Security vulnerability scanning method and device, computer equipment and storage medium

Abstract

The invention discloses a security vulnerability scanning method and device, computer equipment and a storage medium. The method comprises the following steps: receiving and intercepting request data; analyzing and storing original normal request parameters of the request data; replacing the original normal request parameter with the security test pollution data with the pollution mark; continuing to process the request message according to the replaced request data; in a response stage after the request processing is completed, intercepting and analyzing response content; and executing security vulnerability detection and judgment based on the intercepted response content. According to the method, the request parameters are intercepted and modified, the request data are subjected to vulnerability scanning by using the security test pollution data with the pollution marks, and then the normal request parameters are replied, so that the problem of data pollution is avoided while the vulnerability scanning accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and more specifically to a security vulnerability scanning method, device, computer equipment and storage medium. Background Art

[0002] Existing security vulnerability scanning methods are divided into gray box scanning, white box scanning and black box scanning according to the principle type.

[0003] Black box scanning requires sending a large number of test contaminated data packets (payload) to the target service, which will cause a large amount of data pollution to the target business system and affect the normal operation of the business system.

[0004] White box scanning scans the source code and will not cause data pollution to the target service, but it has a high false positive rate and requires a lot of manual confirmation costs.

[0005] Gray box scanning modifies the system runtime bytecode and changes the program execution logic by adding hooks. It only monitors and analyzes the data flow in the system. It can avoid sending test contaminated data packets or send only a small amount of test data packets to verify whether the vulnerability is a false alarm. However, if you do not send test contaminated data packets and only analyze the data flow, the lack of data verification will result in the accuracy of gray box scanning being insufficient. If you send a small amount of contaminated data packets, you can achieve a high accuracy rate in vulnerability identification, but a small amount of contaminated data packets will still cause data contamination in the target system. Summary of the invention

[0006] The purpose of the present invention is to overcome the deficiencies of the prior art and to provide a security vulnerability scanning method, apparatus, computer equipment and storage medium, aiming to solve the problem of low accuracy of vulnerability scanning and avoid data contamination of the target system.

[0007] To achieve the above object, the present invention adopts the following technical solutions:

[0008] In a first aspect, the present invention provides a security vulnerability scanning method, comprising:

[0009] Receive and intercept request data;

[0010] Parse and save the original normal request parameters of the request data;

[0011] Replace the original normal request parameters with the security test polluted data with the pollution mark;

[0012] Continue processing the request message according to the replaced request data;

[0013] In the response phase after the request processing is completed, intercept and parse the response content;

[0014] Based on the intercepted response content, security vulnerability detection and judgment are performed.

[0015] Furthermore, it also includes:

[0016] After completing the security vulnerability detection, clean up and recycle the used security test contaminated data.

[0017] Furthermore, it also includes:

[0018] Restore the original normal request parameters.

[0019] Furthermore, the parsing and saving of original normal request parameters of the request data includes:

[0020] Parse the request header of the request data to see if there is a history field marked with pollution;

[0021] If there is no history field with a pollution mark, the original normal request parameters are saved in the global cache.

[0022] Furthermore, replacing the original normal request parameters with the security test contaminated data with the contamination mark includes:

[0023] Select safe test contaminated data;

[0024] Add contamination marks to selected safety test contamination data;

[0025] Use security test contaminated data to replace the original normal request parameters;

[0026] Reconstruct the request data using the replaced parameters.

[0027] Furthermore, the security vulnerability detection and judgment based on the intercepted response content includes:

[0028] Parse the intercepted response content;

[0029] If the security test contaminated data with contamination marks in the response content is not filtered, it is determined that a security vulnerability exists.

[0030] Furthermore, after the security vulnerability detection is completed, the used security test contaminated data is cleaned up and recovered, including:

[0031] Abort the security test to pollute the data and continue execution in the data flow;

[0032] Abort and recycle operation requests that may have an impact on the database when executing security test pollution data.

[0033] In a second aspect, the present invention further provides a security vulnerability scanning device, comprising:

[0034] A receiving unit, used for receiving and intercepting request data;

[0035] A parsing unit, used for parsing and saving original normal request parameters of request data;

[0036] A replacement unit, used for replacing original normal request parameters with security test polluted data with pollution marks;

[0037] An execution unit, used to continue processing the request message according to the replaced request data;

[0038] The interception unit is used to intercept and parse the response content in the response phase after the request processing is completed;

[0039] The security vulnerability determination unit is used to perform security vulnerability detection and determination based on the intercepted response content.

[0040] In a third aspect, the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security vulnerability scanning method as described above when executing the computer program.

[0041] In a fourth aspect, the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the security vulnerability scanning method as described above.

[0042] Compared with the prior art, the present invention has the following beneficial effects: a security vulnerability scanning method, comprising receiving and intercepting request data; parsing and saving the original normal request parameters of the request data; replacing the original normal request parameters with security test contaminated data with contamination marks; continuing to process the request message according to the replaced request data; in the response phase after the request processing is completed, intercepting and parsing the response content; and performing security vulnerability detection and judgment based on the intercepted response content. The present invention intercepts and modifies the request parameters, first performs vulnerability scanning on the request data using the security test contaminated data with contamination marks, and then restores the normal request parameters, thereby improving the accuracy of vulnerability scanning and avoiding the problem of data contamination.

[0043] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0045] Figure 1 A schematic diagram of an application environment of a security vulnerability scanning method provided by a specific embodiment of the present invention;

[0046] Figure 2 The process of the security vulnerability scanning method provided by the specific embodiment of the present invention Figure 1 ;

[0047] Figure 3 The process of the security vulnerability scanning method provided by the specific embodiment of the present invention Figure 2 ;

[0048] Figure 4 A schematic block diagram of a security vulnerability scanning device provided by a specific embodiment of the present invention Figure 1 ;

[0049] Figure 5 A schematic block diagram of a security vulnerability scanning device provided by a specific embodiment of the present invention Figure 2 ;

[0050] Figure 6 A schematic block diagram of a computer device provided for a specific embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0053] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

[0054] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0055] Figure 1 The schematic diagram of the application environment of the security vulnerability scanning method provided by the specific embodiment of the present invention is applicable to various business systems that need to perform security vulnerability scanning, especially systems with high requirements for data authenticity, such as financial systems, medical systems, data statistics and analysis systems, etc.

[0056] like Figure 1 As shown, in the application environment, there are users and servers, wherein the user sends request data to the server, the server intercepts and processes the request data sent by the user, and replaces the original normal request parameters in the request data with security test polluted data with pollution marks to perform vulnerability scanning, and after the scan is completed, the continued execution of the polluted data request is terminated, and the original normal request parameters are restored, the user's request is executed according to the original business logic, and finally the execution result of the request data is fed back to the user.

[0057] It should be noted that, in actual operation, the server may include multiple servers, such as a server cluster or a cloud server.

[0058] Figure 2 A flowchart of a security vulnerability scanning method provided by a specific embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes the following steps: S10-S60.

[0059] S10. Receive and intercept request data.

[0060] In this embodiment, the gray box scanning tool is installed in the service of the business system through the byte code modification principle of the gray box scanning tool, and an interception hook is installed in the key processing logic function of the business system. When the business system receives a new request from the user, the gray box scanning tool intercepts the request data through the hook.

[0061] S20: parse and save the original normal request parameters of the request data.

[0062] In one embodiment, step S20 specifically includes the following steps: S201 - S202 .

[0063] S201, parsing the request data to determine whether the request header contains a history field marked as contaminated.

[0064] S202: If there is no history field with a pollution mark, the original normal request parameters are saved in the global cache.

[0065] For steps S201-S202, in this embodiment, the original normal request parameters are parsed from the request. First, the request header is parsed to see if there is a pollution history mark field. If not, the original normal request parameters are saved in the global cache.

[0066] It should be noted that the purpose of parsing whether the request header contains a pollution history mark field is to avoid repeated replacement of request data that has been marked as a pollution state.

[0067] S30: Replace the original normal request parameters with the security test contaminated data with the contamination mark.

[0068] In one embodiment, step S30 specifically includes the following steps: S301 - S304 .

[0069] S301, select safety test contamination data.

[0070] Security testing contaminated data refers to data input used to test system security. These inputs often contain specific attack vectors or abnormal data to detect the system's response and protection capabilities when processing abnormal or malicious inputs.

[0071] These security test contaminated data can come from a pre-defined test case library, containing known attack vectors such as SQL injection, XSS scripts, etc.

[0072] S302: Add a contamination mark to the selected safety test contamination data.

[0073] By adding pollution tags, you can track which requests use polluted data, which is convenient for subsequent analysis and management.

[0074] S303: Use security test contaminated data to replace the original normal request parameters.

[0075] By finding the parameter position that needs to be replaced, the security test polluted data is then replaced with the original normal request parameters.

[0076] S304: Reconstruct the request data using the replaced parameters.

[0077] Reconstruct the request data using the replaced parameters to ensure that it is still valid and can continue to run.

[0078] For steps S301-S304, by inserting test data with pollution marks, it is possible to effectively detect whether there are security loopholes in the business system when processing abnormal inputs, thereby discovering potential security defects in a timely manner.

[0079] S40: Continue processing the request message according to the replaced request data.

[0080] After reconstruction, the control hook (HOOK) releases the request, so that the replaced request data continues to process the request message.

[0081] S50: In the response phase after the request processing is completed, intercept and parse the response content.

[0082] In this embodiment, after the business system processes the request message, it will execute the response return request function, and the response content will be intercepted again through the hook in the response return request.

[0083] S60: Based on the intercepted response content, perform security vulnerability detection and judgment.

[0084] In one embodiment, step S60 specifically includes the following steps: S601 - S602 .

[0085] S601: parse the intercepted response content.

[0086] S602: If the security test contaminated data with the contamination mark in the response content is not filtered, it is determined that there is a security vulnerability.

[0087] In this embodiment, for steps S601-S602, it is determined whether the business system has a vulnerability based on the response content. For example, if the polluted data added in the request is not filtered and continues to be displayed in the response request, it can be determined that there is a security vulnerability, and the vulnerability and runtime function call stack are reported to the vulnerability management background.

[0088] For steps S601-S602, by adding contaminated data, it is possible to quickly determine whether the system correctly filters and processes abnormal inputs, thereby improving vulnerability detection efficiency.

[0089] like Figure 3 As shown, in one embodiment, the security vulnerability scanning method further includes the following steps: S70.

[0090] S70. After completing the security vulnerability detection, clean up and recycle the used security test contaminated data.

[0091] In one embodiment, step S70 specifically includes the following steps: S701 - S702 .

[0092] S701, terminate the security test and continue to execute the polluted data in the data flow.

[0093] S702: suspend and recycle the operation requests that may have an impact on the database when the security test polluted data is executed.

[0094] In this embodiment, for steps S701-S702, after the security vulnerability is determined, the pollution mark field in the data stream is parsed. If it is marked as a polluted data packet, the data pollution request is terminated by calling the recovery function of the business system, and the system processing result is not returned to the data requester. At the same time, HOOK intercepts the database operation function, and the database operation request that may cause insertion, update, etc. to the database and affect the system data is also terminated and recovered. By suspending the execution of the above response requests and the suspension of the execution of database modification operations, the purpose of clearing the added security test pollution data is achieved as a whole.

[0095] like Figure 3 As shown, in one embodiment, the security vulnerability scanning method further includes the following steps: S80.

[0096] S80: Restore the original normal request parameters.

[0097] In this embodiment, after clearing the added security test contaminated data, the original normal request parameters are taken out from the global cache and then replaced in the request data stream to restore the normal business data. The contaminated and restored data is added to the request header, and the replaced normal request is sent to the request processing function of the business system. The original business request continues to be executed on the request data according to the original business logic, thereby not affecting the normal execution of the business request. After the business request is executed normally, the execution result is fed back to the user.

[0098] The present invention intercepts and modifies request parameters, first performs vulnerability scanning on request data using security test contaminated data with contamination marks, and then restores normal request parameters, thereby improving the accuracy of vulnerability scanning and avoiding the problem of data contamination.

[0099] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0100] The embodiment of the present invention also provides a security vulnerability scanning device, which is used to perform the steps in any embodiment of the aforementioned security vulnerability scanning method. Figure 4 , Figure 4A schematic block diagram of a security vulnerability scanning device 100 provided in an embodiment of the present application is shown. The security vulnerability scanning device 100 specifically includes:

[0101] The receiving unit 110 is used to receive and intercept request data; the parsing unit 120 is used to parse and save the original normal request parameters of the request data; the replacement unit 130 is used to replace the original normal request parameters with security test contaminated data with contamination marks; the execution unit 140 is used to continue processing the request message according to the replaced request data; the interception unit 150 is used to intercept and parse the response content in the response stage after the request processing is completed; the security vulnerability judgment unit 160 is used to perform security vulnerability detection and judgment based on the intercepted response content.

[0102] like Figure 5 As shown, in one embodiment, the security vulnerability scanning device 100 further includes:

[0103] The cleaning and recycling unit 170 is used to clean and recycle the used security test contaminated data after completing the security vulnerability detection.

[0104] like Figure 5 As shown, in one embodiment, the security vulnerability scanning device 100 further includes:

[0105] The restoring unit 180 is used to restore the original normal request parameters.

[0106] In one embodiment, the parsing unit 120 is specifically used for:

[0107] Parse the request data to see if there is a history field with a tainted mark in the request header; if there is no history field with a tainted mark, save the original normal request parameters to the global cache.

[0108] In one embodiment, the replacement unit 130 is specifically configured to:

[0109] Select security test contaminated data; add a contamination mark to the selected security test contaminated data; replace the original normal request parameters with the security test contaminated data; and reconstruct the request data using the replaced parameters.

[0110] In one embodiment, the security vulnerability determination unit 160 is specifically used to:

[0111] Parse the intercepted response content; if the security test contaminated data with contamination marks in the response content is not filtered, it is determined that a security vulnerability exists.

[0112] In one embodiment, the cleaning and recovery unit 170 is specifically used for:

[0113] The security test polluted data is terminated to continue to be executed in the data flow; the operation request that may have an impact on the database when the security test polluted data is executed is terminated and recovered.

[0114] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned security vulnerability scanning device 100 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and brevity of description, it will not be repeated here.

[0115] The above-mentioned security vulnerability scanning device can be implemented in the form of a computer program, and the computer program can be Figure 6 Runs on the computer device shown.

[0116] See also Figure 6 , Figure 6 700 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 700 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.

[0117] like Figure 6 As shown, the computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned security vulnerability scanning method steps are implemented.

[0118] The computer device 700 may be a terminal or a server. The computer device 700 includes a processor 720 , a memory, and a network interface 750 connected via a system bus 710 , wherein the memory may include a non-volatile storage medium 730 and an internal memory 740 .

[0119] The non-volatile storage medium 730 may store an operating system 731 and a computer program 732. When the computer program 732 is executed, the processor 720 may execute a security vulnerability scanning method.

[0120] The processor 720 is used to provide computing and control capabilities and support the operation of the entire computer device 700.

[0121] The internal memory 740 provides an environment for the operation of the computer program 732 in the non-volatile storage medium 730. When the computer program 732 is executed by the processor 720, the processor 720 can execute the security vulnerability scanning method.

[0122] The network interface 750 is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will appreciate that Figure 6The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 700 to which the solution of the present application is applied. The specific computer device 700 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components. The processor 720 is used to run the program code stored in the memory to implement the security vulnerability scanning method.

[0123] Those skilled in the art will understand that Figure 6 The embodiments of the computer device shown in the figure do not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such embodiments, the structure and function of the memory and the processor are the same as those of the embodiment of the present invention. Figure 6 The embodiments shown are consistent and will not be described again here.

[0124] It should be understood that in the embodiment of the present application, the processor 720 may be a central processing unit (CPU), and the processor 720 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0125] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium may be a non-volatile computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the security vulnerability scanning method disclosed in the embodiment of the present invention is implemented.

[0126] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the above-described equipment, devices and units can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. Those of ordinary skill in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0127] In the several embodiments provided by the present invention, it should be understood that the disclosed equipment, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. Units with the same function may also be combined into one unit. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be electrical, mechanical or other forms of connection.

[0128] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0129] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0130] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), disk or optical disk and other media that can store program codes.

[0131] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A security vulnerability scanning method, characterized in that: include: Receive and intercept request data; Parse and save the original normal request parameters of the request data; Replace the original normal request parameters with the security test polluted data with the pollution mark; Continue processing the request message according to the replaced request data; In the response phase after the request processing is completed, intercept and parse the response content; Based on the intercepted response content, security vulnerability detection and judgment are performed.

2. The security vulnerability scanning method according to claim 1, characterized in that: Also includes: After completing the security vulnerability detection, clean up and recycle the used security test contaminated data.

3. The security vulnerability scanning method according to claim 1, characterized in that: Also includes: Restore the original normal request parameters.

4. The security vulnerability scanning method according to claim 1, characterized in that: The parsing and saving of the original normal request parameters of the request data includes: Parse the request header of the request data to see if there is a history field marked with pollution; If there is no history field with a pollution mark, the original normal request parameters are saved in the global cache.

5. The security vulnerability scanning method according to claim 1, characterized in that: The replacing of the original normal request parameters with the security test polluted data with the pollution mark includes: Select safe test contamination data; Add contamination marks to selected safety test contamination data; Use security test contaminated data to replace the original normal request parameters; Reconstruct the request data using the replaced parameters.

6. The security vulnerability scanning method according to claim 1, characterized in that: The security vulnerability detection and judgment based on the intercepted response content includes: Parse the intercepted response content; If the security test contaminated data with contamination marks in the response content is not filtered, it is determined that a security vulnerability exists.

7. The security vulnerability scanning method according to claim 1, characterized in that: After the security vulnerability detection is completed, the used security test contaminated data is cleaned and recycled, including: Abort the security test to pollute the data and continue execution in the data flow; Abort and recycle operation requests that may have an impact on the database when executing security test pollution data.

8. A security vulnerability scanning device, characterized in that: include: A receiving unit, used for receiving and intercepting request data; A parsing unit, used for parsing and saving original normal request parameters of request data; A replacement unit, used for replacing original normal request parameters with security test polluted data with pollution marks; An execution unit, used to continue processing the request message according to the replaced request data; The interception unit is used to intercept and parse the response content in the response phase after the request processing is completed; The security vulnerability determination unit is used to perform security vulnerability detection and determination based on the intercepted response content.

9. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the security vulnerability scanning method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the security vulnerability scanning method according to any one of claims 1 to 7.

Images