Security vulnerability detection method and system based on domestic server

Abstract

The invention relates to the technical field of computer security detection, and discloses a security vulnerability detection method and system based on a localized server, and the method comprises the steps: building a feature information library, and obtaining target data; collecting parameter data of the first object, and executing feature detection; and comparing the target data with the parameter data to form a first result. According to the method, a C / S structure is adopted, a management platform is deployed in an operation and maintenance center, client software is deployed in a domestic server operating system, a vulnerability detection instruction can be issued and vulnerability information can be displayed in the middle ten days of management, and banner information is directly collected and POC is executed on a terminal through a client. And after determining whether there is a vulnerability, reporting vulnerability information to a management center for display and alarm, thereby effectively eliminating vulnerability detection failure caused by network transmission and reducing network influence. And the accuracy and effectiveness of vulnerability detection are superior to those of the existing detection mode.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security detection, and in particular to a security vulnerability detection method and system based on a domestic server. Background Art

[0002] At present, vulnerability detection tools are mainly network-based vulnerability detection tools, that is, sending data packets through the network to obtain the banner information of the target system, or sending POC data to determine whether there is a vulnerability. This method is more dependent on network communication, and is often unable to accurately discover system vulnerabilities due to factors such as network management and control and firewalls. In addition, this method often requires the centralized sending of a large number of network data packets, which can easily lead to network storms and affect business communications. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is that the existing technology relies on network communication and is greatly affected by firewalls.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a security vulnerability detection method based on a domestic server, comprising: establishing a feature information library to obtain target data; collecting parameter data of a first object to perform feature detection; and comparing the target data and the parameter data to form a first result.

[0006] As a preferred solution of the security vulnerability detection method based on domestic servers described in the present invention, wherein: the parameter data of the first object is collected, before performing feature detection, it also includes performing feature detection after receiving a feature detection instruction, and the feature detection instruction contains a security verification mechanism.

[0007] As a preferred solution of the security vulnerability detection method based on a domestic server described in the present invention, after executing the feature detection, it also includes uploading the feature detection result to the feature information library and correcting the first result.

[0008] As a preferred solution of the security vulnerability detection method based on a domestic server described in the present invention, wherein: after the comparison of the target data and the parameter data forms a first result, it also includes correcting the first result using the feature detection result, and evaluating according to the corrected first result; presetting the first interval and the second interval to compare with the first result to determine the triggering of an action; the action includes no action and a first action; the trigger includes, when the first result belongs to the first interval, executing no action; when the first result belongs to the second interval, executing the first action.

[0009] As a preferred solution of the security vulnerability detection method based on domestic servers described in the present invention, wherein: the target data includes but is not limited to known vulnerability information and security verification mechanisms; the parameter data includes but is not limited to key information of domestic servers.

[0010] As a preferred solution of the security vulnerability detection method based on domestic servers described in the present invention, wherein: the feature detection includes but is not limited to vulnerability detection, and the vulnerability detection includes dynamic detection and static detection; the dynamic detection includes executing the security verification mechanism issued by the execution management center, and judging whether there is vulnerability information based on the back-end feedback result of the security verification mechanism; the static detection includes collecting the system version and kernel information of the domestic server, the installed software and the currently running process through standard system commands to form the currently executed software information.

[0011] As a preferred solution of the security vulnerability detection method based on domestic servers described in the present invention, the first result includes but is not limited to generating a vulnerability report when vulnerability information is detected, and alerting and visually displaying the vulnerability information and vulnerability report.

[0012] A security vulnerability detection system based on a domestic server using any of the methods described in the present invention, wherein: a management center module is used to store existing vulnerability information, issue detection instructions, summarize, warn and display detection results; a client module is used to collect parameter data of a first object, perform static and dynamic detection, and upload the detection results to an evaluation module; an evaluation module compares the detection results and makes corrections and evaluations, and uploads the evaluation results to the management center module.

[0013] A computer device comprises: a memory and a processor; the memory stores a computer program, comprising: the steps of implementing any one of the methods of the present invention when the processor executes the computer program.

[0014] A computer-readable storage medium stores a computer program, comprising: when the computer program is executed by a processor, the steps of implementing any one of the methods of the present invention are implemented.

[0015] Beneficial effects of the present invention: The method of the present invention adopts a C / S structure, deploys a management platform in the operation and maintenance center, and deploys client software in the domestic server operating system. The management center can issue vulnerability detection instructions and display vulnerability information. The client directly collects banner information and executes POC at the terminal. After determining whether there is a vulnerability, the vulnerability information is reported to the management center for display and alarm, which can effectively prevent vulnerability detection failures caused by network transmission and reduce network impact. The accuracy and effectiveness of vulnerability detection are superior to current detection methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0017] Figure 1 An overall flow chart of a security vulnerability detection method based on a domestic server provided by an embodiment of the present invention;

[0018] Figure 2 A software working diagram of a security vulnerability detection method based on a domestic server provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0020] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a security vulnerability detection method based on a domestic server, comprising:

[0021] S1: Establish a feature information database and obtain target data.

[0022] Furthermore, a vulnerability information database and a POC information database are established in the management center. Specifically, a structured database is created to define the key fields of vulnerability information, including vulnerability name, vulnerability number (such as CVE number, CNVD number, etc.), affected software, affected version range, vulnerability description, vulnerability level, vulnerability characteristics and repair suggestions, etc. An independent module is set up in the information database to store security verification mechanisms.

[0023] Obtain the latest vulnerability information from official vulnerability databases (such as CVE, CNVD, NVD, etc.) or authoritative security intelligence sources. According to the characteristics of the domestic server environment of this system, filter the vulnerability information related to the system to avoid introducing redundant data irrelevant to the system, and ensure the accuracy and efficiency of the vulnerability information database.

[0024] S2: Collect parameter data of the first object and perform feature detection.

[0025] Furthermore, in one embodiment of the present invention, the feature detection may be vulnerability detection. Specifically, when the management center issues a vulnerability detection instruction, it carries a security verification mechanism and pushes it to the client software. After receiving the vulnerability detection instruction, the client software performs the vulnerability detection.

[0026] The security verification mechanism includes but is not limited to POC instructions, signature matching detection and automated vulnerability scanning scripts. In one embodiment of the present invention, when the management center issues a vulnerability detection instruction, it carries the POC information and pushes it to the client software. After the client receives the detection instruction, it triggers the dynamic detection and static detection modules.

[0027] Furthermore, after the management center issues the POC instruction, the dynamic detection module first loads the POC instruction and executes it to simulate the specific conditions or behaviors of vulnerability exploitation, and determines whether the vulnerability exists by monitoring the system feedback after execution (such as return code, system log, network traffic changes, etc.). For example, some POC instructions will try to open specific ports, call specific system APIs, or execute specific commands. By monitoring these response behaviors, the authenticity of the vulnerability can be determined.

[0028] In addition to single feedback results, the dynamic detection module can also monitor the behavior of the server system, such as CPU usage, memory consumption, file system changes, etc., to capture abnormal resource consumption or abnormal behavior of specific processes.

[0029] If a result that matches the vulnerability characteristics is detected, the dynamic detection module will generate a JSON report with the vulnerability details and report it to the management center to ensure that the management center obtains the vulnerability details in a timely manner.

[0030] Furthermore, the static detection module collects parameter data of the first object, and the first object includes various types of servers. All servers that can install and execute the client agent software provided by the present invention are included in the first object. Accordingly, the parameter data of the first object includes system version, kernel information, installed software and current process, etc.

[0031] Specifically, the static detection module obtains the system kernel information through the uname -a command and the cat / etc / os-release command, and extracts the distribution and version information of the operating system.

[0032] Use the rpm-qa command to obtain information about installed software packages in the system, including the software name and version number. Use the ps command to obtain information about currently running processes and verify the execution status of the software, thereby confirming whether the installed software is actually running in the system. Cross-check the installed software information obtained by rpm-qa with the process information obtained by the ps command to ensure that the software running in the system matches the impact range of the known vulnerability.

[0033] The static detection module integrates the collected information into JSON format and reports it to the management center through the data upload module.

[0034] In another embodiment of the present invention, the security verification mechanism may also be a signature matching detection. Specifically, the signature matching detection is targeted at domestic servers or sensitive business systems, and is suitable for systems that cannot directly execute instructions and have strict security policies or performance constraints.

[0035] Furthermore, a vulnerability information database and signature feature database are established in the management center to record information such as vulnerability name, number, impact scope, vulnerability description and rectification suggestions. Each vulnerability feature data contains specific system configuration, version, file hash and other static data for signature matching detection.

[0036] The management center pushes the vulnerability detection command to the client and provides the vulnerability feature data that needs to be compared. The client collects the system key information of the domestic server, including the system version, kernel information, installed software and currently running processes, and generates the system key information feature data, compares the system key information feature data with the vulnerability feature data, and determines whether there are features that match the vulnerability in a static detection method.

[0037] The test results are also integrated into JSON format and reported to the management center.

[0038] In another embodiment of the present invention, feature detection can also be file integrity detection. Specifically, the management center generates a signature (such as a hash value) list of core system files and sends it to the client for comparison. The client reads the core files (such as system library files, executable programs, etc.) and generates a hash value, which is compared with the signature list sent to determine whether there is file tampering. After tampering is detected, it is reported to the management center and an alarm is triggered.

[0039] S3: Compare the target data and the parameter data to form a first result.

[0040] Specifically, after obtaining the reported information, the management center obtains the prepared vulnerability information as the first result by comparing the operating system version information, kernel information, version information of the software being installed, etc. with the vulnerability information library.

[0041] Further, the first result is corrected using the vulnerability detection result, and an evaluation is performed based on the corrected first result;

[0042] The preset first interval, the second interval and the first result are compared to determine the triggering of the action;

[0043] The actions include no action and a first action;

[0044] The trigger includes:

[0045] When the first result belongs to the first interval, no action is performed;

[0046] When the first result belongs to the second interval, a first action is performed.

[0047] Specifically, the first result is whether a vulnerability is detected. The first interval includes no vulnerability detected, and the collected system and software information is exactly the same as the standard information, confirming that there is no possibility of a vulnerability. The second interval includes but is not limited to detected vulnerabilities and other situations. The correction is when the first result is that no vulnerability is detected, if the dynamic monitoring result is that a vulnerability is detected, the first result is corrected to be detected and belongs to the second interval.

[0048] The first action includes but is not limited to generating an HTML vulnerability report based on the vulnerability information, pushing the vulnerability information and the vulnerability report to an alarm module, and displaying the vulnerability alarm information in a management center.

[0049] In another embodiment of the present invention, the second interval also includes a situation where no vulnerability is found in dynamic detection and the version information comparison does not match, but the collected system and software information is different from the standard information, and it is impossible to determine whether there is a vulnerability.

[0050] The corresponding first action at this time can be a review mechanism, which reports the fuzzy matching results or uncertain items to the management center for manual or semi-automatic review, and feeds back the review results to the vulnerability library to improve the accuracy of future detection.

[0051] The manual or semi-automatic method can use heuristic rules to assist in detection, and define a set of inference rules based on historical data and known vulnerability features to identify uncertain system states. For example, a rule can be defined: if the version information has a similarity of more than 90% with the closest known vulnerability feature in the vulnerability library, it is determined to be a possible vulnerability risk. Combined with the heuristic rule judgment results, it is manually confirmed whether it is a vulnerability.

[0052] The test results of the review mechanism are taken as the first result and re-evaluated.

[0053] Example 2, reference Figure 2 , which is another embodiment of the present invention, provides a specific implementation method of a security vulnerability detection method based on a domestic server.

[0054] Specifically, the software program includes a management platform and a client agent. The management platform is mainly responsible for distributing the vulnerability information database, aggregating and storing vulnerability information and alarms, and generating reports, while the client agent is responsible for the information collection module of the domestic server and dynamic vulnerability detection.

[0055] The management center is mainly responsible for the overall management, summary and command issuance, including management module, vulnerability information library, POC library, report generation module, alarm module, etc.

[0056] The client agent is mainly installed on domestic services. It is mainly responsible for collecting the server's current information, such as system version information, component information, installed software information, process information, etc., and executing POC, performing dynamic vulnerability detection and reporting to the management platform for alarm display.

[0057] The specific implementation method is as follows:

[0058] 1. Establish a vulnerability information database and POC information database in the management center, as shown in Table 1.

[0059] Table 1 Schematic diagram of information database data

[0060]

[0061]

[0062] 2. When the management center issues a vulnerability detection command, it will carry the POC information and push it to the client software.

[0063] 3. After the client receives the detection instruction, it triggers the dynamic detection and static detection modules.

[0064] Among them, the dynamic detection module executes the POC instructions issued by the management center, and determines whether there is vulnerability information based on the feedback results of the POC execution backend. If so, it reports to the management center in json format.

[0065] The static detection module obtains system kernel information through the uname-a command, obtains operating system version information through the cat / etc / os-release command, obtains installation software information through rpm-qa, and obtains process information through the ps command. It obtains the executing software information by comparing the installation software information and the process information.

[0066] 4. Report the operating system kernel information, version information, and information about the software being executed to the management center in JSON format.

[0067] 5. After the management center obtains the reported information, it obtains the prepared vulnerability information by comparing the operating system version information, kernel information, and installed software version information with the vulnerability information database.

[0068] 6. Push vulnerability information to the alarm module and display vulnerability alarm information in the management center

[0069] 7. Generate an HTML vulnerability report based on the vulnerability information.

[0070] Embodiment 3, in an exemplary embodiment, a security vulnerability detection system based on a domestic server is also provided, including a management center module, a client module and an evaluation module.

[0071] Specifically, the management center module is used to store existing vulnerability information, issue detection instructions, and summarize, warn and display detection results.

[0072] The client module is used to collect parameter data of the first object, perform static and dynamic detection, and upload the detection results to the evaluation module;

[0073] The evaluation module is used to compare the test results and make corrections and evaluations, and upload the evaluation results to the management center module.

[0074] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0075] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0076] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0077] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0078] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A security vulnerability detection method based on a domestic server, characterized in that: include: Establish a feature information database and obtain target data; Collect parameter data of the first object and perform feature detection; The target data and the parameter data are compared to form a first result.

2. The security vulnerability detection method based on a domestic server as claimed in claim 1, characterized in that: Before collecting parameter data of the first object and performing feature detection, the method further includes: After receiving the feature detection instruction, the feature detection is performed, and the feature detection instruction includes a security verification mechanism.

3. The security vulnerability detection method based on a domestic server as claimed in claim 2, characterized in that: After the feature detection is performed, the method further includes: The feature detection result is uploaded to the feature information library, and the first result is corrected.

4. The security vulnerability detection method based on a domestic server as claimed in claim 3 is characterized in that: After the comparison of the target data and the parameter data forms a first result, the method further includes: Correcting the first result using the feature detection result, and performing evaluation based on the corrected first result; The preset first interval, the second interval and the first result are compared to determine the triggering of the action; The actions include no action and a first action; The trigger includes: When the first result belongs to the first interval, no action is performed; When the first result belongs to the second interval, a first action is performed.

5. The security vulnerability detection method based on a domestic server as claimed in claim 1, characterized in that: The target data includes but is not limited to known vulnerability information and security verification mechanisms; The parameter data includes but is not limited to key information of domestic servers.

6. The method for detecting security vulnerabilities based on a domestic server as claimed in claim 5, characterized in that: The feature detection includes but is not limited to vulnerability detection, and the vulnerability detection includes dynamic detection and static detection; The dynamic detection includes executing the security verification mechanism issued by the management center, and judging whether there is vulnerability information based on the feedback result of the back-end execution of the security verification mechanism; The static detection includes collecting the system version and kernel information, installed software and currently running processes of the domestic server through standard system commands to form the currently executed software information.

7. The security vulnerability detection method based on a domestic server as claimed in claim 6, characterized in that: The first result includes, but is not limited to, generating a vulnerability report when vulnerability information is detected, and providing an alarm and visual display of the vulnerability information and the vulnerability report.

8. A security vulnerability detection system based on a domestic server using any of the methods of claims 1 to 7, characterized in that: include, The management center module is used to store existing vulnerability information, issue detection instructions, and summarize, warn, and display detection results; A client module, configured to collect parameter data of the first object, perform static and dynamic detection, and upload the detection results to the evaluation module; The evaluation module compares the test results, makes corrections and evaluations, and uploads the evaluation results to the management center module.

9. A computer device comprising: Memory and processor; The memory stores a computer program, which is characterized in that when the processor executes the computer program, the steps of the security vulnerability detection method based on the domestic server as described in any one of claims 1-7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the security vulnerability detection method based on the domestic server as described in any one of claims 1 to 7 are implemented.

Images