Software dynamic vulnerability verification method and system based on containerized environment

Abstract

The embodiment of the invention discloses a software dynamic vulnerability verification method and system based on a containerized environment, and the method comprises the steps: obtaining and recording a complete attack path of an attacker who attacks successfully; according to the complete attack path of each successfully attacked attacker, analyzing security vulnerabilities existing in the software service and repair priorities corresponding to the security vulnerabilities; the repair priority level corresponding to the security vulnerability is determined according to software service authority and data sensitivity related to the security vulnerability; meanwhile, an attack method report of the security vulnerability is generated according to the complete attack path of the attacker for reference of developers, and the security vulnerability is repaired. According to the software dynamic vulnerability verification method based on the containerized environment, the core lies in that through the containerized technology and the dynamic verification method, the efficiency and effect of network security vulnerability detection and management are improved, and therefore risks caused by security vulnerabilities are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and specifically provides a software dynamic vulnerability verification method and system based on a containerized environment. Background Art

[0002] With the rapid development of information technology, software systems have become an important part of enterprises. However, the existence of software vulnerabilities has exposed these systems to security threats. Software vulnerabilities refer to defects or weaknesses in software that can be exploited by attackers to perform unauthorized operations, such as accessing sensitive data, causing system crashes, or controlling the entire system.

[0003] Currently, the main technologies for detecting software vulnerabilities include static code analysis and dynamic application security testing (DAST).

[0004] Static code analysis: Static code analysis tools detect potential security vulnerabilities by scanning source code or compiled code without running the program code. This method can quickly identify patterns of known vulnerabilities, but it has the following drawbacks:

[0005] High false positive rates: Static analysis tools tend to produce a high number of false positives because they cannot distinguish between code that could be exploited in real life and code that is simply present in the code base but not actually used.

[0006] Inability to detect runtime vulnerabilities: Static analysis cannot detect vulnerabilities that only appear while the program is running, such as those that rely on specific input or environment configuration.

[0007] Dynamic Application Security Testing (DAST): DAST tools test applications while they are running, simulating attacks to find vulnerabilities. Although this method can more accurately identify exploitable vulnerabilities, it has the following problems:

[0008] Complex environment construction: For testing, it is necessary to build an application deployment environment that is similar to the production environment, which can be very complex and time-consuming.

[0009] Limited test coverage: Due to time and resource constraints, DAST may not cover all attack paths and scenarios.

[0010] In summary, the main technologies for detecting software vulnerabilities currently have the following defects:

[0011] Inefficiency: The high false positive rate of static analysis and the resource consumption of DAST cause security teams to spend a lot of time to verify and classify vulnerabilities.

[0012] Lack of accuracy: Static analysis cannot fully and accurately determine the actual exploitability of a vulnerability, and DAST may not be able to fully simulate real attack scenarios due to environmental differences.

[0013] Slow response: Under existing technologies, the entire process from discovering a vulnerability to confirming its severity and taking repair measures may be very slow, increasing the security risk of the system.

[0014] In view of this, the present invention patent is proposed. Summary of the invention

[0015] In response to the above technical problems, the present invention proposes a method and system for building a distributed message queue that supports multiple regions, so as to solve the problem of message queue traffic management in multi-cloud and multi-region scenarios.

[0016] Specifically, the following technical solutions are adopted:

[0017] In a first aspect, the present invention provides a software dynamic vulnerability verification method based on a containerized environment, comprising:

[0018] Scan software for vulnerabilities;

[0019] When a potential vulnerability is found in the software, the software containing the potential vulnerability and its operating environment are packaged into a container image and deployed in an isolated VPC network;

[0020] In an isolated VPC network, expose containerized software to the public network and monitor the software.

[0021] Analyzes network traffic and attack attempts monitored by the software to verify whether potential vulnerabilities can be exploited.

[0022] As an optional implementation of the present invention, in a software dynamic vulnerability verification method based on a containerized environment of the present invention, in an isolated VPC network, exposing the containerized deployed software to the public network and performing software monitoring includes:

[0023] Detailed logging of all inbound and outbound network traffic through the software’s gateway;

[0024] When the software's container image is running, all process information, network port information, and network activity information are recorded in detail.

[0025] As an optional embodiment of the present invention, in a software dynamic vulnerability verification method based on a containerized environment of the present invention, the network traffic and attack attempts monitored by the analysis software to verify whether the potential vulnerability can be exploited includes:

[0026] Analyze the inbound and outbound network traffic information of the software service, the process information of the container image running of the software service, the network port information, and the network activity information;

[0027] When an attacker is found to have obtained machine permissions for a software service or to have created a process on the server or to have performed network activities, the attack is deemed to have been successful and the potential vulnerability can be exploited.

[0028] As an optional embodiment of the present invention, a software dynamic vulnerability verification method based on a containerized environment of the present invention includes:

[0029] Obtain and record the complete attack path of a successful attacker;

[0030] Analyze the security vulnerabilities in software services and the corresponding repair priorities of the security vulnerabilities based on the complete attack paths of each successful attacker;

[0031] The repair priority level corresponding to the security vulnerability is determined according to the software service permissions and data sensitivity involved in the security vulnerability;

[0032] At the same time, an attack method report of the security vulnerability is generated based on the attacker's complete attack path for developers to refer to and fix the security vulnerability.

[0033] As an optional embodiment of the present invention, a software dynamic vulnerability verification method based on a containerized environment of the present invention includes:

[0034] Set a preset time interval for exposing the software service container image to the public network. During the preset time interval, if no attacker is found to have successfully attacked, the potential vulnerability cannot be exploited.

[0035] As an optional embodiment of the present invention, a software dynamic vulnerability verification method based on a containerized environment of the present invention includes:

[0036] When the software service container image is exposed on the public network for a preset time interval, the container image is destroyed to complete the test;

[0037] Alternatively, when the software service container image is exposed on the public network for less than a preset time interval, but the software service is paralyzed by an attacker, the container image is destroyed to complete the test.

[0038] As an optional implementation of the present invention, in a software dynamic vulnerability verification method based on a containerized environment of the present invention, after the software containing potential vulnerabilities and its operating environment are packaged into a container image, the production data and sensitive data in the container image are deleted, and only the services and configurations for verifying the potential vulnerabilities are retained.

[0039] As an optional implementation of the present invention, in a software dynamic vulnerability verification method based on a containerized environment of the present invention, after the containerized deployed software is exposed to the public network in an isolated VPC network, a post is automatically triggered to be posted to the hacker community to attract hacker attacks and collect community feedback; and / or white hat hackers are invited to conduct security testing attacks through a crowd testing platform.

[0040] In a second aspect, the present invention provides a software dynamic vulnerability verification system based on a containerized environment, comprising:

[0041] Vulnerability scanning module, which performs vulnerability scanning on software;

[0042] A container image packaging module, when the vulnerability scanning module scans the software for potential vulnerabilities, the container image packaging module packages the software containing the potential vulnerabilities and its operating environment to generate a container image;

[0043] Isolate the VPC network module, build an isolated VPC network, and deploy the container image generated by the container image packaging module in the isolated VPC network;

[0044] The security vulnerability monitoring and analysis module exposes the containerized deployed software to the public network in the isolated VPC network, and performs software monitoring. The security vulnerability monitoring and analysis module analyzes the network traffic and attack attempts monitored by the software to verify whether potential vulnerabilities can be exploited.

[0045] In a third aspect, the present invention provides a computer-readable recording medium storing a computer executable program, which, when executed, implements the software dynamic vulnerability verification method based on a containerized environment.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] The key points and protection points of a software dynamic vulnerability verification method based on a containerized environment of the present invention include:

[0048] 1. Containerized deployment technology: A containerized method for quickly building and deploying software containing potential vulnerabilities and their operating environment. The application of containerized technology in the present invention, especially the deployment strategy in an isolated VPC network.

[0049] 2. Network exposure and monitoring mechanisms: Methods for exposing containerized software to the public Internet, and how to ensure that the system remains secure while being exposed. Technologies for real-time monitoring of network traffic, and how to record and analyze attack behaviors.

[0050] 3. Dynamic vulnerability verification process: A process to verify whether a vulnerability can be exploited by actually observing hacker attack behaviors. A method to analyze attack attempts and derive the possibility of vulnerability exploitation from them.

[0051] 4. Vulnerability priority determination logic: Technology that automatically determines vulnerability repair priorities based on the results of attack attempts. A solution that generates vulnerability reports and recommends repair measures.

[0052] The present invention provides a software dynamic vulnerability verification method based on a containerized environment, which has the following advantages:

[0053] Reducing the false alarm rate: Since the software dynamic vulnerability verification method based on the containerized environment of the present invention verifies the vulnerability through actual attack behavior instead of relying solely on static code analysis, the false alarm rate can be significantly reduced.

[0054] Improve verification efficiency: Containerization technology simplifies the environment deployment process, allowing vulnerability verification to be performed quickly, thereby improving overall efficiency.

[0055] Enhanced verification accuracy: Actual network attack behaviors provide the most direct evidence of whether a vulnerability can be exploited, which is more accurate than simulated attacks.

[0056] Rapid response to security threats: Through real-time monitoring and rapid vulnerability prioritization, security teams can respond to real security threats more quickly and reduce security risks.

[0057] Saving resources: Due to the lightweight and reusability of the containerized environment, the present invention saves a lot of computing resources and human resources compared to traditional DAST.

[0058] Improve the effectiveness of security management: Through automated and standardized vulnerability verification processes, the present invention helps organizations manage security risks more effectively and ensure the security of critical systems.

[0059] In summary, the software dynamic vulnerability verification method based on a containerized environment of the present invention derives the above-mentioned multiple advantages by solving the problems in the prior art, and these advantages jointly improve the overall performance of software security vulnerability detection and management. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flowchart of a software dynamic vulnerability verification method based on a containerized environment according to a first embodiment of the present invention;

[0061] Figure 2 A system framework diagram of a software dynamic vulnerability verification system based on a containerized environment according to a first embodiment of the present invention;

[0062] Figure 3A schematic structural diagram of an electronic device according to a second embodiment of the present invention;

[0063] Figure 4 A schematic diagram of a computer-readable recording medium according to a second embodiment of the present invention. DETAILED DESCRIPTION

[0064] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0065] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0067] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0068] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0069] Embodiment 1

[0070] See also Figure 1 As shown, a software dynamic vulnerability verification method based on a containerized environment in this embodiment includes:

[0071] Scan software for vulnerabilities, specifically through vulnerability detection software. Vulnerability detection software is a tool used to scan software code or system configuration to identify potential security vulnerabilities. It can automatically identify known security issues and report them to users.

[0072] When a potential vulnerability is found in the software, the software containing the potential vulnerability and its operating environment are packaged into a container image and deployed in an isolated VPC network;

[0073] In an isolated VPC network, expose containerized software to the public network and monitor the software.

[0074] Analyzes network traffic and attack attempts monitored by the software to verify whether potential vulnerabilities can be exploited.

[0075] Traditional vulnerability verification requires security personnel to build a complex verification environment and simulate attacks, which is a time-consuming process and may lead to inaccurate verification results due to differences in the capabilities of security personnel. The software dynamic vulnerability verification method based on a containerized environment in this embodiment simplifies the verification process and improves the efficiency and accuracy of verification through automated containerized deployment and network environment isolation.

[0076] Containerization is a lightweight technology that allows developers to package applications and their dependent environments together so that the applications can run seamlessly in different computing environments without being affected by the underlying operating system. Common tools for containerization technology include Docker and others.

[0077] The present embodiment provides a software dynamic vulnerability verification method based on a containerized environment to observe hacker attack behaviors in real time: by deploying software containing vulnerabilities on the public Internet and attracting hacker attacks, the attack behaviors can be monitored in real time in an isolated VPC network, thereby obtaining first-hand data for evaluating the actual threats of potential vulnerabilities.

[0078] The present embodiment provides a software dynamic vulnerability verification method based on a containerized environment. Through containerized deployment and exposure to a public network environment, it is possible to obtain attack behaviors that the software may suffer in the actual operating environment. Therefore, it can provide more accurate vulnerability information to help organizations manage security risks more effectively and ensure the security of critical systems.

[0079] In summary, the core of the software dynamic vulnerability verification method based on a containerized environment in this embodiment is to improve the efficiency and effectiveness of network security vulnerability detection and management through containerization technology and dynamic verification methods, thereby reducing the risks caused by security vulnerabilities.

[0080] In this embodiment, a software dynamic vulnerability verification method based on a containerized environment is provided. In an isolated VPC network, the containerized software is exposed to the public network and software monitoring is performed, including:

[0081] Detailed logging of all inbound and outbound network traffic through the software’s gateway;

[0082] When the software's container image is running, all process information, network port information, and network activity information are recorded in detail.

[0083] The present embodiment provides a software dynamic vulnerability verification method based on a containerized environment. By real-time monitoring of container images deployed in an isolated VPC network and recording of operation data, it is used to detect whether an attack has occurred and analyze the attack path after an attack has occurred, thereby helping R&D personnel to better discover security vulnerabilities in the software and solve security vulnerabilities in the software in a more targeted manner.

[0084] Furthermore, in a software dynamic vulnerability verification method based on a containerized environment of this embodiment, the network traffic and attack attempts monitored by the analysis software to verify whether the potential vulnerability can be exploited includes:

[0085] Analyze the inbound and outbound network traffic information of the software service, the process information of the container image running of the software service, the network port information, and the network activity information;

[0086] When an attacker is found to have obtained machine permissions for a software service or to have created a process on the server or to have performed network activities, the attack is deemed to have been successful and the potential vulnerability can be exploited.

[0087] Therefore, this embodiment can detect successful attack behaviors in real time by recording the inbound and outbound network traffic information of the software service, the process information of the container image running of the software service, the network port information, and the network activity information, so as to determine that the potential vulnerabilities scanned by the software scanning process have the risk of being exploited and need to be repaired.

[0088] A software dynamic vulnerability verification method based on a containerized environment in this embodiment includes:

[0089] Obtain and record the complete attack path of a successful attacker;

[0090] Analyze the security vulnerabilities in software services and the corresponding repair priorities of the security vulnerabilities based on the complete attack paths of each successful attacker;

[0091] The repair priority level corresponding to the security vulnerability is determined according to the software service permissions and data sensitivity involved in the security vulnerability;

[0092] At the same time, an attack method report of the security vulnerability is generated based on the attacker's complete attack path for developers to refer to and fix the security vulnerability.

[0093] The present embodiment provides a software dynamic vulnerability verification method based on a containerized environment. According to the success or failure of the monitored attack, the system can automatically determine the severity of the vulnerability and recommend the priority of vulnerability repair accordingly, thereby helping security workers to allocate resources and attention more reasonably.

[0094] Specifically, when a security vulnerability involves obtaining higher permissions of the software, or when a security vulnerability involves obtaining private information of the software, the priority level of repair corresponding to the security vulnerability is higher, and R&D personnel are required to complete the repair of the security vulnerability as soon as possible.

[0095] A software dynamic vulnerability verification method based on a containerized environment in this embodiment includes:

[0096] Set a preset time interval for exposing the software service container image to the public network. During the preset time interval, if no attacker is found to have successfully attacked, the potential vulnerability cannot be exploited.

[0097] This embodiment sets the preset time interval for the software service container image to be exposed on the public network to at least cover 24 hours, so as to verify the risk of being attacked at different time periods of the day.

[0098] In addition, for the same potential vulnerability scanned by the software, after N (N is a set value) times of containerized deployment and public network exposure dynamic verification, if no potential vulnerability is found to be exploitable, the potential vulnerability is marked as not a risk and is fed back to the vulnerability scanning software. The potential vulnerability is ignored in subsequent software scanning processes, but the ignored potential vulnerabilities need to be recorded and displayed in the vulnerability scanning results for reference by R&D personnel.

[0099] As an optional implementation of this embodiment, a software dynamic vulnerability verification method based on a containerized environment in this embodiment includes:

[0100] When the software service container image is exposed on the public network for a preset time interval, the container image is destroyed to complete the test;

[0101] Alternatively, when the software service container image is exposed on the public network for less than a preset time interval, but the software service is paralyzed by an attacker, the container image is destroyed to complete the test.

[0102] The present embodiment provides a software dynamic vulnerability verification method based on a containerized environment. After completing the security vulnerability test, the container image of the software service is destroyed in a timely manner to prevent the container image from being stolen.

[0103] In this embodiment, a software dynamic vulnerability verification method based on a containerized environment is described. After the software containing potential vulnerabilities and its operating environment are packaged into a container image, the production data and sensitive data in the container image are deleted, and only the service and configuration for verifying the potential vulnerability are retained. In this way, the security of the production data and sensitive data of the software service can be guaranteed, and the verification of the attack behavior can be satisfied.

[0104] The present embodiment is a method for dynamic software vulnerability verification based on a containerized environment. In the isolated VPC network, after the containerized software is exposed to the public network, it automatically triggers the posting to the hacker community to attract hacker attacks and collect community feedback; and / or invites white hat hackers to conduct security testing attacks through a crowd testing platform. This embodiment attracts and / or invites hackers so that the container image of the software service will be attacked by hackers during exposure, thereby ensuring that the test verification of whether the potential vulnerabilities of the software can be exploited is effective.

[0105] Among them, through the crowd testing platform, white hat hackers are invited to conduct security tests on the system and rewards are provided. The advantage of this is that more potential vulnerabilities may be discovered by utilizing a wide range of expert resources.

[0106] See also Figure 2 As shown, a software dynamic vulnerability verification method based on a containerized environment in this embodiment is described in detail:

[0107] Step 1: The vulnerability platform performs vulnerability scans regularly. When a software vulnerability is detected, the service module is triggered to automatically package the software containing potential vulnerabilities and its operating environment into a container image and deploy it in an isolated VPC network. There is no production data in the isolated network, only services and configurations that verify the vulnerability. By establishing a public network route, the service is exposed on the public network.

[0108] Step 2: In the VPC network, expose the containerized software to the public Internet, record all inbound and outbound network traffic in detail on the gateway, and record all process information, network port information, and network activity information in detail when the container is running.

[0109] Step 3: The vulnerability platform posts in various hacker communities to attract hackers to attempt attacks and collect community feedback.

[0110] Step 4: Analyze the monitored network traffic and attack attempts, verify whether the vulnerability can be exploited, and record whether the attack is successful or not.

[0111] Step 5: If it is found that the attacker has obtained machine permissions or created a process on the server or conducted network activities, the attack is considered successful and the complete attack path is recorded. Based on the verification results, the priority of vulnerability repair is automatically determined and a report with detailed attack methods is generated.

[0112] Step 6: Destroy the container service. The test is complete.

[0113] In summary, the key points and protection points of a software dynamic vulnerability verification method based on a containerized environment in this embodiment include:

[0114] 1. Containerized deployment technology: A containerized method for quickly building and deploying software containing potential vulnerabilities and their operating environment. The application of containerized technology in the present invention, especially the deployment strategy in an isolated VPC network.

[0115] 2. Network exposure and monitoring mechanisms: Methods for exposing containerized software to the public Internet, and how to ensure that the system remains secure while being exposed. Technologies for real-time monitoring of network traffic, and how to record and analyze attack behaviors.

[0116] 3. Dynamic vulnerability verification process: A process to verify whether a vulnerability can be exploited by actually observing hacker attack behaviors. A method to analyze attack attempts and derive the possibility of vulnerability exploitation from them.

[0117] 4. Vulnerability priority determination logic: Technology that automatically determines vulnerability repair priorities based on the results of attack attempts. A solution that generates vulnerability reports and recommends repair measures.

[0118] The software dynamic vulnerability verification method based on the containerized environment of this embodiment has the following advantages:

[0119] Reducing the false alarm rate: Since the software dynamic vulnerability verification method based on the containerized environment of this embodiment verifies the vulnerability through actual attack behavior instead of relying solely on static code analysis, the false alarm rate can be significantly reduced.

[0120] Improve verification efficiency: Containerization technology simplifies the environment deployment process, allowing vulnerability verification to be performed quickly, thereby improving overall efficiency.

[0121] Enhanced verification accuracy: Actual network attack behaviors provide the most direct evidence of whether a vulnerability can be exploited, which is more accurate than simulated attacks.

[0122] Rapid response to security threats: Through real-time monitoring and rapid vulnerability prioritization, security teams can respond to real security threats more quickly and reduce security risks.

[0123] Saving resources: Due to the lightweight and reusability of the containerized environment, the present invention saves a lot of computing resources and human resources compared to traditional DAST.

[0124] Improve the effectiveness of security management: Through automated and standardized vulnerability verification processes, the present invention helps organizations manage security risks more effectively and ensure the security of critical systems.

[0125] In summary, the software dynamic vulnerability verification method based on a containerized environment in this embodiment derives the above-mentioned multiple advantages by solving the problems in the prior art, which together improve the overall performance of software security vulnerability detection and management.

[0126] See also Figure 2 As shown, this embodiment also provides a software dynamic vulnerability verification system based on a containerized environment, including:

[0127] Vulnerability scanning module, which performs vulnerability scanning on software;

[0128] A container image packaging module, when the vulnerability scanning module scans the software for potential vulnerabilities, the container image packaging module packages the software containing the potential vulnerabilities and its operating environment to generate a container image;

[0129] Isolate the VPC network module, build an isolated VPC network, and deploy the container image generated by the container image packaging module in the isolated VPC network;

[0130] The security vulnerability monitoring and analysis module exposes the containerized deployed software to the public network in the isolated VPC network, and performs software monitoring. The security vulnerability monitoring and analysis module analyzes the network traffic and attack attempts monitored by the software to verify whether potential vulnerabilities can be exploited.

[0131] The software dynamic vulnerability verification system based on a containerized environment in this embodiment simplifies the verification process and improves the efficiency and accuracy of verification through automated containerized deployment and network environment isolation.

[0132] A software dynamic vulnerability verification system based on a containerized environment in this embodiment observes hacker attack behaviors in real time: by deploying software containing vulnerabilities on the public Internet and attracting hacker attacks, the attack behaviors can be monitored in real time in an isolated VPC network, thereby obtaining first-hand data for evaluating the actual threats of potential vulnerabilities.

[0133] The software dynamic vulnerability verification system based on a containerized environment in this embodiment can obtain the attack behaviors that the software may suffer in the actual operating environment through containerized deployment and exposure to the public network environment. Therefore, it can provide more accurate vulnerability information to help organizations manage security risks more effectively and ensure the security of critical systems.

[0134] In summary, the core of the software dynamic vulnerability verification system based on a containerized environment in this embodiment is to improve the efficiency and effectiveness of network security vulnerability detection and management through containerization technology and dynamic verification methods, thereby reducing the risks caused by security vulnerabilities.

[0135] In a software dynamic vulnerability verification system based on a containerized environment in this embodiment, a security vulnerability monitoring and analysis module exposes the containerized deployed software to the public network in an isolated VPC network and performs software monitoring including:

[0136] Detailed logging of all inbound and outbound network traffic through the software’s gateway;

[0137] When the software's container image is running, all process information, network port information, and network activity information are recorded in detail.

[0138] The present embodiment is a software dynamic vulnerability verification system based on a containerized environment. The security vulnerability monitoring and analysis module monitors the container images deployed in the isolated VPC network in real time and records the running data to detect whether an attack has occurred and analyze the attack path after the attack has occurred, thereby helping R&D personnel to better discover security vulnerabilities in the software and solve the security vulnerabilities in the software in a more targeted manner.

[0139] Furthermore, in a software dynamic vulnerability verification system based on a containerized environment of this embodiment, the security vulnerability monitoring and analysis module analyzes the network traffic and attack attempts monitored by the software to verify whether the potential vulnerability can be exploited, including:

[0140] Analyze the inbound and outbound network traffic information of the software service, the process information of the container image running of the software service, the network port information, and the network activity information;

[0141] When an attacker is found to have obtained machine permissions for a software service or to have created a process on the server or to have performed network activities, the attack is deemed to have been successful and the potential vulnerability can be exploited.

[0142] Therefore, the security vulnerability monitoring and analysis module of this embodiment can detect successful attack behaviors in real time by recording the inbound and outbound network traffic information of the software service, the process information of the container image running of the software service, the network port information, and the network activity information, so as to determine that the potential vulnerabilities scanned by the software scanning process have the risk of being exploited and need to be repaired.

[0143] In this embodiment, a software dynamic vulnerability verification system based on a containerized environment is described. After the container image packaging module packages the software containing potential vulnerabilities and its operating environment into a container image, the production data and sensitive data in the container image are deleted, and only the services and configurations for verifying potential vulnerabilities are retained. In this way, the security of the production data and sensitive data of the software service can be guaranteed, and the verification of attack behaviors can be satisfied.

[0144] The present embodiment is a software dynamic vulnerability verification system based on a containerized environment. In the isolated VPC network, after the containerized software is exposed to the public network, it automatically triggers the posting to the hacker community to attract hacker attacks and collect community feedback; and / or invites white hat hackers to conduct security testing attacks through a crowd testing platform. This embodiment attracts and / or invites hackers so that the container image of the software service will be attacked by hackers during exposure, thereby ensuring that the test verification of whether the potential vulnerabilities of the software can be exploited is effective.

[0145] Among them, through the crowd testing platform, white hat hackers are invited to conduct security tests on the system and rewards are provided. The advantage of this is that more potential vulnerabilities may be discovered by utilizing a wide range of expert resources.

[0146] Embodiment 2

[0147] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0148] Figure 3 It is a structural diagram of an electronic device of an embodiment of the present invention, which includes a processor and a memory, wherein the memory is used to store a computer executable program, and when the computer program is executed by the processor, the processor executes a software dynamic vulnerability verification method based on a containerized environment of embodiment one.

[0149] like Figure 3As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0150] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0151] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0152] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0153] It should be understood that Figure 3 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0154] Figure 4 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Figure 4As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, a software dynamic vulnerability verification method based on a containerized environment according to the first embodiment of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or device. The program code contained on the readable recording medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0155] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0156] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.

[0157] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A software dynamic vulnerability verification method based on a containerized environment, characterized in that: include: Scan software for vulnerabilities; When a potential vulnerability is found in the software, the software containing the potential vulnerability and its operating environment are packaged into a container image and deployed in an isolated VPC network; In an isolated VPC network, expose containerized software to the public network and monitor the software. Analyzes network traffic and attack attempts monitored by the software to verify whether potential vulnerabilities can be exploited.

2. According to a method for dynamic software vulnerability verification based on a containerized environment according to claim 1, it is characterized in that: Exposing the containerized software to the public network and performing software monitoring in the isolated VPC network includes: Detailed logging of all inbound and outbound network traffic through the software’s gateway; When the software's container image is running, all process information, network port information, and network activity information are recorded in detail.

3. According to a method for dynamic software vulnerability verification based on a containerized environment as described in claim 2, it is characterized in that: The analysis software monitors network traffic and attack attempts to verify whether potential vulnerabilities can be exploited, including: Analyze the inbound and outbound network traffic information of the software service, the process information of the container image running of the software service, the network port information, and the network activity information; When an attacker is found to have obtained machine permissions for a software service or to have created a process on the server or to have performed network activities, the attack is deemed to have been successful and the potential vulnerability can be exploited.

4. According to the method for dynamic software vulnerability verification based on containerized environment of claim 3, it is characterized in that: include: Obtain and record the complete attack path of a successful attacker; Analyze the security vulnerabilities in software services and the corresponding repair priorities of the security vulnerabilities based on the complete attack paths of each successful attacker; The repair priority level corresponding to the security vulnerability is determined according to the software service permissions and data sensitivity involved in the security vulnerability; At the same time, an attack method report of the security vulnerability is generated based on the attacker's complete attack path for developers to refer to and fix the security vulnerability.

5. According to a method for dynamic software vulnerability verification based on a containerized environment as described in claim 3, it is characterized in that: include: Set a preset time interval for exposing the software service container image to the public network. During the preset time interval, if no attacker is found to have successfully attacked, the potential vulnerability cannot be exploited.

6. A software dynamic vulnerability verification method based on a containerized environment according to claim 5, characterized in that: include: When the software service container image is exposed on the public network for a preset time interval, the container image is destroyed to complete the test; Alternatively, when the software service container image is exposed on the public network for less than a preset time interval, but the software service is paralyzed by an attacker, the container image is destroyed to complete the test.

7. According to a method for dynamic software vulnerability verification based on a containerized environment as described in claim 1, it is characterized in that: After the software containing potential vulnerabilities and its operating environment are packaged into a container image, the production data and sensitive data in the container image are deleted, and only the services and configurations for verifying the potential vulnerabilities are retained.

8. The method for dynamic software vulnerability verification based on a containerized environment according to claim 1, characterized in that: After the containerized software is exposed to the public network in the isolated VPC network, it automatically triggers posting to the hacker community to attract hacker attacks and collect community feedback; and / or invites white hat hackers to conduct security testing attacks through the crowd testing platform.

9. A software dynamic vulnerability verification system based on a containerized environment, characterized in that: include: Vulnerability scanning module, which performs vulnerability scanning on software; A container image packaging module, when the vulnerability scanning module scans the software for potential vulnerabilities, the container image packaging module packages the software containing the potential vulnerabilities and its operating environment to generate a container image; Isolate the VPC network module, build an isolated VPC network, and deploy the container image generated by the container image packaging module in the isolated VPC network; The security vulnerability monitoring and analysis module exposes the containerized deployed software to the public network in the isolated VPC network, and performs software monitoring. The security vulnerability monitoring and analysis module analyzes the network traffic and attack attempts monitored by the software to verify whether potential vulnerabilities can be exploited.

10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, a software dynamic vulnerability verification method based on a containerized environment as described in any one of claims 1 to 8 is implemented.

Images