matching module queries the corresponding vulnerability according to the CPE ID obtained by the asset identification module, classifies the vulnerability level, and transmits the obtained vulnerability level to the vulnerability detection report management module, and the vulnerability detection report management module generates a detection report according to the vulnerability level.

2. A method for rapid vulnerability detection based on traffic, characterized in that: The following steps are involved: Step S1, collecting fingerprint rule data, CPE dictionary data, and CVE vulnerability data; Step S2: Use a switch to collect and filter traffic to obtain traffic data; Step S3: Use the fingerprint rule data and the CPE dictionary data to perform asset identification on the traffic data and obtain the corresponding CPEID; Step S4: query the corresponding vulnerability according to the CPE ID obtained in step S3, and classify the vulnerability level; Step S5: Generate a vulnerability detection report according to the vulnerability level.

3. According to claim 2, a method for rapid vulnerability detection based on traffic flow is characterized in that: In step S1, the method for collecting fingerprint rule data includes: Step S111, collecting fingerprint rules for identifying asset data, and dividing the collected fingerprint rules into three categories, including operating system OS, service Service and application Http; Step S112, extracting relevant fields from the fingerprint rule; Step S113: Create corresponding tables or sets according to the three types of fingerprint rules collected, and construct respective tables according to the extracted fields; Step S114, importing the fingerprint rules parsed in step S113 into the fingerprint rule database; Step S115: Write a script or a scheduled task to regularly fetch new fingerprint rules from public channels and update the new fingerprint rules to the fingerprint rule database.

4. A method for rapid vulnerability detection based on traffic according to any one of claims 2 or 3, characterized in that: In step S1, the collection of the CPE dictionary data includes: Step S121, collecting and acquiring a CPE dictionary data set of known assets from public channels; Step S122: extract fields from each CPE dictionary data, including CPE ID, Port, manufacturer, product, and version information; Step S123, selecting a MySQL database to store the CPE dictionary data, and using an ETL tool to import the CPE dictionary data extracted in step S122 into the CPE dictionary database; Step S124: Set a scheduled task to regularly fetch the latest CPE dictionary data from public channels and update it to the CPE dictionary database.

5. A method for rapid vulnerability detection based on traffic according to any one of claims 2 or 3, characterized in that: In step S1, the collection of CVE vulnerability data includes: Step S131, collecting known CVE vulnerability data from mainstream vulnerability platforms; Step S132: extract corresponding fields from the collected CVE vulnerability data; Step S133, selecting a MySQL database to store the parsed CVE vulnerability data; Step S134: Set a scheduled task to regularly obtain the latest CVE vulnerability data and update it to the CVE vulnerability database.

6. A method for rapid vulnerability detection based on traffic according to claim 5, characterized in that: The step S2 specifically includes: Step S21, configure the switch to perform port mirroring, copy the traffic of the port to be monitored to a specific monitoring port through the mirroring configuration command of the switch, save the configuration and ensure that the mirroring session runs successfully; Step S22, connect to the target port of the mirror, start capturing traffic through a packet capture tool, and collect traffic data; Step S23: List all IP addresses used in the IDC computer room or determine their subnets, and determine the IP address range of the IDC computer room; Step S24: Filter the collected traffic data.

7. The method for rapid vulnerability detection based on traffic flow according to claim 6 is characterized in that: The step S3 specifically includes: Match the traffic data filtered in step S2 with the fingerprint rule database and the CPE dictionary database to obtain the corresponding asset CPE ID, port, manufacturer, product, and version information; And write the above asset CPE ID, Port, manufacturer, product, and version into the asset library.

8. The method for rapid vulnerability detection based on traffic flow according to claim 7 is characterized in that: The step S4 specifically includes: Step S41: According to the asset CPE ID obtained in step S3, by traversing the CVE vulnerability database, query and obtain a list of all associated vulnerabilities: Step S42, traverse and query the detailed information of each CVE vulnerability; Step S43: Classify each CVE vulnerability by CVSS score and calculate the vulnerability level.

9. The method for rapid vulnerability detection based on traffic flow according to claim 8 is characterized in that: In step S43, the vulnerability level is defined as: Low level: CVSS score: 0.0 - 3.9; Medium: CVSS score: 4.0 - 6.9; High level: CVSS score: 7.0 - 8.9; Severity Rating: CVSS score: 9.0 - 10.

0.

10. The method for rapid vulnerability detection based on traffic flow according to claim 8, characterized in that: In step S43, the CVSS score of the vulnerability is calculated as follows: If a score is listed in the relevant field of the CVE detailed information, that score is used; If the relevant fields of the CVE details do not list the scores, the CVSS calculator is used to calculate the scores based on the various attributes of the vulnerability.

Images