Virtual patch processing method and device and storage medium

Abstract

The invention discloses a virtual patch processing method and device and a storage medium, and relates to the technical field of network security. The method comprises the steps that in the process of installing a virtual patch used for repairing a target security vulnerability of a terminal to the terminal, a preposition strategy is obtained, and the preposition strategy at least comprises a deployment condition of the virtual patch; determining whether the information of the target operation environment of the terminal meets the deployment condition of the virtual patch, the target operation environment information including environment information on which the target security vulnerability can be successfully utilized by an attacker and protection state information that the target security vulnerability is subjected to security protection at present; and under the condition that the information of the target operation environment of the terminal meets the deployment condition of the virtual patch, installing the virtual patch in the terminal. The technical problems of excessive resource consumption and low accuracy of an existing virtual patch protection scheme are solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and storage medium for processing a virtual patch. Background Art

[0002] Virtual patching is a security technology that allows administrators to protect systems or applications from known security vulnerabilities without timely software updates or patch deployment. This technology is particularly suitable for situations where it is not possible to downtime for updates immediately, or it is difficult to apply formal patches for some reason (such as lack of official support for older software). Specifically, virtual patching works by implementing additional security rules or filters at the system network level or application level. These security rules are designed to identify and block malicious inputs or requests that exploit known vulnerabilities, thereby temporarily plugging security gaps before the vulnerabilities in the system or application itself are permanently fixed. Virtual patches do not modify the original code of the application, but are inserted into the data transmission path as a policy layer to monitor and intercept potential attacks.

[0003] However, installing too many virtual patches may require additional computing and network resources to monitor and filter traffic, which will increase the operating costs of the system. At the same time, as the number of virtual patches increases, managing these temporary solutions and related rule sets will become more complicated, increasing the operational burden. In addition, deploying virtual patches simply based on security vulnerabilities in the application version is not accurate enough, which can easily lead to invalid or redundant deployment of virtual patches.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The present application provides a virtual patch processing method, device and storage medium to at least solve the technical problems of excessive resource consumption and low accuracy in existing virtual patch protection solutions.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for processing a virtual patch is provided, comprising: in the process of installing a virtual patch for repairing a target security vulnerability of a terminal to a terminal, obtaining a pre-policy, wherein the pre-policy at least includes a deployment condition of the virtual patch; determining whether information of a target operating environment of the terminal meets the deployment condition of the virtual patch, wherein the target operating environment information includes: environmental information required for the target security vulnerability to be successfully exploited by an attacker and protection status information of the target security vulnerability currently being protected; and installing the virtual patch in the terminal when the information of the target operating environment of the terminal meets the deployment condition of the virtual patch.

[0007] Optionally, the pre-policy includes the following deployment conditions: a first type of deployment conditions, wherein the first type of deployment conditions are used to characterize information of target objects related to the security vulnerabilities protected by the virtual patch, wherein the target objects are operating systems and / or applications affected by the security vulnerabilities protected by the virtual patch; and a second type of deployment conditions, wherein the second type of deployment conditions are used to characterize information security protection information of the information security device and / or security protection system for the target object.

[0008] Optionally, the first type of deployment conditions includes at least one of the following deployment conditions: a first deployment condition, wherein the first deployment condition includes: system information of the operating system and / or program information of the application program affected by the security vulnerability protected by the virtual patch; a second deployment condition, wherein the second deployment condition includes: system operating status information of the operating system and / or operating status information of the application program affected by the security vulnerability protected by the virtual patch.

[0009] Optionally, the second type of deployment conditions includes at least one of the following deployment conditions: a third deployment condition, wherein the third deployment condition includes configuration information of the information security device and / or the security protection system for network access ports related to security vulnerabilities; a fourth deployment condition, wherein the fourth deployment condition includes vulnerability protection information of the information security device and / or the security protection system for target objects, wherein the vulnerability protection information is protection configuration information about security vulnerabilities other than virtual patches.

[0010] Optionally, the first type of deployment condition also includes at least one of the following deployment conditions: a fifth deployment condition, wherein the fifth deployment condition includes version information of the target object; a sixth deployment condition, wherein the sixth deployment condition includes the port opening status of the target object; a seventh deployment condition, wherein the seventh deployment condition includes environmental configuration information of the target object.

[0011] Optionally, the seventh deployment condition includes at least one of the following environment configuration information: first environment configuration information, wherein the first environment configuration information is used to configure the operating mode information that the target object needs to be in when the security vulnerability successfully attacks the target object; second environment configuration information, wherein the second environment configuration information is used to configure the permission information that the target object needs to enable when the security vulnerability successfully attacks the target object; third environment configuration information, wherein the third environment configuration information is used to configure the security configuration information that the target object needs to pre-set when the security vulnerability successfully attacks the target object; fourth environment configuration information, wherein the fourth environment configuration information is used to configure the application call link that the security vulnerability relies on when it attacks the target object.

[0012] Optionally, the method for processing virtual patches also includes: when the pre-policy includes N deployment conditions and there is a judgment order among the N deployment conditions, judging whether the security vulnerability of the terminal meets the N deployment conditions according to the judgment order, wherein, when it is judged that the security vulnerability in the terminal does not meet the i-th deployment condition among the N deployment conditions according to the judgment order, prohibiting the installation of the virtual patch in the terminal, and stopping judging whether the security vulnerability in the terminal meets the i+1-th deployment condition among the N deployment conditions, wherein i is a positive integer less than N.

[0013] Optionally, the virtual patch processing method also includes: in the case where the virtual patch has been installed in the terminal, detecting whether the target security vulnerability of the terminal meets the uninstallation condition of the virtual patch included in the pre-policy; upon detecting that the security vulnerability of the terminal meets any one of the uninstallation conditions included in the pre-policy, determining that the target security vulnerability of the terminal has been repaired or the target security vulnerability has become invalid; and uninstalling the virtual patch already installed in the terminal.

[0014] According to another aspect of the present application, a virtual patch processing device is also provided, including: an acquisition unit, which acquires a pre-policy during the process of installing a virtual patch for repairing a target security vulnerability of a terminal to the terminal, wherein the pre-policy includes at least a deployment condition of the virtual patch; a determination unit, which determines whether information on a target operating environment of the terminal meets the deployment condition of the virtual patch, wherein the target operating environment information includes: environmental information on which the target security vulnerability can be successfully exploited by an attacker and protection status information on the current security protection of the target security vulnerability; an installation unit, which installs the virtual patch in the terminal if the information on the target operating environment of the terminal meets the deployment condition of the virtual patch.

[0015] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program runs, the device where the computer-readable storage medium is located executes the above-mentioned virtual patch processing method.

[0016] As can be seen from the above content, in the present application, first, in the process of installing a virtual patch for repairing the target security vulnerability of the terminal to the terminal, a pre-policy including the virtual patch deployment conditions is obtained, and whether to install the virtual patch is determined according to the deployment conditions in the pre-policy. The virtual patch can only be installed in the terminal when all the target security vulnerabilities of the system or application in the terminal meet the deployment conditions of the virtual patch. Compared with the prior art that deploys virtual patches only by the security vulnerabilities existing in the application version, the present application makes a decision on whether to install the virtual patch through multiple deployment conditions in the pre-policy, and only installs the virtual patch at the security vulnerabilities that meet the pre-policy, ensuring the rationality and accuracy of the virtual patch deployment, thereby achieving the technical effect of improving the rationality and accuracy of the virtual patch deployment, and further solving the technical problems of excessive resource consumption and low accuracy in the existing virtual patch protection scheme. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flowchart of an optional virtual patch processing method according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of an optional virtual patch protection system according to an embodiment of the present application;

[0020] Figure 3 It is a schematic diagram of an optional virtual patch processing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] It should also be noted that the information and data collected by this application are authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation portals for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0024] According to an embodiment of the present application, an embodiment of a method for processing a virtual patch is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] It should be noted that an intelligent protection system is used as the execution subject of the virtual patch processing method of the embodiment of the present application. It is understandable that the virtual patch processing method provided in the embodiment of the present application can also be executed by other systems or devices, and the embodiment of the present application does not specifically limit this.

[0026] Figure 1 is a flowchart of an optional virtual patch processing method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0027] Step S101 : acquiring a pre-position policy during the process of installing a virtual patch for repairing a target security vulnerability of the terminal to the terminal.

[0028] In step S101, the pre-policy at least includes a deployment condition of the virtual patch.

[0029] Optionally, the content covered by the deployment conditions in the pre-policy includes, but is not limited to: system information of the operating system and / or program information of the application related to the security vulnerabilities protected by the virtual patch, system running status information of the operating system and / or running status information of the application related to the security vulnerabilities protected by the virtual patch, version information of the operating system and / or application related to the security vulnerabilities protected by the virtual patch, environment configuration information of the operating system and / or application related to the security vulnerabilities protected by the virtual patch, port opening information of the operating system and / or application related to the security vulnerabilities protected by the virtual patch, configuration information of the firewall, and protection status information of other protection systems against security vulnerabilities.

[0030] Optionally, after detecting the target security vulnerability in the terminal, the intelligent protection system performs vulnerability repair, and in the process of installing a virtual patch for repairing the target security vulnerability in the terminal to the terminal, simultaneously obtains the pre-position policy.

[0031] In some examples, step S101 may include: obtaining a pre-position policy when determining a virtual patch to be installed in the terminal for repairing a target security vulnerability of the terminal.

[0032] Step S102: determining whether the information of the target operating environment of the terminal meets the deployment condition of the virtual patch.

[0033] In step S102, the target operating environment information includes: the environment information that the target security vulnerability needs to rely on in order to be successfully exploited by an attacker and the protection status information of the target security vulnerability currently being protected.

[0034] Optionally, the intelligent protection system will first determine whether the information of the terminal's target operating environment meets the deployment conditions of the virtual patch. If the information of the terminal's target operating environment meets the deployment conditions of the virtual patch, the virtual patch will be installed in the terminal. If the information of the terminal's target operating environment does not meet the deployment conditions of the virtual patch, the virtual patch will not be installed in the terminal.

[0035] Optionally, when the environmental information required for the current target security vulnerability to be successfully exploited by an attacker and the protection status information of the target security vulnerability respectively meet the deployment conditions, the virtual patch is installed in the terminal; when any one of the environmental information required for the current target security vulnerability to be successfully exploited by an attacker and the protection status information of the target security vulnerability does not meet the deployment conditions, the installation of the virtual patch in the terminal is stopped.

[0036] Step S103: after determining that the information of the target operating environment of the terminal meets the deployment condition of the virtual patch, if the target operating environment of the terminal meets the deployment condition of the virtual patch, the virtual patch is installed in the terminal.

[0037] Optionally, the intelligent protection system may install the virtual patch in the terminal when determining that the information of the target operating environment of the terminal meets the deployment conditions of the virtual patch.

[0038] Optionally, the information of the target operating environment of the terminal includes at least system operating status information of the operating system or operating status information of the application of the target security vulnerability protected by the virtual patch in the terminal, version information of the operating system or application of the target security vulnerability protected by the virtual patch in the terminal, environment configuration information of the operating system or application of the target security vulnerability protected by the virtual patch in the terminal, port opening status of the operating system or application of the target security vulnerability protected by the virtual patch in the terminal, firewall configuration information of the operating system or application of the target security vulnerability protected by the virtual patch in the terminal, information of the operating system or application of the target security vulnerability protected by the virtual patch in the terminal, and protection status information of other protection systems for the target security vulnerability protected by the virtual patch in the terminal.

[0039] Optionally, the intelligent protection system obtains deployment conditions when a virtual patch is to be installed in the terminal, and automatically installs the virtual patch in the terminal when the security vulnerability protected by the virtual patch meets the deployment conditions of the virtual patch; if the security vulnerability protected by the virtual patch does not meet any of the deployment conditions, it is determined not to install the virtual patch in the terminal or the installation of the virtual patch in the terminal is stopped.

[0040] Optionally, Figure 2 is a schematic diagram of an optional virtual patch protection system according to an embodiment of the present application, such as Figure 2 As shown, the system includes two modules, a patch pre-policy module and a patch deployment module, wherein the patch pre-policy module is used to set the pre-policy of applying the virtual patch to the terminal, and the patch deployment module is used to implement the deployment of the virtual patch, including the monitoring of security vulnerability information, the deployment of the virtual patch, and the uninstallation of the virtual patch. The patch pre-policy module will pass the pre-policy to the patch deployment module. When the patch deployment module detects that a certain operating system or application in the terminal has a security vulnerability, the pre-policy can be used to determine whether a virtual patch needs to be deployed at the security vulnerability. When the virtual patch pre-policy changes, the patch pre-policy module will synchronize the changes in the pre-policy to the patch deployment module in real time, so as to facilitate the real-time adjustment of the deployment of the virtual patch.

[0041] For example, some key business systems or applications cannot be shut down for updates immediately due to their importance in the business, some old versions of software may lack official support because they have exceeded the official support cycle, and there is a lack of system or application R&D personnel. As a result, when there are security vulnerabilities in the software system or application, the vulnerabilities cannot be repaired in time and can only be maintained through virtual patches. The virtual patch protection system can sort out the necessary security vulnerabilities that need to be repaired from multiple dimensions, and automatically deploy virtual patches. At the same time, after the vulnerabilities are repaired or become invalid, the relevant virtual patches can be automatically uninstalled.

[0042] For example, when a new 0day vulnerability (Zero-day Exploit) breaks out and the software system or application related to the 0day vulnerability cannot be effectively repaired in a timely manner, for example, there is no related patch for the 0day vulnerability, or the patch upgrade makes large changes to the software system or application, and the software system or application cannot be upgraded quickly. At this time, the virtual patch protection system can accurately and effectively provide defense capabilities for the operating system or application with security vulnerabilities to ensure that the security vulnerabilities are not exploited by attackers, and there is no need to worry about performance consumption. When a patch is released for the subsequent 0day vulnerability and the operating system or application has completed the repair of the security vulnerability, the related virtual patch will be automatically uninstalled to avoid unnecessary performance consumption.

[0043] It can be seen from the contents of steps S101 to S103 that in the present application, first, in the process of installing a virtual patch for repairing a target security vulnerability of the terminal to the terminal, a pre-policy is obtained, wherein the pre-policy includes at least the deployment conditions of the virtual patch, and then it is determined whether the information of the target operating environment of the terminal meets the deployment conditions of the virtual patch, wherein the target operating environment information includes: the environmental information required for the target security vulnerability to be successfully exploited by an attacker and the protection status information of the target security vulnerability currently being protected by security protection, and then, if the information of the target operating environment of the terminal meets the deployment conditions of the virtual patch, the virtual patch is installed in the terminal.

[0044] As can be seen from the above content, in the present application, first, in the process of installing a virtual patch for repairing the target security vulnerability of the terminal to the terminal, a pre-policy including the virtual patch deployment conditions is obtained, and whether to install the virtual patch is determined according to the deployment conditions in the pre-policy. The virtual patch can only be installed in the terminal when all the target security vulnerabilities of the system or application in the terminal meet the deployment conditions of the virtual patch. Compared with the prior art that deploys virtual patches only by the security vulnerabilities existing in the application version, the present application makes a decision on whether to install the virtual patch through multiple deployment conditions in the pre-policy, and only installs the virtual patch at the security vulnerabilities that meet the pre-policy, ensuring the rationality and accuracy of the virtual patch deployment, thereby achieving the technical effect of improving the rationality and accuracy of the virtual patch deployment, and further solving the technical problems of excessive resource consumption and low accuracy in the existing virtual patch protection scheme.

[0045] In an optional embodiment, the pre-strategy includes the following deployment conditions: a first type of deployment conditions, wherein the first type of deployment conditions are used to characterize information about target objects related to the security vulnerabilities protected by the virtual patch, wherein the target objects are operating systems and / or applications affected by the security vulnerabilities protected by the virtual patch; and a second type of deployment conditions, wherein the second type of deployment conditions are used to characterize information security protection information of the information security device and / or security protection system for the target object.

[0046] Optionally, the first type of deployment conditions is information about target objects related to the security vulnerabilities protected by the virtual patch, i.e., information about the operating system and / or application programs in the terminal that are affected by the security vulnerabilities protected by the virtual patch, such as information about software systems or applications related to the security vulnerabilities protected by the virtual patch; the second type of deployment conditions is used to characterize information about information security protection of target objects by information security devices and / or security protection systems, such as firewalls, intrusion detection systems, antivirus software and other security tools or devices, which are responsible for monitoring and protecting target components from attacks.

[0047] Alternatively, when a security vulnerability exists in an application framework, it does not necessarily mean that security protection is required, because the security vulnerability itself may have some preconditions, and can only be exploited after the preconditions are met. For example, some applications require certain configurations to be enabled before the security vulnerability takes effect.

[0048] Optionally, there are many ways to build a virtual patch. For example, in addition to an external firewall, you can also deploy virtual patches by applying WAF (Web Application Firewall), RASP (Runtime Application Self-Protection), terminal traffic protection, host behavior protection, etc. If other security protection devices already have relevant protection strategies, there is no need to deploy duplicate virtual patches. Among them, WAF is to add a WAF filter inside the application to detect security vulnerability exploitation requests and block the requests. RASP is based on the security vulnerability exploitation process and performs protection at the application function level to block the execution of functions related to security vulnerability exploitation. Terminal traffic protection is to detect traffic directly in the kernel or by diversion, identify security vulnerability exploitation traffic characteristics, and block malicious traffic. Host behavior protection is to monitor before the execution of host behavior actions, and block host behavior actions related to the detection of security vulnerability exploitation.

[0049] From the above content, it can be seen that the intelligent protection system can deploy necessary virtual patches to a minimum by finely limiting the virtual patch deployment scenarios, which can greatly reduce the number of virtual patch policies and reduce the system resource consumption during runtime. It can also define the pre-policy of virtual patch deployment from multiple dimensions, accurately understand the harmfulness of security vulnerabilities and deploy virtual patches in a targeted manner. Through these deployment conditions, security incidents can be identified and responded to more quickly, reducing the possibility of security vulnerabilities being exploited.

[0050] In an optional embodiment, the first type of deployment conditions includes at least one of the following deployment conditions: a first deployment condition, wherein the first deployment condition includes: system information of the operating system and / or program information of the application program affected by the security vulnerability protected by the virtual patch; a second deployment condition, wherein the second deployment condition includes: system operating status information of the operating system and / or operating status information of the application program affected by the security vulnerability protected by the virtual patch.

[0051] Optionally, the first deployment condition is the system information of the operating system and / or the program information of the application affected by the security vulnerability protected by the virtual patch, that is, the system information of the operating system and the program information of the application affected by the security vulnerability, and the second deployment condition is the system running status information of the operating system and / or the running status information of the application affected by the security vulnerability protected by the virtual patch, similarly, the system running status information of the operating system and the running status information of the application affected by the security vulnerability.

[0052] Optionally, the system information of the operating system and the program information of the application in the first deployment condition only include information of the operating system or application involving the virtual patch technology, and the virtual patch can be deployed only for security vulnerabilities existing in the operating system or application that allows virtual patch deployment.

[0053] Optionally, for the system running status information of the operating system and the running status information of the application in the second deployment condition, the security vulnerabilities usually require the operating system and the application to be running for them to take effect. For example, the EternalBlue vulnerability (MS17-010) requires that the SMB service (Server Message Block) be enabled in the running system to be successfully exploited. In other words, there are some security vulnerabilities that can only be exploited in a specific system running state or application running state.

[0054] From the above content, it can be seen that the intelligent protection system can improve the deployment efficiency and accuracy of virtual patches through these deployment conditions, improve the stability and security of the system, and by installing virtual patches at the appropriate time, it can reduce the risk of system instability or performance degradation caused by the implementation of virtual patches.

[0055] In an optional embodiment, the second category of deployment conditions includes at least one of the following deployment conditions: a third deployment condition, wherein the third deployment condition includes configuration information of the information security device and / or the security protection system for network access ports related to security vulnerabilities; a fourth deployment condition, wherein the fourth deployment condition includes vulnerability protection information of the information security device and / or the security protection system for target objects, wherein the vulnerability protection information is protection configuration information about security vulnerabilities other than virtual patches.

[0056] Optionally, the third deployment condition is the configuration information of the information security equipment and security protection system for the network access ports related to the security vulnerability, for example, whether the firewall configuration allows the external network to access the ports related to the security vulnerability. If the firewall disables the external network's access to port 445, then the EternalBlue vulnerability cannot be exploited, so there is no need to deploy a virtual patch.

[0057] Optionally, the fourth deployment condition is the vulnerability protection information of the information security equipment and security protection system for the operating system and application programs affected by the security vulnerabilities, that is, the current protection status of other protection devices or systems other than the virtual patch for the security vulnerabilities protected by the virtual patch. It should be noted that relevant interfaces need to be built here for real-time reception or regular query of the current protection status of other protection systems for security vulnerabilities, such as regular query of the list of security vulnerabilities currently defended by the IPS system (Intrusion Prevention System) to view the current security vulnerability status.

[0058] From the above content, it can be seen that the intelligent protection system decides whether to deploy virtual patches by connecting various types of protection system information in series and obtaining the fire protection status information of other protection systems against vulnerabilities, which can effectively avoid redundant deployment of virtual patches.

[0059] In an optional embodiment, the first type of deployment condition also includes at least one of the following deployment conditions: a fifth deployment condition, wherein the fifth deployment condition includes version information of the target object, a sixth deployment condition, wherein the sixth deployment condition includes the port opening status of the target object, and a seventh deployment condition, wherein the seventh deployment condition includes environmental configuration information of the target object.

[0060] Optionally, the fifth deployment condition is the specific version information of the operating system and application programs affected by the security vulnerability in the target object. Generally, virtual patches are mainly used to protect against security vulnerabilities in specific versions of the operating system or application programs. Not all applications have security vulnerabilities, but security vulnerabilities are often closely related to the version of a specific application program, and are even closely related to the version of internal components that the application program depends on.

[0061] Optionally, the sixth deployment condition is whether relevant ports of the operating system and / or application program affected by the security vulnerability in the target object are open. For example, the EternalBlue vulnerability exploits a security vulnerability in the SMB (Server Message Block) protocol, which uses port 445 by default. Therefore, the target Windows system needs to open port 445 so that attackers can try to exploit this vulnerability for security attacks. If port 445 is not open, the security vulnerability cannot take effect, i.e., there is no need to deploy a virtual patch.

[0062] Optionally, the seventh deployment condition is a specific environment configuration that the operating system and / or application program affected by the security vulnerability in the target object depends on. Only when the specific environment configuration is met can the security vulnerability be exploited by an attacker.

[0063] From the above content, it can be seen that the intelligent protection system can reduce the false positives and omissions of security vulnerabilities in the system through these precise deployment conditions, improve the accuracy of security monitoring, and deploy virtual patches more accurately according to these deployment conditions to prevent invalid or redundant virtual patch deployment.

[0064] In an optional embodiment, the seventh deployment condition includes at least one of the following environment configuration information: first environment configuration information, wherein the first environment configuration information is used to configure the operating mode information of the target object required when the security vulnerability successfully attacks the target object, second environment configuration information, wherein the second environment configuration information is used to configure the permission information that the target object needs to enable when the security vulnerability successfully attacks the target object, third environment configuration information, wherein the third environment configuration information is used to configure the security configuration information that the target object needs to pre-set when the security vulnerability successfully attacks the target object, and fourth environment configuration information, wherein the fourth environment configuration information is used to configure the application call link that the security vulnerability relies on when it attacks the target object.

[0065] Optionally, the first environment configuration information is the operating mode information of the target object that is required for the security vulnerability to successfully attack the target object. For example, a command injection security vulnerability exists in a web application framework, but the security vulnerability can only be exploited when the application mode is "debug mode". The attacker first needs to use certain methods (such as social engineering, exploiting other vulnerabilities) to prompt the administrator to turn on the debugging mode of the application before entering and executing malicious code through the security vulnerability.

[0066] Optionally, the second environment configuration information is permission information that needs to be enabled for the target object when the security vulnerability successfully attacks the target object. For example, a security vulnerability can only take effect when a service is running with the highest user permissions. If the service is running with non-highest user permissions, although the security vulnerability still exists, the attacker cannot exploit the security vulnerability to launch a security attack.

[0067] Optionally, the third environment configuration information is security configuration information that needs to be pre-set by the target object when the security vulnerability successfully attacks the target object. For example, in a content management system, users are usually allowed to upload files, such as pictures, documents, etc. However, if the upload function does not correctly configure the file type check or execution restriction, then the attacker can use this security vulnerability to upload and execute malicious PHP backdoor files, where the PHP backdoor file is a malicious code that allows the attacker to remotely control the server, execute arbitrary commands, obtain sensitive information, etc. Therefore, when the upload function is open to users and the security configuration is missing, it means that the attacker can use this vulnerability to upload malicious files, thereby attacking the system.

[0068] Optionally, the fourth environment configuration information is the application call link that the security vulnerability relies on when launching a security attack on the target object. For example, an application has a security vulnerability, but if the security vulnerability is to be fully exploited for attack, it must be combined with the functions or vulnerabilities of other applications, that is, there are necessary third-party dependent link nodes in the vulnerability exploitation process, that is, the attacker needs to find security vulnerabilities in multiple applications or systems and understand the correlation between them before he can successfully exploit the vulnerabilities for attack.

[0069] From the above content, it can be seen that the environmental configuration information covers information such as operating mode, program permissions, security configuration, and dependency links. It can define the scenarios in which security vulnerabilities take effect in a very detailed manner, and perform customized security vulnerability detection based on different operating modes, permission settings, and security configuration information, thereby improving the accuracy of deploying virtual patches. In addition, by performing vulnerability detection on different environmental configuration information, potential security risks can be identified more comprehensively, thereby improving the security of the system.

[0070] In an optional embodiment, the intelligent protection system includes N deployment conditions in the pre-strategy, and there is a judgment order among the N deployment conditions. The system judges whether the security vulnerability of the terminal satisfies the N deployment conditions according to the judgment order. When it is judged that the security vulnerability in the terminal does not satisfy the i-th deployment condition among the N deployment conditions according to the judgment order, the installation of the virtual patch in the terminal is prohibited, and the judgment of whether the security vulnerability in the terminal satisfies the i+1-th deployment condition among the N deployment conditions is stopped, wherein i is a positive integer less than N.

[0071] Optionally, the intelligent protection system detects in real time the system information of the operating system or the program information, version information, running status information, port opening status information, runtime environment configuration information, related firewall configuration information of the application program in the current terminal that is affected by the security vulnerability protected by the virtual patch, and the current protection status of other protection systems against the security vulnerability protected by the virtual patch.

[0072] Optionally, when the intelligent protection system monitors an operating system or application with a security vulnerability in the terminal and a virtual patch has not been deployed, it makes a judgment based on the deployment conditions in the pre-policy to detect whether the security vulnerability of the terminal satisfies each of all deployment conditions included in the pre-policy. When it is detected that the security vulnerability of the terminal satisfies each of all deployment conditions, the virtual patch is installed in the terminal. When it is detected that the security vulnerability of the target terminal does not satisfy any of all deployment conditions, the installation of the virtual patch in the terminal is prohibited.

[0073] Optionally, when the pre-policy includes N deployment conditions and there is a judgment order among the N deployment conditions, whether the security vulnerability of the terminal meets the N deployment conditions is judged according to the judgment order. For example, the intelligent protection system first queries the version information of the operating system or application to be deployed with the virtual patch, and judges whether the version information is consistent with the version information in the corresponding virtual patch pre-policy. If they are consistent, the deployment judgment process continues, otherwise the deployment is terminated; then it is judged whether the current relevant operating system or application is running. If the deployment condition in the pre-policy is to take effect only when running, then when the application with the security vulnerability is not running, the deployment is terminated, otherwise the deployment judgment process continues. If the deployment condition in the pre-policy is to take effect even when not running, the deployment judgment process continues; then it is judged whether the port opening status information of the current relevant operating system or application meets the pre-policy of the virtual patch. If the relevant ports that need to be opened when the security vulnerability attack is met in the pre-policy are already open, Then continue the deployment determination process, otherwise the deployment is terminated; then determine whether the firewall configuration information of the current relevant operating system or application meets the pre-policy of the virtual patch. If the relevant firewall configuration allows the necessary network communication for the exploitation of the security vulnerability, then continue the deployment determination process, otherwise the deployment is terminated; then determine whether the current protection status of other protection systems for the vulnerability protected by the virtual patch meets the pre-policy of the virtual patch. If other protection systems do not yet have protection against the exploitation of the security vulnerability, then continue the deployment determination process, otherwise the deployment is terminated; finally, determine whether the environment configuration information of the current relevant operating system or application at runtime meets the pre-policy of the virtual patch. If all information such as the operating mode, program permissions, operating configuration, and dependent links of the software system or application with security vulnerabilities meets the conditions for deploying virtual patches in the pre-policy, then deploy the virtual patch at the corresponding security vulnerability of the operating system or application. If any of the information does not meet the conditions for deploying the virtual patch in the pre-policy, the deployment of the virtual patch is terminated.

[0074] Optionally, when the pre-policy includes N deployment conditions and there is no order of judgment among the N deployment conditions, the judgment can be made directly based on all the deployment conditions in the pre-policy. Regardless of the order among the conditions, the virtual patch can be deployed at the security vulnerability as long as all the deployment conditions are met.

[0075] Optionally, the intelligent protection system defines N deployment conditions in the pre-policy, which are used to evaluate whether to install a virtual patch at the location where a security vulnerability exists in the terminal. When there is a judgment order among these deployment conditions, the security vulnerabilities of the target terminal are judged one by one in a specific order. If it is found during the judgment process that the target terminal does not meet the i-th deployment condition (i is less than N), the system will prohibit the installation of the virtual patch at the security vulnerability of the target terminal and stop continuing to judge whether the security vulnerability of the target terminal meets the subsequent i+1-th deployment condition.

[0076] From the above content, it can be seen that the intelligent protection system monitors the relevant software systems or applications that contain security vulnerabilities but have not deployed virtual patches in real time. By judging the matching status of the pre-policy, it can deploy the necessary virtual patches to the minimum extent and avoid deploying meaningless virtual patches. At the same time, through intelligent monitoring and automatic deployment of virtual patches, the security of the system is improved. At the same time, the intelligent protection system makes orderly judgments on the security vulnerabilities in the target terminal according to these deployment conditions, which can ensure that the system can evaluate security sequentially and step by step, and by checking each deployment condition in an orderly manner, once it is determined that the target terminal does not meet a certain condition, the system will stop the subsequent judgment process, avoid unnecessary calculations and resource consumption, and improve efficiency.

[0077] In an optional embodiment, the pre-policy also includes an uninstallation condition for the virtual patch; the contents covered in the uninstallation condition include but are not limited to: system information of the operating system and / or program information of the application program related to the security vulnerability protected by the virtual patch, system operation status information of the operating system and / or operation status information of the application program related to the security vulnerability protected by the virtual patch, version information of the operating system and / or application program related to the security vulnerability protected by the virtual patch, environment configuration information of the operating system and / or application program related to the security vulnerability protected by the virtual patch, port opening information of the operating system and / or application program related to the security vulnerability protected by the virtual patch, configuration information of the firewall, and protection status information of other protection systems against security vulnerabilities.

[0078] In an optional embodiment, when a virtual patch has been installed in the terminal, the intelligent protection system detects whether the target security vulnerability of the terminal meets the uninstallation condition of the virtual patch included in the pre-policy, and upon detecting that the security vulnerability of the terminal meets any one of the uninstallation conditions included in the pre-policy, determines that the target security vulnerability of the terminal has been repaired or the target security vulnerability has become invalid, and uninstalls the virtual patch installed in the terminal.

[0079] Optionally, the intelligent protection system automatically uninstalls the corresponding deployed virtual patch when the target security vulnerability in the terminal is repaired or invalidated. The target security vulnerability may be invalidated when the operating system or application that deployed the target security vulnerability is uninstalled. In this case, the target security vulnerability no longer exists, that is, it is invalid. At this time, the virtual patch originally deployed at the target security vulnerability should be uninstalled.

[0080] Optionally, the uninstallation conditions in the pre-policy correspond to the deployment conditions in the pre-policy in a one-to-one relationship. For example, the first deployment condition is used to characterize the information of the target object related to the security vulnerability protected by the virtual patch. If the system information of the operating system related to the security vulnerability protected by the virtual patch to be deployed is A, then during the virtual patch deployment process, the intelligent protection system will query the version information of the operating system or application related to the security vulnerability protected by the virtual patch to be deployed, and determine whether the version information is consistent with the version information in the corresponding virtual patch deployment condition. If consistent, the deployment determination process will continue. During the virtual patch uninstallation process, the program information of the operating system and / or application where the virtual patch has been deployed will be queried to determine whether the version information is consistent with the version information in the corresponding virtual patch uninstallation condition. If inconsistent, the virtual patch will be directly uninstalled, otherwise the uninstallation determination process will continue. Therefore, the uninstallation conditions in the pre-policy are at least consistent with the number of deployment conditions.

[0081] Optionally, the intelligent protection system can monitor the operating system or application program on which the virtual patch has been deployed in the terminal in real time. If the operating system or application program on which the virtual patch has been deployed has been uninstalled, then the uninstallation operation of the virtual patch is executed, otherwise the uninstallation determination process continues; query the version information of the operating system or application program on which the virtual patch has been deployed, and determine whether the version information is consistent with the corresponding version information in the virtual patch pre-policy. If they are consistent, the uninstallation determination process continues, otherwise the virtual patch is uninstalled (inconsistency indicates that the relevant security vulnerability has been repaired by upgrading or patching, and no virtual patch is needed to protect it); then determine whether the current relevant operating system or application program is running. If the security vulnerability in the pre-policy only takes effect when the operating system or application program is running, then if the application program on which the virtual patch has been deployed is not running, then the virtual patch is uninstalled, otherwise the uninstallation determination process continues. If the security vulnerability in the pre-policy takes effect when the operating system or application program is not running, then if the application program on which the virtual patch has been deployed is not running, then the uninstallation determination process continues; then determine whether the current relevant software Whether the port opening status information of the system or application satisfies the virtual patch pre-position policy. If the relevant ports of the exploitable security vulnerability in the pre-position policy are open and the ports of the current operating system or application are open, the uninstallation determination process continues; otherwise, the virtual patch is uninstalled; whether the firewall configuration information of the current relevant operating system or application satisfies the virtual patch pre-position policy. If the relevant firewall configuration allows the necessary network communication for the exploitation of the security vulnerability, the uninstallation determination process continues; otherwise, the virtual patch is uninstalled; whether the current protection status of the vulnerability protected by the virtual patch by other protection systems satisfies the virtual patch pre-position policy. If other protection systems do not yet have protection for the security vulnerability, the uninstallation determination process continues; otherwise, the virtual patch is uninstalled; whether the environment configuration information of the current relevant software system or application during runtime satisfies the virtual patch pre-position policy. If the operating mode, program permissions, operating configuration, dependent links, etc. of the operating system or application all match the patch pre-position policy, the uninstallation determination process ends and there is no need to uninstall the virtual patch; otherwise, the virtual patch is uninstalled.

[0082] From the above content, it can be seen that the intelligent protection system monitors the relevant operating systems or applications where virtual patches have been deployed in real time. By judging the matching status of the uninstallation conditions, it can promptly uninstall meaningless virtual patches and leave only necessary virtual patches, thereby maximizing the virtual patch protection performance. By intelligently uninstalling virtual patches that are no longer needed, the system can avoid unnecessary resource occupation and optimize the performance of the target terminal. At the same time, by promptly uninstalling virtual patches that have expired or have fixed vulnerabilities, it can reduce the potential risks caused by virtual patches and ensure the stability and reliability of system operation.

[0083] According to an embodiment of the present application, an embodiment of a virtual patch processing device is also provided. Figure 3 is a schematic diagram of an optional virtual patch processing device according to an embodiment of the present application, such as Figure 3 As shown, the virtual patch processing device includes: an acquisition unit 301 , a determination unit 302 , and an installation unit 303 .

[0084] Optionally, the acquisition unit 301 is used to obtain a pre-policy during the process of installing a virtual patch for repairing a target security vulnerability of the terminal to the terminal, wherein the pre-policy includes at least a deployment condition of the virtual patch; the determination unit 302 is used to determine whether information on the target operating environment of the terminal meets the deployment condition of the virtual patch, wherein the target operating environment information includes: environmental information required for the target security vulnerability to be successfully exploited by an attacker and protection status information of the target security vulnerability currently being protected; the installation unit 303 is used to install the virtual patch in the terminal when the information on the target operating environment of the terminal meets the deployment condition of the virtual patch.

[0085] Optionally, the acquisition unit 301 includes: a first type of deployment conditions, wherein the first type of deployment conditions are used to characterize information of target objects related to the security vulnerabilities protected by the virtual patch, wherein the target objects are operating systems and / or applications affected by the security vulnerabilities protected by the virtual patch; and a second type of deployment conditions, wherein the second type of deployment conditions are used to characterize information security protection information of the information security device and / or security protection system for the target object.

[0086] Optionally, the first type of deployment conditions includes: a first deployment condition, wherein the first deployment condition includes: system information of the operating system and / or program information of the application program affected by the security vulnerability protected by the virtual patch; a second deployment condition, wherein the second deployment condition includes: system operating status information of the operating system and / or operating status information of the application program affected by the security vulnerability protected by the virtual patch.

[0087] Optionally, the second type of deployment conditions include: a third deployment condition, wherein the third deployment condition includes configuration information of the information security device and / or the security protection system for network access ports related to security vulnerabilities; a fourth deployment condition, wherein the fourth deployment condition includes vulnerability protection information of the information security device and / or the security protection system for the target object, wherein the vulnerability protection information is protection configuration information about security vulnerabilities other than virtual patches.

[0088] Optionally, the first type of deployment conditions includes: a fifth deployment condition, wherein the fifth deployment condition includes version information of the target object; a sixth deployment condition, wherein the sixth deployment condition includes the port opening status of the target object; and a seventh deployment condition, wherein the seventh deployment condition includes environmental configuration information of the target object.

[0089] Optionally, the seventh deployment condition includes: first environment configuration information, wherein the first environment configuration information is used to configure the operating mode information that the target object needs to be in when the security vulnerability successfully attacks the target object; second environment configuration information, wherein the second environment configuration information is used to configure the permission information that the target object needs to enable when the security vulnerability successfully attacks the target object; third environment configuration information, wherein the third environment configuration information is used to configure the security configuration information that the target object needs to pre-set when the security vulnerability successfully attacks the target object; fourth environment configuration information, wherein the fourth environment configuration information is used to configure the application call link that the security vulnerability relies on when it attacks the target object.

[0090] Optionally, the virtual patch processing device also includes: a judgment unit, which is used to judge whether the security vulnerability of the terminal meets the N deployment conditions according to the judgment order when the pre-policy includes N deployment conditions and there is a judgment order among the N deployment conditions, wherein, when it is judged according to the judgment order that the security vulnerability in the terminal does not meet the i-th deployment condition among the N deployment conditions, it is prohibited to install the virtual patch in the terminal, and stop judging whether the security vulnerability in the terminal meets the i+1-th deployment condition among the N deployment conditions, wherein i is a positive integer less than N.

[0091] Optionally, the virtual patch processing device further includes: a first detection unit, a first determination unit, and a first uninstallation unit. The first detection unit is used to detect whether the target security vulnerability of the terminal meets the uninstallation condition of the virtual patch included in the pre-policy when the virtual patch has been installed in the terminal; the first determination unit is used to determine that the target security vulnerability of the terminal has been repaired or the target security vulnerability has become invalid when it is detected that the security vulnerability of the terminal meets any one of the uninstallation conditions included in the pre-policy; the first uninstallation unit is used to uninstall the virtual patch installed in the terminal.

[0092] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the above-mentioned virtual patch processing method.

[0093] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0094] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0097] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0099] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for processing a virtual patch, characterized in that: include: In the process of installing a virtual patch for repairing a target security vulnerability of a terminal to the terminal, obtaining a pre-position policy, wherein the pre-position policy at least includes a deployment condition of the virtual patch; Determine whether the target operating environment information of the terminal meets the deployment conditions of the virtual patch, wherein the target operating environment information includes: the environment information required for the target security vulnerability to be successfully exploited by an attacker and the protection status information of the target security vulnerability currently being protected; When the information of the target operating environment of the terminal meets the deployment condition of the virtual patch, the virtual patch is installed in the terminal.

2. The method for processing a virtual patch according to claim 1, characterized in that: The pre-position strategy includes the following deployment conditions: A first type of deployment condition, wherein the first type of deployment condition is used to characterize information of a target object related to the security vulnerability protected by the virtual patch, wherein the target object is an operating system and / or application program affected by the security vulnerability protected by the virtual patch; The second type of deployment conditions, wherein the second type of deployment conditions are used to characterize the information security protection information of the information security device and / or the security protection system for the target object.

3. The method for processing a virtual patch according to claim 2, characterized in that: The first type of deployment condition includes at least one of the following deployment conditions: A first deployment condition, wherein the first deployment condition includes: system information of an operating system and / or program information of an application program affected by a security vulnerability protected by the virtual patch; The second deployment condition includes: system operation status information of the operating system and / or operation status information of the application program affected by the security vulnerability protected by the virtual patch.

4. The method for processing a virtual patch according to claim 2, characterized in that: The second type of deployment condition includes at least one of the following deployment conditions: A third deployment condition, wherein the third deployment condition includes configuration information of the information security device and / or security protection system for a network access port related to the security vulnerability; A fourth deployment condition, wherein the fourth deployment condition includes vulnerability protection information of the information security device and / or security protection system for the target object, wherein the vulnerability protection information is protection configuration information about the security vulnerability other than the virtual patch.

5. The method for processing a virtual patch according to claim 2, characterized in that: The first type of deployment condition also includes at least one of the following deployment conditions: a fifth deployment condition, wherein the fifth deployment condition includes version information of the target object; a sixth deployment condition, wherein the sixth deployment condition includes a port opening state of the target object; A seventh deployment condition, wherein the seventh deployment condition includes environmental configuration information of the target object.

6. The method for processing a virtual patch according to claim 5, characterized in that: The seventh deployment condition includes at least one of the following environment configuration information: First environment configuration information, wherein the first environment configuration information is used to configure the operation mode information of the target object required when the security vulnerability successfully attacks the target object; Second environment configuration information, wherein the second environment configuration information is used to configure permission information that the target object needs to enable when the security vulnerability successfully attacks the target object; Third environment configuration information, wherein the third environment configuration information is used to configure security configuration information that is required to be pre-set by the target object when the security vulnerability successfully attacks the target object; Fourth environment configuration information, wherein the fourth environment configuration information is used to configure the application call link that the security vulnerability relies on when launching a security attack on the target object.

7. The method for processing a virtual patch according to claim 1, characterized in that: The virtual patch processing method further includes: In a case where the pre-policy includes N deployment conditions and there is a judgment order among the N deployment conditions, whether the security vulnerability of the terminal satisfies the N deployment conditions is judged according to the judgment order, wherein, when it is judged according to the judgment order that the security vulnerability in the terminal does not satisfy the i-th deployment condition among the N deployment conditions, installation of the virtual patch in the terminal is prohibited, and judgment of whether the security vulnerability in the terminal satisfies the i+1-th deployment condition among the N deployment conditions is stopped, wherein i is a positive integer less than N.

8. The method for processing a virtual patch according to claim 1, characterized in that: The virtual patch processing method further includes: In the case where the virtual patch has been installed in the terminal, detecting whether a target security vulnerability of the terminal satisfies an uninstallation condition of the virtual patch included in the pre-policy; Upon detecting that the security vulnerability of the terminal satisfies any one of the uninstallation conditions included in the pre-policy, determining that the target security vulnerability of the terminal has been repaired or the target security vulnerability has become invalid; The virtual patch that has been installed in the terminal is uninstalled.

9. A virtual patch processing device, characterized in that: include: an acquisition unit, which acquires a pre-position policy during the process of installing a virtual patch for repairing a target security vulnerability of a terminal to the terminal, wherein the pre-position policy at least includes a deployment condition of the virtual patch; A determination unit, which determines whether information of a target operating environment of the terminal satisfies a deployment condition of the virtual patch, wherein the target operating environment information includes: environmental information required for the target security vulnerability to be successfully exploited by an attacker and protection status information of the target security vulnerability currently being protected; The installation unit is configured to install the virtual patch in the terminal when the information of the target operating environment of the terminal meets the deployment condition of the virtual patch.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the virtual patch processing method according to any one of claims 1 to 8.

Images