Vulnerability scanning instruction starting method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a vulnerability scanning instruction starting method and device, electronic equipment and a storage medium. The method comprises the steps that if a starting instruction of vulnerability scanning is received, a pre-detection instruction is sent to an IP address range corresponding to a system, and the pre-detection instruction carries a first identifier; receiving detection information fed back by the pre-detection instruction, if the detection information indicates that abnormal forwarding exists in the pre-detection instruction, determining a forwarding node corresponding to the abnormal forwarding, and adding the forwarding node into a white list, the forwarding node in the white list forbids forwarding of the instruction carrying the first identifier and the instruction carrying the second identifier; a target IP address corresponding to each forwarding node in the white list is determined, a vulnerability scanning instruction is sent to the remaining IP addresses except the target IP address in the IP address range so as to respond to the starting instruction, and the vulnerability scanning instruction carries a second identifier.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, device, electronic device, and storage medium for starting a vulnerability scanning instruction. Background Art

[0002] With the widespread application of Internet technology, the business system services of major enterprises are becoming more open, and the network security situation they face is becoming increasingly severe. In order to avoid vulnerabilities in their own systems, enterprises usually conduct vulnerability scans on internal assets on a regular basis. For large enterprises, the internal IT environment often has connections with branches, subsidiaries, third-party partners and other institutions. If the vulnerability scanning traffic is not effectively controlled, it may be accidentally forwarded to other institutions through nodes such as load balancing devices and reverse proxy servers, thereby interfering with the security operations of other institutions and even affecting the normal operation of related systems.

[0003] Therefore, there is an urgent need for a method that can prevent and monitor the risk of vulnerability scanning traffic forwarding and effectively control the risk of vulnerability scanning. Summary of the invention

[0004] The embodiments of the present application provide a method, device, electronic device, and storage medium for starting a vulnerability scanning instruction, so as to achieve the effect of preventing and monitoring the risk of vulnerability scanning traffic forwarding and effectively controlling the risk of vulnerability scanning.

[0005] In a first aspect, an embodiment of the present application provides a method for starting a vulnerability scanning instruction, comprising: if a vulnerability scanning start instruction is received, a pre-detection instruction is issued to the IP address range corresponding to the system, wherein the pre-detection instruction carries a first identifier; detection information fed back by the pre-detection instruction is received, and if the detection information indicates that there is abnormal forwarding of the pre-detection instruction, a forwarding node corresponding to the abnormal forwarding is determined, and the forwarding node is added to a whitelist, wherein the forwarding nodes in the whitelist are prohibited from forwarding instructions carrying the first identifier and instructions with a second identifier; a target IP address corresponding to each forwarding node in the whitelist is determined, and a vulnerability scanning instruction is sent to the remaining IP addresses in the IP address range except the target IP address in response to the start instruction, wherein the vulnerability scanning instruction carries a second identifier.

[0006] In a second aspect, an embodiment of the present application provides a startup device for a vulnerability scanning instruction, comprising: an issuing module, for issuing a pre-detection instruction to the IP address range corresponding to the system if a startup instruction for the vulnerability scanning is received, wherein the pre-detection instruction carries a first identifier; a receiving module, for receiving detection information fed back by the pre-detection instruction, and if the detection information indicates that the pre-detection instruction has abnormal forwarding, determining a forwarding node corresponding to the abnormal forwarding, and adding the forwarding node to a whitelist, wherein the forwarding nodes in the whitelist are prohibited from forwarding instructions carrying the first identifier and / or the second identifier; a determining module, for determining a target IP address corresponding to each forwarding node in the whitelist, and sending a vulnerability scanning instruction to the remaining IP addresses in the IP address range except the target IP address in response to the startup instruction, wherein the vulnerability scanning instruction carries a second identifier.

[0007] In a third aspect, an embodiment of the present application provides a device for starting a vulnerability scanning instruction, including: a memory, a processor;

[0008] The memory stores computer-executable instructions;

[0009] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0010] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0011] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0013] Figure 1 A schematic diagram of a scenario of a method for starting a vulnerability scanning instruction provided in this application;

[0014] Figure 2 Schematic diagram of the process of starting the vulnerability scanning instruction provided in this application Figure 1 ;

[0015] Figure 3 A schematic diagram of the structure of the system for starting the vulnerability scanning instruction provided by this application;

[0016] Figure 4 A schematic diagram of the structure of a device for starting a vulnerability scanning instruction provided by this application;

[0017] Figure 5 A schematic diagram of the structure of the startup device for the vulnerability scanning instruction provided in this application.

[0018] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0019] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0020] First, the terms involved in this application are explained:

[0021] Host field: The Host field is a key part of the HTTP request header, which is used to specify the server domain name or IP address and port number that the client wants to access. In HTTP requests, the Host field is used to specify the server domain name or IP address and port number that the client wants to access. When the internal system of an enterprise issues instructions, if these instructions need to be forwarded to the system of a partner unit for processing, then during the forwarding process, the Host field is likely to be modified to the domain name or IP address of the partner unit system.

[0022] IP: The full name is Internet Protocol. The Chinese meaning is "Internet Protocol". IP specifies the rules that computers should follow when communicating on the Internet. Computer systems produced by any manufacturer can be interconnected with the Internet as long as they comply with the IP protocol. In addition, IP addresses are unique and can be divided into public addresses and private addresses according to the nature of the user. Public addresses are used in the Internet and can be accessed at will on the Internet; private addresses can only be used in internal networks and can only communicate with the Internet through proxy servers.

[0023] Vulnerability scanning: refers to the act of detecting security vulnerabilities of designated remote or local computer systems through scanning and other means based on a vulnerability database to discover exploitable vulnerabilities.

[0024] Load balancing: is a technology that distributes network traffic, requests, or workloads to multiple servers or computing resources in order to improve system performance, reliability, and scalability.

[0025] Reverse proxy: refers to a method of proxying requests from external network users to a designated internal server and returning data to the user. The client does not communicate directly with the server, but with the reverse proxy server.

[0026] Full flow detection: Full flow is mainly reflected in three "fulls", namely full flow collection and storage, full behavior analysis and full flow backtracking. Through full flow analysis equipment, full network flow collection and storage, full behavior analysis and full flow backtracking are realized, and network metadata is extracted and uploaded to the big data analysis platform to achieve richer functions.

[0027] Web Application Firewall (WAF): is a specific form of application firewall that identifies and protects against malicious features of business traffic from websites or applications.

[0028] Data packet: Also known as a packet, it is a formatted data unit transmitted in a packet-switched network. A data packet is divided into two parts, including control information, which is the header, and the data itself, which is the payload.

[0029] Configuration management database: CMDB for short, is a logical database that contains information about the entire life cycle of configuration items and the relationships between configuration items (including physical relationships, real-time communication relationships, non-real-time communication relationships, and dependency relationships).

[0030] Figure 1 A schematic diagram of a scenario of a method for starting a vulnerability scanning instruction provided in this application, such as Figure 1 As shown, in the specific application scenario of the present application, there is enterprise A, a forwarding node for interaction between enterprise A and an affiliated organization, and an affiliated organization.

[0031] Vulnerability scanning is a security vulnerability detection based on vulnerability libraries. Requests sent to the target system generally have vulnerability exploitation characteristics. When the scanning traffic is accidentally forwarded to the associated organization, its security protection system will detect the attack. At the same time, in recent years, network attack methods have become more diverse and frequently updated, and the size of the vulnerability library has also increased significantly. A single vulnerability scan will send a large number of vulnerability exploitation requests to the target system, triggering a large number of alarms in a short period of time, which may drown out the important alarms of the associated units and affect their security monitoring.

[0032] Unexpected forwarding of vulnerability scanning traffic is generally due to the failure of load balancing devices, reverse proxy servers and other Web application processing nodes to implement strict forwarding filtering controls. The forwarding targets are often important business systems. High-intensity scanning traffic may affect the performance of related business processing, interfere with normal business logic, and may even trigger the threat blocking mechanism of the other end, resulting in serious consequences such as business connection interruption.

[0033] When vulnerability scanning traffic is accidentally forwarded to important industry hubs, it may cause chaos in the industry network and seriously disrupt the business operations of the entire industry.

[0034] In combination with the above scenarios, it can be seen that in the prior art, there is a technical problem that vulnerability scanning traffic is not effectively controlled and may be accidentally forwarded to other organizations through load balancing devices, reverse proxy servers and other nodes, thereby interfering with the security operations of other organizations and even affecting the normal operation of related systems.

[0035] The method for starting the vulnerability scanning instruction provided in the present application can detect abnormal forwarding through pre-detection instructions, avoid mistakenly sending the vulnerability scanning instruction to non-target systems, and thus reduce business interruptions or security incidents caused by false alarms. After adding the abnormal forwarding nodes to the whitelist, these nodes are prohibited from forwarding instructions carrying specific identifiers, which can avoid the accidental forwarding of vulnerability scanning traffic to non-target systems and protect them from unnecessary security threats. After determining that there will be no impact on non-target systems, the vulnerability scanning system can focus more on scanning the target IP address range, thereby improving the efficiency and accuracy of the scan, achieving the prevention and monitoring of the risk of vulnerability scanning traffic forwarding, and effectively controlling the risk effect of vulnerability scanning. It solves the problem that if the vulnerability scanning traffic is not effectively controlled, it may be accidentally forwarded to other institutions through nodes such as load balancing devices and reverse proxy servers, thereby interfering with the security operations of other institutions and even affecting the normal operation of related systems.

[0036] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0037] Figure 2 Schematic diagram of the process of starting the vulnerability scanning instruction provided in this application Figure 1 ,like Figure 2 As shown, the method includes:

[0038] S201, if a vulnerability scan start instruction is received, a pre-detection instruction is issued to the IP address range corresponding to the system, wherein the pre-detection instruction carries a first identifier;

[0039] That is to say, when receiving a vulnerability scan start instruction, instead of issuing a vulnerability scan instruction directly, a pre-detection instruction is issued first. Optionally, the vulnerability scan instruction will carry attack characteristics. If the vulnerability scan instruction is forwarded to the system of a partner unit connected to the enterprise system, it will cause damage to the partner unit's system and affect the normal use of business scenarios. Therefore, before officially issuing a vulnerability scan instruction, a pre-detection instruction without attack characteristics can be issued first.

[0040] Pre-configure a harmless Web request detection task in the vulnerability scanning module for the subsequent scan range check task before the formal scan. Example: If the IP address of the surviving host is 888.888.88.88, and it has opened a Web service on TCP port 8088, then request http: / / 888.888.88.88:8088 / lousaozhuanfajiancha.

[0041] Optionally, the sample code is as follows:

[0042] GET / lousaozhuanfajiancha HTTP / 1.1

[0043] Host:888.888.88.88:8088

[0044] Connection:keep-alive

[0045] Upgrade-Insecure-Requests:1

[0046] User-Agent:Mozilla / 5.0(Windows NT 10.0;Win64;x64)App

[0047] Among them, "lousaozhuanfajiancha" is equivalent to the first logo.

[0048] S202, receiving detection information fed back by the pre-detection instruction, and if the detection information indicates that the pre-detection instruction has abnormal forwarding, determining a forwarding node corresponding to the abnormal forwarding, and adding the forwarding node to a whitelist, wherein the forwarding nodes in the whitelist are prohibited from forwarding instructions carrying the first identifier and instructions carrying the second identifier;

[0049] It should be noted that abnormal forwarding refers to forwarding to an unexpected address. For example, when scanning traffic is accidentally forwarded to an affiliated organization, its security protection system will detect the attack.

[0050] In order to prevent the forwarding node from continuously forwarding pre-detection instructions or vulnerability scanning instructions in subsequent work, causing trouble to the affiliated organizations, the forwarding node is added to the whitelist. Then the vulnerability scanning system will no longer forward to the forwarding node.

[0051] S203. Determine the target IP address corresponding to each forwarding node in the whitelist, and send a vulnerability scanning instruction to the remaining IP addresses in the IP address range except the target IP address to respond to the start instruction, wherein the vulnerability scanning instruction carries a second identifier.

[0052] Optionally, a second identifier is configured in the vulnerability scanning module, and a custom request header attribute is added for all HTTP requests in the vulnerability scan (equivalent to the vulnerability scanning instruction), and the attribute content is unique, such as Vendor-Scanner:saf87#K3o2l*13+mc8u (equivalent to the second identifier).

[0053] The code example is as follows:

[0054] GET / ** / ****** / *****.htm HTTP / 1.1

[0055] Host:www.****.com

[0056] Connection:keep-alive

[0057] Upgrade-Insecure-Requests:1

[0058] User-Agent:Mozilla / 5.0(Windows NT 10.0;Win64;x64)App

[0059] Vendor-Scanner:saf87#K3o2l*13+mc8u

[0060] Optionally, the execution subject of the above steps is a vulnerability scanning system, which is used to issue vulnerability scanning instructions and detection instructions.

[0061] It should be noted that different forwarding nodes are responsible for forwarding to different affiliated organizations or internal organizations. Adding forwarding nodes to the whitelist can effectively prevent pre-detection instructions or vulnerability scanning instructions from being forwarded to affiliated organizations.

[0062] Optionally, the IP information of forwarding nodes such as load balancing and reverse proxy in the enterprise configuration management database (CMDB) is synchronized to the vulnerability scanning whitelist through the configuration and scheduling module, and each forwarding node IP is excluded from the scanning task.

[0063] The method for starting the vulnerability scanning instruction provided in the embodiment of the present application can detect abnormal forwarding through pre-detection instructions, avoid mistakenly sending the vulnerability scanning instruction to non-target systems, and thus reduce business interruptions or security incidents caused by false alarms. After adding abnormal forwarding nodes to the whitelist, these nodes are prohibited from forwarding instructions carrying specific identifiers, which can avoid accidental forwarding of vulnerability scanning traffic to non-target systems and protect them from unnecessary security threats. After determining that non-target systems will not be affected, the vulnerability scanning system can focus more on scanning the target IP address range, thereby improving the efficiency and accuracy of the scan, achieving the prevention and monitoring of vulnerability scanning traffic forwarding risks, and effectively controlling the risk effects of vulnerability scanning.

[0064] In a possible embodiment, first address information corresponding to the pre-detection instruction when it is issued and second address information corresponding to the pre-detection instruction during the forwarding process are determined; the first address information and the second address information are compared, and whether the pre-detection instruction is abnormally forwarded is determined based on the comparison result.

[0065] When a pre-detection instruction is issued, the source address information of the instruction is recorded. This usually refers to the IP address or network location of the system that initiated the scan. When the pre-detection instruction is forwarded, the address information of each node it reaches is recorded. This information can be obtained through network monitoring tools or log analysis.

[0066] Compare the recorded first address information with the second address information. If an unexpected address appears in the second address information, that is, it is not within the predetermined scanning range, then it can be considered that abnormal forwarding exists. Based on the comparison results, if it is found that the pre-detection instruction is forwarded to an unauthorized address or a system unrelated to the business, it can be determined that abnormal forwarding exists. Once the existence of abnormal forwarding is determined, measures should be taken immediately to prevent further forwarding, and the relevant forwarding nodes should be added to the whitelist to prohibit them from forwarding instructions carrying specific identifiers.

[0067] In a possible embodiment, a first Host field carried by the first address information when the pre-detection instruction is issued and a second Host field carried by the second address information after the pre-detection instruction is issued are determined; if the first Host field is inconsistent with the second Host field, it is determined that the pre-detection instruction is abnormally forwarded; if the first Host field is consistent with the second Host field, it is determined that the pre-detection instruction is normally forwarded.

[0068] When the vulnerability scanning system issues a pre-detection instruction, the source address information of the instruction is recorded, and the first Host field carried therein is extracted. This field represents the expected target host. When the pre-detection instruction is transmitted and forwarded on the network, each node it reaches is monitored, and the Host field of the second address information is extracted from the responses of these nodes. This field represents the actual target host reached. If the two are inconsistent, it means that the pre-detection instruction was mistakenly forwarded to an unexpected host, that is, abnormal forwarding occurred.

[0069] If the two are consistent, it means that the pre-detection instruction is correctly forwarded as expected and no exception occurs.

[0070] If abnormal forwarding is found, measures should be taken immediately to prevent further forwarding and add the relevant forwarding nodes to the whitelist to prohibit them from forwarding instructions carrying specific identifiers.

[0071] If it is a normal forwarding, the subsequent forwarding process can be monitored to ensure the security and accuracy of the entire scanning process. In this way, the vulnerability scanning system can effectively identify and handle abnormal forwarding situations and protect non-target systems from unnecessary interference or potential security threats. This host field-based inspection mechanism is simple and effective, and can quickly locate the problem and improve the stability and security of the system.

[0072] In a possible embodiment, a shielding instruction is sent to the forwarding node, wherein the shielding instruction is used to shield instructions carrying the first identifier and / or the second identifier.

[0073] One or more blocking instructions are created to specify the instruction type to be blocked (i.e., instructions carrying the first identifier and / or the second identifier). These instructions will tell the forwarding node not to forward the instructions carrying the first identifier and / or the second identifier to other network segments or systems.

[0074] That is, do not forward pre-detection instructions and vulnerability scanning instructions to other network segments or systems.

[0075] Optionally, by configuring HTTP request filtering rules in forwarding nodes such as load balancing and reverse proxy, access requests that are customized to carry the first identifier and / or the second identifier are discarded.

[0076] Optionally, the code example is as follows:

[0077] http{

[0078] upstream demo{

[0079] server xxx;

[0080] server xxx;

[0081] }

[0082] server{

[0083] listen xxx; #Listening port number

[0084] server_name xxx;

[0085] if($http_Vendor-Scanner='saf87#K3o2l*13+mc8u'){

[0086] rewrite^(.*)$ / 40x.html; #Directly redirect to the local customized 40x page

[0087] }

[0088] location / xxx{

[0089] proxy_pass demo; #Proxy to the defined demo

[0090] }

[0091] }

[0092] }

[0093] Optionally, a bypass-type traffic security detection device is deployed at the boundary between the enterprise and relevant organizations such as third-party partners to identify the first identifier and / or the second identifier. When a custom request header or a specified directory is matched, the log containing the source and destination addresses, HTTP request header information, etc. is transmitted to the monitoring and judgment module.

[0094] The code example is as follows:

[0095] TTP request path like " / lousaozhuanfajiancha" or Vendor-Scanner like "saf87#K3o2l*13+mc8u")

[0096] Response Action:

[0097] Threat name = "Vulnerability scanning traffic" and send log to "Monitoring and determination module"

[0098] In a possible embodiment, if an abnormal reminder is received from a forwarding node, an abnormal instruction that triggers the abnormal reminder is determined, wherein the abnormal reminder is used to prompt the current forwarding node that it has received an instruction carrying a first identifier and / or a second identifier; and whether to update the whitelist is determined based on the IP address corresponding to the upstream forwarding node corresponding to the abnormal instruction.

[0099] When the forwarding node receives an instruction carrying the first identifier and / or the second identifier, an abnormal alert will be triggered. This alert is a signal that a detection instruction and / or a vulnerability scanning instruction is passing through the node. The system first needs to identify the specific instructions that trigger the abnormal alert. Optionally, analyze network traffic logs or monitoring data to determine which instructions are abnormal. Once the abnormal instructions are identified, the next step is to track the source of these instructions. This usually involves finding the IP address of the upstream forwarding node associated with the abnormal instructions. Based on the IP address of the upstream forwarding node, the system needs to decide whether to add these addresses to the whitelist. If it is decided to update the whitelist, the system will perform the necessary operations to add the new IP address. After updating the whitelist, the system should continue to monitor network activity to ensure that the new rules are effective and make adjustments as needed.

[0100] In a possible embodiment, third address information corresponding to the abnormal instruction at the upstream forwarding node and fourth address information corresponding to the current forwarding node are determined; the third address information and the fourth address information are compared, and whether to update the whitelist is determined according to the comparison result.

[0101] When the abnormal instruction reaches the current forwarding node, the source address information of the instruction at the upstream forwarding node, i.e., the third address information, is recorded. At the same time, the address information when the current forwarding node receives the abnormal instruction, i.e., the fourth address information, is recorded. The third address information is compared with the fourth address information:

[0102] If the two are inconsistent, it means that the abnormal instruction passed through an unexpected path or node during transmission, which may pose a security risk or configuration error.

[0103] If the two are consistent, it means that the transmission path of the abnormal instruction is as expected, that is, it is circulating within the enterprise where the missed delivery scanning system is installed.

[0104] If it is found that the third address information is inconsistent with the fourth address information, it indicates abnormal forwarding or potential security issues, and you should consider updating the whitelist.

[0105] Updating the whitelist may involve adding the IP addresses of relevant upstream forwarding nodes to the whitelist to block future abnormal traffic.

[0106] Optionally, the third address information may be IP address information, and the fourth address information may be IP address information.

[0107] In a possible embodiment, the third Host field carried by the third address information corresponding to the upstream forwarding node of the abnormal instruction and the fourth Host field carried by the fourth address information corresponding to the current forwarding node are determined; if the third Host field is consistent with the fourth Host field, it is determined to add the upstream forwarding node to the whitelist; if the third Host field is inconsistent with the fourth Host field, it is determined to add the forwarding node that reports the abnormal instruction to the whitelist.

[0108] Since the current forwarding node has issued an abnormal alert, it is known that the Host field corresponding to the address forwarded by the current forwarding node shows that it has been forwarded to the system of the associated organization, so the upstream forwarding node with the same Host field as the current forwarding node also indicates abnormal forwarding, but has not yet triggered an abnormal alert. Therefore, the upstream forwarding node needs to be added to the whitelist.

[0109] Optionally, after the upstream forwarding node is added to the whitelist, the host field of the upstream forwarding node of the upstream forwarding node may be further determined, thereby tracing back to the forwarding node where the abnormality first occurred.

[0110] Since the Host field corresponding to the current forwarding node is abnormal, if it is different from the Host field corresponding to the current forwarding node, it can be considered as normal forwarding, that is, internal forwarding within the enterprise.

[0111] Optionally, scan traffic forwarding alarm policy configuration: configure the association rule "Vulnerability scan exceeds expected range" based on the above log in the monitoring and judgment module. When it is identified that the network layer target IP of an access request is different from the IP of the Host field in the HTTP request header, it indicates that the scan request has been forwarded, and the Host IP of the HTTP request is the forwarding initial node IP. At this time, an alarm is generated, and the security operation personnel and the scan execution personnel intervene and confirm.

[0112] The code example is as follows: Strategy logic:

[0113] (Data source = "Full flow detection device" or Data source = "Web application firewall") and (HTTP request path like " / lousaozhuanfajiancha" or Threat name = "Leakage scanning forwarding check" or Vendor-Scanner like "saf87#K3o2l*13+mc8u") and not (Destination address = HTTP_Host_IP)

[0114] Response Action:

[0115] Alert Name="Vulnerability scan exceeded expected scope".

[0116] By adding a specific identifier to the vulnerability scanning request content, and the system's configuration and scheduling module sends rules for detecting the identifier feature to the full flow detection, WAF and other security devices at the border of other institutions, and at the same time adding a harmless pre-scan (i.e., including the scanning identifier feature and a specific Web request directory, but no attack request) task before the actual vulnerability scan, the monitoring and judgment module can realize real-time monitoring and analysis of the flow of related traffic during the pre-scan and formal scan. When it is detected that the expected target address in the scan traffic is different from the actual destination address of the flow, an alarm that the vulnerability scan exceeds the expected range is immediately generated, and the enterprise security operation personnel will deal with it in time. On the other hand, before the pre-scan is carried out, forwarding filtering rules are configured on forwarding nodes such as load balancing and reverse proxy to prevent the forwarding of requests containing vulnerability scanning features, and the forwarding node IP information in the CMDB is synchronously added to the whitelist exceptions in the scanning module (i.e., not included in the scan) through the configuration and scheduling module, thereby minimizing the possibility of forwarding behavior and effectively controlling risks.

[0117] Figure 3 A schematic diagram of the structure of the startup system of the vulnerability scanning instruction provided by this application, such as Figure 3 As shown:

[0118] (1) Vulnerability scanning module. This module mainly includes vulnerability scanning, configuring scan request tags, configuring vulnerability scanning request paths, and adding vulnerability scanning whitelist functions.

[0119] (2) Configuration and scheduling module. The main functions of this module include:

[0120] a) Synchronize the IP information of forwarding nodes such as load balancing and reverse proxy in the enterprise CMDB to the vulnerability scanning whitelist;

[0121] b) Synchronize the configuration information not included in the scan in (1) to the CMDB.

[0122] (3) Monitoring and judgment module. The main function of this module is to collect and parse the alarm logs sent by traffic or security devices, monitor the traffic trends according to the source / destination address; at the same time, configure comprehensive detection rules, compare the corresponding fields of the parsed logs according to the logic in the rules and generate comparison results.

[0123] (4) Disposal module. The main function of this module is to respond to the comparison results generated in (3). When the detection rules in (3) are triggered, this module will generate an alarm and can link (1) and (2) to configure response actions, such as adding a missed scan whitelist and triggering a security device traffic blocking scenario.

[0124] The method for starting the vulnerability scanning instruction provided in the embodiment of the present application can detect abnormal forwarding through pre-detection instructions, avoid mistakenly sending the vulnerability scanning instruction to non-target systems, and thus reduce business interruptions or security incidents caused by false alarms. After adding the abnormal forwarding nodes to the whitelist, these nodes are prohibited from forwarding instructions carrying specific identifiers, which can avoid the accidental forwarding of vulnerability scanning traffic to non-target systems and protect them from unnecessary security threats. After determining that there will be no impact on non-target systems, the vulnerability scanning system can focus more on scanning the target IP address range, thereby improving the efficiency and accuracy of the scan, achieving the prevention and monitoring of vulnerability scanning traffic forwarding risks, and effectively controlling the risk effects of vulnerability scanning. It solves the problem that if the vulnerability scanning traffic is not effectively controlled, it may be accidentally forwarded to other institutions via nodes such as load balancing devices and reverse proxy servers, thereby interfering with the security operations of other institutions and even affecting the normal operation of related systems.

[0125] Figure 4 A schematic diagram of the structure of the device for starting the vulnerability scanning instruction provided by this application, such as Figure 4 As shown, the vulnerability scanning instruction startup device 40 provided in this embodiment includes:

[0126] The issuing module 401 is used to issue a pre-detection instruction to the IP address range corresponding to the system if a vulnerability scan start instruction is received, wherein the pre-detection instruction carries a first identifier;

[0127] A receiving module 402 is used to receive detection information fed back by the pre-detection instruction. If the detection information indicates that the pre-detection instruction has abnormal forwarding, a forwarding node corresponding to the abnormal forwarding is determined, and the forwarding node is added to a whitelist, wherein the forwarding node in the whitelist is prohibited from forwarding instructions carrying the first identifier and the second identifier;

[0128] The determination module 403 is used to determine the target IP address corresponding to each forwarding node in the whitelist, and send a vulnerability scanning instruction to the remaining IP addresses in the IP address range except the target IP address in response to the start instruction, wherein the vulnerability scanning instruction carries a second identifier.

[0129] In a possible embodiment, the receiving module 402 is also used to determine the first address information corresponding to the pre-detection instruction when it is issued and the second address information corresponding to the pre-detection instruction during the forwarding process; compare the first address information and the second address information, and determine whether the pre-detection instruction has abnormal forwarding based on the comparison result.

[0130] In a possible embodiment, the receiving module 402 is also used to determine the first Host field carried by the first address information when the pre-detection instruction is issued and the second Host field carried by the second address information after the pre-detection instruction is issued; if the first Host field is inconsistent with the second Host field, it is determined that the pre-detection instruction is abnormally forwarded; if the first Host field is consistent with the second Host field, it is determined that the pre-detection instruction is forwarded normally.

[0131] In a possible embodiment, the determining module 403 is further configured to send a shielding instruction to the forwarding node, wherein the shielding instruction is configured to shield instructions carrying the first identifier and the second identifier.

[0132] In a possible embodiment, the device also includes: a reminder module (not shown in the figure), which is used to determine the abnormal instruction that triggers the abnormal reminder if an abnormal reminder is received from the forwarding node, wherein the abnormal reminder is used to prompt the current forwarding node that it has received an instruction carrying a first identifier and a second identifier; and determine whether to update the whitelist based on the IP address corresponding to the upstream forwarding node corresponding to the abnormal instruction.

[0133] In a possible embodiment, the reminder module is also used to determine the third address information corresponding to the abnormal instruction at the upstream forwarding node and the fourth address information corresponding to the current forwarding node; compare the third address information and the fourth address information, and determine whether to update the whitelist based on the comparison result.

[0134] In a possible embodiment, the reminder module is also used to determine the third Host field carried by the third address information corresponding to the abnormal instruction in the upstream forwarding node and the fourth Host field carried by the fourth address information after the pre-detection instruction is issued; if the third Host field is consistent with the fourth Host field, it is determined to add the upstream forwarding node to the whitelist; if the third Host field is inconsistent with the fourth Host field, it is determined to add the forwarding node that reports the abnormal instruction to the whitelist.

[0135] The device for starting the vulnerability scanning instruction provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail in this embodiment.

[0136] Figure 5 This is a schematic diagram of the structure of the startup device of the vulnerability scanning instruction provided by this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0137] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0138] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0139] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0140] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0141] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0142] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0143] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0144] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0145] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0146] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0147] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0148] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0149] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0150] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0151] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for starting a vulnerability scanning instruction, characterized in that: include: If a vulnerability scan start instruction is received, a pre-detection instruction is issued to the IP address range corresponding to the system, wherein the pre-detection instruction carries a first identifier; Receive detection information fed back by the pre-detection instruction, and if the detection information indicates that the pre-detection instruction has abnormal forwarding, determine a forwarding node corresponding to the abnormal forwarding, and add the forwarding node to a whitelist, wherein the forwarding nodes in the whitelist are prohibited from forwarding instructions carrying the first identifier and instructions carrying the second identifier; Determine the target IP address corresponding to each forwarding node in the whitelist, and send a vulnerability scanning instruction to the remaining IP addresses in the IP address range except the target IP address in response to the start instruction, wherein the vulnerability scanning instruction carries a second identifier.

2. The method according to claim 1, characterized in that If the detection information indicates that the pre-detection instruction has abnormal forwarding, before determining the forwarding node corresponding to the abnormal forwarding, the method further includes: Determine the first address information corresponding to the pre-detection instruction when it is issued and the second address information corresponding to the pre-detection instruction during the forwarding process; The first address information and the second address information are compared, and whether the pre-detection instruction has abnormal forwarding is determined according to the comparison result.

3. The method according to claim 2, characterized in that include: Determine a first Host field carried by the first address information when the pre-detection instruction is issued and a second Host field carried by the second address information after the pre-detection instruction is issued; If the first Host field is inconsistent with the second Host field, determining that the pre-detection instruction is abnormally forwarded; If the first Host field is consistent with the second Host field, it is determined that the pre-detection instruction is forwarded normally.

4. The method according to claim 1, characterized in that: After sending a vulnerability scanning instruction to the remaining IP addresses in the IP address range except the target IP address in response to the start instruction, the method further includes: A shielding instruction is sent to the forwarding node, wherein the shielding instruction is used to shield instructions carrying the first identifier and / or the second identifier.

5. The method according to any one of claims 1 to 4, characterized in that After sending a vulnerability scanning instruction to the remaining IP addresses in the IP address range except the target IP address in response to the start instruction, the method further includes: If an abnormal reminder fed back by the forwarding node is received, determining an abnormal instruction that triggers the abnormal reminder, wherein the abnormal reminder is used to prompt the current forwarding node to receive an instruction carrying the first identifier and / or the second identifier; Determine whether to update the whitelist according to the IP address corresponding to the upstream forwarding node corresponding to the abnormal instruction.

6. The method according to claim 5, characterized in that Determining whether to update the whitelist according to the IP address corresponding to the upstream forwarding node corresponding to the abnormal instruction, the method further includes: Determine third address information corresponding to the upstream forwarding node and fourth address information corresponding to the current forwarding node of the abnormal instruction; The third address information and the fourth address information are compared, and it is determined whether to update the whitelist according to the comparison result.

7. The method according to claim 6, characterized in that Comparing the third address information with the fourth address information, and determining whether to update the whitelist according to the comparison result, the method further includes: Determine a third Host field carried by third address information corresponding to an upstream forwarding node of the abnormal instruction and a fourth Host field carried by fourth address information corresponding to a current forwarding node; If the third Host field is consistent with the fourth Host field, determining to add the upstream forwarding node to the whitelist; If the third Host field is inconsistent with the fourth Host field, it is determined to add the forwarding node that reports the abnormal instruction to the whitelist.

8. A device for starting a vulnerability scanning instruction, characterized in that: include: An issuing module, configured to issue a pre-detection instruction to an IP address range corresponding to the system if a vulnerability scan start instruction is received, wherein the pre-detection instruction carries a first identifier; A receiving module, configured to receive detection information fed back by the pre-detection instruction, and if the detection information indicates that the pre-detection instruction has abnormal forwarding, determine a forwarding node corresponding to the abnormal forwarding, and add the forwarding node to a whitelist, wherein the forwarding nodes in the whitelist are prohibited from forwarding instructions carrying the first identifier and / or the second identifier; A determination module is used to determine the target IP address corresponding to each forwarding node in the whitelist, and send a vulnerability scanning instruction to the remaining IP addresses in the IP address range except the target IP address to respond to the start instruction, wherein the vulnerability scanning instruction carries a second identifier.

9. A device for starting a vulnerability scanning instruction, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images