Method and system for quickly performing special scanning activity based on rule file

Abstract

The invention discloses a method and a system for quickly performing a special scanning activity based on a rule file, and relates to the technical field of network security. The special scanning activity system comprises a function module and a rule module. The rule module is used for defining a rule file; and the function module is used for executing a corresponding scanning process or behavior according to a predefined rule file. According to the rule file which is in a standard format and is used for special scanning, the rule file in the format can be analyzed by a system, the system can collect assets in an asset surveying and mapping site or an asset library according to predefined rules by analyzing the rule file, the assets are determined by the predefined rules, and the assets in the asset surveying and mapping site or the asset library can be analyzed by the system. The method comprises the following steps of: collecting related assets such as a certain fingerprint or a certain service, a certain port and the like, and then carrying out special detection on the collected assets according to a predefined Poc set in a rule file so as to detect the vulnerable special assets which are focused on.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for quickly performing special scanning activities based on rule files. Background Art

[0002] In recent years, the threats and risks of network security have increased dramatically, and have become a common challenge faced by mankind in the information age. In the process of security operations, we need to pay special attention to new vulnerabilities, hot vulnerabilities, and vulnerabilities related to systems or programs that are used by customers more frequently, and promptly detect whether there are related vulnerabilities in the assets exposed by customers. Especially when new vulnerabilities break out, timely detection of customers' assets with new vulnerabilities and taking corresponding mitigation measures or emergency measures can intuitively let customers experience the value of security operations, prevent customer assets from suffering losses due to related network security vulnerabilities, or avoid being notified by network regulatory units. Summary of the invention

[0003] In view of this, the present invention provides a system for rapid special monitoring of customer assets according to security operation needs, so as to cope with the special detection and monitoring of the increasing number of new vulnerabilities and hot vulnerabilities, and at the same time serve the special detection of conventional vulnerabilities.

[0004] In a first aspect, the present invention provides a system for quickly performing special scanning activities based on rule files, including a function module and a rule module; The rule module is used to define a rule file; The functional module is used to execute corresponding scanning processes or behaviors according to the predefined rule files.

[0005] Furthermore, the functional modules specifically include: Configure cyberspace asset mapping sources or self-built asset mapping sources as asset mapping sources / libraries for the system to collect special assets; Implement query API based on configured asset mapping source / library, and define string keywords for each asset mapping source / library, which are used as key values ​​under assets sub-element in rule files; Parse the rule file and map the elements in the rule file to related structures; Enable or disable the current rule specialization according to the value of the enable element; Query the query rules represented by all key-value dictionary sub-elements in the assets element list and deduplicate the queried assets; Process the assets_record element. When the assets_record element is true, record the queried special assets to the storage medium. When the assets_record element is false, skip recording the queried assets to the storage medium and directly scan the special POC collection for the queried assets. According to the tag element of the rule file, a fuzzy query is performed on the Poc name, Poc path, Poc tag, and vulnerability risk level in the Poc library of the functional module subsystem; According to all the sub-elements in the scripts element list in the rule file, query the Poc path in the Poc library of the function module; De-duplicate the POC set found based on the tag and scripts elements; The asset collection queried by the assets element is scanned against the Poc collection queried by tags and scripts.

[0006] Furthermore, the functional module corresponds to one or more rule files and can perform multiple special tests simultaneously.

[0007] Furthermore, the rule module is a YAML rule file in a standardized format formulated according to operational requirements.

[0008] In a second aspect, the present invention provides a method for quickly performing special scanning activities based on rule files, the method comprising converting special scanning activities or behaviors into special rule files, the system identifying and translating the special rule files, and the system executing special operations according to the definition of the rule files.

[0009] Furthermore, the special scanning activities or behaviors specifically include: Security operation analysis, the security operation analysis specifically includes: If special security inspection actions, hot vulnerabilities, or new vulnerabilities are detected, a new special security inspection process will be implemented; If it is necessary to continuously monitor the special project during the operation, perform periodic special project scanning and select the special project rule file.

[0010] Furthermore, the conversion into a special rule file specifically includes: Create a new special rules file; Define the rule name; Define asset search rules; Define scanning Poc set; Save the rules file.

[0011] Furthermore, the system identifies and translates the special rule files, including: After the selection of the special rule file or the saving of the rule file is executed, the rule file is parsed; the parsing of the rule file specifically includes mapping the rule file to the data structure in the functional module, so that the functional module translates the special scanning action expressed in the rule file into a logical action that the machine can follow.

[0012] Furthermore, the system performs special operations according to the definition of the rule file, including: Processing the enable element, including, when the enable element is false, returning the security operations analysis; when the enable element is true, processing the assets element; The processing of the assets element includes querying the assets element and removing duplicates from the query results; Process the assets_record element, including, when the assets_record element is true, recording all queried assets to disk; when the assets_record element is false, proceeding to the next step; Processing tag elements, including: the function module identifies the tag element. If there is a comma in the tag element, the tag element is split into an array by the comma, and then a fuzzy query is performed on the Poc name, Poc path, Poc label, and vulnerability risk level in the Poc library of the function module according to the value of the tag element; Processing the scripts element, including, the function module regards all the strings in the list as Poc paths in the Poc library, and queries the Poc library; Merge and remove duplicate special POC sets, including merging and removing duplicates of all special POCs expressed by tags and scripts elements in the special rule file; Perform special scans, including performing POC collection scans on the queried assets; Return to Security Operations Analysis.

[0013] In a third aspect, the present invention further provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a method for quickly performing a special scanning activity based on a rule file as described in any one of the above items.

[0014] Beneficial effects of the present invention: The present invention provides a rule file in a standardized format for special scanning, and implements a system to parse the rule file in this format. By parsing the rule file, the system can collect assets in an asset mapping site or an asset library according to predefined rules. These assets are determined by predefined rules and can be assets related to a certain type of fingerprint or a certain type of service, a certain type of port, etc., and then perform special detection on the collected assets according to the POC set predefined in the rule file to detect the vulnerability special assets of key concern. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A flow chart of a method for quickly performing special scanning activities based on rule files of the present invention; Figure 2 Specific workflow diagram of the method for quickly performing special scanning activities based on rule files of the present invention; Figure 3 Examples of rule names in embodiments of the present invention; Figure 4 Embodiment 1 of defining asset search rules in the embodiment of the present invention; Figure 5 Embodiment 2 of defining asset search rules in the embodiment of the present invention; Figure 6 An example of a scanning Poc set is defined in an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to make the objects, advantages and features of the present invention more obvious, the present invention is further described in detail in the following specific embodiments.

[0017] Special scanning is performed dynamically according to the needs of new vulnerabilities or operation processes. The present invention defines a set of special detection rule files to describe special detection activities in the operation process, and around the special detection rule files, the system implements parsing, translation, expression, execution scanning and other actions.

[0018] Example 1 Based on this system, special scanning activities can be abstracted into special rule files, and then the system parses the special rule files and performs special scanning according to the rule files. The system is divided into two subsystems, the function module subsystem and the rule module subsystem. The rule module is a rule file in a special format, and the function module executes the corresponding scanning process or behavior according to the predefined rule file.

[0019] The functional modules mainly implement the following functions: Configure the cyberspace asset mapping source as the asset mapping source / library for the system to collect special assets, such as cyberspace asset mapping service products, Fofa, Quake, Hunter, etc., or self-built asset mapping sources, such as self-owned ElasticSearch libraries, etc.; To implement the query API based on the configured mapping source / library, define a string keyword for each mapping source / library, which is used as the key value under the assets sub-element in the rule file; Implement the function of parsing rule files and map the elements in the rule files to related structures; Enable or disable the current rule based on the value of the enable element; Implement querying of query rules represented by all key-value dictionary sub-elements in the assets element list and deduplication of the queried asset collection, where the query uses the implemented query API, the key value represents the corresponding surveying and mapping source / library, and the value value represents the query rule of the surveying and mapping source / library represented by the key value; When the assets_record element is true, the queried special assets are recorded to the storage medium. When it is false, the queried assets are skipped and the special Poc collection is directly scanned for the queried assets. Implement fuzzy query on Poc name, Poc path, Poc label, vulnerability risk level, etc. in the Poc library of the functional module based on the tag element of the rule file; According to all the sub-elements in the scripts element list in the rule file, the Poc path in the Poc library of the function module is queried; De-duplicate the POC set found by the tag and scripts elements; Implement scanning of the Poc collection obtained by querying tags and scripts on the asset collection obtained by querying the assets element; Implement support for one or more rule files so that multiple special tests can be performed at one time.

[0020] The rule module is a series of YAML rule files in a specific format formulated according to operational requirements, including the element fields shown in Table 1: Table 1

[0021] The top-level element is map. The key is the name of the special rule, which can be customized. The value is also of map type and contains the following elements: desc: Specific description, this is an optional field, it can be present or not; Category: the category of the item, indicating which category the item belongs to. This is an optional field, and it is acceptable to have this field or not. parentCategory: special parent category; enable: indicates whether to enable this special rule file. If it is set to false, the system will not use this special rule file when performing special scanning. This is an optional field and the default value is true. assets: This element is one of the core elements of the rule file. It represents the rules for collecting specific special assets from the asset library / source. It is a list dictionary, where the key value represents the asset library / source, and the value represents the search rule on this asset library / source. When the system executes this rule file, it will use the search rule represented by the value to find the asset source / library represented by the key value; assets_record: This element is one of the core elements of the rule file. It indicates whether to record the collected assets into a database or file first and then perform a special scan on these special assets after collecting them during the special scan process. tag: This element is one of the core elements of the rule file. This element defines the Poc tag. This tag value is used to fuzzy search the Poc in the Poc library. After the searched Poc is merged with the Poc defined in the scripts field to remove duplicates, the assets searched in assets are scanned. It can be multiple values ​​separated by commas. scripts: This element is one of the core elements of the rule file. It is a list value, one for each line. This element is used to accurately define the Poc path. The Poc defined in the scripts field is combined with the Poc fuzzy searched at the tag to remove duplicates, and then the assets searched at the assets are scanned; The following is an example of the rule file format, fields, and field descriptions: topics\rdzx\puyuan.yaml #Special rule name RDZX_Puyuan_KeHu: #Special description, optional, you can have or not have this field desc: Puyuan deserialization project #Special category, optional, you can have or not have this field category: deserialize #Special parent class, optional, you can have or not have this field parentCategory: java #Whether to enable this special item, optional, it can be enabled by default enable: true #This field defines the special asset search rule, where the key field represents the asset source, and the value field represents the asset search rule on this asset source. You can define multiple, one for each assets: # soss source, domain / notdomain can have multiple values, separated by commas - soss: notdomain=XX #This field indicates whether to record the searched assets assets_record: false #This field defines the Poc tag. This tag value is used to fuzzy search the Poc in the Poc library. After the searched Poc is merged with the Poc defined in the scripts field to remove duplicates, the assets searched in assets are scanned. It can be multiple values, separated by commas. tag: puyuan #This field defines the Poc path. After the Poc defined in the scripts field is combined with the searched Poc to remove duplicates, the assets searched in assets are scanned, one for each scripts: - / pocs / custom / puyuan-default-rce.yaml - / pocs / custom / puyuan-eos-rce.yaml - / pocs / custom / puyuan-sccp-rce.yaml.

[0022] Example 2 like Figure 1 , Figure 2 As shown, a method for quickly performing special scanning activities based on rule files, the execution process includes: 1. Security Operation Analysis During the security operation analysis process, we will face various service scenario needs and requirements. When faced with special security inspection actions, hot vulnerability projects, or when new vulnerabilities are detected, a new special security monitoring process will be triggered. At this time, the selection of rule files will be skipped and executed in sequence. When certain projects need to be continuously monitored during the operation process, we will trigger periodic special scans to determine the network security situation of certain projects. At this time, execution will start from the selection of rule files and execute in sequence.

[0023] 2. Write rule files 1. Create a new special rules file In the hot topic (rdzx) or other category directories under the specific directory (topics), create a new special rule of puyuan.yaml. You can copy the existing special file and rename it.

[0024] 2. Define reasonable rule names Define a reasonable rule name. The rule name and rule path must be unique. Example of rule name is Figure 3 shown.

[0025] 3. Define asset search rules Set asset search rules. The asset search rules support the following asset mapping sources / libraries: "fofa", supports fofa source, and its value can be filled in according to fofa rules; "quake", supports quake source, and its value can be filled in according to the quake rules; "hunter", supports hunter source, its value can be filled in according to hunter rules; "starsoes", supports the company's original asset mapping library, and its value can be filled in according to the Elastic rules. The mapping library has been disabled; "scanxes", which supports Starshot's Elastic asset mapping library, can be filled in according to the Elastic rules; "scanx", same as starshot; "starshot", supports Starshot's Sqlite asset mapping library, the rule format is: assets={taskid} or assets={service} or assets={fingerextrainfo}, taskid is the id of the scanning task, service is the service name, and fingerextrainfo is the additional information of the fingerprint; "soss", supports the soss asset library, and its rule format is: domain={customer name} or notdomain={customer name}, domain means taking the assets of a certain customer, and notdomain means taking all customer assets but not taking the assets of a certain customer.

[0026] Specific examples include Figure 4 , Figure 5 shown.

[0027] 4. Define optional fields Set optional field values ​​such as desc, category, parentCategory, and enable.

[0028] 5. Define the scanning POC set like Figure 6 As shown in the figure, tags and scripts are used. The tags field fuzzily searches the Poc library, and can search for paths, names, labels, and threat levels. The scripts field accurately indicates the use of a certain Poc. The Pocs searched by the two fields are combined to scan the searched special assets. If there is no Poc for this vulnerability in the existing Poc rule library in the system, a new Poc for this vulnerability needs to be written.

[0029] 6. Save the rule file Save the rule files for abstract transformation of special activities to a specific directory that can be recognized by the functional module.

[0030] 3. Select rule file During the security operation process, when it is necessary to monitor the network security situation of certain special projects, it is necessary to trigger a periodic special scanning process. At this time, it is necessary to select special rule files in the special rule library according to the monitoring project.

[0031] 4. Parsing rule files The rule file is mapped to a specific data structure in the functional module so that the functional module can translate the special scanning actions expressed in the rule file into specific logical actions that the machine can follow.

[0032] 5. Processing the enable element When the function module recognizes that the value of the enable element is true, the current rule item is enabled; when it is false, the current item is disabled and the security analysis action is returned.

[0033] 6. Processing assets elements The assets element is mapped to a list of function modules. Each value in the list is a map dictionary, where the key value represents the asset source and the value value represents the query expression of this asset source. The key value is the asset source keyword defined above. The function module uses it to find the query API corresponding to the asset source and triggers the query action with the query expression value until all assets sub-elements are processed.

[0034] All the queried results are deduplicated.

[0035] 7. Processing assets_record elements When the function module recognizes that the value of assets_record is true, it records all queried assets to disk; otherwise, if it is false, it ignores this action and proceeds to the next step.

[0036] 8. Processing tag elements The function module identifies the tag element. If there is a comma in the tag, the tag is split into an array by the comma. Then, according to the value of the tag element, a fuzzy query is performed on the Poc name, Poc path, Poc label, vulnerability risk level, etc. in the Poc library that comes with the function module.

[0037] 9. Processing scripts elements The function module identifies the value of the scripts element, and its value is mapped to the list string of the function module. The function module regards all the strings in the list as Poc paths in the Poc library and queries the Poc it represents.

[0038] 10. Merge the Deduplication Special POC Set Merge all special POCs expressed by tags and scripts elements in the special rule file and remove duplicates.

[0039] 11. Perform special scans The functional module performs a scan of all special POCs expressed by tags and scripts for all special assets expressed by the assets element.

[0040] 12. Return to Security Operations Analysis The results of the special scan are returned to the security operation process to evaluate the security operation effect and serve as the basis for executing the next step of the security operation process. For example, based on the evaluation of the special scan results, it is decided whether this special scan needs to be executed periodically until the expected effect of vulnerability management is achieved within the operation cycle.

[0041] Example 3 A computer-readable storage medium stores computer instructions, which implement the steps of the method in Example 1 when executed by a processor.

[0042] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0043] The present invention is described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0044] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0045] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0046] The above embodiments describe the technical solutions of the present invention in detail. Obviously, the present invention is not limited to the described embodiments. Based on the embodiments of the present invention, people familiar with the technical field can also make various changes accordingly, but any changes that are equivalent or similar to the present invention belong to the scope of protection of the present invention.

[0047] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

Claims

1. A system for quickly performing special scanning activities based on rule files, characterized in that: Includes function modules and rule modules; The rule module is used to define a rule file; The functional module is used to execute corresponding scanning processes or behaviors according to the predefined rule files.

2. A system for quickly performing special scanning activities based on rule files as claimed in claim 1, characterized in that: The functional modules specifically include: Configure cyberspace asset mapping sources or self-built asset mapping sources as asset mapping sources / libraries for the system to collect special assets; Implement query API based on configured asset mapping source / library, and define string keywords for each asset mapping source / library, which are used as key values ​​under assets sub-element in rule files; Parse the rule file and map the elements in the rule file to related structures; Enable or disable the current rule specialization according to the value of the enable element; Query the query rules represented by all key-value dictionary sub-elements in the assets element list and deduplicate the queried assets; Process the assets_record element. When the assets_record element is true, record the queried special assets to the storage medium. When the assets_record element is false, skip recording the queried assets to the storage medium and directly scan the special POC collection for the queried assets. According to the tag element of the rule file, a fuzzy query is performed on the Poc name, Poc path, Poc tag, and vulnerability risk level in the Poc library of the functional module subsystem; According to all the sub-elements in the scripts element list in the rule file, query the Poc path in the Poc library of the function module; De-duplicate the POC set found based on the tag and scripts elements; The asset collection queried by the assets element is scanned against the Poc collection queried by tags and scripts.

3. A system for quickly performing special scanning activities based on rule files as claimed in claim 2, characterized in that: The functional module corresponds to one or more rule files and can perform multiple special tests at the same time.

4. A system for quickly performing special scanning activities based on rule files as claimed in claim 1, characterized in that: The rule module is a YAML rule file in a standardized format developed according to operational requirements.

5. A method for quickly performing special scanning activities based on rule files, characterized in that: The method includes converting special scanning activities or behaviors into special rule files, the system identifying and translating the special rule files, and the system executing special operations according to the definition of the rule files.

6. A method for quickly performing special scanning activities based on rule files as claimed in claim 5, characterized in that: The special scanning activities or behaviors include: Security operation analysis, the security operation analysis specifically includes: If special security inspection actions, hot vulnerabilities, or new vulnerabilities are detected, a new special security inspection process will be implemented; If it is necessary to continuously monitor the special project during the operation, perform periodic special project scanning and select the special project rule file.

7. A method for quickly performing special scanning activities based on rule files as claimed in claim 6, characterized in that: The conversion into a special rules document specifically includes: Create a new special rules file; Define the rule name; Define asset search rules; Define scanning Poc set; Save the rules file.

8. A method for quickly performing special scanning activities based on rule files as claimed in claim 7, characterized in that: The system identifies and translates special rule files, including: After the selection of the special rule file or the saving of the rule file is executed, the rule file is parsed; the parsing of the rule file specifically includes mapping the rule file to the data structure in the functional module, so that the functional module translates the special scanning action expressed in the rule file into a logical action that the machine can follow.

9. A method for quickly performing special scanning activities based on rule files as claimed in claim 8, characterized in that: The system performs special operations according to the definition of the rule file, including: Processing the enable element, including, when the enable element is false, returning the security operations analysis; when the enable element is true, processing the assets element; The processing of the assets element includes querying the assets element and removing duplicates from the query results; Process the assets_record element, including, when the assets_record element is true, recording all queried assets to disk; when the assets_record element is false, proceeding to the next step; Processing tag elements, including: the function module identifies the tag element. If there is a comma in the tag element, the tag element is split into an array by the comma, and then a fuzzy query is performed on the Poc name, Poc path, Poc label, and vulnerability risk level in the Poc library of the function module according to the value of the tag element; Processing the scripts element, including, the function module regards all the strings in the list as Poc paths in the Poc library, and queries the Poc library; Merge and remove duplicate special POC sets, including merging and removing duplicates of all special POCs expressed by tags and scripts elements in the special rule file; Perform special scans, including performing POC collection scans on the queried assets; Return to Security Operations Analysis.

10. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a method for quickly performing special scanning activities based on rule files as described in any one of claims 5 to 9 are implemented.

Images