Port vulnerability scanning event processing method and device, equipment and storage medium

Abstract

The invention relates to the technical field of internet security, and discloses a port vulnerability scanning event processing method, device and equipment and a storage medium, and the method comprises the steps: analyzing a port vulnerability scanning event, and obtaining a vulnerability analysis result; extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result; determining a preset troubleshooting strategy according to the attack address information; and processing the port vulnerability scanning event based on a preset troubleshooting strategy. Compared with the prior art that a user needs to monitor the access condition of a server or a host in real time and then needs to manually process a port vulnerability scanning event, the method only needs to extract the attack address information from the port vulnerability scanning event, and then processes the port vulnerability scanning event according to the preset troubleshooting strategy of the attack address information, so that the processing efficiency of the port vulnerability scanning event is improved. Therefore, the processing efficiency of the port vulnerability scanning event is improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to a port vulnerability scanning event processing method, device, equipment and storage medium. Background Art

[0002] Port vulnerability scanning is a method of collecting information by which attackers scan servers or hosts to discover their open ports, services, and existing security vulnerabilities, thereby preparing for subsequent attacks. In the prior art, users are required to monitor the access to servers or hosts in real time, determine port vulnerability scanning events based on manual experience, and then manually handle port vulnerability scanning events, resulting in low efficiency in handling port vulnerability scanning events.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a port vulnerability scanning event processing method, device, equipment and storage medium, aiming to solve the technical problem of how to improve the processing efficiency of port vulnerability scanning events.

[0005] To achieve the above object, the present invention provides a method for processing a port vulnerability scanning event, the method comprising the following steps:

[0006] Analyze port vulnerability scanning events and obtain vulnerability analysis results;

[0007] Extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result;

[0008] Determine a preset troubleshooting strategy based on the attack address information;

[0009] The port vulnerability scanning event is processed based on the preset troubleshooting strategy.

[0010] Optionally, before the step of analyzing the port vulnerability scanning event to obtain the vulnerability analysis result, the step further includes:

[0011] Get the suspicious access object corresponding to the port;

[0012] Determine the port access duration of the suspicious access object;

[0013] When the port access duration is greater than the preset stay duration, a port vulnerability scanning event is generated according to the port access duration and the suspicious access object.

[0014] Optionally, the step of generating a port vulnerability scanning event according to the port access duration and the suspicious access object includes:

[0015] Obtaining access behavior information of the suspicious access object;

[0016] Analyze the access behavior information to obtain behavior analysis results;

[0017] When the behavior analysis result is a scanning behavior, a port vulnerability scanning event is generated according to the access behavior information, the port access duration and the suspicious access object.

[0018] Optionally, after the step of determining the port access duration of the suspicious access object, the method further includes:

[0019] When the port access duration is less than or equal to the preset stay duration, determining the protocol address information of the suspicious access object;

[0020] Determine whether the protocol address information exists in a preset blacklist;

[0021] If the protocol address information exists in the preset blacklist, a port vulnerability scanning event is generated according to the port access duration, the protocol address information and the suspicious access object.

[0022] Optionally, after the step of determining whether the protocol address information exists in a preset blacklist, the method further includes:

[0023] If the protocol address information does not exist in the preset blacklist, determining the access dwell time difference according to the port access duration and the preset dwell time;

[0024] When the access stay time difference is less than the preset stay time difference, the protocol address information of the suspicious access object is added to the preset blacklist for storage.

[0025] Optionally, the step of extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result includes:

[0026] Determine whether the vulnerability analysis result meets the preset scanning success condition;

[0027] When the vulnerability analysis result does not meet the preset scanning success condition, the attack address information is extracted from the port vulnerability scanning event.

[0028] Optionally, the step of extracting attack address information from the port vulnerability scanning event includes:

[0029] Determine the scanning event type according to the port vulnerability scanning event;

[0030] Determine the attack address keyword according to the scanning event type;

[0031] Attack address information is extracted from the port vulnerability scanning event according to the attack address keyword.

[0032] Optionally, after the step of determining whether the vulnerability analysis result meets a preset scanning success condition, the step further includes:

[0033] When the vulnerability analysis result meets the preset scanning success condition, determining the vulnerability event level according to the port vulnerability scanning event and the vulnerability analysis result;

[0034] Determine a preset vulnerability strategy according to the vulnerability event level;

[0035] The port vulnerability scanning event is processed according to the preset vulnerability strategy.

[0036] Optionally, the step of processing the port vulnerability scanning event according to the preset vulnerability policy includes:

[0037] Determining a port management terminal according to the vulnerability event level;

[0038] Generate a vulnerability rectification process report based on the port vulnerability scanning event, the vulnerability analysis result and the preset vulnerability strategy;

[0039] The port vulnerability scanning event is processed through the port management terminal according to the vulnerability rectification process report.

[0040] Optionally, the step of determining a preset troubleshooting strategy according to the attack address information includes:

[0041] Extracting address keywords from the attack address information;

[0042] Determine the attack address type according to the address keyword;

[0043] A preset troubleshooting strategy corresponding to the attack address information is determined according to the attack address type.

[0044] Optionally, the step of determining a preset troubleshooting strategy corresponding to the attack address information according to the attack address type includes:

[0045] Determine whether the attack address type is consistent with the preset intranet type;

[0046] When the attack address type is consistent with the preset intranet type, determining vulnerability scanning process information according to the port vulnerability scanning event;

[0047] When the vulnerability scanning process information does not meet the preset attack condition, a preset troubleshooting strategy corresponding to the attack address information is determined according to the attack address type and the vulnerability scanning process information.

[0048] Optionally, after the step of determining whether the attack address type is consistent with a preset intranet type, the method further includes:

[0049] When the attack address type is inconsistent with the preset intranet type, determining a security linkage device according to the port vulnerability scanning event;

[0050] The port vulnerability scanning event is processed by the security linkage device.

[0051] In addition, to achieve the above-mentioned purpose, the present invention also proposes a port vulnerability scanning event processing device, the port vulnerability scanning event processing device comprising:

[0052] An analysis module is used to analyze port vulnerability scanning events and obtain vulnerability analysis results;

[0053] An extraction module, used for extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result;

[0054] A determination module, used to determine a preset troubleshooting strategy according to the attack address information;

[0055] A processing module is used to process the port vulnerability scanning event based on the preset troubleshooting strategy.

[0056] Optionally, the port vulnerability scanning event processing device further includes a generating module;

[0057] The generating module is used to obtain the suspicious access object corresponding to the port;

[0058] The generating module is further used to determine the port access duration of the suspicious access object;

[0059] The generating module is further configured to generate a port vulnerability scanning event according to the port access duration and the suspicious access object when the port access duration is greater than a preset stay duration.

[0060] Optionally, the generating module is further used to obtain access behavior information of the suspicious access object;

[0061] The generating module is further used to analyze the access behavior information to obtain a behavior analysis result;

[0062] The generation module is further configured to generate a port vulnerability scanning event according to the access behavior information, the port access duration and the suspicious access object when the behavior analysis result is a scanning behavior.

[0063] Optionally, the extraction module is further used to determine whether the vulnerability analysis result meets a preset scanning success condition;

[0064] The extraction module is further configured to extract attack address information from the port vulnerability scanning event when the vulnerability analysis result does not meet the preset scanning success condition.

[0065] Optionally, the determination module is further used to extract address keywords from the attack address information;

[0066] The determination module is further used to determine the attack address type according to the address keyword;

[0067] The determination module is further used to determine a preset troubleshooting strategy corresponding to the attack address information according to the attack address type.

[0068] Optionally, the determination module is further used to determine whether the attack address type is consistent with a preset intranet type;

[0069] The determination module is further configured to determine vulnerability scanning process information according to the port vulnerability scanning event when the attack address type is consistent with the preset intranet type;

[0070] The determination module is further configured to determine a preset troubleshooting strategy corresponding to the attack address information according to the attack address type and the vulnerability scanning process information when the vulnerability scanning process information does not meet a preset attack condition.

[0071] In addition, to achieve the above-mentioned purpose, the present invention also proposes a port vulnerability scanning event processing device, which includes: a memory, a processor, and a port vulnerability scanning event handler stored on the memory and executable on the processor, and the port vulnerability scanning event handler is configured to implement the steps of the port vulnerability scanning event processing method described above.

[0072] In addition, to achieve the above objectives, the present invention also proposes a storage medium, on which a port vulnerability scanning event handler is stored, and when the port vulnerability scanning event handler is executed by a processor, the steps of the port vulnerability scanning event processing method described above are implemented.

[0073] The present invention first analyzes the port vulnerability scanning event to obtain the vulnerability analysis result, then extracts the attack address information from the port vulnerability scanning event according to the vulnerability analysis result, then determines the preset troubleshooting strategy according to the attack address information, and finally processes the port vulnerability scanning event based on the preset troubleshooting strategy. Compared with the prior art, which requires users to monitor the port access situation in real time and then manually process the port vulnerability scanning event, the present invention only needs to extract the attack address information from the port vulnerability scanning event, and then processes the port vulnerability scanning event according to the preset troubleshooting strategy of the attack address information, thereby improving the processing efficiency of the port vulnerability scanning event, and then improving the overall security capability and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 It is a structural diagram of a port vulnerability scanning event processing device in a hardware operating environment involved in an embodiment of the present invention;

[0075] Figure 2 It is a flow chart of the first embodiment of the method for processing port vulnerability scanning events of the present invention;

[0076] Figure 3 It is a flow chart of the second embodiment of the method for processing port vulnerability scanning events of the present invention;

[0077] Figure 4 It is a flow chart of the third embodiment of the method for processing port vulnerability scanning events of the present invention;

[0078] Figure 5 It is a structural block diagram of the first embodiment of the port vulnerability scanning event processing device of the present invention.

[0079] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0080] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0081] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of the structure of a port vulnerability scanning event processing device in a hardware operating environment according to an embodiment of the present invention.

[0082] like Figure 1As shown, the port vulnerability scanning event processing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0083] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the port vulnerability scanning event processing device, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0084] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a port vulnerability scanning event processing program.

[0085] exist Figure 1 In the port vulnerability scanning event processing device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the port vulnerability scanning event processing device of the present invention can be set in the port vulnerability scanning event processing device, and the port vulnerability scanning event processing device calls the port vulnerability scanning event processing program stored in the memory 1005 through the processor 1001, and executes the port vulnerability scanning event processing method provided by the embodiment of the present invention.

[0086] The embodiment of the present invention provides a method for processing a port vulnerability scanning event, referring to Figure 2 , Figure 2 It is a flowchart of the first embodiment of the method for processing port vulnerability scanning events of the present invention.

[0087] In this embodiment, the port vulnerability scanning event processing method includes the following steps:

[0088] Step S10: Analyze the port vulnerability scanning event to obtain vulnerability analysis results.

[0089] It is easy to understand that the execution subject of this embodiment can be a port vulnerability scanning event processing device with functions such as data processing, network communication and program running, or it can be other computer devices with similar functions, and this embodiment is not limited.

[0090] It is understandable that port vulnerability scanning is an event in which an attacker scans a server or host to discover its open ports, services, and existing security vulnerabilities. The vulnerability analysis result can be a successful port vulnerability scan or a failed port vulnerability scan.

[0091] Furthermore, in order to accurately obtain port vulnerability scanning events, the port vulnerability scanning events are analyzed. Before obtaining the vulnerability analysis results, it is necessary to obtain the suspicious access object corresponding to the port and determine the port access duration of the suspicious access object. When the port access duration is greater than the preset stay time, a port vulnerability scanning event is generated based on the port access duration and the suspicious access object.

[0092] It should be noted that the suspicious access object can be an object that accesses a server or a host, including normal access objects and port vulnerability scanning objects. The port access duration is the duration of the suspicious access object accessing the server or host, and the preset stay duration can be customized by the user, such as 10 minutes or 50 seconds.

[0093] Assume that the suspicious access objects corresponding to the port are object A and object B, where the port access duration corresponding to object A is 50s, the port access duration corresponding to object B is 60s, and the preset stay time is 55s. If the port access duration corresponding to object B is greater than the preset stay time, it is determined that object B may scan the server or host, and a port vulnerability scanning event needs to be generated based on object B and the port access duration corresponding to object B.

[0094] In a specific implementation, a method for generating a port vulnerability scanning event based on port access duration and suspicious access objects is to obtain access behavior information of suspicious access objects, then analyze the access behavior information to obtain a behavior analysis result; when the behavior analysis result is a scanning behavior, a port vulnerability scanning event is generated based on the access behavior information, port access duration, and suspicious access objects.

[0095] It should also be understood that the behavior analysis results can be scanning behavior or access behavior, wherein scanning behavior is the behavior of a suspicious access object scanning a server or host, etc., and access behavior is the behavior of a suspicious access object normally accessing a server or host, etc.

[0096] In this embodiment, when the port access duration is less than or equal to the preset residence time, the protocol address information of the suspicious access object is determined, and then it is determined whether the protocol address information exists in the preset blacklist. When the protocol address information exists in the preset blacklist, a port vulnerability scanning event is generated based on the port access duration, the protocol address information and the suspicious access object.

[0097] It should be noted that the preset blacklist is a list of attack addresses of blacklisted scanning servers or hosts that is pre-established by the user, wherein the preset blacklist contains multiple attack addresses, namely, protocol address information, etc.

[0098] Assuming that the port access time 40s corresponding to the suspicious access object C is less than the preset stay time 55s, it is necessary to search for the protocol address information corresponding to the suspicious access object C in the preset blacklist. If it exists, it means that the suspicious access object C has previously scanned the server or host. The port vulnerability scanning event can be directly generated based on the port access time and protocol address information corresponding to the suspicious access object C.

[0099] In a specific implementation, if the protocol address information does not exist in the preset blacklist, the access-dwelling time difference is determined based on the port access time and the preset dwelling time. When the access-dwelling time difference is less than the preset dwelling time difference, the protocol address information of the suspicious access object is added to the preset blacklist for storage.

[0100] It should be understood that the preset dwell time difference may be a user-defined setting, which may be 10 seconds, 20 seconds, etc., and this embodiment is not limited thereto.

[0101] Assuming that the port access time corresponding to the suspicious access object D is 40s and the preset stay time is 55s, the access stay time difference between the port access time and the preset stay time is 15s, and the preset stay time difference is 20s, then the protocol address information corresponding to the suspicious access object D needs to be added to the preset blacklist for storage.

[0102] In this embodiment, the scanning behavior can also be discovered through a traffic detection device or a log detection device, and then a port vulnerability scanning event is generated according to the scanning behavior, and the port vulnerability scanning event is analyzed to obtain a vulnerability analysis result.

[0103] Step S20: extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result.

[0104] In the specific implementation, it is also necessary to determine whether the vulnerability analysis result meets the preset scanning success condition. When the vulnerability analysis result does not meet the preset scanning success condition, the attack address information is extracted from the port vulnerability scanning event.

[0105] It should be noted that the attack address information may be the address of the event initiator of the vulnerability scanning event, etc. The preset scanning success condition may be that the vulnerability analysis result is a vulnerability scanning success, etc. In a specific implementation, if there are a large number of requested web pages that cannot be found by the server in the vulnerability analysis result, or the status code is the content of the request being successfully processed, or whether the returned result contains sensitive data, etc., the vulnerability analysis result is determined to be a vulnerability scanning success.

[0106] In this embodiment, when the vulnerability analysis result meets the preset scanning success condition, the vulnerability event level is determined according to the port vulnerability scanning event and the vulnerability analysis result, the preset vulnerability policy is determined according to the vulnerability event level, and the port vulnerability scanning event is processed according to the preset vulnerability policy.

[0107] It should be understood that the vulnerability event level can be customized by the user, and the vulnerability event level can also be determined according to the scan event type, where the vulnerability event level can be high or low, etc. The preset vulnerability policy can be customized by the user, and can be used to notify relevant personnel for emergency processing, shut down services or host offline or restrict access, etc., and issue a vulnerability rectification notice.

[0108] Furthermore, in order to speed up the success of vulnerability scanning events, the step of processing port vulnerability scanning events according to preset vulnerability policies can be to determine the port management terminal according to the vulnerability event level, and then generate a vulnerability rectification process report based on the port vulnerability scanning event, vulnerability analysis results and preset vulnerability policies, and process the port vulnerability scanning event through the port management terminal according to the vulnerability rectification process report.

[0109] It should be noted that the vulnerability rectification process report can be understood as the operational process for rectifying the vulnerability. The vulnerability rectification process report can then be sent to the port management terminal so that the person in charge of the port management terminal can handle the port vulnerability scanning event according to the vulnerability rectification process report.

[0110] It should also be understood that when the vulnerability analysis result meets the preset scanning success condition, it is determined that the suspicious access object scans the server or host successfully; when the vulnerability analysis result does not meet the preset scanning success condition, it is determined that the suspicious access object scans the server or host failed, etc.

[0111] Furthermore, in order to accurately extract the attack address information, the processing method for extracting the attack address information from the port vulnerability scanning event summary can be to determine the scanning event type according to the port vulnerability scanning event, then determine the attack address keyword according to the scanning event type, and finally extract the attack address information from the port vulnerability scanning event according to the attack address keyword.

[0112] It should also be noted that the scanning event type can be a scanning server type or a scanning host type. Since the server and the host are different, the corresponding attack address keywords are also different. It is necessary to extract the attack address information from a specific location in the port vulnerability scanning event based on the attack address keyword.

[0113] Step S30: Determine a preset troubleshooting strategy according to the attack address information.

[0114] It should also be understood that the attack address information may be WAN address information, i.e., external network information, or LAN address information, i.e., internal network information, etc. The preset troubleshooting strategy may be user-defined, such as linking a firewall or other device to perform blocking or false alarm troubleshooting.

[0115] Furthermore, in order to accurately determine the preset troubleshooting strategy, the processing method for determining the preset troubleshooting strategy based on the attack address information can be to extract address keywords from the attack address, then determine the attack address type based on the address keywords, and determine the preset troubleshooting strategy corresponding to the attack address information based on the attack address type.

[0116] It should be noted that since the attack address information includes the intranet and the extranet, the preset troubleshooting strategies corresponding to the intranet and the extranet are completely different. The attack address type includes the intranet type and the extranet type.

[0117] In this embodiment, it is also necessary to determine whether the attack address type is consistent with the preset intranet type. When the attack address type is consistent with the preset intranet type, the vulnerability scanning process information is determined according to the port vulnerability scanning event. When the vulnerability scanning process information does not meet the preset attack conditions, the preset troubleshooting strategy corresponding to the attack address information is determined according to the attack address type and the vulnerability scanning process information; when the attack address type is inconsistent with the preset intranet type, the security linkage device is determined according to the port vulnerability scanning event, and the port vulnerability scanning event is processed by the security linkage device.

[0118] It should also be understood that the security linkage device can be a firewall device, etc. The preset attack condition can be vulnerability scanning process information, scanning false positive information, etc. If it is not scanning false positive information, it is necessary to notify relevant personnel to conduct on-machine investigation of the attack address information; if it is a false positive caused by internal testing, etc., rule optimization processing is performed.

[0119] Step S40: Processing the port vulnerability scanning event based on the preset troubleshooting strategy.

[0120] In the specific implementation, if the attack address information belongs to the external network address information, the firewall and other devices will be linked to block it to prevent it from continuing to scan and detect; if the attack address information belongs to the internal network address information, the false alarm investigation stage will be carried out. Check whether it is a false alarm caused by internal testing, etc. If not, notify the relevant personnel to conduct an on-machine investigation of the attack address information; if it is a false alarm caused by internal testing, optimize the rules; finally, summarize and review the reasons for the intrusion and the deficiencies in restoring data or business, thereby improving the overall security capabilities.

[0121] In this embodiment, the port vulnerability scanning event is first analyzed to obtain the vulnerability analysis result, and then the attack address information is extracted from the port vulnerability scanning event according to the vulnerability analysis result, and then the preset troubleshooting strategy is determined according to the attack address information, and finally the port vulnerability scanning event is processed based on the preset troubleshooting strategy. Compared with the prior art, which requires users to monitor the port access situation in real time and then manually process the port vulnerability scanning event, in this embodiment, only the attack address information needs to be extracted from the port vulnerability scanning event, and then the port vulnerability scanning event is processed according to the preset troubleshooting strategy of the attack address information, thereby improving the processing efficiency of the port vulnerability scanning event, and then improving the overall security capabilities and user experience.

[0122] refer to Figure 3 , Figure 3 It is a flow chart of the second embodiment of the method for processing port vulnerability scanning events of the present invention.

[0123] Based on the first embodiment above, in this embodiment, before step S10, the following steps are further included:

[0124] Step S001: Obtain the suspicious access object corresponding to the port.

[0125] It should be noted that the suspicious access object may be an object accessing a server or a host, wherein the suspicious access object includes a normal access object and a port vulnerability scanning object.

[0126] Step S002: Determine the port access duration of the suspicious access object.

[0127] It should be understood that the port access duration is the duration for a suspicious access object to access a server or a host, such as 50 seconds or 1 minute.

[0128] Step S003: when the port access duration is greater than the preset stay duration, a port vulnerability scanning event is generated according to the port access duration and the suspicious access object.

[0129] In a specific implementation, a method for generating a port vulnerability scanning event based on port access duration and suspicious access objects is to obtain access behavior information of suspicious access objects, then analyze the access behavior information to obtain a behavior analysis result; when the behavior analysis result is a scanning behavior, a port vulnerability scanning event is generated based on the access behavior information, port access duration, and suspicious access objects.

[0130] It should also be understood that the behavior analysis results can be scanning behavior or access behavior, wherein scanning behavior is the behavior of a suspicious access object scanning a server or host, etc., and access behavior is the behavior of a suspicious access object normally accessing a server or host, etc.

[0131] In this embodiment, when the port access duration is less than or equal to the preset residence time, the protocol address information of the suspicious access object is determined, and then it is determined whether the protocol address information exists in the preset blacklist. When the protocol address information exists in the preset blacklist, a port vulnerability scanning event is generated based on the port access duration, the protocol address information and the suspicious access object.

[0132] It should be noted that the preset blacklist is a list of attack addresses of blacklisted scanning servers or hosts that is pre-established by the user, wherein the preset blacklist contains multiple attack addresses, namely, protocol address information, etc.

[0133] Assuming that the port access time 40s corresponding to the suspicious access object C is less than the preset stay time 55s, it is necessary to search for the protocol address information corresponding to the suspicious access object C in the preset blacklist. If it exists, it means that the suspicious access object C has previously scanned the server or host. The port vulnerability scanning event can be directly generated based on the port access time and protocol address information corresponding to the suspicious access object C.

[0134] In a specific implementation, if the protocol address information does not exist in the preset blacklist, the access-dwelling time difference is determined based on the port access time and the preset dwelling time. When the access-dwelling time difference is less than the preset dwelling time difference, the protocol address information of the suspicious access object is added to the preset blacklist for storage.

[0135] It should be understood that the preset dwell time difference may be a user-defined setting, which may be 10 seconds, 20 seconds, etc., and this embodiment is not limited thereto.

[0136] Assuming that the port access time corresponding to the suspicious access object D is 40s and the preset stay time is 55s, the access stay time difference between the port access time and the preset stay time is 15s, and the preset stay time difference is 20s, then the protocol address information corresponding to the suspicious access object D needs to be added to the preset blacklist for storage.

[0137] In this embodiment, the suspicious access object corresponding to the port is first obtained, and the port access duration of the suspicious access object is determined. When the port access duration is greater than the preset stay duration, a port vulnerability scanning event is generated based on the port access duration and the suspicious access object. Compared with the prior art, a port vulnerability scanning event is determined to have occurred only when the information of the server or host is collected. In this embodiment, the suspicious access object is determined based on the port access duration, and then a port vulnerability scanning event is generated based on the suspicious access object, thereby improving the sensitivity of perceiving port vulnerability scanning events.

[0138] refer to Figure 4 , Figure 4 It is a flowchart diagram of the third embodiment of the port vulnerability scanning event processing method of the present invention.

[0139] Based on the above first embodiment, in this embodiment, step S20 includes:

[0140] Step S201: Determine whether the vulnerability analysis result meets a preset scanning success condition.

[0141] It should be understood that the vulnerability analysis results include a large number of web pages that the server cannot find the requested content, or the status code indicates that the request was successfully processed, or whether the return result contains sensitive data, etc. The preset scanning success conditions may be that in the vulnerability analysis results, there are a large number of web pages that the server cannot find the requested content, or the status code indicates that the request was successfully processed, or whether the return result contains sensitive data, etc.

[0142] Step S202: When the vulnerability analysis result does not meet the preset scanning success condition, extracting attack address information from the port vulnerability scanning event.

[0143] In a specific implementation, if there are a large number of web pages that the server cannot find the requested web page in the vulnerability analysis results, or the status code indicates that the requested content is successfully processed, or whether the returned result contains sensitive data, etc., the vulnerability analysis result is determined to be a successful vulnerability scan. If there are no large number of web pages that the server cannot find the requested web page in the vulnerability analysis results, or the status code indicates that the requested content is successfully processed, or whether the returned result contains sensitive data, etc., the vulnerability analysis result is determined to be a failed vulnerability scan.

[0144] In this embodiment, when the vulnerability analysis result meets the preset scanning success condition, the vulnerability event level is determined according to the port vulnerability scanning event and the vulnerability analysis result, the preset vulnerability policy is determined according to the vulnerability event level, and the port vulnerability scanning event is processed according to the preset vulnerability policy.

[0145] It should be understood that the vulnerability event level can be customized by the user, and the vulnerability event level can also be determined according to the scan event type, where the vulnerability event level can be high or low, etc. The preset vulnerability policy can be customized by the user, and can be used to notify relevant personnel for emergency processing, shut down services or host offline or restrict access, etc., and issue a vulnerability rectification notice.

[0146] Furthermore, in order to speed up the success of vulnerability scanning events, the step of processing port vulnerability scanning events according to preset vulnerability policies can be to determine the port management terminal according to the vulnerability event level, and then generate a vulnerability rectification process report based on the port vulnerability scanning event, vulnerability analysis results and preset vulnerability policies, and process the port vulnerability scanning event through the port management terminal according to the vulnerability rectification process report.

[0147] It should be noted that the vulnerability rectification process report can be understood as the operational process for rectifying the vulnerability. The vulnerability rectification process report can then be sent to the port management terminal so that the person in charge of the port management terminal can handle the port vulnerability scanning event according to the vulnerability rectification process report.

[0148] It should also be understood that when the vulnerability analysis result meets the preset scanning success condition, it is determined that the suspicious access object scans the server or host successfully; when the vulnerability analysis result does not meet the preset scanning success condition, it is determined that the suspicious access object scans the server or host failed, etc.

[0149] Furthermore, in order to accurately extract the attack address information, the processing method for extracting the attack address information from the port vulnerability scanning event summary can be to determine the scanning event type according to the port vulnerability scanning event, then determine the attack address keyword according to the scanning event type, and finally extract the attack address information from the port vulnerability scanning event according to the attack address keyword.

[0150] It should also be noted that the scanning event type can be a scanning server type or a scanning host type. Since the server and the host are different, the corresponding attack address keywords are also different. It is necessary to extract the attack address information from a specific location in the port vulnerability scanning event based on the attack address keyword.

[0151] In this embodiment, it is determined whether the vulnerability analysis result meets the preset scanning success condition. When the vulnerability analysis result does not meet the preset scanning success condition, the attack address information is extracted from the port vulnerability scanning event. Compared with the prior art, when the vulnerability analysis result does not meet the preset scanning success condition, the vulnerability scanning event is not processed. In this embodiment, it is necessary to extract the attack address information from the port vulnerability scanning event, and further analyze the port vulnerability scanning event based on the attack address information, thereby improving the overall security capability.

[0152] Reference Figure 5 , Figure 5 It is a structural block diagram of the first embodiment of the port vulnerability scanning event processing device of the present invention.

[0153] like Figure 5 As shown, the port vulnerability scanning event processing device proposed in the embodiment of the present invention includes:

[0154] The analysis module 5001 is used to analyze the port vulnerability scanning event and obtain the vulnerability analysis result.

[0155] It is understandable that port vulnerability scanning is an event in which an attacker scans a server or host to discover its open ports, services, and existing security vulnerabilities. The vulnerability analysis result can be a successful port vulnerability scan or a failed port vulnerability scan.

[0156] Furthermore, in order to accurately obtain port vulnerability scanning events, the port vulnerability scanning events are analyzed. Before obtaining the vulnerability analysis results, it is necessary to obtain the suspicious access object corresponding to the port and determine the port access duration of the suspicious access object. When the port access duration is greater than the preset stay time, a port vulnerability scanning event is generated based on the port access duration and the suspicious access object.

[0157] It should be noted that the suspicious access object can be an object that accesses a server or a host, including normal access objects and port vulnerability scanning objects. The port access duration is the duration of the suspicious access object accessing the server or host, and the preset stay duration can be customized by the user, such as 10 minutes or 50 seconds.

[0158] Assume that the suspicious access objects corresponding to the port are object A and object B, where the port access duration corresponding to object A is 50s, the port access duration corresponding to object B is 60s, and the preset stay time is 55s. If the port access duration corresponding to object B is greater than the preset stay time, it is determined that object B may scan the server or host, and a port vulnerability scanning event needs to be generated based on object B and the port access duration corresponding to object B.

[0159] In a specific implementation, a method for generating a port vulnerability scanning event based on port access duration and suspicious access objects is to obtain access behavior information of suspicious access objects, then analyze the access behavior information to obtain a behavior analysis result; when the behavior analysis result is a scanning behavior, a port vulnerability scanning event is generated based on the access behavior information, port access duration, and suspicious access objects.

[0160] It should also be understood that the behavior analysis results can be scanning behavior or access behavior, wherein scanning behavior is the behavior of a suspicious access object scanning a server or host, etc., and access behavior is the behavior of a suspicious access object normally accessing a server or host, etc.

[0161] In this embodiment, when the port access duration is less than or equal to the preset residence time, the protocol address information of the suspicious access object is determined, and then it is determined whether the protocol address information exists in the preset blacklist. When the protocol address information exists in the preset blacklist, a port vulnerability scanning event is generated based on the port access duration, the protocol address information and the suspicious access object.

[0162] It should be noted that the preset blacklist is a list of attack addresses of blacklisted scanning servers or hosts that is pre-established by the user, wherein the preset blacklist contains multiple attack addresses, namely, protocol address information, etc.

[0163] Assuming that the port access time 40s corresponding to the suspicious access object C is less than the preset stay time 55s, it is necessary to search for the protocol address information corresponding to the suspicious access object C in the preset blacklist. If it exists, it means that the suspicious access object C has previously scanned the server or host. The port vulnerability scanning event can be directly generated based on the port access time and protocol address information corresponding to the suspicious access object C.

[0164] In a specific implementation, if the protocol address information does not exist in the preset blacklist, the access-dwelling time difference is determined based on the port access time and the preset dwelling time. When the access-dwelling time difference is less than the preset dwelling time difference, the protocol address information of the suspicious access object is added to the preset blacklist for storage.

[0165] It should be understood that the preset dwell time difference may be a user-defined setting, which may be 10 seconds, 20 seconds, etc., and this embodiment is not limited thereto.

[0166] Assuming that the port access time corresponding to the suspicious access object D is 40s and the preset stay time is 55s, the access stay time difference between the port access time and the preset stay time is 15s, and the preset stay time difference is 20s, then the protocol address information corresponding to the suspicious access object D needs to be added to the preset blacklist for storage.

[0167] In this embodiment, the scanning behavior can also be discovered through a traffic detection device or a log detection device, and then a port vulnerability scanning event is generated according to the scanning behavior, and the port vulnerability scanning event is analyzed to obtain a vulnerability analysis result.

[0168] The extraction module 5002 is used to extract attack address information from the port vulnerability scanning event according to the vulnerability analysis result.

[0169] In the specific implementation, it is also necessary to determine whether the vulnerability analysis result meets the preset scanning success condition. When the vulnerability analysis result does not meet the preset scanning success condition, the attack address information is extracted from the port vulnerability scanning event.

[0170] It should be noted that the attack address information may be the address of the event initiator of the vulnerability scanning event, etc. The preset scanning success condition may be that the vulnerability analysis result is a vulnerability scanning success, etc. In a specific implementation, if there are a large number of requested web pages that cannot be found by the server in the vulnerability analysis result, or the status code is the content of the request being successfully processed, or whether the returned result contains sensitive data, etc., the vulnerability analysis result is determined to be a vulnerability scanning success.

[0171] In this embodiment, when the vulnerability analysis result meets the preset scanning success condition, the vulnerability event level is determined according to the port vulnerability scanning event and the vulnerability analysis result, the preset vulnerability policy is determined according to the vulnerability event level, and the port vulnerability scanning event is processed according to the preset vulnerability policy.

[0172] It should be understood that the vulnerability event level can be customized by the user, and the vulnerability event level can also be determined according to the scan event type, where the vulnerability event level can be high or low, etc. The preset vulnerability policy can be customized by the user, and can be used to notify relevant personnel for emergency processing, shut down services or host offline or restrict access, etc., and issue a vulnerability rectification notice.

[0173] Furthermore, in order to speed up the success of vulnerability scanning events, the step of processing port vulnerability scanning events according to preset vulnerability policies can be to determine the port management terminal according to the vulnerability event level, and then generate a vulnerability rectification process report based on the port vulnerability scanning event, vulnerability analysis results and preset vulnerability policies, and process the port vulnerability scanning event through the port management terminal according to the vulnerability rectification process report.

[0174] It should be noted that the vulnerability rectification process report can be understood as the operational process for rectifying the vulnerability. The vulnerability rectification process report can then be sent to the port management terminal so that the person in charge of the port management terminal can handle the port vulnerability scanning event according to the vulnerability rectification process report.

[0175] It should also be understood that when the vulnerability analysis result meets the preset scanning success condition, it is determined that the suspicious access object scans the server or host successfully; when the vulnerability analysis result does not meet the preset scanning success condition, it is determined that the suspicious access object scans the server or host failed, etc.

[0176] Furthermore, in order to accurately extract the attack address information, the processing method for extracting the attack address information from the port vulnerability scanning event summary can be to determine the scanning event type according to the port vulnerability scanning event, then determine the attack address keyword according to the scanning event type, and finally extract the attack address information from the port vulnerability scanning event according to the attack address keyword.

[0177] It should also be noted that the scanning event type can be a scanning server type or a scanning host type. Since the server and the host are different, the corresponding attack address keywords are also different. It is necessary to extract the attack address information from a specific location in the port vulnerability scanning event based on the attack address keyword.

[0178] The determination module 5003 is used to determine a preset troubleshooting strategy according to the attack address information.

[0179] It should also be understood that the attack address information may be WAN address information, i.e., external network information, or LAN address information, i.e., internal network information, etc. The preset troubleshooting strategy may be user-defined, such as linking a firewall or other device to perform blocking or false alarm troubleshooting.

[0180] Furthermore, in order to accurately determine the preset troubleshooting strategy, the processing method for determining the preset troubleshooting strategy based on the attack address information can be to extract address keywords from the attack address, then determine the attack address type based on the address keywords, and determine the preset troubleshooting strategy corresponding to the attack address information based on the attack address type.

[0181] It should be noted that since the attack address information includes the intranet and the extranet, the preset troubleshooting strategies corresponding to the intranet and the extranet are completely different. The attack address type includes the intranet type and the extranet type.

[0182] In this embodiment, it is also necessary to determine whether the attack address type is consistent with the preset intranet type. When the attack address type is consistent with the preset intranet type, the vulnerability scanning process information is determined according to the port vulnerability scanning event. When the vulnerability scanning process information does not meet the preset attack conditions, the preset troubleshooting strategy corresponding to the attack address information is determined according to the attack address type and the vulnerability scanning process information; when the attack address type is inconsistent with the preset intranet type, the security linkage device is determined according to the port vulnerability scanning event, and the port vulnerability scanning event is processed by the security linkage device.

[0183] It should also be understood that the security linkage device can be a firewall device, etc. The preset attack condition can be vulnerability scanning process information, scanning false positive information, etc. If it is not scanning false positive information, it is necessary to notify relevant personnel to conduct on-machine investigation of the attack address information; if it is a false positive caused by internal testing, etc., rule optimization processing is performed.

[0184] The processing module 5004 is used to process the port vulnerability scanning event based on the preset troubleshooting strategy.

[0185] In the specific implementation, if the attack address information belongs to the external network address information, the firewall and other devices will be linked to block it to prevent it from continuing to scan and detect; if the attack address information belongs to the internal network address information, the false alarm investigation stage will be carried out. Check whether it is a false alarm caused by internal testing, etc. If not, notify the relevant personnel to conduct an on-machine investigation of the attack address information; if it is a false alarm caused by internal testing, optimize the rules; finally, summarize and review the reasons for the intrusion and the deficiencies in restoring data or business, thereby improving the overall security capabilities.

[0186] In this embodiment, the port vulnerability scanning event is first analyzed to obtain the vulnerability analysis result, and then the attack address information is extracted from the port vulnerability scanning event according to the vulnerability analysis result, and then the preset troubleshooting strategy is determined according to the attack address information, and finally the port vulnerability scanning event is processed based on the preset troubleshooting strategy. Compared with the prior art, which requires users to monitor the port access situation in real time and then manually process the port vulnerability scanning event, in this embodiment, only the attack address information needs to be extracted from the port vulnerability scanning event, and then the port vulnerability scanning event is processed according to the preset troubleshooting strategy of the attack address information, thereby improving the processing efficiency of the port vulnerability scanning event, and then improving the overall security capabilities and user experience.

[0187] Furthermore, the port vulnerability scanning event processing device also includes a generation module;

[0188] The generating module is used to obtain the suspicious access object corresponding to the port;

[0189] The generating module is further used to determine the port access duration of the suspicious access object;

[0190] The generating module is further configured to generate a port vulnerability scanning event according to the port access duration and the suspicious access object when the port access duration is greater than a preset stay duration.

[0191] Furthermore, the generating module is also used to obtain the access behavior information of the suspicious access object;

[0192] The generating module is further used to analyze the access behavior information to obtain a behavior analysis result;

[0193] The generation module is further configured to generate a port vulnerability scanning event according to the access behavior information, the port access duration and the suspicious access object when the behavior analysis result is a scanning behavior.

[0194] Furthermore, the extraction module 5002 is also used to determine whether the vulnerability analysis result meets a preset scanning success condition;

[0195] The extraction module 5002 is further configured to extract attack address information from the port vulnerability scanning event when the vulnerability analysis result does not meet the preset scanning success condition.

[0196] Furthermore, the determination module 5003 is also used to extract address keywords from the attack address information;

[0197] The determination module 5003 is further used to determine the attack address type according to the address keyword;

[0198] The determination module 5003 is further configured to determine a preset troubleshooting strategy corresponding to the attack address information according to the attack address type.

[0199] Furthermore, the determination module 5003 is also used to determine whether the attack address type is consistent with a preset intranet type;

[0200] The determination module 5003 is further configured to determine vulnerability scanning process information according to the port vulnerability scanning event when the attack address type is consistent with the preset intranet type;

[0201] The determination module 5003 is further configured to determine a preset troubleshooting strategy corresponding to the attack address information according to the attack address type and the vulnerability scanning process information when the vulnerability scanning process information does not meet a preset attack condition.

[0202] Other embodiments or specific implementations of the port vulnerability scanning event processing device of the present invention can refer to the above-mentioned method embodiments, which will not be described in detail here.

[0203] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0204] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0205] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0206] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0207] The present invention discloses A1, a port vulnerability scanning event processing method, the port vulnerability scanning processing method comprises the following steps:

[0208] Analyze port vulnerability scanning events and obtain vulnerability analysis results;

[0209] Extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result;

[0210] Determine a preset troubleshooting strategy based on the attack address information;

[0211] The port vulnerability scanning event is processed based on the preset troubleshooting strategy.

[0212] A2. The method as described in A1, before the step of analyzing the port vulnerability scanning event and obtaining the vulnerability analysis result, further comprising:

[0213] Get the suspicious access object corresponding to the port;

[0214] Determine the port access duration of the suspicious access object;

[0215] When the port access duration is greater than the preset stay duration, a port vulnerability scanning event is generated according to the port access duration and the suspicious access object.

[0216] A3. The method as described in A2, wherein the step of generating a port vulnerability scanning event according to the port access duration and the suspicious access object comprises:

[0217] Obtaining access behavior information of the suspicious access object;

[0218] Analyze the access behavior information to obtain behavior analysis results;

[0219] When the behavior analysis result is a scanning behavior, a port vulnerability scanning event is generated according to the access behavior information, the port access duration and the suspicious access object.

[0220] A4. The method as described in A2, after the step of determining the port access duration of the suspicious access object, further comprising:

[0221] When the port access duration is less than or equal to the preset stay duration, determining the protocol address information of the suspicious access object;

[0222] Determine whether the protocol address information exists in a preset blacklist;

[0223] If the protocol address information exists in the preset blacklist, a port vulnerability scanning event is generated according to the port access duration, the protocol address information and the suspicious access object.

[0224] A5. The method as described in A4, after the step of determining whether the protocol address information exists in the preset blacklist, further comprising:

[0225] If the protocol address information does not exist in the preset blacklist, determining the access dwell time difference according to the port access duration and the preset dwell time;

[0226] When the access stay time difference is less than the preset stay time difference, the protocol address information of the suspicious access object is added to the preset blacklist for storage.

[0227] A6. The method as described in any one of A1-5, wherein the step of extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result comprises:

[0228] Determine whether the vulnerability analysis result meets the preset scanning success condition;

[0229] When the vulnerability analysis result does not meet the preset scanning success condition, the attack address information is extracted from the port vulnerability scanning event.

[0230] A7. As described in the method of A6, the step of extracting the attack address information from the port vulnerability scanning event comprises:

[0231] Determine the scanning event type according to the port vulnerability scanning event;

[0232] Determine the attack address keyword according to the scanning event type;

[0233] Attack address information is extracted from the port vulnerability scanning event according to the attack address keyword.

[0234] A8. The method as described in A6, after the step of determining whether the vulnerability analysis result meets the preset scanning success condition, further comprising:

[0235] When the vulnerability analysis result meets the preset scanning success condition, determining the vulnerability event level according to the port vulnerability scanning event and the vulnerability analysis result;

[0236] Determine a preset vulnerability strategy according to the vulnerability event level;

[0237] The port vulnerability scanning event is processed according to the preset vulnerability strategy.

[0238] A9. As described in the method of A8, the step of processing the port vulnerability scanning event according to the preset vulnerability strategy comprises:

[0239] Determining a port management terminal according to the vulnerability event level;

[0240] Generate a vulnerability rectification process report based on the port vulnerability scanning event, the vulnerability analysis result and the preset vulnerability strategy;

[0241] The port vulnerability scanning event is processed through the port management terminal according to the vulnerability rectification process report.

[0242] A10. The method as described in any one of A1-A5, wherein the step of determining a preset troubleshooting strategy according to the attack address information comprises:

[0243] Extracting address keywords from the attack address information;

[0244] Determine the attack address type according to the address keyword;

[0245] A preset troubleshooting strategy corresponding to the attack address information is determined according to the attack address type.

[0246] A11. The method as described in A10, wherein the step of determining a preset troubleshooting strategy corresponding to the attack address information according to the attack address type comprises:

[0247] Determine whether the attack address type is consistent with the preset intranet type;

[0248] When the attack address type is consistent with the preset intranet type, determining vulnerability scanning process information according to the port vulnerability scanning event;

[0249] When the vulnerability scanning process information does not meet the preset attack condition, a preset troubleshooting strategy corresponding to the attack address information is determined according to the attack address type and the vulnerability scanning process information.

[0250] A12. The method as described in A11, after the step of determining whether the attack address type is consistent with the preset intranet type, further comprising:

[0251] When the attack address type is inconsistent with the preset intranet type, determining a security linkage device according to the port vulnerability scanning event;

[0252] The port vulnerability scanning event is processed by the security linkage device.

[0253] The present invention also discloses B13, a port vulnerability scanning event processing device, the port vulnerability scanning event processing device comprising:

[0254] An analysis module is used to analyze port vulnerability scanning events and obtain vulnerability analysis results;

[0255] An extraction module, used for extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result;

[0256] A determination module, used to determine a preset troubleshooting strategy according to the attack address information;

[0257] A processing module is used to process the port vulnerability scanning event based on the preset troubleshooting strategy.

[0258] B14. The device as described in B13, wherein the port vulnerability scanning event processing device further includes a generation module;

[0259] The generating module is used to obtain the suspicious access object corresponding to the port;

[0260] The generating module is further used to determine the port access duration of the suspicious access object;

[0261] The generating module is further configured to generate a port vulnerability scanning event according to the port access duration and the suspicious access object when the port access duration is greater than a preset stay duration.

[0262] B15. The device as described in B14, wherein the generating module is further used to obtain the access behavior information of the suspicious access object;

[0263] The generating module is further used to analyze the access behavior information to obtain a behavior analysis result;

[0264] The generation module is further configured to generate a port vulnerability scanning event according to the access behavior information, the port access duration and the suspicious access object when the behavior analysis result is a scanning behavior.

[0265] B16. In the device according to any one of B13 to B15, the extraction module is further used to determine whether the vulnerability analysis result meets a preset scanning success condition;

[0266] The extraction module is further configured to extract attack address information from the port vulnerability scanning event when the vulnerability analysis result does not meet the preset scanning success condition.

[0267] B17. The device as described in any one of B13-B15, wherein the determination module is further used to extract address keywords from the attack address information;

[0268] The determination module is further used to determine the attack address type according to the address keyword;

[0269] The determination module is further used to determine a preset troubleshooting strategy corresponding to the attack address information according to the attack address type.

[0270] B18. In the device as described in B17, the determination module is further used to determine whether the attack address type is consistent with the preset intranet type;

[0271] The determination module is further configured to determine vulnerability scanning process information according to the port vulnerability scanning event when the attack address type is consistent with the preset intranet type;

[0272] The determination module is further configured to determine a preset troubleshooting strategy corresponding to the attack address information according to the attack address type and the vulnerability scanning process information when the vulnerability scanning process information does not meet a preset attack condition.

Claims

1. A method for processing a port vulnerability scanning event, characterized in that: The port vulnerability scanning processing method comprises the following steps: Analyze port vulnerability scanning events and obtain vulnerability analysis results; Extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result; Determine a preset troubleshooting strategy based on the attack address information; The port vulnerability scanning event is processed based on the preset troubleshooting strategy.

2. The method according to claim 1, characterized in that Before the step of analyzing the port vulnerability scanning event and obtaining the vulnerability analysis result, the method further includes: Get the suspicious access object corresponding to the port; Determine the port access duration of the suspicious access object; When the port access duration is greater than the preset stay duration, a port vulnerability scanning event is generated according to the port access duration and the suspicious access object.

3. The method according to claim 2, characterized in that The step of generating a port vulnerability scanning event according to the port access duration and the suspicious access object comprises: Obtaining access behavior information of the suspicious access object; Analyze the access behavior information to obtain behavior analysis results; When the behavior analysis result is a scanning behavior, a port vulnerability scanning event is generated according to the access behavior information, the port access duration and the suspicious access object.

4. The method according to claim 2, characterized in that After the step of determining the port access duration of the suspicious access object, the method further includes: When the port access duration is less than or equal to the preset stay duration, determining the protocol address information of the suspicious access object; Determine whether the protocol address information exists in a preset blacklist; If the protocol address information exists in the preset blacklist, a port vulnerability scanning event is generated according to the port access duration, the protocol address information and the suspicious access object.

5. The method according to claim 4, characterized in that After the step of determining whether the protocol address information exists in the preset blacklist, the method further includes: If the protocol address information does not exist in the preset blacklist, determining the access dwell time difference according to the port access duration and the preset dwell time; When the access stay time difference is less than the preset stay time difference, the protocol address information of the suspicious access object is added to the preset blacklist for storage.

6. The method according to any one of claims 1 to 5, characterized in that: The step of extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result includes: Determine whether the vulnerability analysis result meets the preset scanning success condition; When the vulnerability analysis result does not meet the preset scanning success condition, the attack address information is extracted from the port vulnerability scanning event.

7. The method according to claim 6, characterized in that The step of extracting attack address information from the port vulnerability scanning event includes: Determine the scanning event type according to the port vulnerability scanning event; Determine the attack address keyword according to the scanning event type; Attack address information is extracted from the port vulnerability scanning event according to the attack address keyword.

8. A port vulnerability scanning event processing device, characterized in that: The port vulnerability scanning event processing device comprises: An analysis module is used to analyze port vulnerability scanning events and obtain vulnerability analysis results; An extraction module, used for extracting attack address information from the port vulnerability scanning event according to the vulnerability analysis result; A determination module, used to determine a preset troubleshooting strategy according to the attack address information; A processing module is used to process the port vulnerability scanning event based on the preset troubleshooting strategy.

9. A port vulnerability scanning event processing device, characterized in that: The port vulnerability scanning event processing device includes: a memory, a processor, and a port vulnerability scanning event processing program stored in the memory and executable on the processor, wherein the port vulnerability scanning event processing program is configured with steps for implementing the port vulnerability scanning event processing method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a port vulnerability scanning event processing program, and when the port vulnerability scanning event processing program is executed by the processor, the steps of the port vulnerability scanning event processing method according to any one of claims 1 to 7 are implemented.

Images