Data security vulnerability scanning and repairing system

Abstract

The invention discloses a data security vulnerability scanning and repairing system, which relates to the field of data security and comprises a static scanning module, a dynamic scanning module, a network scanning module, a virtualization scanning module, a search engine scanning module and a multivariate repairing module. According to the method, potential coding defects and security vulnerabilities are identified through source code examination by the static scanning module, and the dynamic scanning module simulates behaviors of attackers, tests running application programs and finds real-time vulnerabilities. The network scanning module, the virtualization scanning module and the search engine scanning module are used for carrying out comprehensive scanning on a network and a system, detecting open ports, service vulnerabilities and configuration errors, carrying out targeted scanning according to sources of the vulnerabilities, improving the comprehensiveness of scanning, and finding and repairing the vulnerabilities to the maximum extent.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security vulnerability scanning and repairing system. Background Art

[0002] Data security refers to measures and technologies for protecting data from unauthorized access, leakage, damage or loss, while data security vulnerabilities refer to flaws or weaknesses in systems or applications that can be exploited by attackers, resulting in data leakage, damage or unauthorized access.

[0003] For example, Chinese patent CN108574675A discloses a full-network security vulnerability scanning system based on WEB technology. The system is an active detection system consisting of three parts: client, server and database. The server is the core of the system and is responsible for accepting customized scanning requests submitted by the client, scheduling each module according to the control strategy, searching the relevant feature database, and using the plug-in library to give suggestions, complete the scan and give the result data, which is written into the result report according to the customized format requirements.

[0004] However, in the existing technology, the generation of security vulnerabilities is often related to a variety of factors, including omissions in the software development process, lack of timely updates and patch management, and weak security awareness of operators. Even mature systems are difficult to escape the threat of vulnerabilities. The existing scanning system is relatively single and cannot detect diversified security vulnerabilities in a timely manner, posing certain security risks. Summary of the invention

[0005] The purpose of the present invention is to provide a data security vulnerability scanning and repairing system to solve the problems raised by the above background technology.

[0006] To achieve the above-mentioned object, the present invention provides the following technical solutions: a data security vulnerability scanning and repairing system, comprising a static scanning module, a dynamic scanning module, a network scanning module, a virtualization scanning module, a search engine scanning module and a multi-repairing module;

[0007] The static scanning module uses SonarQube and Fortify tools to identify potential coding errors and security vulnerabilities through static inspection of source code. Such tools can detect problems in the early stages of development and reduce the cost of later repairs;

[0008] The dynamic scanning module simulates attacker behavior to perform real-time testing on running applications and discover runtime vulnerabilities, such as SQL injection, cross-site scripting (XSS), etc. These tools can provide detailed vulnerability details and repair suggestions;

[0009] The network scanning module uses Nmap and Nessus tools to focus on network-level security detection, and identifies open ports, unauthorized services and other potential network threats by scanning network ports, services and devices. It can effectively discover security risks in the network architecture;

[0010] The virtualization scanning module uses tools such as Aqua and Clair to specifically target container and virtualization technologies, detect security issues in their configurations and dependencies, and ensure the security of the virtual environment;

[0011] In terms of specific scanning methods, there are two main methods: black box testing and white box testing. Black box testing does not rely on internal code, but only simulates attacks from the outside, which is suitable for simulating real attack scenarios; while white box testing conducts in-depth security analysis by accessing source code and system structure, and can discover potential internal security vulnerabilities. Hybrid testing combines the advantages of both and provides more comprehensive and accurate vulnerability detection results;

[0012] The search engine scanning module utilizes a search engine to perform non-invasive scanning, and includes a general search engine scanning unit and a special search engine scanning unit.

[0013] Preferably, the static scanning module, the dynamic scanning module, the network scanning module, the virtualization scanning module and the search engine scanning module are electrically connected in sequence.

[0014] Preferably, the general search engine scanning unit uses a search engine to scan security vulnerabilities and analyze sensitive information, and at the same time forms an index query database, uses the index query database to scan Web security vulnerabilities, and automatically tracks search results through a cache mechanism and an Alert service;

[0015] If there is an SQL injection vulnerability, the search engine is used to check the vulnerabilities in the server page and Web application. Port information can also be used to search for quotation marks and service keywords. After obtaining the corresponding search results, they are compared with the relevant data in the port database of the index query engine to determine whether there is a security threat. Using search engines to perform non-invasive scanning of network security has the advantages of simple operation, hidden scanning, and a wide range of scanning targets.

[0016] Preferably, the dedicated search engine scanning unit intercepts the corresponding information through the port to establish a search index to obtain the corresponding results. After obtaining the results in the application process, the vulnerability knowledge and the corresponding information are correlated and analyzed to obtain the vulnerability information of the target system being detected to determine whether there is a security threat.

[0017] Preferably, the dedicated search engine scanning unit performs security vulnerability scanning mainly in two steps:

[0018] A1. Use Shodan API or Shodan search engine to query the database for relevant asset information or service information. After obtaining the information, organize it according to the corresponding format to improve the accuracy of asset discovery. At the same time, combine it with the IP attribution information database to verify the database information.

[0019] A2. Obtain the queried asset information or service information, and compare it with the relevant information in the vulnerability knowledge base to determine whether the target system under inspection has vulnerabilities. After the query, the corresponding results are published, and the information related to the vulnerabilities is summarized and processed to predict the existing security vulnerabilities. If security vulnerabilities exist, it is necessary to put forward corresponding network security protection suggestions and repair the vulnerabilities.

[0020] Preferably, the specific method of scanning includes the following steps:

[0021] S1. Preliminary preparation phase, including determining the scanning target and scope, configuring scanning tools, and obtaining necessary permissions and resources; this step ensures that the scanning process has a clear direction and avoids missing key parts;

[0022] S2. Information collection and preliminary analysis: Through the network scanning module and system configuration check, basic information of the platform is collected, including open ports, running services and system configuration. This information provides basic data for subsequent detailed scanning;

[0023] S3, enter the detailed scanning stage, using the static scanning module and the dynamic scanning module to perform in-depth scanning. The static scanning module identifies potential coding defects and security vulnerabilities through source code review, while the dynamic scanning module simulates attacker behavior, tests running applications, and discovers real-time vulnerabilities;

[0024] S4. For the network layer, use the network scanning module, the virtualization scanning module and the search engine scanning module to perform a comprehensive scan of the network and the system to detect open ports, service vulnerabilities and configuration errors;

[0025] S5. After obtaining the scan results, enter the result analysis and risk assessment stage. Through detailed analysis of the scan report, determine the severity and potential impact of each vulnerability, and classify and sort them. This step helps to determine the vulnerabilities that need to be repaired first and improve the efficiency and effectiveness of the repair work;

[0026] S6. Develop a regular scanning strategy and regularly perform the above scanning steps to maintain the security and stability of the platform.

[0027] Preferably, the multi-repair module uses multiple methods to repair the scanning results, which includes a system vulnerability repair unit, an application vulnerability repair unit, an access control unit, an encryption transmission unit and a vulnerability management unit.

[0028] Preferably, the system vulnerability repair unit promptly applies security patches and updates provided by the manufacturer to repair known security defects;

[0029] The application vulnerability repair unit eliminates vulnerabilities through code correction and secure coding practices (such as input validation, output encoding, and use of secure APIs);

[0030] The access control unit implements an access control mechanism, allocates and manages user rights, and prevents unauthorized access;

[0031] The encryption transmission unit adopts encryption technology (such as SSL / TLS) in data transmission to address data transmission security vulnerabilities and ensure the confidentiality and integrity of data during transmission;

[0032] The vulnerability management unit regularly updates and reviews dependencies, automatically detecting and fixing known vulnerabilities.

[0033] Preferably, the specific method of repairing comprises the following steps:

[0034] B1. Implement restoration strategies and conduct evaluations;

[0035] B2. Continuously monitor and manage vulnerability fixes.

[0036] Preferably, the step B1 specifically comprises the following steps:

[0037] B11. When implementing repairs, combine development and operation integration with continuous integration / continuous delivery processes to ensure that the repair process is efficient and does not affect platform stability;

[0038] B12. Use automated testing tools to conduct comprehensive testing on the repaired system to verify whether the vulnerability has been completely fixed and ensure that no new security issues have been introduced;

[0039] B13. After the repair is completed, conduct security assessment and penetration testing to confirm that the overall security of the platform meets the expected standards;

[0040] B14. Regularly review and update security strategies, combine actual operation data and the latest security threat intelligence, continuously improve repair measures, and ensure the long-term security and stability of big data;

[0041] The step B2 specifically comprises the following steps:

[0042] B21. Deploy real-time monitoring systems, such as SIEM (security information and event management) tools, to monitor the security status and abnormal activities of the platform in real time;

[0043] B22. Establish a vulnerability management process, including regular scanning, vulnerability notification, patch management, and fix verification, to ensure timely discovery and handling of emerging vulnerabilities;

[0044] B23. Combine with the threat intelligence platform to obtain the latest security threat information and prevent potential attacks;

[0045] B24. Implement log management and analysis to identify suspicious behaviors and potential risks by collecting and analyzing system logs;

[0046] B25. Conduct security assessments and audits regularly to review the effectiveness of existing security measures and remediation strategies to ensure that the platform continues to meet security standards and compliance requirements.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] 1. In the present invention, the static scanning module identifies potential coding defects and security vulnerabilities through source code review, while the dynamic scanning module simulates attacker behavior, tests running applications, and discovers real-time vulnerabilities. For the network level, the network scanning module, virtualization scanning module and search engine scanning module are used to perform a comprehensive scan of the network and system, detect open ports, service vulnerabilities and configuration errors, and perform targeted scanning on the source of the vulnerability, thereby improving the comprehensiveness of the scan and maximizing the discovery and repair of vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The present invention is a flowchart of a data security vulnerability scanning and repairing system.

[0050] In the figure: 1. Static scanning module; 2. Dynamic scanning module; 3. Network scanning module; 4. Virtualization scanning module; 5. Search engine scanning module; 51. General search engine scanning unit; 52. Special search engine scanning unit; 6. Multi-repair module; 61. System vulnerability repair unit; 62. Application vulnerability repair unit; 63. Access control unit; 64. Encryption transmission unit; 65. Vulnerability management unit. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the implementation regulations described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] Example 1: Reference Figure 1 As shown: a data security vulnerability scanning and repairing system, including a static scanning module 1, a dynamic scanning module 2, a network scanning module 3, a virtualization scanning module 4, a search engine scanning module 5 and a multi-repairing module 6;

[0053] The static scanning module 1, the dynamic scanning module 2, the network scanning module 3, the virtualization scanning module 4 and the search engine scanning module 5 are electrically connected in sequence;

[0054] Static scanning module 1 uses tools such as SonarQube and Fortify to identify potential coding errors and security vulnerabilities through static inspection of source code. Such tools can detect problems in the early stages of development and reduce the cost of later repairs;

[0055] Dynamic scanning module 2 simulates attacker behavior to test running applications in real time and discover runtime vulnerabilities such as SQL injection and cross-site scripting (XSS). These tools can provide detailed vulnerability details and repair suggestions;

[0056] Network Scanning Module 3 uses tools such as Nmap and Nessus to focus on network-level security detection. By scanning network ports, services, and devices, it identifies open ports, unauthorized services, and other potential network threats. It can effectively discover security risks in the network architecture.

[0057] Virtualization Scanning Module 4 uses tools such as Aqua and Clair to specifically target containers and virtualization technologies, detect security issues in their configurations and dependencies, and ensure the security of virtual environments;

[0058] In terms of specific scanning methods, there are two main methods: black box testing and white box testing. Black box testing does not rely on internal code, but only simulates attacks from the outside, which is suitable for simulating real attack scenarios; while white box testing conducts in-depth security analysis by accessing source code and system structure, and can discover potential internal security vulnerabilities. Hybrid testing combines the advantages of both and provides more comprehensive and accurate vulnerability detection results;

[0059] The search engine scanning module 5 uses a search engine to perform non-invasive scanning, and includes a general search engine scanning unit 51 and a dedicated search engine scanning unit 52;

[0060] The general search engine scanning unit 51 uses the search engine to scan security holes and analyze sensitive information, and at the same time forms an index query database, uses the index query database to scan Web security holes, and automatically tracks search results through a cache mechanism and an Alert service;

[0061] If there is an SQL injection vulnerability, use the search engine to check for vulnerabilities in the server page and Web application. Port information can also be used to search for quotation marks and service keywords. After obtaining the corresponding search results, compare them with the relevant data in the port database of the index query engine to determine whether there is a security threat. Using search engines to perform non-invasive scanning of network security has the advantages of simple operation, hidden scanning, and a wide range of scanning targets;

[0062] The dedicated search engine scanning unit 52 intercepts the corresponding information through the port to establish a search index to obtain the corresponding results. After obtaining the results in the application process, the vulnerability knowledge and the corresponding information are analyzed for correlation, thereby obtaining the vulnerable information of the detected target system to determine whether there is a security threat;

[0063] The dedicated search engine scanning unit 52 performs security vulnerability scanning mainly in two steps:

[0064] A1. Use Shodan API or Shodan search engine to query the database for relevant asset information or service information. After obtaining the information, organize it according to the corresponding format to improve the accuracy of asset discovery. At the same time, combine it with the IP attribution information database to verify the database information.

[0065] A2. Obtain the queried asset information or service information, and compare it with the relevant information in the vulnerability knowledge base to determine whether the target system under inspection has vulnerabilities. After the query, the corresponding results are published, and the information related to the vulnerabilities is summarized and processed to predict the existing security vulnerabilities. If security vulnerabilities exist, it is necessary to put forward corresponding network security protection suggestions and repair the vulnerabilities.

[0066] The specific scanning method includes the following steps:

[0067] S1. Preliminary preparation phase, including determining the scanning target and scope, configuring scanning tools, and obtaining necessary permissions and resources; this step ensures that the scanning process has a clear direction and avoids missing key parts;

[0068] S2, information collection and preliminary analysis, through the network scanning module 3 and system configuration check, collect the basic information of the platform, including open ports, running services and system configuration, which provides basic data for subsequent detailed scanning;

[0069] S3, enter the detailed scanning stage, use static scanning module 1 and dynamic scanning module 2 to perform in-depth scanning. Static scanning module 1 identifies potential coding defects and security vulnerabilities through source code review, while dynamic scanning module 2 simulates attacker behavior, tests running applications, and discovers real-time vulnerabilities;

[0070] S4. For the network layer, use the network scanning module 3, the virtualization scanning module 4 and the search engine scanning module 5 to perform a comprehensive scan of the network and system to detect open ports, service vulnerabilities and configuration errors;

[0071] S5. After obtaining the scan results, enter the result analysis and risk assessment stage. Through detailed analysis of the scan report, determine the severity and potential impact of each vulnerability, and classify and sort them. This step helps to determine the vulnerabilities that need to be repaired first and improve the efficiency and effectiveness of the repair work;

[0072] S6. Develop a regular scanning strategy and regularly perform the above scanning steps to maintain the security and stability of the platform;

[0073] The multi-repair module 6 uses multiple methods to repair the scan results, which includes a system vulnerability repair unit 61, an application vulnerability repair unit 62, an access control unit 63, an encryption transmission unit 64 and a vulnerability management unit 65;

[0074] System vulnerability repair unit 61 promptly applies security patches and updates provided by manufacturers to repair known security defects;

[0075] The application vulnerability remediation unit 62 eliminates vulnerabilities through code correction and secure coding practices (such as input validation, output encoding, and use of secure APIs);

[0076] The access control unit 63 implements access control mechanisms, allocates and manages user rights, and prevents unauthorized access;

[0077] The encryption transmission unit 64 uses encryption technology (such as SSL / TLS) in data transmission to address data transmission security vulnerabilities and ensure the confidentiality and integrity of data during transmission;

[0078] Vulnerability Management Unit 65 regularly updates and reviews dependencies, automatically detecting and fixing known vulnerabilities;

[0079] The specific method of repairing includes the following steps:

[0080] B1. Implement restoration strategies and conduct evaluations;

[0081] B11. When implementing repairs, combine development and operation integration with continuous integration / continuous delivery processes to ensure that the repair process is efficient and does not affect platform stability;

[0082] B12. Use automated testing tools to conduct comprehensive testing on the repaired system to verify whether the vulnerability has been completely fixed and ensure that no new security issues have been introduced;

[0083] B13. After the repair is completed, conduct security assessment and penetration testing to confirm that the overall security of the platform meets the expected standards;

[0084] B14. Regularly review and update security strategies, combine actual operation data and the latest security threat intelligence, continuously improve repair measures, and ensure the long-term security and stability of big data;

[0085] B2. Continuously monitor and manage vulnerability fixes;

[0086] B21. Deploy real-time monitoring systems, such as SIEM (security information and event management) tools, to monitor the security status and abnormal activities of the platform in real time;

[0087] B22. Establish a vulnerability management process, including regular scanning, vulnerability notification, patch management, and fix verification, to ensure timely discovery and handling of emerging vulnerabilities;

[0088] B23. Combine with the threat intelligence platform to obtain the latest security threat information and prevent potential attacks;

[0089] B24. Implement log management and analysis to identify suspicious behaviors and potential risks by collecting and analyzing system logs;

[0090] B25. Conduct security assessments and audits regularly to review the effectiveness of existing security measures and remediation strategies to ensure that the platform continues to meet security standards and compliance requirements.

[0091] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data security vulnerability scanning and repair system, characterized in that: It includes a static scanning module (1), a dynamic scanning module (2), a network scanning module (3), a virtualization scanning module (4), a search engine scanning module (5) and a multi-repair module (6); The static scanning module (1) identifies potential coding errors and security vulnerabilities by statically checking the source code; The dynamic scanning module (2) performs real-time testing on the running application by simulating the attacker's behavior to discover runtime vulnerabilities; The network scanning module (3) focuses on security detection at the network level, and identifies open ports, unauthorized services and other potential network threats by scanning network ports, services and devices; The virtualization scanning module (4) specifically targets containers and virtualization technologies and detects security issues in their configurations and dependencies; The search engine scanning module (5) performs non-invasive scanning using a search engine, and comprises a general search engine scanning unit (51) and a special search engine scanning unit (52).

2. A data security vulnerability scanning and repairing system according to claim 1, characterized in that: The static scanning module (1), the dynamic scanning module (2), the network scanning module (3), the virtualization scanning module (4) and the search engine scanning module (5) are electrically connected in sequence.

3. A data security vulnerability scanning and repairing system according to claim 2, characterized in that: The general search engine scanning unit (51) uses a search engine to scan security holes and analyze sensitive information, and at the same time forms an index query database, uses the index query database to scan Web security holes, and automatically tracks search results through a cache mechanism and an alert service; If there is a SQL injection vulnerability, use the search engine to check the vulnerability in the server page and web application.

4. A data security vulnerability scanning and repairing system according to claim 3, characterized in that: The dedicated search engine scanning unit (52) intercepts corresponding information through a port to establish a search index to obtain corresponding results, and after obtaining the results in the application process, performs correlation analysis on vulnerability knowledge and corresponding information, thereby obtaining vulnerable information of the detected target system.

5. A data security vulnerability scanning and repairing system according to claim 4, characterized in that: The dedicated search engine scanning unit (52) performs security vulnerability scanning mainly in two steps: A1. Use Shodan API or Shodan search engine to query the database for relevant asset information or service information, organize the information according to the corresponding format, and verify the database information in combination with the IP attribution information database; A2. Obtain the queried asset information or service information, and compare it with the relevant information in the vulnerability knowledge base to determine whether there are vulnerabilities in the target system being tested. After the query, the corresponding results are published, the information related to the vulnerabilities is summarized and processed, and the existing security vulnerabilities are predicted.

6. A data security vulnerability scanning and repairing system according to claim 1, characterized in that: The specific method of scanning includes the following steps: S1, Preliminary preparation stage, including determining the scanning target and scope, configuring scanning tools, and obtaining necessary permissions and resources; S2, information collection and preliminary analysis, through the network scanning module (3) and system configuration check, collect the basic information of the platform, including open ports, running services and system configuration; S3, enter the detailed scanning stage, use the static scanning module (1) and the dynamic scanning module (2) to perform in-depth scanning. The static scanning module (1) identifies potential coding defects and security vulnerabilities through source code review, while the dynamic scanning module (2) simulates attacker behavior, tests the running application, and discovers real-time vulnerabilities; S4. At the network level, use the network scanning module (3), the virtualization scanning module (4) and the search engine scanning module (5) to perform a comprehensive scan of the network and the system to detect open ports, service vulnerabilities and configuration errors; S5. After obtaining the scan results, enter the result analysis and risk assessment stage, through a detailed analysis of the scan report, determine the severity and potential impact of each vulnerability, and classify and sort them; S6. Develop a regular scanning strategy and perform the above scanning steps regularly.

7. A data security vulnerability scanning and repairing system according to claim 1, characterized in that: The multi-repair module (6) uses a variety of methods to repair the scanning results, and includes a system vulnerability repair unit (61), an application vulnerability repair unit (62), an access control unit (63), an encryption transmission unit (64) and a vulnerability management unit (65).

8. A data security vulnerability scanning and repairing system according to claim 7, characterized in that: The system vulnerability repair unit (61) promptly applies security patches and updates provided by the manufacturer to repair known security defects; The application vulnerability repair unit (62) eliminates vulnerabilities through code correction and secure coding practices; The access control unit (63) implements an access control mechanism, allocates and manages user rights, and prevents unauthorized access; The encryption transmission unit (64) adopts encryption technology in data transmission to address data transmission security vulnerabilities; The vulnerability management unit (65) regularly updates and reviews dependencies, and automatically detects and repairs known vulnerabilities.

9. A data security vulnerability scanning and repairing system according to claim 8, characterized in that: The specific method of repair includes the following steps: B1. Implement restoration strategies and conduct evaluations; B2. Continuously monitor and manage vulnerability fixes.

10. A data security vulnerability scanning and repairing system according to claim 9, characterized in that: The step B1 specifically comprises the following steps: B11. When implementing fixes, combine development and operation integration with continuous integration / continuous delivery processes; B12. Use automated testing tools to conduct comprehensive testing on the repaired system to verify whether the vulnerability has been completely fixed; B13. After the repair is completed, conduct security assessment and penetration testing; B14. Regularly review and update security policies, and continuously improve remediation measures based on actual operation data and the latest security threat intelligence; The step B2 specifically comprises the following steps: B21. Deploy a real-time monitoring system to monitor the security status and abnormal activities of the platform in real time; B22. Establish a vulnerability management process, including regular scanning, vulnerability notification, patch management, and fix verification; B23. Combine with the threat intelligence platform to obtain the latest security threat information and prevent potential attacks; B24. Implement log management and analysis to identify suspicious behaviors and potential risks by collecting and analyzing system logs; B25. Perform security assessments and audits regularly to review the effectiveness of existing security measures and remediation strategies.

Images