Vulnerability protection method, device, equipment, medium and product

Abstract

The invention provides a vulnerability protection method and device, equipment, a medium and a product. Belongs to the technical field of network security. Uploading the vulnerability detection report to a block chain network, wherein an intelligent contract is deployed in the block chain network; obtaining at least one vulnerability fixing task, wherein the vulnerability fixing task comprises a vulnerability fixing difficulty level; determining a task execution end of the at least one vulnerability repair task according to the difficulty level, and issuing the corresponding vulnerability repair task to the task execution end; acquiring a vulnerability repair result returned by the task execution end; performing security detection on the vulnerability repair result according to a multi-signature mechanism of the block chain network and a preset rule of the smart contract; and under the condition that the vulnerability repair result passes the security detection, determining that vulnerability repair is completed. The technical problems of low security of vulnerability information and low system stability caused by vulnerability repair in related technologies are solved.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and in particular, relates to a vulnerability protection method, device, equipment, medium and product. Background Art

[0002] With the rapid development of the Internet, the security of network systems has become particularly important.

[0003] Traditional vulnerability management systems rely on a centralized architecture, with all vulnerability reports and repair patches stored on a central server, which poses a risk of single point failure. Vulnerability information is managed through a traditional database, which poses a risk of data tampering.

[0004] In addition, the existing means of verifying vulnerability repair results are single and usually based on manual vulnerability repair. This method not only has a slow response speed, but also easily introduces new problems during the repair process, affecting system stability. Summary of the invention

[0005] The embodiments of the present application provide a vulnerability protection method, apparatus, device, storage medium and computer program product to solve the technical problems of low security of vulnerability information and low stability of the system due to vulnerability repair in the related art.

[0006] In a first aspect, an embodiment of the present application provides a vulnerability protection method, the method comprising:

[0007] Obtain vulnerability detection reports, which include vulnerability types, vulnerability locations, and vulnerability threat levels of the vulnerabilities that occur in the system;

[0008] Upload the vulnerability detection report to the blockchain network, which is deployed with smart contracts. Smart contracts are used to represent the automatic execution of contract content according to preset rules;

[0009] Obtain at least one vulnerability repair task, where at least one vulnerability repair task is to generate a vulnerability detection report for smart contract parsing, and the vulnerability repair task includes a difficulty level of the vulnerability repair;

[0010] Determine at least one task execution end of the vulnerability repair task according to the difficulty level, and issue the corresponding vulnerability repair task to the task execution end;

[0011] Get the vulnerability repair results returned by the task execution end;

[0012] Conduct security checks on vulnerability repair results based on the blockchain network’s multi-signature mechanism and the preset rules of smart contracts;

[0013] When the vulnerability repair result passes the security test, it is determined that the vulnerability is repaired.

[0014] In a second aspect, an embodiment of the present application provides a vulnerability protection device, the device comprising:

[0015] An acquisition module is used to obtain a vulnerability detection report, which includes the vulnerability type, vulnerability location and vulnerability threat level of the vulnerability that occurs in the system;

[0016] The upload module is used to upload the vulnerability detection report to the blockchain network. The blockchain network is deployed with smart contracts, which are used to represent the automatic execution of contract content according to preset rules;

[0017] The acquisition module is further used to acquire at least one vulnerability repair task, wherein the at least one vulnerability repair task is to generate a vulnerability detection report for smart contract parsing, and the vulnerability repair task includes a difficulty level of the vulnerability repair;

[0018] A determination module, used to determine a task execution end of at least one vulnerability repair task according to the difficulty level, and issue the corresponding vulnerability repair task to the task execution end;

[0019] The acquisition module is also used to obtain the vulnerability repair results returned by the task execution end;

[0020] The monitoring module is used to perform security checks on vulnerability repair results based on the multi-signature mechanism of the blockchain network and the preset rules of the smart contract;

[0021] The determination module is also used to determine that the vulnerability repair is complete when the vulnerability repair result passes the security detection.

[0022] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0023] A processor and a memory storing programs or instructions;

[0024] The above method is implemented when the processor executes the program or instruction.

[0025] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored, and the program or instruction implements the above method when executed by a processor.

[0026] In a fifth aspect, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the above method.

[0027] In an embodiment of the present application, the acquired vulnerability detection report is uploaded to the blockchain network, and a vulnerability repair task is generated by the smart contract of the blockchain network. By utilizing the tamper-proof nature of the blockchain network, the technical problem in the related technology that vulnerability information is easily tampered with due to being stored in a traditional database is solved, thereby improving the security of the vulnerability information. By performing security checks on the vulnerability repair results according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract, new problems introduced into the system due to vulnerability repair are avoided, thereby improving the stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0029] Figure 1 is a flow chart of a vulnerability protection method according to an embodiment of the present invention;

[0030] Figure 2 is a schematic structural diagram of a vulnerability protection device according to an embodiment of the present invention;

[0031] Figure 3 is a schematic diagram of the overall process of a vulnerability protection method according to an embodiment of the present invention;

[0032] Figure 4 is a structural block diagram of a vulnerability protection device according to an embodiment of the present invention;

[0033] Figure 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0035] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0036] In addition, it should be noted that the acquisition, storage, use, and processing of data in the embodiments of the present application comply with the relevant provisions of national laws and regulations.

[0037] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0038] In the related art, if vulnerability information such as vulnerability repair reports and vulnerability repair patches are stored in traditional databases for management, the above vulnerability information is at risk of data tampering and lacks transparency, so the security of vulnerability information is low. Manual processing of vulnerability repair and detection has a slow response speed, and repairs may introduce new problems at the same time, resulting in low system stability. If the repair information is stored in a central server, successful repair experience is difficult to be shared by others, resulting in the problem of reinventing the wheel; cross-platform information sharing is inefficient, affecting overall security.

[0039] In order to solve the technical problems of low security of vulnerability information and low system stability caused by vulnerability repair in the prior art, an embodiment of the present application provides a vulnerability protection method, which can be applied in a vulnerability management system to discover and repair system vulnerabilities. Figure 1 is a flow chart of a vulnerability protection method according to an embodiment of the present invention. Figure 1 As shown, the vulnerability protection method may include the following steps:

[0040] S110, obtaining a vulnerability detection report, the vulnerability detection report including the vulnerability type, vulnerability location and vulnerability threat level of the vulnerability occurring in the system.

[0041] In S110, a variety of methods may be used to obtain a vulnerability detection report of the system. For example, the vulnerability detection report may be obtained by using automated scanning tools, manual penetration testing, comprehensive security assessment, etc. The system may be an information system, a network system, an operating system, a database system, or an Internet of Things system, etc.

[0042] Among them, automated scanning tools can use professional vulnerability scanning software on the current market, such as Nessus, OpenVAS, AppScan, etc., which can quickly scan the system and generate vulnerability detection reports. Manual penetration testing can be performed by hiring professional security testers. These testers can simulate hacker attack behaviors, try to find vulnerabilities in the system, and then generate vulnerability detection reports.

[0043] A comprehensive security assessment can be performed by obtaining system data; then inputting the data into the model for vulnerability detection. If there are vulnerabilities in the system, the vulnerabilities are analyzed to obtain an initial detection report.

[0044] Among them, the model can be a vulnerability detection model based on machine learning or deep neural network, and the analysis can be static analysis or dynamic analysis.

[0045] Taking the Enterprise Resource Planning (ERP) system as an example, the vulnerability detection report may include the following details:

[0046] Various types of vulnerabilities in enterprise resource planning systems, such as: Structured Query Language (SQL) injection vulnerabilities; cross-site scripting attacks; cross-site request forgery, etc.

[0047] The specific location of the vulnerability in the enterprise resource planning system, such as: URL path; source code file; database table; server configuration;

[0048] The threat level of the vulnerabilities in the enterprise resource planning system can be divided according to the severity of the vulnerability, the scope of impact, and the exploitability. For example, the vulnerability threat level can be divided into the following levels: High: The vulnerability may cause system crash, data leakage or serious security threats. Such as SQL injection vulnerabilities, remote code execution vulnerabilities, etc. Intermediate: The vulnerability may cause system performance degradation, partial functional failure or lower security threats. Such as CSRF vulnerabilities, insecure file upload vulnerabilities, etc. Low: The vulnerability has a small impact on the system, but still needs attention. Such as information leakage vulnerabilities, weak password policies, etc.

[0049] S120, uploading the vulnerability detection report to the blockchain network, where a smart contract is deployed. The smart contract is used to automatically execute the contract content according to preset rules.

[0050] In S120, the blockchain network can be a well-known blockchain network such as Ethereum, Bitcoin, etc., or an enterprise blockchain network such as Hyperledger.

[0051] In this embodiment, when the blockchain network uses the Ethereum blockchain network, the smart contract can be a piece of code written in the blockchain network using the Solidity language, and developers can use Solidity to create customized smart contracts.

[0052] Vulnerability detection reports can be uploaded to the blockchain network. The specific upload time can be set as needed, including immediate upload, regular upload, and on-demand upload. For example, after a major update or upgrade of the system, or when a specific type of vulnerability is discovered, the system administrator can choose to upload the corresponding report.

[0053] S130, obtaining at least one vulnerability repair task, wherein at least one vulnerability repair task is generating a vulnerability detection report for smart contract parsing, and the vulnerability repair task includes a difficulty level of the vulnerability repair.

[0054] In S130, the preset rules of the smart contract include parsing the vulnerability detection report and generating at least one vulnerability repair task.

[0055] For example, the smart contract can first parse the vulnerability detection report and extract key fields, such as vulnerability ID, vulnerability description, code segment where the vulnerability is located, etc.

[0056] Furthermore, the smart contract creates a repair task for each vulnerability based on the vulnerability information obtained by parsing. These vulnerability repair tasks can be organized into a list, and each task can contain detailed information about the vulnerability and the repair difficulty level, which can include low, medium, and high.

[0057] For example, each vulnerability repair task can contain the following elements: Task Identification (ID): an ID that uniquely identifies each repair task; Vulnerability ID: corresponds to the vulnerability ID in the vulnerability detection report; Vulnerability Description: briefly describes the nature and impact of the vulnerability; Repair Difficulty Level: indicates the difficulty and resources required to repair the vulnerability; Repair Suggestions: based on the vulnerability type and repair experience, the smart contract can provide some repair suggestions or reference plans; Task Status: indicates the current status of the task, such as "pending", "in progress", "completed", etc.

[0058] For example, Task ID: 002; Vulnerability ID: VULN-002; Vulnerability description: Unauthorized access vulnerability, attackers can bypass permission checks to access sensitive data; Repair difficulty level: High; Repair suggestion: Strengthen permission control to ensure that only authorized users can access sensitive data; The access control logic of the contract may need to be modified; Task status: Pending.

[0059] S140, determining a task execution end of at least one vulnerability repair task according to the difficulty level, and issuing the corresponding vulnerability repair task to the task execution end.

[0060] In S140 , the task execution end may include a development team, an operation and maintenance team, a security service provider, an automated repair system, and the like.

[0061] When determining the task execution end, multiple factors can be considered, including the repair difficulty level, vulnerability location, vulnerability type, vulnerability threat level, etc. By comprehensively considering these factors, it can be ensured that the vulnerability repair task is assigned to the most appropriate execution end, thereby improving the repair efficiency and success rate.

[0062] For example, when the repair difficulty level of the vulnerability repair task is low, the vulnerability type is a cross-site scripting attack vulnerability, the vulnerability location is on the product details page, and the vulnerability threat level is medium, the task execution end of the vulnerability repair task can be determined as an automated repair system, and the vulnerability repair task can be sent to the automated repair system, and the automated repair system will execute the vulnerability repair task.

[0063] In addition, it is understandable that when issuing vulnerability repair tasks to task execution parties, detailed vulnerability information, repair suggestions, and necessary resources and tool support can be provided. This helps the execution parties better understand and repair vulnerabilities.

[0064] S150, obtaining the vulnerability repair result returned by the task execution end.

[0065] In S150, after the task execution end executes the corresponding vulnerability repair task, the vulnerability repair result returned by the task execution end is obtained.

[0066] S160, performs security testing on vulnerability repair results based on the multi-signature mechanism of the blockchain network and the preset rules of the smart contract.

[0067] In S160, the preset rules of the smart contract may be to use a variety of methods to perform security testing on the vulnerability repair results, including automated security testing and non-automated security testing;

[0068] Among them, automated security testing includes regression testing, vulnerability reproduction testing, integration testing, deployment verification, predetermined rule verification, multi-signature mechanism, anomaly detection, intelligent monitoring, etc.

[0069] For example, when the vulnerability repair result is jointly signed by multiple preset management terminals, a regression test and / or a vulnerability reproduction test is performed on the vulnerability repair result.

[0070] In this example, regression testing can be re-running previous test cases after the code is modified to ensure that the modification has not introduced new problems; reproduction testing can be re-triggering the fixed vulnerability to verify whether the vulnerability has indeed been resolved.

[0071] The choice of regression testing and reproduction testing tools depends on the specific testing requirements, the type of system being tested, and the technology stack of the testing team. For example, tools such as Selenium, Watir, and Serenity BDD can be used to perform regression testing on vulnerability repair results; Postman, custom scripts, and tools can be used to perform reproduction testing on vulnerability repair results.

[0072] In this way, by combining the multi-signature mechanism of the blockchain network and the preset rules of the smart contract, this security detection method can ensure that the vulnerability repair results are not only recognized by multiple management terminals, but also undergo rigorous testing and verification, thereby improving the security and stability of the system.

[0073] S170, when the vulnerability repair result passes the security check, determine that the vulnerability repair is complete.

[0074] In an embodiment of the present application, the acquired vulnerability detection report is uploaded to the blockchain network, and a vulnerability repair task is generated by the smart contract of the blockchain network. By utilizing the tamper-proof nature of the blockchain network, the technical problem in the related technology that vulnerability information is easily tampered with due to being stored in a traditional database is solved, thereby improving the security of the vulnerability information. By performing security checks on the vulnerability repair results according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract, new problems introduced into the system due to vulnerability repair are avoided, thereby improving the stability of the system.

[0075] In some embodiments, obtaining a vulnerability detection report includes:

[0076] Obtain system behavior data and status data based on preset time intervals;

[0077] Input the behavior data and status data into the machine learning model to perform vulnerability detection and obtain the detection results;

[0078] When the detection results show that the system has vulnerabilities, static analysis and / or dynamic analysis of the vulnerabilities are performed to obtain an initial detection report;

[0079] The test management and visualization platform is used to extract deep information from the initial detection report. The deep information includes vulnerability type, vulnerability location, and vulnerability threat level to obtain a vulnerability detection report.

[0080] In this embodiment, the preset time interval can be set to every hour, every day, every week, etc.; the system can be a bank transaction system, which needs to process a large amount of customer transaction data, including deposit, withdrawal, transfer and other data.

[0081] Behavioral data may include system logs, user operation records, network traffic data, etc.; status data may include system configuration, operating parameters, resource usage, etc.

[0082] The machine learning model can be a vulnerability detection model based on a deep neural network. The model learns the characteristics and patterns of vulnerabilities by training a large amount of historical vulnerability data. After receiving the system's behavior data and status data, the model processes and analyzes the data to detect whether there are potential vulnerabilities. The design of the model can take into account the characteristics of the system and common vulnerability types, such as SQL injection, cross-site scripting attacks, etc.

[0083] Static analysis is to identify vulnerabilities by analyzing static resources such as the system's source code and configuration files. Dynamic analysis is to detect vulnerabilities by monitoring the system's behavior and interactions during operation. For example, this application can use SonarQube static analysis and OWASP ZAP dynamic analysis.

[0084] The test management and visualization platform can be a combination of JIRA and Tableau.

[0085] It is understandable that by statically analyzing the source code and configuration files of the system, as well as dynamically analyzing the behavior and interaction during the operation of the system, vulnerabilities can be discovered more deeply and false positives can be reduced. Through the visualization platform, the vulnerability detection report is intuitively displayed in the form of charts, tables, etc., so that relevant personnel can quickly understand the security status of the system and formulate targeted repair measures.

[0086] In this way, the obtained vulnerability detection report has a more accurate detection result than the vulnerability detection report of the prior art.

[0087] In some embodiments, uploading the vulnerability detection report to the blockchain network includes:

[0088] Get the preset upload rules of the blockchain network, which are set based on smart contracts;

[0089] Convert the format of vulnerability detection reports according to preset upload rules;

[0090] Upload the converted vulnerability detection report to the blockchain network.

[0091] In this embodiment, the preset upload rules may include data format requirements, data size limits, encryption requirements, etc. These rules are set based on smart contracts and are used to guide how to correctly upload vulnerability detection reports to the blockchain network.

[0092] Among them, the vulnerability detection report may initially exist in binary format, CSV, JSON or XML format.

[0093] Convert the format of vulnerability detection reports according to preset upload rules;

[0094] In this step, it is important to note that when performing format conversion, it is necessary to ensure that the converted data can fully and accurately reflect the information in the original vulnerability detection report.

[0095] For example, if the blockchain network requires data in JSON format, and the vulnerability detection report is originally in XML format, then XML to JSON format conversion is required. Specifically, libraries in programming languages ​​such as Python (such as xml.etree.ElementTree and JSON) can be used to achieve this conversion.

[0096] Upload the converted vulnerability detection report to the blockchain network;

[0097] In this step, the upload process involves communicating with the nodes of the blockchain network to write the data into the blockchain's distributed ledger. Once the data is successfully written to the blockchain, it is stored permanently and can be verified and viewed by anyone with access to the blockchain.

[0098] In this way, by selecting appropriate conversion methods and tools, it can be ensured that the vulnerability detection report can meet the upload requirements of the blockchain network and facilitate its storage and sharing on the blockchain.

[0099] In some embodiments, the task execution end includes an automated repair end and an engineer end; the task execution end of at least one vulnerability repair task is determined according to the difficulty level, including:

[0100] For each vulnerability repair task in at least one vulnerability repair task, when the vulnerability difficulty level is low, the task execution end of the vulnerability repair task is determined to be the automated repair end; when the vulnerability difficulty level is medium or high, the task execution end of the vulnerability repair task is determined to be the engineer end.

[0101] In this embodiment, the task execution end may include an automated repair end and an engineer end. The engineer end includes a development team, an operation and maintenance team, a security service provider, etc., and the automated repair end may be an automated repair system.

[0102] When determining the task execution end, multiple factors can be considered, including the repair difficulty level, vulnerability location, vulnerability type, vulnerability threat level, etc. By comprehensively considering these factors, it can be ensured that the vulnerability repair task is assigned to the most appropriate execution end, thereby improving the repair efficiency and success rate.

[0103] Specifically, when the vulnerability difficulty level is low, the task execution end of the vulnerability repair task can be determined to be the automated repair end, and when the vulnerability difficulty level is medium or high, the task execution end of the vulnerability repair task can be determined to be the engineer end.

[0104] For example, the vulnerability repair difficulty level is low, the vulnerability type is a cross-site scripting attack vulnerability, the vulnerability location is on the product details page, the vulnerability threat level is medium, and it is assigned to the automated repair system.

[0105] In this way, by intelligently allocating vulnerability repair tasks to the automated repair end or the engineer end based on factors such as the vulnerability difficulty level, the efficiency of vulnerability repair is improved while ensuring that the vulnerability can be repaired.

[0106] In some embodiments, the preset rules of the smart contract are to perform regression testing and / or reproduction testing on the vulnerability repair results, and to perform security testing on the vulnerability repair results according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract, including:

[0107] Determine whether the vulnerability repair results are jointly signed by multiple preset management terminals;

[0108] When the vulnerability repair result is jointly signed by multiple preset management terminals, a regression test and / or a vulnerability reproduction test is performed on the vulnerability repair result.

[0109] In this embodiment, regression testing can be to re-run previous test cases after the code is modified to ensure that the modification does not introduce new problems; reproduction testing can be to re-trigger the fixed vulnerability to verify whether the vulnerability has indeed been resolved.

[0110] First, the system can determine whether the vulnerability repair results have been jointly signed by multiple preset management terminals.

[0111] In this step, the multi-signature mechanism in the blockchain network can be to require that a transaction or data change must be approved or signed by multiple preset management terminals;

[0112] If the vulnerability repair result is not jointly signed by these preset management terminals, then the vulnerability repair result will be considered invalid or untrusted, and the vulnerability needs to be repaired again.

[0113] When the vulnerability repair result is jointly signed by multiple preset management terminals, a regression test and / or a vulnerability reproduction test is performed on the vulnerability repair result.

[0114] In this step, the purpose of regression testing is to ensure that no new bugs have been introduced during the fix, while verifying that the surrounding code of the fixed vulnerability still works as expected. Vulnerability reproduction testing attempts to re-trigger the vulnerability under the same conditions to verify whether the vulnerability has indeed been successfully fixed.

[0115] The choice of regression testing and reproduction testing tools depends on the specific testing requirements, the type of system being tested, and the technology stack of the testing team. For example, tools such as Selenium, Watir, and Serenity BDD can be used to perform regression testing on vulnerability repair results; Postman, custom scripts, and tools can be used to perform reproduction testing on vulnerability repair results.

[0116] In this way, by combining the multi-signature mechanism of the blockchain network and the preset rules of the smart contract, this security detection method can ensure that the vulnerability repair results are not only recognized by multiple management terminals, but also undergo rigorous testing and verification, thereby greatly improving the security and stability of the system.

[0117] In some embodiments, obtaining at least one vulnerability repair task, wherein the at least one vulnerability repair task is generating a vulnerability detection report for smart contract parsing, includes:

[0118] Control the smart contract to parse the vulnerability detection report and obtain the vulnerability type, vulnerability location, and vulnerability threat level;

[0119] Generate a vulnerability repair plan based on vulnerability type, vulnerability location and vulnerability threat level. The repair plan includes the resources required to repair the vulnerability, the expected time for repair, and the difficulty level of vulnerability repair;

[0120] At least one vulnerability repair task is generated according to the vulnerability repair plan.

[0121] In this embodiment, the control smart contract parses the vulnerability detection report to obtain the vulnerability type, vulnerability location, and vulnerability threat level of the vulnerability;

[0122] In this step, by parsing the report, the smart contract can extract the type of vulnerability (such as buffer overflow, SQL injection, etc.), the specific location of the vulnerability in the code (such as file name, line number, etc.), and the threat level of the vulnerability (such as high, medium, low, etc.)

[0123] Generate a vulnerability repair plan based on vulnerability type, vulnerability location and vulnerability threat level. The repair plan includes the resources required to repair the vulnerability, the expected time for repair, and the difficulty level of vulnerability repair;

[0124] In this step, the repair plan will list in detail the resources required to repair the vulnerability (such as human resources, tools, permissions, patches of specific versions, etc.), the expected repair time (such as emergency repair, planned repair, etc.), and the difficulty level of the vulnerability repair (such as simple, medium, complex, etc.).

[0125] At least one vulnerability repair task is generated according to the vulnerability repair plan.

[0126] For example, the vulnerability detection report records that the vulnerability type is a SQL injection vulnerability, the vulnerability location is in the user login module, and the vulnerability threat level is high. The current repair plan is to apply the latest patch provided by the official, the expected time for repair is immediate, the difficulty level is medium, and it is assigned to security engineer A for processing.

[0127] For example, the vulnerability detection report records that the vulnerability type is a cross-site scripting attack vulnerability, the vulnerability location is on the product details page, and the vulnerability threat level is medium. The vulnerability repair plan is to modify the front-end code, strictly validate and escape the input, and the expected time for repair is during the maintenance window next Monday. The difficulty level is simple and is assigned to front-end development engineer B.

[0128] In this way, not only can vulnerability repair tasks be handled efficiently and the security of the system be improved, but also, because the entire process is based on blockchain and smart contracts, the data is immutable and transparent.

[0129] Figure 2 is a schematic diagram of the structure of a vulnerability protection device according to an embodiment of the present invention. Figure 2 As shown, the vulnerability protection device includes a vulnerability detection module 210, a vulnerability reporting module 220, a vulnerability repair module 230, a vulnerability verification module 240, and a consensus incentive module 250; wherein, the vulnerability detection module 210 is used to generate a vulnerability detection report; the vulnerability reporting module 220 is used to report the discovery of a vulnerability to the system and forward the vulnerability detection report; the vulnerability repair module 230 is used to upload the vulnerability detection report to the blockchain network and receive the vulnerability repair task sent by the blockchain network; the vulnerability verification module 240 is used to verify the vulnerability repair result; the consensus incentive module 250 is used to forward the vulnerability repair task and provide rewards when the task execution end cannot return the vulnerability repair result within the preset time, so that other execution ends can process the vulnerability repair task.

[0130] Figure 3FIG. 1 is a schematic diagram of the overall process of a vulnerability protection method according to an embodiment of the present invention. Figure 3 As shown, the following steps are included:

[0131] S310, vulnerability detection.

[0132] In S310 , the system may perform vulnerability detection based on a preset time interval.

[0133] S320: Generate a vulnerability detection report.

[0134] In S320, a variety of methods can be used to obtain a vulnerability detection report of the system. For example, the vulnerability detection report can be obtained by using automated scanning tools, manual penetration testing, comprehensive security assessment, etc. The system can be an information system, a network system, an operating system, a database system, or an Internet of Things system, etc.

[0135] S330, submit a vulnerability report.

[0136] In S330, the vulnerability detection report is uploaded to the blockchain network.

[0137] S340, smart contract fix.

[0138] In S340, a smart contract is installed on the blockchain network, and the smart contract can parse the vulnerability detection report and generate at least one vulnerability repair task.

[0139] S350, distribute repair tasks.

[0140] In S350, when at least one vulnerability repair task generated by the smart contract is obtained, the at least one vulnerability repair task can be sent to the task execution end.

[0141] S360, perform repair tasks.

[0142] In S360, the task execution end executes the obtained vulnerability repair task.

[0143] S370, verify the repair result.

[0144] In S370, the vulnerability repair results can be security checked according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract.

[0145] S380, stored in blockchain.

[0146] In S380, when the vulnerability repair result is verified, all information related to the repaired vulnerability is uploaded to the blockchain for backup.

[0147] Figure 4A schematic diagram of the structure of a vulnerability protection device provided in another embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0148] Reference Figure 4 , the vulnerability protection device 400 may include:

[0149] The acquisition module 401 is used to acquire a vulnerability detection report, wherein the vulnerability detection report includes the vulnerability type, vulnerability location and vulnerability threat level of the vulnerability that occurs in the system;

[0150] The upload module 402 is used to upload the vulnerability detection report to the blockchain network, where the blockchain network is deployed with a smart contract, which is used to represent the automatic execution of the contract content according to preset rules;

[0151] The acquisition module 401 is further used to acquire at least one vulnerability repair task, wherein the at least one vulnerability repair task is to generate a vulnerability detection report for smart contract parsing, and the vulnerability repair task includes a difficulty level of the vulnerability repair;

[0152] A determination module 403, configured to determine a task execution end of at least one vulnerability repair task according to the difficulty level, and issue the corresponding vulnerability repair task to the task execution end;

[0153] The acquisition module 401 is also used to obtain the vulnerability repair result returned by the task execution end;

[0154] A detection module 404 is used to perform security detection on the vulnerability repair results according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract;

[0155] The determination module 403 is further used to determine that the vulnerability repair is complete when the vulnerability repair result passes the security detection.

[0156] In some embodiments, the acquisition module 401 may include the following units:

[0157] An acquisition unit, used to acquire behavior data and status data of the system based on a preset time interval;

[0158] An input unit, used to input behavior data and status data into a machine learning model for vulnerability detection to obtain detection results;

[0159] An analysis unit, for performing static analysis and / or dynamic analysis on the vulnerability to obtain an initial detection report when the detection result shows that the system has a vulnerability;

[0160] The extraction unit is used to extract deep information from the initial detection report using the test management and visualization platform. The deep information includes vulnerability type, vulnerability location, and vulnerability threat level to obtain a vulnerability detection report.

[0161] In some embodiments, the upload module 402 may include the following units:

[0162] An acquisition unit, used to acquire preset upload rules of the blockchain network, where the preset upload rules are set based on smart contracts;

[0163] A processing unit, used for converting the format of the vulnerability detection report according to a preset upload rule;

[0164] The uploading unit is used to upload the vulnerability detection report after format conversion to the blockchain network.

[0165] In some embodiments, the determination module 403 may also be used to:

[0166] For each vulnerability repair task in at least one vulnerability repair task, when the vulnerability difficulty level is low, the task execution end of the vulnerability repair task is determined to be the automated repair end; when the vulnerability difficulty level is medium or high, the task execution end of the vulnerability repair task is determined to be the engineer end.

[0167] In some embodiments, the detection module 404 may include the following units:

[0168] A judgment unit, used to judge whether the vulnerability repair result is jointly signed by multiple preset management terminals;

[0169] The testing unit is used to perform regression testing and / or vulnerability reproduction testing on the vulnerability repair results when the vulnerability repair results are jointly signed by multiple preset management terminals.

[0170] In some embodiments, the acquisition module 401 may include the following units:

[0171] The control unit is used to control the smart contract to parse the vulnerability detection report and obtain the vulnerability type, vulnerability location, and vulnerability threat level;

[0172] A generation unit, used to generate a vulnerability repair plan according to the vulnerability type, vulnerability location and vulnerability threat level, wherein the repair plan includes resources required to repair the vulnerability, expected repair time and difficulty level of the vulnerability repair;

[0173] At least one vulnerability repair task is generated according to the vulnerability repair plan.

[0174] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application, and are devices corresponding to the above-mentioned vulnerability protection method. All implementation methods in the above-mentioned method embodiment are applicable to the embodiment of the device. Its specific functions and technical effects can be found in the method embodiment part, which will not be repeated here.

[0175] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0176] Figure 5 is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 5 As shown:

[0177] The device may include a processor 501 and a memory 502 storing programs or instructions.

[0178] When the processor 501 executes the program, the steps in any of the above method embodiments are implemented.

[0179] Exemplarily, the program may be divided into one or more modules / units, one or more modules / units are stored in the memory 502, and executed by the processor 501 to complete the present application. One or more modules / units may be a series of program instruction segments capable of completing a specific function, and the instruction segments are used to describe the execution process of the program in the device.

[0180] Specifically, the processor 501 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0181] The memory 502 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 502 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 502 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 502 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 502 is a non-volatile solid-state memory.

[0182] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0183] The processor 501 implements any one of the methods in the above embodiments by reading and executing the program or instruction stored in the memory 502 .

[0184] In one example, the electronic device may further include a communication interface 503 and a bus 504. The processor 501, the memory 502, and the communication interface 503 are connected via the bus 504 and communicate with each other.

[0185] The communication interface 503 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0186] Bus 504 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 504 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0187] In addition, in combination with the method in the above embodiment, the embodiment of the present application may provide a computer-readable storage medium for implementation. The computer-readable storage medium stores a program or instruction; when the program or instruction is executed by a processor, any one of the methods in the above embodiment is implemented. The computer-readable storage medium can be read by a machine such as a computer.

[0188] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0189] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0190] An embodiment of the present application provides a computer program product, which is stored in a computer-readable storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0191] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0192] The functional modules shown in the above block diagram can be implemented as hardware, software, firmware or their combination. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. Programs or code segments can be stored in machine-readable media, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable media" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. Code segments can be downloaded via computer grids such as the Internet, intranets, etc.

[0193] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0194] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by a computer program or instruction. These programs or instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0195] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A vulnerability protection method, characterized in that: The method comprises: Obtaining a vulnerability detection report, wherein the vulnerability detection report includes the vulnerability type, vulnerability location, and vulnerability threat level of the vulnerability that occurs in the system; Uploading the vulnerability detection report to a blockchain network, wherein the blockchain network is deployed with a smart contract, wherein the smart contract is used to automatically execute the contract content according to preset rules; Acquire at least one vulnerability repair task, where the at least one vulnerability repair task is generated by parsing the vulnerability detection report by the smart contract, and the vulnerability repair task includes a difficulty level of the vulnerability repair; Determine a task execution end of the at least one vulnerability repair task according to the difficulty level, and issue a corresponding vulnerability repair task to the task execution end; Obtain the vulnerability repair result returned by the task execution end; Performing security testing on the vulnerability repair results according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract; When the vulnerability repair result passes the security check, it is determined that the vulnerability repair is complete.

2. The method according to claim 1, characterized in that The obtaining of the vulnerability detection report includes: Acquiring behavior data and status data of the system based on a preset time interval; Inputting the behavior data and the status data into a machine learning model to perform vulnerability detection and obtain a detection result; When the detection result shows that the system has a vulnerability, static analysis and / or dynamic analysis are performed on the vulnerability to obtain an initial detection report; A test management and visualization platform is used to extract deep information from the initial detection report, wherein the deep information includes vulnerability type, vulnerability location, and vulnerability threat level, to obtain the vulnerability detection report.

3. The method according to claim 1, characterized in that The uploading of the vulnerability detection report to the blockchain network includes: Obtaining a preset upload rule of the blockchain network, wherein the preset upload rule is set based on the smart contract; Convert the format of the vulnerability detection report according to the preset upload rule; The vulnerability detection report after the format conversion is uploaded to the blockchain network.

4. The method according to claim 1, characterized in that The task execution end includes an automated repair end and an engineer end; The determining the task execution end of the at least one vulnerability repair task according to the difficulty level includes: For each vulnerability repair task in the at least one vulnerability repair task, when the vulnerability difficulty level is low, the task execution end of the vulnerability repair task is determined to be the automated repair end; when the vulnerability difficulty level is medium or high, the task execution end of the vulnerability repair task is determined to be the engineer end.

5. The method according to claim 1, characterized in that The preset rules of the smart contract are to perform regression testing and / or reproduction testing on the vulnerability repair results, and the security testing of the vulnerability repair results according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract includes: Determine whether the vulnerability repair result is jointly signed by multiple preset management terminals; When the vulnerability repair result is jointly signed by the plurality of preset management terminals, a regression test and / or a vulnerability reproduction test is performed on the vulnerability repair result.

6. The method according to claim 1, characterized in that The obtaining of at least one vulnerability repair task, wherein the at least one vulnerability repair task is generated by parsing the vulnerability detection report by the smart contract, includes: Control the smart contract to parse the vulnerability detection report to obtain the vulnerability type, vulnerability location, and vulnerability threat level of the vulnerability; Generate a repair plan for the vulnerability according to the vulnerability type, the vulnerability location and the vulnerability threat level, wherein the repair plan includes resources required to repair the vulnerability, an expected repair time and a difficulty level of the vulnerability repair; The at least one vulnerability repair task is generated according to the repair plan of the vulnerability.

7. A vulnerability protection device, characterized in that: The device comprises: An acquisition module is used to acquire a vulnerability detection report, wherein the vulnerability detection report includes the vulnerability type, vulnerability location and vulnerability threat level of the vulnerability that occurs in the system; An uploading module, used to upload the vulnerability detection report to a blockchain network, where a smart contract is deployed, and the smart contract is used to automatically execute the contract content according to preset rules; The acquisition module is further used to acquire at least one vulnerability repair task, where the at least one vulnerability repair task is generated by the smart contract parsing the vulnerability detection report, and the vulnerability repair task includes a difficulty level of the vulnerability repair; A determination module, configured to determine a task execution end of the at least one vulnerability repair task according to the difficulty level, and issue a corresponding vulnerability repair task to the task execution end; The acquisition module is also used to obtain the vulnerability repair result returned by the task execution end; A monitoring module, used to perform security detection on the vulnerability repair result according to the multi-signature mechanism of the blockchain network and the preset rules of the smart contract; The determination module is further used to determine that the vulnerability repair is complete when the vulnerability repair result passes the security detection.

8. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method according to any one of claims 1 to 6.

Images