Vulnerability scanning and processing method and device, electronic equipment and storage medium

Abstract

The invention relates to a vulnerability scanning and processing method and device, electronic equipment and a storage medium, and the vulnerability scanning and processing method comprises the steps: creating a scanning task through an OpenVAS client, carrying out the vulnerability scanning detection of a target through an NASL plug-in after a server receives a scanning request, and returning a scanning result to the client; and if the medium and high risk vulnerabilities exist, assigning a work order to carry out vulnerability repair and labeling, accurately notifying matched assets, and then querying a vulnerability state until no to-be-repaired vulnerability exists. According to the method and the device, the potential vulnerabilities of the assets can be comprehensively and accurately found and the security risk can be effectively coped by utilizing the vulnerability scanning tool and depending on the high-quality vulnerability library and the vulnerability scanning plug-in, so that network security protection personnel can know and master the vulnerabilities of the assets in advance, the attack of hackers can be effectively prevented, and the security of the network assets is guaranteed.

Description

Technical Field

[0001] The present application relates to the technical field of network asset data security, and in particular to a vulnerability scanning and processing method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of Internet technology, the Internet and various Internet devices have become important carriers of people's lives and work. Nowadays, various types of network assets on the Internet and even in corporate intranets are increasing explosively. Network assets refer to the value of information owned, maintained and used by any enterprise. This information can take various forms, including digital data, files, documents, etc. As various devices and systems are continuously connected to the network, the exposure of various network security vulnerabilities has increased. In order to timely discover various network assets, deal with and investigate various vulnerabilities and hidden dangers, enterprises need efficient means to sort out network assets, analyze asset-related information, and quickly discover network asset vulnerabilities. There are some problems with traditional network asset vulnerability detection methods. Traditional manual detection methods are inefficient and cannot meet the needs of rapid detection of large-scale network assets. Traditional detection methods rely on manual analysis, which is prone to omissions and false positives, making network asset data less secure. Summary of the invention

[0003] (1) Technical issues to be solved

[0004] The present application provides a vulnerability scanning and processing method, device, electronic device and storage medium to solve the problem that traditional network asset vulnerability detection methods are inefficient, prone to missed reports and false reports, and have low security of network asset data.

[0005] (2) Technical solution

[0006] In a first aspect, the present application provides a vulnerability scanning and processing method, including:

[0007] Use the OpenVAS client to create a scan task. After receiving the scan request, the server uses the NASL plug-in to scan the target for vulnerabilities and return the scan results to the client.

[0008] If there are medium or high-risk vulnerabilities, a work order will be assigned to repair and mark the vulnerabilities, match the assets for accurate notification, and then query the vulnerability status until there are no vulnerabilities to be repaired.

[0009] Furthermore, the use of the OpenVAS client to create a scan task, after receiving the scan request, the server uses the NASL plug-in to perform vulnerability scan detection on the target and returns the scan result to the client, including:

[0010] Use the OpenVAS client to create a scan task. The client sends a corresponding connection request based on the server address entered by the user.

[0011] After the client completes the configuration of the scanning task and the survival test of the scanning target according to the user's relevant configuration information, it actively sends a scanning request to the server;

[0012] After receiving the scan request, the server starts the scan plug-in parsing engine, parses the scan information, uses the pre-loaded NASL plug-in to perform vulnerability scan detection on the target using attack detection, and returns the scan results to the client.

[0013] Furthermore, the use of the OpenVAS client to create a scanning task, after the client sends a corresponding connection request according to the server address input by the user, also includes:

[0014] The client compares its own certificate with the server's certificate for verification. If the certificates meet the requirements, the connection between the two parties is successfully established, otherwise the connection fails.

[0015] Furthermore, after the client completes the configuration of the scanning task and the scan target survival test according to the relevant configuration information of the user, before actively sending a scanning request to the server, it also includes:

[0016] After the client successfully initiates a request with the server, the scanning plug-in is configured according to the user's relevant configuration information, and a scanning strategy is generated and the survivability of the scanning target is tested.

[0017] Furthermore, the method of creating a scanning task using the OpenVAS client, and after receiving the scanning request, the server uses the NASL plug-in to perform vulnerability scanning and detection on the target, and returns the scanning result to the client, further includes:

[0018] After receiving the scan results, the client performs relevant data formatting operations according to the configuration information and generates a scan report in a format customized by the corresponding user.

[0019] Furthermore, the scanning task may be a single IP task, an IP segment task or a scheduled task.

[0020] Furthermore, the scanning target can be set according to specific IP, assets, business systems, and departments, and the corresponding scanning IP list can be automatically obtained according to the set target to perform corresponding vulnerability scanning.

[0021] In a second aspect, the present application provides a vulnerability scanning and processing device, comprising:

[0022] The vulnerability scanning module is used to create a scanning task using the OpenVAS client. After receiving the scanning request, the server uses the NASL plug-in to perform vulnerability scanning on the target and returns the scanning results to the client.

[0023] The vulnerability handling module is used to assign work orders to repair and mark medium- and high-risk vulnerabilities, match asset precision notifications, and then query the vulnerability status until there are no vulnerabilities to be repaired.

[0024] In a third aspect, the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the vulnerability scanning and processing method as described above when executing the computer program.

[0025] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the vulnerability scanning and processing method as described above is implemented.

[0026] (3) Beneficial effects

[0027] The above technical solution of the present application has the following advantages:

[0028] The vulnerability scanning and processing method provided in the first aspect of the present application creates a scanning task by using the OpenVAS client. After receiving the scanning request, the server uses the NASL plug-in to perform vulnerability scanning and detection on the target, and returns the scanning results to the client. If there are medium- and high-risk vulnerabilities, a work order is assigned to repair the vulnerabilities and mark them, match the asset with accurate notifications, and then query the vulnerability status until there are no vulnerabilities to be repaired. Vulnerability scanning tools are used, relying on high-quality vulnerability libraries and vulnerability scanning plug-ins to comprehensively and accurately discover potential vulnerabilities in assets and effectively respond to security risks. Network security protection personnel can understand and grasp the vulnerabilities of assets in advance, which can effectively prevent hacker attacks and ensure the security of network assets.

[0029] It can be understood that the beneficial effects of the second, third and fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0031] Figure 1 A flowchart of the vulnerability scanning and processing method provided for this application;

[0032] Figure 2 A schematic diagram of the structure of the vulnerability scanning and processing device provided by this application;

[0033] Figure 3 A schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION

[0034] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0035] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0036] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0037] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways. "Multiple" means "two or more".

[0038] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application but are not intended to limit the scope of the present application.

[0039] like Figure 1 As shown, the vulnerability scanning and processing method provided in this embodiment specifically includes the following steps:

[0040] Use the OpenVAS client to create a scan task. After receiving the scan request, the server uses the NASL plug-in to scan the target for vulnerabilities and return the scan results to the client.

[0041] If there are medium or high-risk vulnerabilities, a work order will be assigned to repair and mark the vulnerabilities, match the assets for accurate notification, and then query the vulnerability status until there are no vulnerabilities to be repaired.

[0042] Vulnerability scanning technology is a key technology in network security technology, and it is also the core technology of network scanners. Traditional network defense tools such as firewalls and antivirus software are passive in mode to resist illegal attacks. Passive defense always leaves loopholes for criminals to exploit. This method is not very safe. Actively studying the characteristics of vulnerabilities can effectively make up for this defect. Using vulnerability scanning tools, relying on high-quality vulnerability libraries and vulnerability scanning plug-ins, NASL plug-ins can drive vulnerability scanning and match assets, comprehensively and accurately discover potential vulnerabilities in assets and effectively respond to security risks. Let network security protection personnel understand and master asset vulnerabilities in advance, which can effectively prevent hacker attacks and ensure the security of network assets.

[0043] OpenVAS (Open Vulnerability Assessment System) is a framework collection that provides vulnerability scanning services and tools. It can quickly and efficiently scan vulnerabilities in network devices and provide effective suggestions and solutions. It is completely open source and efficient. OpenVAS can be said to be a network scanner that contains related tools. The core components are servers and network vulnerability testers. OpenVAS uses active attack detection scanning to perform vulnerability scanning tasks. Its detection script uses NASL attack scripts, and NVTs (Network Vulnerability Tests) is responsible for regularly updating script plug-ins. OpenVAS uses the MVC layered model. The entire vulnerability scanning system consists of four parts, including client, server, database, and scanning target. Each module calls each other through a specific communication protocol to complete the entire vulnerability scanning task.

[0044] In some embodiments, the use of the OpenVAS client to create a scan task, after receiving the scan request, the server uses the NASL plug-in to perform vulnerability scan detection on the target and returns the scan result to the client, including:

[0045] Use the OpenVAS client to create a scan task. The client sends a corresponding connection request based on the server address entered by the user.

[0046] After the client completes the configuration of the scanning task and the survival test of the scanning target according to the user's relevant configuration information, it actively sends a scanning request to the server;

[0047] After receiving the scan request, the server starts the scan plug-in parsing engine, parses the scan information, uses the pre-loaded NASL plug-in to perform vulnerability scan detection on the target using attack detection, and returns the scan results to the client.

[0048] In some embodiments, the use of the OpenVAS client to create a scanning task, after the client issues a corresponding connection request according to the server address input by the user, further includes:

[0049] The client compares its own certificate with the server's certificate for verification. If the certificates meet the requirements, the connection between the two parties is successfully established, otherwise the connection fails.

[0050] In some embodiments, after the client completes the configuration of the scanning task and the scan target survival test according to the relevant configuration information of the user, before actively sending a scanning request to the server, it also includes:

[0051] After the client successfully initiates a request with the server, the scanning plug-in is configured according to the user's relevant configuration information, and a scanning strategy is generated and the survivability of the scanning target is tested.

[0052] In some embodiments, the use of the OpenVAS client to create a scan task, after receiving the scan request, the server uses the NASL plug-in to perform vulnerability scan detection on the target, and returns the scan result to the client, further comprising:

[0053] After receiving the scan results, the client performs relevant data formatting operations according to the configuration information and generates a scan report in a format customized by the corresponding user.

[0054] In some embodiments, the scanning task may be a single IP task, an IP segment task, or a scheduled task.

[0055] In some embodiments, the scanning target can be set according to specific IP, assets, business systems, and departments, and the corresponding scanning IP list can be automatically obtained according to the set target to perform corresponding vulnerability scans.

[0056] The OpenVAS client is mainly responsible for creating scanning tasks, configuring scanning task information, obtaining scanning results, etc. Users set scanning objects and configure scanning strategies through the client. Users can use OpenVAS by entering corresponding commands in the terminal using the GMP (OMP) protocol. The command line format is simple and efficient. Users can write corresponding scripts to create batch tasks, and use the GMP (OMP) protocol to quickly and efficiently perform secondary development on OpenVAS.

[0057] The server side is the key component module of the OpenVAS system. Currently, the server component of OpenVAS can only run on Unix / Linux operating systems. The server side is mainly composed of the Scanner module, the Administrator module and the Manager module. The Scanner module is the core component of the OpenVAS vulnerability scanning system. The Scanner module receives the scanning task information passed by the Manager module, performs attack detection tasks on the scan target by calling and loading the NASL plug-in from the plug-in library, and returns the scanning results to the Manager module. The Manager module is mainly responsible for the process control of the entire vulnerability scanning system. It receives the task request issued by the client according to the GMP (OMP) protocol, forwards it to the Scanner module after corresponding processing, and also receives the result information feedback from the Scanner module. According to the configuration information of the client user, the result is converted into a report in the corresponding format for the user to use. It can realize the start, pause, stop and other functions of the scanning task. The main function of the Administrator module is to manage user information.

[0058] The workflow of the OpenVAS server is as follows: the control module receives the scanning task information transmitted by the client through the GMP (OMP) protocol, and converts it into an information format that the scanning module can recognize using the OSP protocol. The scanning module loads the corresponding script according to the user configuration, and then uses the active attack form to perform a penetration test on the scanning target. After the scan is completed, the scanning module feeds back the scanning results to the control module to generate a corresponding report. The communication between the three modules is all carried out using SSL encryption, and certificate verification and identification are required before the connection is established, which greatly improves the security and reliability of the communication.

[0059] The OpenVAS system uses a PostgreSQL database, which is mainly used to store NVTs plug-in information, scan configuration information, update the task status during the scan, and scan result information. The server-side Scanner module calls plug-ins from the database library. The plug-in information is regularly maintained by the OpenVAS maintainer. Users can download the latest plug-in library from the OpenVAS official website. So far, there are 61,500 NVTs plug-ins of various types, and the number of plug-ins will continue to increase.

[0060] The user uses the OpenVAS client to create a scan task, which can be a single IP task, an IP segment task, or a scheduled task. The client sends a corresponding connection request based on the server address entered by the user. The OpenVAS communication process uses SSL (Secure Sockets Layer) encryption. The server will create a corresponding verification certificate file at the beginning of operation, start related services and wait for the client's connection request.

[0061] The client sends a connection request to the server, and first compares its own certificate with the server's certificate for verification. If the certificate meets the requirements, the connection between the two parties is successfully established, otherwise the connection fails. After the client successfully initiates a request with the server, it will configure the scanning plug-in according to the user's relevant configuration information, generate a scanning strategy, and test the survival of the scanning target.

[0062] When the client completes the configuration of the scanning task and the survival test of the scanning target, it actively sends a scanning request to the server. After receiving the scanning request, the server starts the scanning plug-in parsing engine, parses the scanning information, and uses the pre-loaded NASL plug-in to perform vulnerability scanning and detection on the target in the form of attack detection. After the scanning task is completed, the server will format the scanning data and return the scanning results to the client. After receiving the scanning results, the client will perform relevant data formatting operations according to the configuration information and generate a scanning report in the corresponding user-defined format.

[0063] Using the network asset mapping platform as the client, the interface provided by the Openvas cli command service is called in the GMP protocol format. The Openvas cli command service passes the task to the Openvas Manager management and control service to schedule the task and load the plug-in. The specific Openvas Scanner scanning service is called in the OSP protocol format to complete the vulnerability scan and return the scan results. For the specific structure, please refer to the vulnerability scanning technology architecture. Modify the Openvas Manager management and control service source code, unify the database, and add the report template function.

[0064] The network asset mapping system is deeply integrated with the open source OpenVAS scanning tool, providing configuration of leak scan task parameters, leak scan task management, leak scan task execution management, leak scan result display, and interfaces for connecting to other scanners and third-party vulnerability scanning tools. The system provides vulnerability scanning tasks that set scan targets, scan ports, scan strategies, and scan methods. Among them, the scan targets can be set by specific IP, assets, business systems, and departments. The system can automatically obtain the corresponding scan IP list according to the set target and perform the corresponding vulnerability scan.

[0065] The vulnerability scanning and processing method provided in the embodiment of the present application, by utilizing vulnerability scanning tools, relies on high-quality vulnerability libraries and vulnerability scanning plug-ins, comprehensively and accurately discovers potential vulnerabilities of assets and effectively responds to security risks, allowing network security protection personnel to understand and grasp the vulnerabilities of assets in advance, which can effectively prevent hacker attacks and ensure the security of network assets.

[0066] Corresponding to the vulnerability scanning and processing method described in the above embodiment, Figure 2 As shown, this embodiment provides a vulnerability scanning and processing device, and the vulnerability scanning and processing device 200 includes:

[0067] The vulnerability scanning module 201 is used to create a scanning task using the OpenVAS client. After receiving the scanning request, the server uses the NASL plug-in to perform vulnerability scanning on the target and returns the scanning result to the client.

[0068] The vulnerability processing module 202 is used to assign a work order to repair and mark the vulnerability if there are medium or high risk vulnerabilities, match asset precision notifications, and then query the vulnerability status until there are no vulnerabilities to be repaired.

[0069] It should be noted that the information interaction, execution process, etc. between the above-mentioned modules / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0070] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0071] The present application embodiment also provides an electronic device 300, such as Figure 3 As shown, it includes a memory 301, a processor 302, and a computer program 303 stored in the memory 301 and executable on the processor 302. When the processor 302 executes the computer program 303, the steps of the vulnerability scanning and processing method provided in the first aspect are implemented.

[0072] In applications, the electronic device may include, but is not limited to, a processor and a memory. Figure 3This is only an example of an electronic device and does not constitute a limitation on the electronic device. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input and output devices, network access devices, etc. Input and output devices may include cameras, audio acquisition / playback devices, display screens, etc. Network access devices may include a network module for wirelessly communicating with external devices.

[0073] In applications, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0074] In application, the memory may be an internal storage unit of an electronic device in some embodiments, such as a hard disk or memory of the electronic device. The memory may also be an external storage device of the electronic device in other embodiments, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. The memory may also include both an internal storage unit and an external storage device of the electronic device. The memory is used to store operating systems, applications, boot loaders (BootLoader), data, and other programs, such as program codes of computer programs, etc. The memory may also be used to temporarily store data that has been output or is to be output.

[0075] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0076] The present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0077] Those of ordinary skill in the art will appreciate that the devices and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0078] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices, which can be electrical, mechanical or other forms.

[0079] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A vulnerability scanning and processing method, characterized in that: include: Use the OpenVAS client to create a scan task. After receiving the scan request, the server uses the NASL plug-in to scan the target for vulnerabilities and return the scan results to the client. If there are medium or high-risk vulnerabilities, a work order will be assigned to repair and mark the vulnerabilities, match the assets for accurate notification, and then query the vulnerability status until there are no vulnerabilities to be repaired.

2. The vulnerability scanning and processing method according to claim 1, characterized in that: The OpenVAS client is used to create a scanning task. After receiving the scanning request, the server uses the NASL plug-in to perform vulnerability scanning on the target and returns the scanning results to the client, including: Use the OpenVAS client to create a scan task. The client sends a corresponding connection request based on the server address entered by the user. After the client completes the configuration of the scanning task and the survival test of the scanning target according to the user's relevant configuration information, it actively sends a scanning request to the server; After receiving the scan request, the server starts the scan plug-in parsing engine, parses the scan information, uses the pre-loaded NASL plug-in to perform vulnerability scan detection on the target using attack detection, and returns the scan results to the client.

3. The vulnerability scanning and processing method according to claim 2, characterized in that: The method of creating a scanning task by using the OpenVAS client, after the client sends a corresponding connection request according to the server address input by the user, further includes: The client compares its own certificate with the server's certificate for verification. If the certificates meet the requirements, the connection between the two parties is successfully established, otherwise the connection fails.

4. The vulnerability scanning and processing method according to claim 2, characterized in that: After the client completes the configuration of the scanning task and the scan target survival test according to the relevant configuration information of the user, before actively sending a scanning request to the server, it also includes: After the client successfully initiates a request with the server, the scanning plug-in is configured according to the user's relevant configuration information, and a scanning strategy is generated and the survivability of the scanning target is tested.

5. The vulnerability scanning and processing method according to claim 1, characterized in that: The method of using the OpenVAS client to create a scan task, and after receiving the scan request, the server uses the NASL plug-in to perform vulnerability scan detection on the target, and returns the scan result to the client, further includes: After receiving the scan results, the client performs relevant data formatting operations according to the configuration information and generates a scan report in a format customized by the corresponding user.

6. The vulnerability scanning and processing method according to claim 1, characterized in that: The scanning task may be a single IP task, an IP segment task or a scheduled task.

7. The vulnerability scanning and processing method according to claim 1, characterized in that: The scanning target can be set according to specific IP, assets, business systems, and departments. The corresponding scanning IP list can be automatically obtained according to the set target to perform corresponding vulnerability scanning.

8. A vulnerability scanning and processing device, characterized in that: include: The vulnerability scanning module is used to create a scanning task using the OpenVAS client. After receiving the scanning request, the server uses the NASL plug-in to perform vulnerability scanning on the target and returns the scanning results to the client. The vulnerability handling module is used to assign work orders to repair and mark medium- and high-risk vulnerabilities, match asset precision notifications, and then query the vulnerability status until there are no vulnerabilities to be repaired.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the vulnerability scanning and processing method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the vulnerability scanning and processing method according to any one of claims 1 to 7 is implemented.

Images