Network security vulnerability detection method and computer equipment

Abstract

The embodiments of the present application relate to the field of vulnerability detection, and specifically to a network security vulnerability detection method and computer equipment. A specific implementation of the method includes: a data acquisition subsystem collects an initial web page information set corresponding to a web page identifier; a data monitoring subsystem performs data cleaning processing on each initial web page information in the initial web page information set; the data monitoring subsystem performs vulnerability detection processing on the web page cleaning information set to generate a vulnerability detection result set; the data monitoring subsystem performs fusion processing on the initial web page information set and the vulnerability detection result set to generate a vulnerability detection information set; the data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem; the data alarm subsystem performs alarm processing on the vulnerability detection information. This implementation improves the security of network services.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of vulnerability detection, and specifically to a network security vulnerability detection method and computer equipment. Background Art

[0002] As the broadcasting and television industry has moved towards the Internet era in recent years, websites have become the main battlefield for publicity. Website tampering security incidents have a huge impact, and incidents closely related to the interests of netizens, such as user information leakage, have attracted widespread public attention to network security. At present, when conducting network security vulnerability detection, the usual method is to use pre-set firewalls and rule libraries to perform vulnerability detection on web page information.

[0003] However, in practice, it is found that when the above method is used to detect network security vulnerabilities, the following technical problems often occur:

[0004] The pre-set rule base needs to be updated regularly. Before the rule base is updated, it is difficult to detect newly generated vulnerabilities in time, resulting in low accuracy of vulnerability detection information generated by vulnerability detection, making it difficult to issue warnings for web page information with vulnerabilities in time, resulting in reduced security of network services. Summary of the invention

[0005] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0006] Some embodiments of the present application propose a network security vulnerability detection method, a computer device, and a computer-readable storage medium to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In a first aspect, some embodiments of the present application provide a network security vulnerability detection method, which is applied to a network security vulnerability detection system, wherein the network security vulnerability detection system comprises: a data acquisition subsystem, a data monitoring subsystem, and a data alarm subsystem, wherein the method comprises: the data acquisition subsystem, in response to receiving a web page identifier sent by a management terminal, collects an initial web page information set corresponding to the web page identifier, and sends the initial web page information set to the data monitoring subsystem; the data monitoring subsystem, in response to receiving the initial web page information set sent by the data acquisition subsystem, performs data cleaning processing on each initial web page information in the initial web page information set to generate a web page cleansing subsystem. The data monitoring subsystem performs vulnerability detection processing on the web page cleaning information set to generate a vulnerability detection result set; the data monitoring subsystem performs fusion processing on the initial web page information set and the vulnerability detection result set to generate a vulnerability detection information set, and sends the vulnerability detection information set to the data alarm subsystem; the data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem; the data alarm subsystem performs alarm processing on the vulnerability detection information in response to determining that the vulnerability detection information in the vulnerability detection information set meets the preset abnormal condition.

[0008] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0009] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0010] The above-mentioned embodiments of the present application have the following beneficial effects: through the network security vulnerability detection method of some embodiments of the present application, the security of network services can be improved. Specifically, the reason for the reduction of the security of network services is that the pre-set rule base needs to be updated regularly. Before the rule base is updated, it is difficult to detect the newly generated vulnerabilities in time, which leads to the low accuracy of the vulnerability detection information generated by the vulnerability detection, and it is difficult to warn the web page information with vulnerabilities in time. Based on this, the network security vulnerability detection method of some embodiments of the present application, first, the above-mentioned data acquisition subsystem responds to the web page identification sent by the management terminal, collects the initial web page information set corresponding to the above-mentioned web page identification, and sends the above-mentioned initial web page information set to the above-mentioned data monitoring subsystem. Thus, the initial web page information set of each level corresponding to the web page identification can be collected. Secondly, the above-mentioned data monitoring subsystem responds to the initial web page information set sent by the above-mentioned data acquisition subsystem, performs data cleaning processing on each initial web page information in the above-mentioned initial web page information set to generate web page cleaning information and obtain a web page cleaning information set. Thus, the web page cleaning information set after data cleaning can be obtained. Then, the above-mentioned data monitoring subsystem performs vulnerability detection processing on the above-mentioned web page cleaning information set to generate a vulnerability detection result set. Thus, the web page cleaning information set can be subjected to vulnerability detection processing by the vulnerability scanning model so as to obtain a relatively accurate vulnerability detection result set. Then, the data monitoring subsystem performs a fusion processing on the initial web page information set and the vulnerability detection result set to generate a vulnerability detection information set, and sends the vulnerability detection information set to the data alarm subsystem. Thus, a relatively accurate vulnerability detection information set can be obtained so as to subsequently perform an alarm processing on the vulnerability detection information with abnormalities. Afterwards, the data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem. Thus, the vulnerability detection information can be stored in the database so as to view the vulnerability detection information at any time in the future. Finally, the data alarm subsystem performs an alarm processing on the vulnerability detection information in response to determining that the vulnerability detection information in the vulnerability detection information set meets the preset abnormal condition. Thus, an alarm processing can be performed on the vulnerability detection information with vulnerabilities. Therefore, by using the vulnerability scanning model instead of using the pre-set rule base to perform vulnerability detection processing on the web page information, a relatively accurate vulnerability detection information can be obtained so as to promptly alarm the web page information with vulnerabilities. Thereby, the security of network services can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0012] Figure 1 is a flow chart of some embodiments of the network security vulnerability detection method according to the present application;

[0013] Figure 2 It is a schematic diagram of the structure of a computer device suitable for implementing some embodiments of the present application. DETAILED DESCRIPTION

[0014] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0015] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0016] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0017] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0018] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0019] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0020] Figure 1The flow chart 100 of some embodiments of the network security vulnerability detection method according to the present application is shown. The network security vulnerability detection method is applied to a network security vulnerability detection system, and the network security vulnerability detection system includes: a data acquisition subsystem, a data monitoring subsystem, and a data alarm subsystem, including the following steps:

[0021] Step 101 : In response to receiving a web page identifier sent by a management terminal, the data collection subsystem collects an initial web page information set corresponding to the web page identifier, and sends the initial web page information set to the data monitoring subsystem.

[0022] In some embodiments, the data acquisition subsystem, in response to receiving a web page identifier sent by a management terminal, collects an initial web page information set corresponding to the web page identifier, and sends the initial web page information set to the data monitoring subsystem. Among them, the web page identifier can uniquely identify a web page. Here, the web page can be a web page to be tested for vulnerabilities. The initial web page information in the initial web page information set can be web page information that represents the content of the web page (for example, the web page information can be: broadcast information including broadcast content, including user privacy information such as user name, mobile phone number, address, etc.). The management terminal can be a terminal that wants to perform vulnerability detection on the web page. The data acquisition subsystem can be a system for collecting the initial web page information set. The data monitoring subsystem can be a central processor that performs vulnerability detection on the initial web page information set. The data alarm subsystem can be a system that alarms web pages with vulnerabilities.

[0023] In practice, in response to receiving the web page identifier sent by the management terminal, the data collection subsystem may collect the initial web page information set corresponding to the web page identifier through the following steps:

[0024] The first step is to collect the first web page information and the collection timestamp corresponding to the above web page identifier. Among them, the above first web page information may include: a lower-level web page identifier. In practice, the above data collection subsystem may collect the first web page information and the collection timestamp corresponding to the above web page identifier from the terminal device through a wired connection or a wireless connection. Here, the first web page information may be the web page information of the content of the web page represented by the web page identifier. The collection timestamp may represent the time when the first web page information is collected. The lower-level web page identifier may uniquely identify a web page. Here, the web page represented by the lower-level web page identifier may be the next-level web page of the web page represented by the web page identifier.

[0025] It should be noted that the above wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0026] The second step is to determine the target web page information set. The target web page information set may be empty initially. In practice, the data collection subsystem may determine a preset information set as the target web page information set. For example, the preset information set may be an empty set.

[0027] Step 3: For the first web page information and the target web page information set, perform the following collection sub-steps:

[0028] The first sub-step is to add the first web page information to the target web page information set.

[0029] The second sub-step is, in response to determining that the subordinate web page identifier included in the first web page information is empty, determining the target web page information set as the initial web page information set.

[0030] The fourth step is to update the initial web page information set based on the acquisition timestamp.

[0031] Optionally, the above method further includes:

[0032] The first step is to collect the second web page information corresponding to the subordinate web page identifier included in the first web page information in response to determining that the subordinate web page identifier included in the first web page information is not empty, wherein the second web page information includes: the subordinate web page identifier. In practice, the above-mentioned data collection subsystem can collect the second web page information corresponding to the subordinate web page identifier included in the first web page information from the terminal device through a wired connection or a wireless connection. The second web page information can be the web page information of the content of the web page represented by the subordinate web page identifier included in the first web page information. Here, the second web page information can be the web page information of the next-level web page of the web page represented by the first web page information.

[0033] The second step is to add the second web page information to the target web page information set to update the target web page information set.

[0034] The third step is to determine the updated target web page information set as the target web page information set, and determine the second web page information as the first web page information, so as to perform the above collection step again.

[0035] In practice, the data collection subsystem can update the initial web page information set based on the collection timestamp through the following steps:

[0036] The first step is to obtain the current timestamp. In practice, the data acquisition subsystem can obtain the timestamp representing the current time from the terminal device through a wired connection or a wireless connection as the current timestamp.

[0037] In the second step, in response to determining that the current timestamp and the acquisition timestamp satisfy the preset time interval condition, the web page update information set corresponding to the web page identifier is collected. The preset time interval condition may be: the difference between the current timestamp and the acquisition timestamp is greater than a preset duration. For example, the preset duration may be seven days. In practice, the specific implementation method of collecting the web page update information set corresponding to the web page identifier and the technical effects thereof may refer to step 101 in the above embodiment, which will not be described in detail here.

[0038] The third step is to update the initial web page information set based on the web page update information set. In practice, the data collection subsystem may update the initial web page information set to the web page update information set to update the initial web page information set.

[0039] Step 102 , in response to receiving the initial web page information set sent by the data acquisition subsystem, the data monitoring subsystem performs data cleaning processing on each initial web page information in the initial web page information set to generate web page cleaning information and obtain a web page cleaning information set.

[0040] In some embodiments, in response to receiving the initial web page information set sent by the data acquisition subsystem, the data monitoring subsystem performs data cleaning processing on each initial web page information in the initial web page information set to generate web page cleaning information and obtain the web page cleaning information set. In practice, in response to receiving the initial web page information set sent by the data acquisition subsystem, first, for each initial web page information in the initial web page information set, the data monitoring subsystem may remove the information representing the null in the initial web page information to perform data cleaning processing on the initial web page information and obtain the web page cleaning information. Then, the data acquisition subsystem may determine the obtained individual web page cleaning information as the web page cleaning information set.

[0041] Step 103: the data monitoring subsystem performs vulnerability detection processing on the web page cleaning information set to generate a vulnerability detection result set.

[0042] In some embodiments, the data monitoring subsystem performs vulnerability detection processing on the web page cleaning information set to generate a vulnerability detection result set. The web page cleaning information in the web page cleaning information set may include, but is not limited to: a superior web page identifier, a subordinate web page identifier, and a key identifier. The superior web page identifier can uniquely identify a web page. Here, the web page represented by the superior web page identifier can be the superior web page of the web page represented by the web page cleaning information. The key identifier can be: a first preset key identifier or a second preset key identifier. Here, the first preset key identifier can represent the web page represented by the web page cleaning information that the management terminal pays attention to. The second preset key identifier can represent the web page represented by the web page cleaning information that the management terminal does not pay attention to.

[0043] In practice, the data monitoring subsystem may perform vulnerability detection processing on the web page cleaning information set through the following steps to generate a vulnerability detection result set:

[0044] The first step is to send the preset vulnerability scan type information to the management terminal so as to receive the target vulnerability scan type sent by the management terminal. The preset vulnerability scan type information may include: a first vulnerability scan type and a second vulnerability scan type. The first vulnerability scan type may represent the information of "quick scan". The second vulnerability scan type may represent the information of "full site scan". Here, in response to receiving the preset vulnerability scan type information sent by the data monitoring subsystem, the management terminal selects the first vulnerability scan type or the second vulnerability scan type as the target vulnerability scan type, and sends the target vulnerability scan type to the data monitoring subsystem.

[0045] In the second step, in response to determining that the target vulnerability scan type meets the preset quick scan condition, the following quick scan steps are performed:

[0046] In the first quick scanning step, the web page cleaning information set is screened to generate a web page key information set. The preset quick scanning condition may be: the target vulnerability scanning type is the first vulnerability scanning type. In practice, the data detection subsystem may determine each web page cleaning information in the web page cleaning information set that meets the preset screening condition as the web page key information set. The preset screening condition may be: the parent web page identifier included in the web page cleaning information is not empty, or the key identifier included in the web page cleaning information is the first preset key identifier.

[0047] The second quick scanning step is to execute the following first scanning sub-step for each key information of the web page in the key information set:

[0048] In the first sub-step, the above web page key information is input into a pre-trained vulnerability scanning model to generate a first vulnerability scanning result. The first vulnerability scanning result can characterize whether the web page corresponding to the web page key information has a vulnerability (for example, the vulnerability can be but is not limited to: obtaining user privacy information without the consent of the management terminal, SQL (Structured Query Language) injection, link injection, etc.). The pre-trained vulnerability scanning model can be a pre-trained neural network model that takes the web page key information as input and the first vulnerability scanning result as output.

[0049] In a second sub-step, in response to determining that the first vulnerability scan result satisfies a first preset vulnerability condition, the first preset vulnerability result is determined as a vulnerability detection result. The first preset vulnerability condition may be: the first vulnerability scan result indicates that a webpage corresponding to the key information of the webpage has a vulnerability. For example, the first preset vulnerability result may be information indicating that "the current webpage has a vulnerability".

[0050] In the third sub-step, in response to determining that the first vulnerability scanning result does not meet the first preset vulnerability condition, a second preset vulnerability result is determined as the vulnerability detection result. For example, the second preset vulnerability result may be information indicating that "there is no vulnerability in the current page".

[0051] In the third quick scanning step, the determined vulnerability detection results are determined as a vulnerability detection result set.

[0052] In the third step, in response to determining that the target vulnerability scan type meets the preset full-site scan condition, the following full-site scan steps are performed:

[0053] The first full-site scanning step is to perform the following second scanning sub-step for each web page cleaning information in the web page cleaning information set:

[0054] In a first sub-step, the web page cleaning information is input into a pre-trained vulnerability scanning model to obtain a second vulnerability scanning result. The preset full-site scanning condition may be that the target vulnerability scanning type is a second vulnerability scanning type. The second vulnerability scanning result may indicate whether the web page corresponding to the web page cleaning information has a vulnerability. The pre-trained vulnerability scanning model may be a pre-trained neural network model that takes the web page cleaning information as input and takes the second vulnerability scanning result as output.

[0055] In the second sub-step, in response to determining that the second vulnerability scanning result satisfies a second preset vulnerability condition, the first preset vulnerability result is determined as a vulnerability detection result. The second preset vulnerability condition may be: the second vulnerability scanning result indicates that the webpage corresponding to the webpage cleaning information has a vulnerability.

[0056] The third sub-step is, in response to determining that the second vulnerability scanning result does not satisfy the second preset vulnerability condition, determining the second preset vulnerability result as the vulnerability detection result.

[0057] In the second full-site scanning step, each determined vulnerability detection result is determined as a vulnerability detection result set.

[0058] Optionally, before inputting the webpage key information into a pre-trained vulnerability scanning model to generate a first vulnerability scanning result, the method further includes:

[0059] The first step is to obtain the training sample set.

[0060] In some embodiments, the data monitoring subsystem may obtain a training sample set from a terminal device via a wired connection or a wireless connection, wherein the training samples in the training sample set may include: sample web page information and sample vulnerability scanning results.

[0061] The second step is to determine the initial vulnerability scanning model.

[0062] In some embodiments, the data monitoring subsystem may determine an initial vulnerability scanning model, wherein the initial vulnerability scanning model may include: an initial extraction model, an initial classification model, and an initial scanning model.

[0063] The initial extraction model may be a neural network model that takes sample web page information as input and takes initial extraction information as output. For example, the initial extraction model may be a bag-of-words model, a TF-IDF (Term Frequency-Inverse Document Frequency, text feature extraction) model, or an LLM (Large Language Model, large language model).

[0064] The initial classification model may be a neural network model that takes the initial extracted information as input and takes the initial classification information group as output. For example, the initial classification model may be a decision tree model.

[0065] The initial scanning model can be a model that takes the initial classification information group as input and the initial vulnerability scanning results as output. The initial scanning model can include three layers:

[0066] The first layer, the input layer, is used to input the initial classified information group into the second layer.

[0067] The second layer, the processing layer, includes a first sub-model and a second sub-model. The first sub-model may be a model that takes an initial classification information group as input and a first scan result as output. The second sub-model may be a model that takes an initial classification information group as input and a second scan result as output. Here, the first scan result may be: a first preset vulnerability result or a second preset vulnerability result. The second scan result may be: a first preset vulnerability result or a second preset vulnerability result. For example, the first sub-model may be: a GAN (Generative Adversarial Networks) model. The second sub-model may be: a GDBT (Generative Adversarial Networks) model.

[0068] The third layer, the output layer, determines the first preset vulnerability result as the initial vulnerability scan result in response to determining that the first scan result and the second scan result meet the preset scan condition. In response to determining that the first scan result and the second scan result do not meet the preset scan condition, the second preset vulnerability result is determined as the initial vulnerability scan result. The preset scan condition may be: the first scan result is the first preset vulnerability result, or the second scan result is the first preset vulnerability result.

[0069] The third step is to select target training samples from the above training sample set.

[0070] In some embodiments, the data monitoring subsystem may select a target training sample from the training sample set. In practice, the data monitoring subsystem may randomly select a training sample from the training sample set as the target training sample.

[0071] The fourth step is to input the sample web page information included in the selected target training sample into the initial extraction model to obtain initial extraction information.

[0072] In some embodiments, the data monitoring subsystem may input the sample web page information included in the selected target training sample into the initial extraction model to obtain initial extraction information.

[0073] The fifth step is to input the initial extracted information into the initial classification model to generate an initial classification information group.

[0074] In some embodiments, the data monitoring subsystem may input the initial extracted information into an initial classification model to generate an initial classification information group.

[0075] In the sixth step, the initial classification information group is input into the initial scanning model to obtain the initial vulnerability scanning result.

[0076] In some embodiments, the data monitoring subsystem may input the initial classification information group into the initial scanning model to obtain initial vulnerability scanning results.

[0077] In the seventh step, based on a preset loss function, a difference value between the initial vulnerability scanning result and the sample vulnerability scanning result included in the selected target training sample is determined.

[0078] In some embodiments, the data monitoring subsystem may determine the difference between the initial vulnerability scan result and the sample vulnerability scan result included in the selected target training sample based on a preset loss function. For example, the preset loss function may be, but is not limited to: mean square error loss function (MSE), cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, log loss function, square loss function, exponential loss function, etc.

[0079] In step 8, in response to determining that the difference value is greater than or equal to the preset difference value, adjusting the network parameters of the initial vulnerability scanning model.

[0080] In some embodiments, the data monitoring subsystem may adjust the network parameters of the initial vulnerability scanning model in response to determining that the difference value is greater than or equal to the preset difference value. For example, the difference value and the preset difference value may be calculated. On this basis, the network parameters of the initial malicious code detection model are adjusted using methods such as back propagation and gradient descent. For example, the preset difference value may be 0.1.

[0081] Optionally, in response to determining that the difference value is less than the preset difference value, the initial vulnerability scanning model is determined as the trained vulnerability scanning model:

[0082] In some embodiments, the execution entity may determine the initial vulnerability scanning model as the trained vulnerability scanning model in response to determining that the difference value is less than the preset difference value.

[0083] Thus, firstly, by training the initial extraction model, relatively accurate feature information in the sample web page information can be extracted. Secondly, by training the initial classification model, the initial extraction information can be split to classify the initial extraction information according to different contents, so as to obtain the initial classification information group, so as to perform vulnerability scanning on the initial classification information of different contents later. After that, by training the initial scanning model including the first sub-model of the unsupervised learning model and the second sub-model of the supervised learning model, the initial vulnerability scanning result can be more accurately identified. Thus, by training the initial vulnerability scanning model including the initial extraction model, the initial classification model, and the initial scanning model, relatively accurate initial vulnerability scanning results can be identified, so as to subsequently issue an alarm for web page information with vulnerabilities. Thus, the security of network services can be improved.

[0084] Step 104: the data monitoring subsystem performs a fusion process on the initial web page information set and the vulnerability detection result set to generate a vulnerability detection information set, and sends the vulnerability detection information set to the data alarm subsystem.

[0085] In some embodiments, the data monitoring subsystem performs a fusion process on the initial web page information set and the vulnerability detection result set to generate a vulnerability detection information set, and sends the vulnerability detection information set to the data alarm subsystem. In practice, first, for each initial web page information in the initial web page information set, first, in response to determining that there is a vulnerability detection result corresponding to the initial web page information in the vulnerability detection result set, the data monitoring subsystem can determine the initial web page information and the vulnerability detection result corresponding to the initial web page information in the vulnerability detection result set as vulnerability detection information. Second, in response to determining that there is no vulnerability detection result corresponding to the initial web page information in the vulnerability detection result set, the initial web page information is determined as vulnerability detection information. Secondly, the data monitoring subsystem can determine each determined vulnerability detection information as a vulnerability detection information set. Then, the data monitoring subsystem can send the vulnerability detection information set to the data alarm subsystem.

[0086] Step 105: the data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem.

[0087] In some embodiments, the data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem. The data alarm subsystem includes: a data partitioning subsystem, a data backup subsystem sequence, and a data compression subsystem sequence. Here, the data partitioning subsystem may be a system for partitioning the vulnerability detection information set. The data backup subsystem in the data backup subsystem sequence may be a system for encrypting the vulnerability detection information. The data compression subsystem in the data compression subsystem sequence may be a system for compressing the vulnerability detection information.

[0088] In practice, in response to receiving the vulnerability detection information set sent by the data monitoring subsystem, the data alarm subsystem may store the vulnerability detection information set in a database through the following steps:

[0089] In the first step, the data partitioning subsystem, in response to receiving the vulnerability detection information set sent by the data monitoring subsystem, partitions the vulnerability detection information set to generate a vulnerability detection information group sequence. Among them, the vulnerability detection information group in the vulnerability detection information group sequence may correspond to the data backup subsystem in the data backup subsystem sequence. The data backup subsystem in the data backup subsystem sequence may correspond to the data compression subsystem in the data compression subsystem sequence. In practice, the data partitioning subsystem, in response to receiving the vulnerability detection information set sent by the data monitoring subsystem, partitions the vulnerability detection information set through a preset partitioning algorithm to generate a vulnerability detection information group sequence. For example, the preset partitioning algorithm may be: partitioning the vulnerability detection information set according to a preset length to generate a vulnerability detection information group sequence. Here, the vulnerability detection information groups in the vulnerability detection information group sequence are arranged from left to right according to the vulnerability detection information in the vulnerability detection information set. For example, the preset length may be 256.

[0090] In the second step, the data partitioning subsystem sends each vulnerability detection information group in the vulnerability detection information group sequence to the data backup subsystem corresponding to the vulnerability detection information group.

[0091] In the third step, the data backup subsystem in the data backup subsystem sequence executes the following encryption substeps in response to receiving the vulnerability detection information group sent by the data partitioning subsystem:

[0092] In the first sub-step, each vulnerability detection information in the vulnerability detection information group is encrypted to generate vulnerability encrypted detection information, and a vulnerability encrypted detection information group is obtained. In practice, the data backup subsystem can encrypt each vulnerability detection information in the vulnerability detection information group by a preset encryption algorithm to generate vulnerability encrypted detection information, and obtain a vulnerability encrypted detection information group. For example, the preset encryption algorithm can be, but is not limited to, a hash algorithm, a DES (Data Encryption Standard) algorithm, and an AES (Advanced Encryption Standard) algorithm.

[0093] The second sub-step is to send the above vulnerability encryption detection information group to the data compression subsystem corresponding to the above data backup subsystem.

[0094] In the fourth step, the data compression subsystem in the data compression subsystem sequence executes the following compression substeps in response to receiving the vulnerability encryption detection information group sent by the data backup subsystem corresponding to the data compression subsystem:

[0095] The first sub-step is to compress the vulnerability encryption detection information group to generate a vulnerability compression detection information group. In practice, the data compression subsystem can compress the vulnerability encryption detection information group using a preset compression algorithm to generate a vulnerability compression detection information group. For example, the preset compression algorithm can be, but is not limited to: a Huffman coding algorithm, a dictionary coding algorithm, and a conversion coding algorithm.

[0096] The second sub-step is to store the vulnerability compression detection information group in a database, which may be a cloud database.

[0097] Therefore, first, the vulnerability detection information set can be divided and processed so that the vulnerability detection information set can be backed up concurrently later. Secondly, each thread can be encrypted independently through the data backup subsystem sequence, which can improve the encryption efficiency and reduce the impact of the encryption process on the overall backup speed. Then, each thread can be compressed independently through the data compression subsystem sequence, which can make full use of system resources and improve the compression speed. Finally, the vulnerability compression detection information group can be written concurrently to the mounted cloud storage, which can improve the parallelism of storage operations and further speed up the backup speed. Therefore, the vulnerability detection information set can be backed up concurrently through the data backup subsystem sequence and the data compression subsystem sequence, which can improve the backup speed.

[0098] Step 106 : In response to determining that the vulnerability detection information in the vulnerability detection information set meets a preset abnormal condition, the data alarm subsystem performs alarm processing on the vulnerability detection information.

[0099] In some embodiments, the data alarm subsystem performs alarm processing on the vulnerability detection information in response to determining that the vulnerability detection information in the vulnerability detection information set meets a preset abnormal condition. The preset abnormal condition may be: the vulnerability detection result included in the vulnerability detection information represents a first preset vulnerability result. The alarm processing may be displaying warning text or controlling a speaker to emit a prompt sound.

[0100] Optionally, the above method further includes:

[0101] In the first step, the data acquisition subsystem responds to the early warning feedback information sent by the management terminal and sends the early warning feedback information to the data monitoring subsystem. Here, the early warning feedback information may correspond to the vulnerability detection information in the vulnerability detection information set. The early warning feedback information may be generated by the following steps: the management terminal responds to determining that the vulnerability detection information sent by the data monitoring subsystem received includes a vulnerability detection result that is a first preset vulnerability result, and updates the web page information corresponding to the vulnerability detection information to obtain the early warning feedback information. Thus, the management terminal can update the web page information where the vulnerability occurs to reduce the occurrence of vulnerabilities on the web page.

[0102] In the second step, the data monitoring subsystem, in response to receiving the early warning feedback information sent by the data acquisition subsystem, performs vulnerability detection processing on the vulnerability detection information in the vulnerability detection information set corresponding to the early warning feedback information based on the early warning feedback information to generate a target vulnerability detection result. In practice, first, in response to receiving the early warning feedback information sent by the data acquisition subsystem, the data monitoring subsystem may update the vulnerability detection information in the vulnerability detection information set corresponding to the early warning feedback information to the early warning feedback information to perform update processing on the vulnerability detection information to obtain the target vulnerability update information. Then, the data monitoring subsystem may perform vulnerability detection processing on the target vulnerability update information to generate a target vulnerability detection result. In practice, the specific implementation method of performing vulnerability detection processing on the target vulnerability update information and the technical effect brought about by it can refer to step 103 in the above embodiment, which will not be repeated here.

[0103] In the third step, the data monitoring subsystem updates the vulnerability detection information corresponding to the warning feedback information in the vulnerability detection information set based on the target vulnerability detection result to generate target vulnerability detection information. In practice, the execution subject may update the initial web page information included in the vulnerability detection information corresponding to the warning feedback information in the vulnerability detection information set to the warning feedback information, and update the vulnerability detection result included in the vulnerability detection information to the target vulnerability detection result, so as to update the vulnerability detection information and obtain the target vulnerability detection information.

[0104] In the fourth step, the data monitoring subsystem sends the target vulnerability detection information to the data alarm subsystem.

[0105] In step 5, the data alarm subsystem stores the target vulnerability detection information in the database in response to receiving the target vulnerability detection information sent by the data monitoring subsystem. In practice, the specific implementation method of storing the target vulnerability detection information in the database and the technical effect brought about by it can refer to step 105 in the above embodiment, which will not be repeated here.

[0106] In step 6, the data alarm subsystem performs alarm processing on the target vulnerability detection information in response to determining that the target vulnerability detection information satisfies the preset abnormal condition. In practice, the specific implementation method of performing alarm processing on the target vulnerability detection information in response to determining that the target vulnerability detection information satisfies the preset abnormal condition and the technical effect thereof can be referred to step 106 in the above embodiment, which will not be described in detail here.

[0107] The above-mentioned embodiments of the present application have the following beneficial effects: through the network security vulnerability detection method of some embodiments of the present application, the security of network services can be improved. Specifically, the reason for the reduction of the security of network services is that the pre-set rule base needs to be updated regularly. Before the rule base is updated, it is difficult to detect the newly generated vulnerabilities in time, which leads to the low accuracy of the vulnerability detection information generated by the vulnerability detection, and it is difficult to warn the web page information with vulnerabilities in time. Based on this, the network security vulnerability detection method of some embodiments of the present application, first, the above-mentioned data acquisition subsystem responds to the web page identification sent by the management terminal, collects the initial web page information set corresponding to the above-mentioned web page identification, and sends the above-mentioned initial web page information set to the above-mentioned data monitoring subsystem. Thus, the initial web page information set of each level corresponding to the web page identification can be collected. Secondly, the above-mentioned data monitoring subsystem responds to the initial web page information set sent by the above-mentioned data acquisition subsystem, performs data cleaning processing on each initial web page information in the above-mentioned initial web page information set to generate web page cleaning information and obtain a web page cleaning information set. Thus, the web page cleaning information set after data cleaning can be obtained. Then, the above-mentioned data monitoring subsystem performs vulnerability detection processing on the above-mentioned web page cleaning information set to generate a vulnerability detection result set. Thus, the web page cleaning information set can be subjected to vulnerability detection processing by the vulnerability scanning model so as to obtain a relatively accurate vulnerability detection result set. Then, the data monitoring subsystem performs a fusion processing on the initial web page information set and the vulnerability detection result set to generate a vulnerability detection information set, and sends the vulnerability detection information set to the data alarm subsystem. Thus, a relatively accurate vulnerability detection information set can be obtained so as to subsequently perform an alarm processing on the vulnerability detection information with abnormalities. Afterwards, the data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem. Thus, the vulnerability detection information can be stored in the database so as to view the vulnerability detection information at any time in the future. Finally, the data alarm subsystem performs an alarm processing on the vulnerability detection information in response to determining that the vulnerability detection information in the vulnerability detection information set meets the preset abnormal condition. Thus, an alarm processing can be performed on the vulnerability detection information with vulnerabilities. Therefore, by using the vulnerability scanning model instead of using the pre-set rule base to perform vulnerability detection processing on the web page information, a relatively accurate vulnerability detection information can be obtained so as to promptly alarm the web page information with vulnerabilities. Thereby, the security of network services can be improved.

[0108] The present application also provides a computer device 200. Figure 2As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0109] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0110] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0111] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0112] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the acquisition module, sampling module, determination module, and mixing module, thereby implementing the above-mentioned network security vulnerability detection method. That is, the memory 203 stores instructions for executing the above-mentioned network security vulnerability detection.

[0113] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0114] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned network security vulnerability detection method.

[0115] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk). The computer-readable storage medium includes instructions, and the above-mentioned instructions instruct the computing device to execute the above-mentioned network security vulnerability detection method.

[0116] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0117] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A network security vulnerability detection method, applied to a network security vulnerability detection system, the network security vulnerability detection system comprising: Data acquisition subsystem, data monitoring subsystem, data alarm subsystem, including: In response to receiving the web page identifier sent by the management terminal, the data collection subsystem collects an initial web page information set corresponding to the web page identifier, and sends the initial web page information set to the data monitoring subsystem; In response to receiving the initial web page information set sent by the data acquisition subsystem, the data monitoring subsystem performs data cleaning processing on each initial web page information in the initial web page information set to generate web page cleaning information and obtain a web page cleaning information set; The data monitoring subsystem performs vulnerability detection processing on the web page cleaning information set to generate a vulnerability detection result set; The data monitoring subsystem performs a fusion process on the initial webpage information set and the vulnerability detection result set to generate a vulnerability detection information set, and sends the vulnerability detection information set to the data alarm subsystem; The data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem; The data alarm subsystem performs alarm processing on the vulnerability detection information in response to determining that the vulnerability detection information in the vulnerability detection information set meets a preset abnormal condition; The performing vulnerability detection processing on the web page cleaning information set to generate a vulnerability detection result set includes: Based on the target vulnerability scan type, perform a quick scan or a full site scan using a pre-trained vulnerability scan model; The pre-trained vulnerability scanning model is obtained by training the initial vulnerability scanning model using the training sample set, wherein the initial vulnerability scanning model includes: an initial extraction model, an initial classification model, and an initial scanning model, wherein the initial extraction model is a neural network model that takes sample web page information as input and takes initial extraction information as output; the initial classification model is a neural network model that takes initial extraction information as input and takes initial classification information group as output; the initial scanning model is a model that takes initial classification information group as input and takes initial vulnerability scanning result as output; Among them, the initial scanning model includes three layers: The first layer, the input layer, is used to input the initial classified information group into the second layer; The second layer, the processing layer, includes a first sub-model and a second sub-model, wherein the first sub-model is a model that takes the initial classification information group as input and the first scanning result as output, and the second sub-model is a model that takes the initial classification information group as input and the second scanning result as output; The third layer, the output layer, determines the first preset vulnerability result as the initial vulnerability scanning result in response to determining that the first scanning result and the second scanning result meet the preset scanning conditions; in response to determining that the first scanning result and the second scanning result do not meet the above-mentioned preset scanning conditions, determines the second preset vulnerability result as the initial vulnerability scanning result.

2. The network security vulnerability detection method according to claim 1, wherein: The method further comprises: The data acquisition subsystem, in response to receiving the early warning feedback information sent by the management terminal, sends the early warning feedback information to the data monitoring subsystem; The data monitoring subsystem, in response to receiving the early warning feedback information sent by the data acquisition subsystem, performs vulnerability detection processing on the vulnerability detection information corresponding to the early warning feedback information in the vulnerability detection information set based on the early warning feedback information to generate a target vulnerability detection result; The data monitoring subsystem updates the vulnerability detection information corresponding to the early warning feedback information in the vulnerability detection information set based on the target vulnerability detection result to generate target vulnerability detection information; The data monitoring subsystem sends the target vulnerability detection information to the data alarm subsystem; The data alarm subsystem stores the target vulnerability detection information in the database in response to receiving the target vulnerability detection information sent by the data monitoring subsystem; In response to determining that the target vulnerability detection information meets the preset abnormal condition, the data alarm subsystem performs alarm processing on the target vulnerability detection information.

3. The network security vulnerability detection method according to claim 1, wherein: In response to receiving the webpage identifier sent by the management terminal, collecting the initial webpage information set corresponding to the webpage identifier includes: Collecting first web page information corresponding to the web page identifier and a collection timestamp, wherein the first web page information includes: a lower-level web page identifier; Determine a target web page information set, wherein the target web page information set is initially empty; For the first web page information and the target web page information set, the following collection steps are performed: Adding the first web page information to the target web page information set; In response to determining that the subordinate web page identifier included in the first web page information is empty, determining the target web page information set as the initial web page information set; Based on the acquisition timestamp, the initial web page information set is updated.

4. The network security vulnerability detection method according to claim 3, wherein: The method further comprises: In response to determining that the subordinate webpage identifier included in the first webpage information is not empty, collecting second webpage information corresponding to the subordinate webpage identifier included in the first webpage information, wherein the second webpage information includes: the subordinate webpage identifier; Adding the second web page information to the target web page information set to update the target web page information set; The updated target web page information set is determined as the target web page information set, and the second web page information is determined as the first web page information, so as to perform the collection step again.

5. The network security vulnerability detection method according to claim 3, wherein: The updating process of the initial web page information set based on the acquisition timestamp includes: Get the current timestamp; In response to determining that the current timestamp and the collection timestamp satisfy a preset time interval condition, collecting a webpage update information set corresponding to the webpage identifier; Based on the webpage update information set, the initial webpage information set is updated.

6. The network security vulnerability detection method according to claim 1, wherein: The performing vulnerability detection processing on the web page cleaning information set to generate a vulnerability detection result set includes: Sending the preset vulnerability scanning type to the management terminal so as to receive the target vulnerability scanning type sent by the management terminal; In response to determining that the target vulnerability scan type meets the preset quick scan condition, the following quick scan steps are performed: Screening the web page cleaning information set to generate a web page key information set; For each web page key information in the web page key information set, the following first scanning step is performed: Inputting the key information of the webpage into a pre-trained vulnerability scanning model to generate a first vulnerability scanning result; In response to determining that the first vulnerability scanning result satisfies a first preset vulnerability condition, determining the first preset vulnerability result as a vulnerability detection result; In response to determining that the first vulnerability scanning result does not satisfy the first preset vulnerability condition, determining a second preset vulnerability result as a vulnerability detection result; Determine each determined vulnerability detection result as a vulnerability detection result set; In response to determining that the target vulnerability scan type meets the preset full-station scan condition, the following full-station scan steps are performed: For each web page cleaning information in the web page cleaning information set, the following second scanning step is performed: Inputting the webpage cleaning information into a pre-trained vulnerability scanning model to obtain a second vulnerability scanning result; In response to determining that the second vulnerability scanning result satisfies a second preset vulnerability condition, determining the first preset vulnerability result as a vulnerability detection result; In response to determining that the second vulnerability scanning result does not satisfy the second preset vulnerability condition, determining the second preset vulnerability result as the vulnerability detection result; The determined vulnerability detection results are determined as a vulnerability detection result set.

7. The network security vulnerability detection method according to claim 1, wherein: The data alarm subsystem includes: a data partition subsystem, a data backup subsystem sequence, and a data compression subsystem sequence; And the data alarm subsystem stores the vulnerability detection information set in a database in response to receiving the vulnerability detection information set sent by the data monitoring subsystem, including: The data partitioning subsystem, in response to receiving the vulnerability detection information set sent by the data monitoring subsystem, partitions the vulnerability detection information set to generate a vulnerability detection information group sequence, wherein the vulnerability detection information groups in the vulnerability detection information group sequence correspond to the data backup subsystems in the data backup subsystem sequence, and the data backup subsystems in the data backup subsystem sequence correspond to the data compression subsystems in the data compression subsystem sequence; The data partitioning subsystem sends each vulnerability detection information group in the vulnerability detection information group sequence to the data backup subsystem corresponding to the vulnerability detection information group; The data backup subsystem in the data backup subsystem sequence executes the following encryption steps in response to receiving the vulnerability detection information group sent by the data partitioning subsystem: Encrypting each vulnerability detection information in the vulnerability detection information group to generate encrypted vulnerability detection information, thereby obtaining an encrypted vulnerability detection information group; Sending the vulnerability encryption detection information group to the data compression subsystem corresponding to the data backup subsystem; In response to receiving the vulnerability encryption detection information group sent by the data backup subsystem corresponding to the data compression subsystem, the data compression subsystem in the data compression subsystem sequence performs the following compression steps: Compressing the vulnerability encryption detection information group to generate a vulnerability compression detection information group; The vulnerability compression detection information group is stored in a database.

8. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images