Vulnerability scanning method and device based on asset fingerprints, equipment and medium

Abstract

The invention discloses a vulnerability scanning method and device based on asset fingerprints, equipment and a medium, and relates to the technical field of network security, and the method comprises the steps: carrying out the quantitative evaluation of the current performance state of a scanning missing server before vulnerability scanning, determining a concurrency amount for concurrently scanning assets based on the obtained server performance quantized value and a target conversion algorithm model, and obtaining the concurrency amount of the scanning assets; the target conversion algorithm model is a conversion algorithm model between the server performance quantized value and the scanning asset concurrency; and analyzing the to-be-scanned assets through the asset fingerprints corresponding to the to-be-scanned assets to obtain the server resource missing quantity required by the to-be-scanned assets, and performing vulnerability scanning operation based on the scanned asset concurrency quantity and the server resource missing quantity. According to the method, the resource quantity of the server missing for scanning required by scanning is obtained based on the asset fingerprint, and the performance of the server missing for scanning is evaluated to determine the scanning asset concurrency quantity, so that the scanning stability and accuracy are effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a vulnerability scanning method, device, equipment and medium based on asset fingerprint. Background Art

[0002] Currently, scanning is dynamically controlled based on the asset status. However, the real-time monitoring and feedback mechanism needs to collect and analyze a large amount of real-time data in order to adjust the scanning strategy in time. This requires powerful data processing and decision support capabilities. In actual operation, it is difficult to achieve real-time monitoring and dynamic feedback mechanism.

[0003] From the above, it can be seen that how to improve the stability and performance of scanning is an urgent problem to be solved. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a vulnerability scanning method, device, equipment and medium based on asset fingerprint, which can improve the stability and performance of scanning. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a vulnerability scanning method based on asset fingerprint, comprising:

[0006] Before performing vulnerability scanning, perform quantitative evaluation on the current performance status of the missed servers to obtain the corresponding server performance quantitative value;

[0007] Determine the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the concurrent scanning asset volume; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the concurrent scanning asset volume;

[0008] The asset to be scanned is subjected to corresponding analysis operations through the asset fingerprint corresponding to the asset to be scanned, so as to obtain the amount of missed-scan server resources required to scan the asset to be scanned, and corresponding vulnerability scanning operations are performed based on the concurrent scanning asset volume and the missed-scan server resources.

[0009] Optionally, before performing the vulnerability scan, a quantitative evaluation operation is performed on the current performance status of the missed-scan server to obtain a corresponding server performance quantification value, including:

[0010] Before performing vulnerability scanning, a quantitative evaluation operation is performed on the current performance status of the missed-scan servers based on performance indicators in the missed-scan servers and using a preset weighted sum algorithm to obtain a corresponding server performance quantification value.

[0011] Optionally, before determining the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the concurrent scanning asset amount, the method further includes:

[0012] Determine the initial conversion algorithm model;

[0013] The initial conversion algorithm model is trained and tested accordingly using historical server data to obtain a target conversion algorithm model for converting server performance quantification values ​​into scanning asset concurrency.

[0014] Optionally, after determining the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the concurrent scanning asset volume, the method further includes:

[0015] Determine whether the server performance quantization value meets a preset performance saturation condition;

[0016] If the server performance quantization value meets the preset performance saturation condition, reducing the corresponding scanning asset concurrency based on the first preset concurrency reduction rule;

[0017] If the server performance quantization value does not meet the preset performance saturation condition, the corresponding scanning asset concurrency is increased based on the first preset concurrency increase rule.

[0018] Optionally, before performing a corresponding analysis operation on the asset to be scanned by using the asset fingerprint corresponding to the asset to be scanned to obtain the amount of missed-scan server resources required to scan the asset to be scanned, and performing a corresponding vulnerability scanning operation based on the concurrent amount of scanned assets and the amount of missed-scan server resources, the method further includes:

[0019] Determining whether the asset to be scanned meets a preset condition;

[0020] If the asset to be scanned meets the preset condition, the concurrency of the corresponding scanned asset is increased based on the second preset concurrency increase rule, and the corresponding scan depth is increased based on the preset scan depth increase rule;

[0021] If the asset to be scanned does not meet the preset condition, reducing the concurrency of the corresponding scanned asset based on a second preset concurrency reduction rule;

[0022] The preset condition is a preset high-risk condition or a preset high-complexity condition.

[0023] Optionally, if the asset to be scanned does not meet the preset condition, before reducing the concurrency of the corresponding scanned asset based on a preset concurrency reduction rule, the method further includes:

[0024] Determining whether the amount of missed-scan server resources required to scan the asset to be scanned is limited;

[0025] If the amount of missed-scan server resources required to scan the to-be-scanned assets is limited, the corresponding concurrent scanning asset amount is reduced based on the third preset concurrent amount reduction rule.

[0026] Optionally, performing a corresponding analysis operation on the asset to be scanned by using an asset fingerprint corresponding to the asset to be scanned to obtain an amount of missed-scan server resources required to scan the asset to be scanned includes:

[0027] Determine the scanning magnitude value corresponding to each of the assets to be scanned based on the preset mapping relationship and the asset fingerprint corresponding to the asset to be scanned;

[0028] Analyzing the scan magnitude value to determine the amount of missed scan server resources required to scan the asset to be scanned;

[0029] Among them, the preset mapping relationship is a mapping relationship between the predetermined asset fingerprints of different assets and the corresponding scanning level values, and the scanning level value is a parameter value determined based on the scale, complexity and distribution characteristics of the assets and can reflect the amount of missed scanning server resources required for the corresponding assets.

[0030] In a second aspect, the present application provides a vulnerability scanning device based on asset fingerprint, comprising:

[0031] The quantitative value determination module is used to perform a quantitative evaluation operation on the current performance status of the missed server before performing the vulnerability scan to obtain the corresponding server performance quantitative value;

[0032] A concurrency determination module, used to determine the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the asset scanning concurrency; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the asset scanning concurrency;

[0033] The vulnerability scanning module is used to perform corresponding analysis operations on the assets to be scanned through the asset fingerprints corresponding to the assets to be scanned, so as to obtain the amount of missed-scan server resources required to scan the assets to be scanned, and perform corresponding vulnerability scanning operations based on the concurrent scanning asset volume and the missed-scan server resources.

[0034] In a third aspect, the present application provides an electronic device, including:

[0035] Memory, used to store computer programs;

[0036] The processor is used to execute the computer program to implement the aforementioned vulnerability scanning method based on asset fingerprint.

[0037] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned asset fingerprint-based vulnerability scanning method.

[0038] Before performing vulnerability scanning, the present application performs a quantitative evaluation operation on the current performance status of the missed scanning server to obtain the corresponding server performance quantification value; determines the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the concurrent scanning asset; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the concurrent scanning asset; performs corresponding analysis operations on the asset to be scanned through the asset fingerprint corresponding to the asset to be scanned to obtain the amount of missed scanning server resources required to scan the asset to be scanned, and performs corresponding vulnerability scanning operations based on the scanning asset concurrent amount and the missed scanning server resources. As can be seen from the above, the present application first performs a quantitative evaluation on the performance status of the missed scanning server to obtain the corresponding server performance quantification value, then determines the scanning asset concurrent amount for concurrently scanning assets through the server performance quantification value and the target conversion algorithm, then analyzes the asset to be scanned based on the asset fingerprint to obtain the amount of missed scanning server resources required for the asset to be scanned, and finally performs vulnerability scanning operations through the scanning asset concurrent amount and the scanning asset concurrent amount. In this way, before conducting a vulnerability scan, the amount of server resources required for the scan is obtained based on the asset fingerprint of the asset to be scanned, and the performance of the server is evaluated to determine the concurrent amount of the scanned assets. This effectively supplements the lack of real-time control of the concurrent amount during the dynamic scanning process, thereby improving the stability and accuracy of the scan. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A flow chart of a vulnerability scanning method based on asset fingerprint disclosed in this application;

[0041] Figure 2 A flowchart of a specific vulnerability scanning method based on asset fingerprint disclosed in this application;

[0042] Figure 3 A flowchart of a specific vulnerability scanning method based on asset fingerprint disclosed in this application;

[0043] Figure 4This is a schematic diagram of the structure of a vulnerability scanning device based on asset fingerprint disclosed in this application;

[0044] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] At present, when dynamically controlling scanning based on asset conditions, because the real-time monitoring and feedback mechanism needs to collect and analyze a large amount of real-time data, and needs to adjust the scanning strategy in a timely manner, this places high demands on data processing and decision support capabilities, and it is difficult to achieve real-time monitoring and dynamic feedback mechanisms in actual operations. To this end, this application provides a vulnerability scanning method based on asset fingerprints. Before performing a vulnerability scan, the amount of leaky scanning server resources required for scanning is obtained according to the asset fingerprint of the asset to be scanned, and the performance of the leaky scanning server is evaluated to determine the concurrent amount of scanned assets, which effectively supplements the deficiency of real-time control of concurrent amount during the dynamic scanning process, thereby improving the stability and accuracy of the scan.

[0047] See also Figure 1 As shown, an embodiment of the present invention discloses a vulnerability scanning method based on asset fingerprint, including:

[0048] Step S11: before performing vulnerability scanning, a quantitative evaluation operation is performed on the current performance status of the missed-scan server to obtain a corresponding server performance quantitative value.

[0049] In this embodiment, before performing vulnerability scanning, the performance indicators of the missed scan server are calculated using a preset weighted sum algorithm or a preset performance calculation model to obtain a server performance quantification value. Specifically, before performing vulnerability scanning, the current performance status of the missed scan server is quantitatively evaluated to obtain a corresponding server performance quantification value, including: before performing vulnerability scanning, based on the performance indicators of the missed scan server and using a preset weighted sum algorithm, the current performance status of the missed scan server is quantitatively evaluated to obtain a corresponding server performance quantification value.

[0050] It is understandable that the performance indicators of the missed scan server include but are not limited to CPU (Central Processing Unit) performance (such as single-core / multi-core performance score), memory size, and disk IO (Input / Output) performance (read and write speed). In a specific implementation, a corresponding weight is assigned to each of the performance indicators, and then a comprehensive score of the performance indicators of the missed scan server is obtained by weighted summation to obtain the quantitative value of the server performance. It should be specifically noted that the weight allocation of the performance indicators is determined based on actual needs and is not specifically limited here.

[0051] In another specific implementation, the performance indicators of the missed scan server are preprocessed, that is, the performance indicators of the missed scan server are cleaned, standardized, and feature selected to obtain corresponding processed data to ensure the quality and consistency of the data, and then the processed data is trained using a machine learning algorithm to establish one or more machine learning models. The training process of the machine learning model includes feature extraction, model construction, and optimization parameters to obtain a corresponding trained machine learning model, and the performance indicators of the missed scan server are input into the trained machine learning model to obtain a comprehensive quantitative value of the server performance. For example, the server performance quantitative value that may be obtained by the missed scan server with Loongson 3A6000, 16GB memory, and high-speed SSD (Solid State Disk or Solid State Drive) is 1000.

[0052] Step S12: determining the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the scanning asset concurrency; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the scanning asset concurrency.

[0053] In this embodiment, multiple assets to be scanned are scanned simultaneously, which places certain requirements on the performance of the missed-scan server. Therefore, it is necessary to quantitatively evaluate the performance status of the missed-scan server. After obtaining the corresponding server performance quantification value, a target conversion algorithm model is established based on the relationship between the server performance quantification value and the asset scanning concurrency, which is used to convert the server performance quantification value into the asset scanning concurrency. For example, the missed-scan server with a server performance quantification value of 1000 corresponds to a maximum asset scanning concurrency of 1000, but in actual operation, the asset scanning concurrency also needs to consider factors such as the priority of the scanning task and the importance of the asset. It should be noted that when the configuration of the missed-scan server changes, the asset scanning concurrency needs to be recalculated.

[0054] It is understandable that before determining the concurrent amount of the scanning assets, it is necessary to first construct a conversion algorithm model between the server performance quantification value and the concurrent amount of the scanning assets, that is, to construct a target conversion algorithm model. Specifically, before determining the concurrent amount for concurrent scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the concurrent amount of the scanning assets, it also includes: determining an initial conversion algorithm model; using historical server data to perform corresponding training and testing on the initial conversion algorithm model to obtain a target conversion algorithm model for converting the server performance quantification value into the concurrent amount of the scanning assets.

[0055] It should be pointed out that before constructing the target conversion algorithm model, it is necessary to first collect the historical server data of the missed scanning server, clean and preprocess the collected data, and then determine the correlation between the server performance quantification value and the scanning asset concurrency through correlation analysis to obtain the corresponding correlation analysis results, and establish the initial conversion algorithm model based on the correlation results to represent the relationship between the server performance quantification value and the scanning asset concurrency, and then perform corresponding training and testing on the initial conversion algorithm model through the historical server to obtain the target conversion algorithm model for converting the server performance quantification value into the scanning asset concurrency.

[0056] Step S13: performing corresponding analysis operations on the asset to be scanned through the asset fingerprint corresponding to the asset to be scanned to obtain the amount of missed server resources required to scan the asset to be scanned, and performing corresponding vulnerability scanning operations based on the concurrent scanning asset volume and the missed server resources.

[0057] In this embodiment, the scanning magnitude values ​​corresponding to each of the assets to be scanned are determined based on the asset fingerprints corresponding to the assets to be scanned and the preset mapping relationship, and then the scanning magnitude values ​​are analyzed to determine the amount of missed scan server resources required to scan the assets to be scanned. Specifically, the asset fingerprints corresponding to the assets to be scanned are used to perform corresponding analysis operations on the assets to be scanned to obtain the amount of missed scan server resources required to scan the assets to be scanned, including: determining the scanning magnitude values ​​corresponding to each of the assets to be scanned based on the preset mapping relationship and the asset fingerprints corresponding to the assets to be scanned; analyzing the scanning magnitude values ​​to determine the amount of missed scan server resources required to scan the assets to be scanned; wherein the preset mapping relationship is a mapping relationship between the asset fingerprints of different assets and the corresponding scanning magnitude values ​​determined in advance, and the scanning magnitude value is a parameter value that can reflect the amount of missed scan server resources required for the corresponding assets and is determined based on the scale, complexity and distribution characteristics of the assets. For example, the scanning magnitude value of OpenSSH (Open Secure Shell, an open source management tool) is 5, and the scanning magnitude value of Microsoft Windows RPC (Remote Procedure Call, remote procedure call) is 7. For a host, if both services are detected, the asset scan level of the host is the sum of the two services (or the sum adjusted according to the weights), which is 12.

[0058] It can be understood that the asset fingerprint corresponding to the asset to be scanned is obtained by locating the fingerprint dimension of the asset, and the scanning magnitude value corresponding to each of the assets to be scanned is determined based on the asset fingerprint and the preset mapping relationship, and the amount of missed server resources required to scan the asset to be scanned is determined by analyzing the scanning magnitude value. As the unique identifier of the asset, the asset fingerprint contains rich asset information. Among them, the asset fingerprint corresponding to the asset to be scanned is obtained through the fingerprint dimension of the host asset and the fingerprint dimension of the Web (World wide web, i.e. global wide area network) asset. The fingerprint dimension of the host asset includes software information, specifically including the version and configuration information of the operating system and key services (such as OpenSSH, Microsoft Windows RPC, etc.); the fingerprint dimension of the Web asset includes asset classification, specifically including Web applications (based on frameworks, languages, etc.), operating systems, industrial control systems, and middleware.

[0059] It should be noted that for unscanned assets, the scan is performed according to the preset initial scan level (e.g., level 10 for host assets and level 50 for Web assets). Different initial scan levels are set for different types of assets. For example, for host assets, an initial scan level of 10 may be set, while for Web assets, an initial scan level of 50 may be set. The setting of the initial scan level is based on a comprehensive consideration of the asset type, quantity, and security requirements.

[0060] As can be seen from the above, the present application first quantitatively evaluates the performance status of the missed scan server to obtain the corresponding server performance quantification value, then determines the scanning asset concurrency for concurrently scanning assets through the server performance quantification value and the target conversion algorithm, and then analyzes the assets to be scanned based on the asset fingerprint to obtain the missed scan server resource volume required for the assets to be scanned, and finally performs vulnerability scanning operations through the scanning asset concurrency volume and the scanning asset concurrency volume. In this way, before performing a vulnerability scan, the missed scan server resource volume required for scanning is obtained according to the asset fingerprint of the asset to be scanned, and the performance of the missed scan server is evaluated to determine the scanning asset concurrency volume, which effectively supplements the deficiency of real-time control of concurrency during the dynamic scanning process, thereby improving the stability and accuracy of the scan.

[0061] It can be seen from the above embodiments that the present application performs vulnerability scanning operations based on the concurrent volume of scanned assets and the amount of resources of missed-scanned servers. However, when determining the concurrent volume of scanned assets, the performance status of missed-scanned servers should also be considered. Therefore, the concurrent volume of scanned assets is dynamically adjusted by performing a quantitative evaluation operation on the current performance status of the missed-scanned servers to obtain the server performance quantification value.

[0062] See also Figure 2 As shown, an embodiment of the present invention discloses a vulnerability scanning method based on asset fingerprint, including:

[0063] Step S21: Before performing vulnerability scanning, a quantitative evaluation operation is performed on the current performance status of the missed server to obtain a corresponding server performance quantification value.

[0064] Step S22, determining the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the scanning asset concurrency; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the scanning asset concurrency.

[0065] Step S23: Determine whether the server performance quantization value meets a preset performance saturation condition.

[0066] In this embodiment, a corresponding quantitative evaluation operation is performed on the current performance status of the missed-scan server to obtain the server performance quantification value, and based on the server performance quantification value, it is determined whether the missed-scan server meets the preset performance saturation threshold to dynamically adjust the corresponding scanning asset concurrency.

[0067] Step S24: If the server performance quantization value meets the preset performance saturation condition, the corresponding scanning asset concurrency is reduced based on the first preset concurrency reduction rule, and the corresponding vulnerability scanning operation is performed based on the reduced scanning asset concurrency and the missed server resource amount.

[0068] In this embodiment, when the server performance quantization value meets the preset performance saturation condition, that is, the performance of the missed scan server is close to the preset performance saturation threshold, it means that the processing capacity of the missed scan server is close to the limit. If the scanning asset concurrency continues to increase, it will cause server overload. Therefore, it is necessary to reduce the corresponding scanning asset concurrency to obtain the corresponding reduced scanning asset concurrency, and perform the corresponding vulnerability scanning operation based on the reduced scanning asset concurrency and the missed scan server resource amount. Among them, the first preset concurrency reduction rule is a concurrency reduction rule determined based on the number of assets to be scanned and the server performance quantization value.

[0069] Step S25: If the server performance quantization value does not meet the preset performance saturation condition, the corresponding scanning asset concurrency is increased based on the first preset concurrency increase rule, and the corresponding vulnerability scanning operation is performed based on the increased scanning asset concurrency and the missed server resource amount.

[0070] In this embodiment, if the server performance quantization value does not meet the preset performance saturation condition, that is, the server performance quantization value is not close to the preset performance saturation threshold, it means that the missed scan server still has sufficient resources to process more requests or tasks under the current load. Based on this situation, the corresponding scanning asset concurrency is increased based on the first preset concurrency increase rule to obtain the corresponding increased scanning asset concurrency, and the corresponding vulnerability scanning operation is performed based on the increased scanning asset concurrency and the missed scan server resource amount. Among them, the first preset concurrency increase rule is a concurrency increase rule determined based on the number of assets to be scanned and the server performance quantization value.

[0071] Among them, the specific implementation process of the above steps S21 and S22 can refer to the corresponding content in the previous embodiment, and will not be repeated here.

[0072] As can be seen from the above, the server performance quantification value is obtained by quantitatively evaluating the current performance status of the missed scan server, and then the scanning asset concurrency is dynamically adjusted based on the server performance quantification value to ensure a balance between scanning efficiency and server performance.

[0073] It can be seen from the above embodiments that the present application dynamically adjusts the scanning asset concurrency by using the server performance quantification value obtained by quantitatively evaluating the current performance status of the missed-scan server, and also needs to dynamically adjust the scanning asset concurrency based on the type of the assets to be scanned and the amount of resources of the missed-scan server.

[0074] See also Figure 3 As shown, an embodiment of the present invention discloses a vulnerability scanning method based on asset fingerprint, including:

[0075] Step S31: Before performing vulnerability scanning, a quantitative evaluation operation is performed on the current performance status of the missed server to obtain a corresponding server performance quantification value.

[0076] Step S32: determining the corresponding concurrent amount of scanning assets based on the server performance quantification value and the target conversion algorithm model; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the concurrent amount of scanning assets.

[0077] Step S33, determining whether the asset to be scanned meets a preset condition; wherein the preset condition is a preset high-risk condition or a preset high-complexity condition.

[0078] In this embodiment, it is determined whether the asset to be scanned exceeds the preset risk threshold. If the asset to be scanned exceeds the preset risk threshold, it indicates that the asset to be scanned meets the preset high-risk condition; it is determined whether the asset to be scanned exceeds the preset complexity threshold. If the asset to be scanned exceeds the preset complexity threshold, it indicates that the asset to be scanned meets the preset high-complexity condition.

[0079] Step S34: If the asset to be scanned meets the preset conditions, the corresponding scanning asset concurrency is increased based on the second preset concurrency increase rule, and the corresponding scanning depth is increased based on the preset scanning depth increase rule to obtain the corresponding increased scanning asset concurrency, and perform corresponding vulnerability scanning operations based on the increased scanning asset concurrency and the missed server resource amount.

[0080] In this embodiment, if the asset to be scanned meets the preset high-risk condition or the preset high-complexity condition, the concurrency of the corresponding scanning asset is increased based on the second preset concurrency increase rule, and the corresponding scanning depth is increased based on the preset scanning depth increase rule; the second preset concurrency increase rule is a concurrency increase rule determined based on the risk type and complexity type of the asset to be scanned; the preset scanning depth increase rule is a scanning depth increase rule determined based on the risk type and complexity type of the asset to be scanned.

[0081] Step S35: If the asset to be scanned does not meet the preset condition, the corresponding scanning asset concurrency is reduced based on the second preset concurrency reduction rule to obtain the corresponding reduced scanning asset concurrency, and the corresponding vulnerability scanning operation is performed based on the reduced scanning asset concurrency and the missed server resource amount.

[0082] In this embodiment, if the asset to be scanned does not meet the preset high-risk condition or the preset high-complexity condition, the concurrency of the corresponding scanning asset is reduced based on the second preset concurrency reduction rule; the second preset concurrency reduction rule is a concurrency reduction rule determined based on the risk type and complexity type of the asset to be scanned.

[0083] It is understandable that before reducing the corresponding scanning asset concurrency based on the preset concurrency reduction rule, it is also necessary to determine whether the amount of missed scanning server resources required for scanning the asset to be scanned is limited, and dynamically adjust the corresponding scanning asset concurrency based on the limited situation. Specifically, if the asset to be scanned does not meet the preset conditions, before reducing the corresponding scanning asset concurrency based on the preset concurrency reduction rule, it also includes: determining whether the amount of missed scanning server resources required for scanning the asset to be scanned is limited; if the amount of missed scanning server resources required for scanning the asset to be scanned is limited, reducing the corresponding scanning asset concurrency based on the third preset concurrency reduction rule; the third preset concurrency reduction rule is a concurrency reduction rule determined based on the amount of missed scanning server resources required for scanning the asset to be scanned.

[0084] For the specific implementation process of the above steps S31 and S32, reference may be made to the corresponding contents in the aforementioned embodiments, which will not be described in detail here.

[0085] As can be seen from the above, the concurrency of the scanning assets can be dynamically adjusted based on the type of the assets to be scanned and the amount of missed server resources. Even when server resources are limited, the concurrency for concurrently scanning assets can be dynamically adjusted, thereby improving security management efficiency and scanning accuracy.

[0086] Accordingly, see Figure 4As shown, the present application also provides a vulnerability scanning device based on asset fingerprint, including:

[0087] The quantitative value determination module 11 is used to perform a quantitative evaluation operation on the current performance status of the missed server before performing the vulnerability scan to obtain the corresponding server performance quantitative value;

[0088] A concurrency determination module 12 is used to determine the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the asset scanning concurrency; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the asset scanning concurrency;

[0089] The vulnerability scanning module 13 is used to perform corresponding analysis operations on the assets to be scanned through the asset fingerprints corresponding to the assets to be scanned, so as to obtain the amount of missed-scan server resources required to scan the assets to be scanned, and perform corresponding vulnerability scanning operations based on the concurrent scanning asset volume and the missed-scan server resources.

[0090] As can be seen from the above, the present application first quantitatively evaluates the performance status of the missed scan server to obtain the corresponding server performance quantification value, then determines the scanning asset concurrency for concurrently scanning assets through the server performance quantification value and the target conversion algorithm, and then analyzes the assets to be scanned based on the asset fingerprint to obtain the missed scan server resource volume required for the assets to be scanned, and finally performs vulnerability scanning operations through the scanning asset concurrency volume and the scanning asset concurrency volume. In this way, before performing a vulnerability scan, the missed scan server resource volume required for scanning is obtained according to the asset fingerprint of the asset to be scanned, and the performance of the missed scan server is evaluated to determine the scanning asset concurrency volume, which effectively supplements the deficiency of real-time control of concurrency during the dynamic scanning process, thereby improving the stability and accuracy of the scan.

[0091] In some specific implementations, the quantization value determination module 11 may specifically include:

[0092] The performance evaluation unit is used to perform a quantitative evaluation operation on the current performance status of the missed-scan server based on the performance indicators in the missed-scan server and using a preset weighted sum algorithm before performing a vulnerability scan to obtain a corresponding server performance quantification value.

[0093] In some specific implementations, the asset fingerprint-based vulnerability scanning device may further include:

[0094] An initial model determination unit, used to determine an initial conversion algorithm model;

[0095] The target model determination completion unit is used to use historical server data to perform corresponding training and testing on the initial conversion algorithm model to obtain a target conversion algorithm model for converting the server performance quantization value into the scanning asset concurrency.

[0096] In some specific implementations, the asset fingerprint-based vulnerability scanning device may further include:

[0097] A quantization value judgment unit, used to judge whether the server performance quantization value meets a preset performance saturation condition;

[0098] A first concurrency reduction unit, configured to reduce the concurrency of the corresponding scanning asset based on a first preset concurrency reduction rule if the server performance quantization value meets the preset performance saturation condition;

[0099] The first concurrency increasing unit is used to increase the concurrency of the corresponding scanning asset based on a first preset concurrency increasing rule if the server performance quantization value does not meet the preset performance saturation condition.

[0100] In some specific implementations, the asset fingerprint-based vulnerability scanning device may further include:

[0101] A first asset judgment unit, used to judge whether the asset to be scanned meets a preset condition;

[0102] A second concurrency increasing unit is used to increase the concurrency of the corresponding scanned asset based on a second preset concurrency increasing rule if the asset to be scanned meets the preset condition, and to increase the corresponding scan depth based on a preset scan depth increasing rule;

[0103] The second concurrency reduction unit is used to reduce the concurrency of the corresponding scanning asset based on a second preset concurrency reduction rule if the asset to be scanned does not meet the preset condition.

[0104] In some specific implementations, the asset fingerprint-based vulnerability scanning device may further include:

[0105] The second asset determination unit is used to determine whether the amount of missed-scan server resources required to scan the asset to be scanned is limited;

[0106] The third concurrency reduction unit is used to reduce the concurrency of the corresponding scanning asset based on a third preset concurrency reduction rule if the amount of resources of the missed scanning server required to scan the asset to be scanned is limited.

[0107] In some specific implementations, the vulnerability scanning module 13 may specifically include:

[0108] A magnitude value determining unit, configured to determine a scanning magnitude value corresponding to each of the assets to be scanned based on a preset mapping relationship and an asset fingerprint corresponding to the asset to be scanned;

[0109] The resource quantity determination unit is used to analyze the scan level value to determine the missed scan server resource quantity required to scan the to-be-scanned asset.

[0110] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the vulnerability scanning method based on asset fingerprints disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0111] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0112] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0113] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the asset fingerprint-based vulnerability scanning method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0114] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed vulnerability scanning method based on asset fingerprint is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0115] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0116] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0117] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0118] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0119] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A vulnerability scanning method based on asset fingerprint, characterized in that: include: Before performing vulnerability scanning, perform quantitative evaluation on the current performance status of the missed servers to obtain the corresponding server performance quantitative value; Determine the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the concurrent scanning asset volume; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the concurrent scanning asset volume; The asset to be scanned is subjected to corresponding analysis operations through the asset fingerprint corresponding to the asset to be scanned, so as to obtain the amount of missed-scan server resources required to scan the asset to be scanned, and corresponding vulnerability scanning operations are performed based on the concurrent scanning asset volume and the missed-scan server resources.

2. The vulnerability scanning method based on asset fingerprint according to claim 1 is characterized in that: Before performing vulnerability scanning, a quantitative evaluation operation is performed on the current performance status of the missed server to obtain a corresponding server performance quantitative value, including: Before performing vulnerability scanning, a quantitative evaluation operation is performed on the current performance status of the missed-scan servers based on performance indicators in the missed-scan servers and using a preset weighted sum algorithm to obtain a corresponding server performance quantification value.

3. The vulnerability scanning method based on asset fingerprint according to claim 1 is characterized in that: Before determining the concurrency for concurrently scanning assets based on the server performance quantization value and the target conversion algorithm model to obtain the concurrent scanning asset amount, the method further includes: Determine the initial conversion algorithm model; The initial conversion algorithm model is trained and tested accordingly using historical server data to obtain a target conversion algorithm model for converting server performance quantification values ​​into scanning asset concurrency.

4. The vulnerability scanning method based on asset fingerprint according to claim 1, characterized in that: After determining the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the concurrent scanning asset volume, the method further includes: Determine whether the server performance quantization value meets a preset performance saturation condition; If the server performance quantization value meets the preset performance saturation condition, reducing the corresponding scanning asset concurrency based on the first preset concurrency reduction rule; If the server performance quantization value does not meet the preset performance saturation condition, the corresponding scanning asset concurrency is increased based on the first preset concurrency increase rule.

5. The vulnerability scanning method based on asset fingerprint according to claim 1, characterized in that: The method further includes: performing a corresponding analysis operation on the asset to be scanned by using the asset fingerprint corresponding to the asset to be scanned to obtain the amount of missed-scan server resources required to scan the asset to be scanned, and performing a corresponding vulnerability scanning operation based on the concurrent amount of scanned assets and the amount of missed-scan server resources. Determining whether the asset to be scanned meets a preset condition; If the asset to be scanned meets the preset condition, the concurrency of the corresponding scanned asset is increased based on the second preset concurrency increase rule, and the corresponding scan depth is increased based on the preset scan depth increase rule; If the asset to be scanned does not meet the preset condition, reducing the concurrency of the corresponding scanning asset based on a second preset concurrency reduction rule; The preset condition is a preset high-risk condition or a preset high-complexity condition.

6. The vulnerability scanning method based on asset fingerprint according to claim 5 is characterized in that: If the asset to be scanned does not meet the preset condition, before reducing the concurrency of the corresponding scanned asset based on the preset concurrency reduction rule, the method further includes: Determining whether the amount of missed-scan server resources required to scan the asset to be scanned is limited; If the amount of missed-scan server resources required to scan the to-be-scanned assets is limited, the corresponding concurrent scanning asset amount is reduced based on the third preset concurrent amount reduction rule.

7. The vulnerability scanning method based on asset fingerprint according to any one of claims 1 to 6, characterized in that: The performing corresponding analysis operations on the asset to be scanned by using the asset fingerprint corresponding to the asset to be scanned to obtain the amount of missed scan server resources required to scan the asset to be scanned includes: Determine the scanning magnitude value corresponding to each of the assets to be scanned based on the preset mapping relationship and the asset fingerprint corresponding to the asset to be scanned; Analyzing the scan magnitude value to determine the amount of missed scan server resources required to scan the asset to be scanned; Among them, the preset mapping relationship is a mapping relationship between the predetermined asset fingerprints of different assets and the corresponding scanning level values, and the scanning level value is a parameter value determined based on the scale, complexity and distribution characteristics of the assets and can reflect the amount of missed scanning server resources required for the corresponding assets.

8. A vulnerability scanning device based on asset fingerprint, characterized in that: include: The quantitative value determination module is used to perform a quantitative evaluation operation on the current performance status of the missed server before performing the vulnerability scan to obtain the corresponding server performance quantitative value; A concurrency determination module, used to determine the concurrency for concurrently scanning assets based on the server performance quantification value and the target conversion algorithm model to obtain the asset scanning concurrency; the target conversion algorithm model is a conversion algorithm model between the server performance quantification value and the asset scanning concurrency; The vulnerability scanning module is used to perform corresponding analysis operations on the assets to be scanned through the asset fingerprints corresponding to the assets to be scanned, so as to obtain the amount of missed-scan server resources required to scan the assets to be scanned, and perform corresponding vulnerability scanning operations based on the concurrent scanning asset volume and the missed-scan server resources.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the vulnerability scanning method based on asset fingerprint as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the asset fingerprint-based vulnerability scanning method according to any one of claims 1 to 7 is implemented.

Images