System security scanning method and device, electronic equipment and storage medium

Abstract

The invention relates to a system security scanning method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining newly-added resources in a system, and enabling the newly-added resources to comprise a newly-added domain name and a newly-added IP address; in response to a system security scanning request, obtaining a network state of the newly added resource; under the condition that the network state of the newly-added resource is online, judging whether a target page corresponding to the newly-added resource is an effective page or not; and under the condition that the target page is an effective page, performing security scanning processing on newly-added resources corresponding to the target page. In the process of vulnerability scanning, page features of newly added resources are analyzed by using a multi-dimensional identification technology, newly online business pages are rapidly and accurately identified, resource vulnerabilities are rapidly determined in the early stage of resource online, system security repair is performed in a targeted manner, and complexity of vulnerability problems is prevented. Therefore, the repair difficulty is reduced.

Description

Technical Field

[0001] The present application relates to the field of system security technology, and in particular to a system security scanning method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of Internet technology, the speed of business iteration of Internet companies is accelerating to adapt to the needs of the market and users. However, this rapid iteration also brings new challenges, especially in terms of system security; newly launched business systems often focus on the realization of business functions first, while ignoring the importance of security protection, which makes new systems easy targets for hacker attacks after they are launched, and may face security risks such as key information leakage.

[0003] Internet companies have a wide range of external network exposure, and IP addresses, ports and domain names are updated frequently, which makes security monitoring extremely difficult. The monitoring scale reaches hundreds of thousands to millions. With the rapid iteration of business systems and the continuous addition of new functions, the emergence and repair of vulnerabilities have become more complicated.

[0004] Therefore, there is an urgent need to develop a system security scanning method, device, electronic device and storage medium to solve one or more of the above-mentioned problems. Summary of the invention

[0005] In view of this, in order to solve the above technical problems or part of the technical problems, the embodiments of the present invention provide a system security scanning method, device, electronic device and storage medium.

[0006] In a first aspect, the present application provides a system security scanning method, the method comprising:

[0007] Acquire new resources in the system, the new resources including new domain names and new IP addresses;

[0008] In response to a system security scan request, obtaining a network status of the newly added resource;

[0009] When the network status of the newly added resource is online, determining whether the target page corresponding to the newly added resource is a valid page;

[0010] When the target page is a valid page, a security scan is performed on the newly added resources corresponding to the target page.

[0011] In a possible implementation manner, the determining whether the target page corresponding to the newly added resource is a valid page includes:

[0012] Determine whether the target page corresponding to the newly added resource is a return page;

[0013] In the case where the target page corresponding to the newly added resource is a non-return page, determining whether the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement;

[0014] In the case where the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the newly added resource is a valid page;

[0015] In the case that the parameter length of the request parameter does not meet the preset parameter length requirement, determining whether the target page is rendered through the network protocol corresponding to the newly added resource;

[0016] In the case where the target page fails to pass page rendering, the target page corresponding to the newly added resource is a valid page.

[0017] In a possible implementation, the method further includes:

[0018] In the case where the target page corresponding to the newly added resource meets the preset invalid condition, the target page corresponding to the newly added resource is an invalid page;

[0019] The preset invalid condition is that the target page is a return page, or the target page is rendered by page;

[0020] Stop the security scanning process of the invalid page.

[0021] In a possible implementation manner, before determining whether the target page corresponding to the newly added resource is a valid page, the method further includes:

[0022] Obtaining the network protocol corresponding to the newly added resource;

[0023] The target page corresponding to the newly added resource is obtained by using the network protocol, and in the process of obtaining the target page corresponding to the newly added resource, the parameter length of the request parameter corresponding to the target page is obtained.

[0024] In a possible implementation, the method further includes:

[0025] In the case that the target page corresponding to the newly added resource is an invalid page, the target page corresponding to the newly added resource is reacquired according to a preset protocol recognition cycle, and it is determined whether the target page is a valid page.

[0026] In a possible implementation, the method further includes:

[0027] When the network status of the newly added resource is offline, the step of obtaining the network status of the newly added resource is re-executed according to a preset detection period.

[0028] In a possible implementation manner, acquiring the newly added resources in the system includes:

[0029] Detecting the system using a network protocol to obtain newly added domain names and newly added IP addresses in the system;

[0030] or,

[0031] The system is connected using a system work order to obtain a newly added domain name and a newly added IP address in the system.

[0032] In a second aspect, the present application provides a system security scanning device, the device comprising:

[0033] A resource acquisition module is used to acquire new resources in the system, wherein the new resources include new domain names and new IP addresses;

[0034] A network status acquisition module, used to obtain the network status of the newly added resource in response to a system security scan request;

[0035] A judgment module, used for judging whether a target page corresponding to the newly added resource is a valid page when the network status of the newly added resource is online;

[0036] The security scanning module is used to perform security scanning processing on the newly added resources corresponding to the target page when the target page is a valid page.

[0037] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the system security scanning method described in any one of the embodiments of the first aspect when executing the computer program.

[0038] In a fourth aspect, the present application further provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the system security scanning method described in any embodiment of the first aspect are implemented.

[0039] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the system security scanning method provided by the embodiment of the present application obtains new resources in the system, promptly identifies the new resources, and incorporates them into the security scanning detection process, promptly obtains the network status of the new resources, determines whether the business system is online, and then initiates vulnerability scanning in a targeted manner. During the vulnerability scanning process, multi-dimensional recognition technology is used to analyze the page features of the new resources, quickly and accurately identify the newly launched business pages, quickly determine resource vulnerabilities in the early stage of resource online, and perform targeted system security repairs to prevent the complication of vulnerability problems, thereby reducing the difficulty of repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0042] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0043] Figure 1 A schematic diagram of a system security scanning method provided in an embodiment of the present application;

[0044] Figure 2 A schematic diagram of a system security scanning method provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of the steps of a system security scanning method provided in an embodiment of the present application;

[0046] Figure 4 A schematic diagram of the steps of multi-dimensional content recognition provided in an embodiment of the present application;

[0047] Figure 5 A schematic diagram of the structure of a system security scanning device provided in an embodiment of the present application;

[0048] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0050] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0051] In order to solve the problem that the Internet companies in the prior art have a wide external network exposure, IP addresses, ports and domain names are frequently updated, resulting in great difficulty in security monitoring, with the order of hundreds of thousands to millions. Even if the enterprise can timely update the security team's information about new domain names and IPs, there are timeliness issues, resulting in delays in business deployment; and the rapid iteration of business systems and the continuous addition of new functions make the emergence and repair of vulnerabilities more complicated; and in the process of vulnerability scanning, although traditional vulnerability scanning tools can identify newly added domain names, when the business system is not fully deployed, large-scale black box scanning is not only ineffective, but also wastes resources. Based on the above technical problems, the present application provides a system security scanning method, device, electronic device and storage medium, which can realize targeted initiation of vulnerability scanning, use multi-dimensional recognition technology to analyze the page features of newly added resources during the vulnerability scanning process, quickly and accurately identify newly launched business pages, and perform targeted system security repairs to prevent the complexity of vulnerability problems, thereby reducing the difficulty of repair.

[0052] Figure 1 A schematic diagram of a system security scanning method provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method specifically includes:

[0053] S101, acquiring new resources in the system, where the new resources include a new domain name and a new IP address;

[0054] In this embodiment, the newly added domain name and IP address information in the system is effectively obtained through external black box detection technology or internal fuxi system work order docking mechanism.

[0055] Specifically, external black box detection technology can detect newly added domain names and IP addresses in a timely manner by regularly scanning and monitoring the network environment, and feedback this information to the system administrator. The internal fuxi system work order docking mechanism allows system administrators to submit work orders to request the fuxi system to automatically detect and obtain newly added domain names and IP address information. Both of the above methods can ensure that system administrators can keep abreast of newly added domain names and IP addresses inside and outside the system in a timely manner, so as to better manage and maintain system security.

[0056] S102, in response to the system security scan request, obtaining the network status of the newly added resource;

[0057] In this embodiment, after acquiring the new resources in the system, a scanning task is started periodically to detect the network status of the new resources to ensure timely understanding of the network connection status of the resources, effectively monitor and manage the new resources, so that the new resources can work normally, thereby ensuring the stability and reliability of the system.

[0058] S103: When the network status of the newly added resource is online, determine whether the target page corresponding to the newly added resource is a valid page;

[0059] In this embodiment, when the system detects the emergence of new resources and determines that the new resources are online, the system will use multi-dimensional recognition technology to perform further analysis and judgment. Specifically, it will identify and analyze these new resources through a variety of different parameters and characteristics to determine whether the new resources correspond to valid pages in the system. Through the judgment process, it ensures that the system will not waste scanning resources on invalid pages when scanning and processing resources, so that the system can use its resources more efficiently and ensure the accuracy and effectiveness of the scanning and processing process.

[0060] Multi-dimensional recognition technology analyzes whether the system page corresponding to the newly added resource is a valid page by analyzing the characteristics of the returned content. Specifically, this technology can use keywords to determine whether there is a business change by checking the characteristics of the Nginx default page or the company's standard return page; or when encountering non-keyword recognition, multi-dimensional recognition technology can also evaluate the richness of the page content by analyzing the length of the payload; in addition, it can also assist in judgment by identifying special cases of JavaScript (JS) rendering pages; it can quickly and accurately identify newly launched business pages, thereby providing strong support for business monitoring and management.

[0061] S104: When the target page is a valid page, perform security scanning on the newly added resources corresponding to the target page.

[0062] In this embodiment, by determining that the page corresponding to the newly added resource is a valid page, the newly added resource is subjected to security scanning. The security scanning process includes but is not limited to vulnerability scanning, malicious code detection, and permission verification. Through security scanning, potential security risks of the newly added resources can be effectively identified and prevented to ensure system security and reliability.

[0063] After obtaining the security scan results, a security scan report can be generated based on the security scan results, and the security scan report and security repair suggestions can be sent to the system administrator, and guidance on repair operations can be provided; repair suggestions include but are not limited to patch installation, configuration modification, permission adjustment, etc., to help system administrators understand the specific implementation steps of repair suggestions and ensure the accuracy and effectiveness of the repair process, so as to ensure that system administrators can quickly take measures based on the report content and promptly repair the discovered security vulnerabilities.

[0064] After the system administrator completes the security repair, a security scan is performed again to verify the repair effect. By comparing the scan results before and after the repair, the system can evaluate the effectiveness of the repair measures and ensure that all potential security issues have been properly resolved. If new security issues are found during the verification process, the system will restart the repair process until the system security meets the expected standards.

[0065] The system security scanning method provided in this embodiment quickly identifies the existence of these new resources by real-time monitoring and obtaining the information of new resources in the system. Once the new resources are detected, the system will immediately include them in the security scanning detection process to ensure that these resources can be timely security assessed. Then the system will monitor and obtain the network status information of these new resources in real time to determine whether the business system has been successfully launched. Once it is confirmed that the business system has been launched, the system will initiate a vulnerability scan in a targeted manner to ensure that potential security vulnerabilities can be discovered in the early stages of resource launch. In the process of vulnerability scanning, the system uses multi-dimensional recognition technology to analyze the page features of the new resources, which can quickly and accurately identify the newly launched business pages, thereby making the deployment of security scanning more efficient. Through the above scanning method, the system can quickly identify the potential vulnerabilities of resources in the early stage of resource launch, and carry out targeted system security repairs to avoid these vulnerabilities becoming more complicated over time, effectively preventing the complexity of vulnerability problems, thereby reducing the difficulty of vulnerability repair, improving the security of the entire system, and ensuring the stable operation of the business.

[0066] Figure 2 A schematic diagram of a system security scanning method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the method specifically includes:

[0067] S201, determining whether the target page corresponding to the newly added resource is a return page;

[0068] The return page in the business system is used to return certain information, not to provide actual content or functions; therefore, in the process of determining whether the target page corresponding to the newly added resources is a valid page, first determine whether the target page is a return page to avoid wasting resources on pages with no actual business value.

[0069] In this embodiment, the system administrator can set specific rules to identify the return page. For example, the return page usually has a specific URL pattern, return status code or return content format. By analyzing these features, the system can effectively identify the return page, thereby avoiding unnecessary security scans on these pages.

[0070] S202: When the target page corresponding to the newly added resource is a non-return page, determine whether the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement;

[0071] S203: When the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the newly added resource is a valid page;

[0072] In this embodiment, when it is clear that the target page is a non-return page, that is, when the target page is a page that actually participates in the business process, in order to further confirm the validity of the target page, the length of the request parameter is judged in the process of obtaining the target page, and the richness of the page content is judged by the parameter length of the request parameter;

[0073] Specifically, the target page is evaluated by parameter length assessment to see if it meets the expected valid page standard; the request parameter length is checked to see if it is within a reasonable range to determine if the target page is valid. If the parameter length meets expectations, the page is a valid business page; otherwise, if the parameter length is abnormal, the page is an invalid business page.

[0074] S204: If the parameter length of the request parameter does not meet the preset parameter length requirement, determine whether the target page is rendered through the network protocol corresponding to the newly added resource;

[0075] S205: When the target page fails to pass page rendering, the target page corresponding to the newly added resource is a valid page.

[0076] In this embodiment, when the parameter length of the target page request parameter meets the preset parameter length requirement, it is further determined whether the target page is generated through page rendering to ensure the richness and effectiveness of the page content. Page rendering usually involves technologies such as JavaScript, which are used to dynamically generate page content; by analyzing the network protocol, the system can determine whether the target page is generated through page rendering technology; if the target page is not generated through page rendering, that is, the page content is static, then the page can be considered a valid page.

[0077] After confirming that the target page is a valid page, the system will perform a security scan on the newly added resources. The security scan includes vulnerability scanning, malicious code detection, and permission verification. Through these scanning processes, the system can comprehensively evaluate the security status of the newly added resources to ensure system security and reliability.

[0078] The system security scanning method provided in this embodiment, when a new resource is online, identifies the resource protocol and page content through a scheduled task, stores the http content and the length of the return parameter, and determines whether there is a change in the message content through multi-dimensional identification through the http content and the length of the return parameter, that is, determines whether the page is a valid page through return page judgment, payload length judgment and js page rendering. When there is a change and it is determined that the page of the newly added resource is a valid page, the multi-level scanner plug-in is called to perform page scanning; the newly launched valid business page is quickly identified, so as to perform security scanning deployment on the valid page, and improve security scanning efficiency.

[0079] In an optional solution of the embodiment of the present invention, the method further includes:

[0080] In the case where the target page corresponding to the newly added resource meets the preset invalid condition, the target page corresponding to the newly added resource is an invalid page;

[0081] The preset invalid condition is that the target page is a return page, or the target page is rendered by page;

[0082] Stop the security scanning process of the invalid page.

[0083] In this embodiment, when the target page corresponding to the newly added resource fails to meet the preset validity conditions, that is, the target page fails to meet the predetermined standards or requirements, then the target page corresponding to the newly added resource will be regarded as an invalid page. In this case, the system will immediately stop further security scanning processing for the invalid page to ensure the rationality and security of resource allocation and avoid unnecessary waste of resources and potential security risks for invalid pages. In this way, the system can use resources more efficiently, ensuring that only pages that meet the validity conditions will be subject to further security checks, thereby improving overall security and resource utilization efficiency.

[0084] In an optional solution of the embodiment of the present invention, before determining whether the target page corresponding to the newly added resource is a valid page, the method further includes:

[0085] Obtaining the network protocol corresponding to the newly added resource;

[0086] The target page corresponding to the newly added resource is obtained by using the network protocol, and in the process of obtaining the target page corresponding to the newly added resource, the parameter length of the request parameter corresponding to the target page is obtained.

[0087] In this embodiment, the network protocol corresponding to the newly added resource is analyzed to determine whether it conforms to the protocol type supported by the business system;

[0088] Specifically, in order to ensure the compatibility and security of the newly added resources, the system will first analyze the network protocols used by the newly added resources. Business systems usually support specific protocol types, such as HTTP, HTTPS, FTP, etc. By analyzing the network protocols of the newly added resources, the system can determine whether they meet the protocol types supported by the business system. If the protocol used by the newly added resource is no longer in the support list, then the resource may not work properly or there is a security risk, so it can be considered an invalid resource.

[0089] In order to further confirm the validity of the newly added resources, the system will analyze the URL pattern of the newly added resources. The URL pattern usually contains information such as path and query parameters. By analyzing this information, the system can determine whether the newly added resources comply with the URL specifications of the business system; if the URL pattern does not comply with the specifications, then the resource may not be accessed normally or there may be potential security issues, so it can be regarded as an invalid resource. If the URL pattern of the newly added resource complies with the business system specifications, it is determined whether the newly added resource has access rights;

[0090] By using the above-mentioned network protocol, the target page corresponding to the newly added resource can be successfully obtained, and in the process of obtaining the target page corresponding to the newly added resource, the parameter length of the request parameter corresponding to the target page can be obtained.

[0091] In an optional solution of the embodiment of the present invention, the method further includes:

[0092] In the case that the target page corresponding to the newly added resource is an invalid page, the target page corresponding to the newly added resource is reacquired according to a preset protocol recognition cycle, and it is determined whether the target page is a valid page.

[0093] In this embodiment, when the target page corresponding to the newly added resource is identified as an invalid page, the system will automatically re-acquire the target page corresponding to the newly added resource according to a pre-set protocol identification cycle. Subsequently, the system will judge the re-acquired target page to confirm whether it is a valid page.

[0094] After confirming that the target page is a valid page, security scanning such as vulnerability scanning, malicious code detection, and permission verification are performed on the newly added resources. Security scanning of valid pages is a key step to ensure system security; vulnerability scanning can discover potential security vulnerabilities, malicious code detection can identify and remove possible malicious code, and permission verification can ensure that the access rights of resources are set correctly to prevent unauthorized access. Through regular detection and security scanning of newly added resources, the system can promptly discover and handle security risks of newly added resources, thereby ensuring the stable operation of the entire business system.

[0095] In an optional solution of the embodiment of the present invention, the method further includes:

[0096] When the network status of the newly added resource is offline, the step of obtaining the network status of the newly added resource is re-executed according to a preset detection period.

[0097] In this embodiment, when the network status of the newly added resource is offline, the system will re-execute the step of obtaining the network status of the newly added resource according to a preset detection period.

[0098] Specifically, when the network connection status of a newly added resource is detected as offline, the system will not give up the attempt immediately, but will periodically detect it at a pre-set time interval. This detection period can be fixed or dynamically adjusted to adapt to different network environments and needs. In this way, the system can continuously monitor the network status of the resource when it is offline. Once the network returns to normal, the system will be able to detect and handle it in time, thereby ensuring the availability of resources and the stability of the system.

[0099] In an optional solution of the embodiment of the present invention, the acquiring of the newly added resources in the system includes:

[0100] Detecting the system using a network protocol to obtain newly added domain names and newly added IP addresses in the system;

[0101] or,

[0102] The system is connected using a system work order to obtain a newly added domain name and a newly added IP address in the system.

[0103] In this embodiment, the newly added resources include newly added domain names / IPs of the external system and newly added domain names / IPs of the internal system;

[0104] Specifically, the external system uses black box detection to detect newly added domain names / IPs, and the internal system uses the fuxi system work order docking to discover newly added domain names / IPs. The external system uses black box detection technology to identify and discover newly added domain names and IP addresses. Specifically, it simulates network requests and responses to detect changes in the network. In this way, the system can promptly discover new resources in the external network environment and ensure timely updates and synchronization of business systems. The internal system obtains newly added domain names and IP addresses by docking with the work order system. The work order system records all changes and additions to internal resources. By docking with the work order system, the system can obtain the latest information on internal resources in real time to ensure the accuracy and completeness of internal resources.

[0105] The newly added resource monitoring method provided in this embodiment includes two aspects: internal monitoring and external monitoring. Internal monitoring is mainly responsible for real-time monitoring and management of system internal resources, ensuring the reasonable allocation and use of resources, and preventing the abuse and waste of internal resources, while external monitoring is mainly responsible for timely discovery and integration of external newly added resources, ensuring that these resources can be quickly and effectively incorporated into the entire network system, thereby improving the overall performance and reliability of the network. This dual mechanism ensures that newly added resources in both internal and external systems can be captured and managed in a timely and accurate manner, maintaining a high degree of stability and security, and ensuring the normal operation of the network and the secure transmission of data.

[0106] Figure 3 A schematic diagram of the steps of a system security scanning method provided in an embodiment of the present application is as follows: Figure 3 As shown in the figure, the system security scanning method first discovers the newly added domain names or IP addresses through external black box detection technology or internal fuxi system work order docking. Then, these newly added domain names or IP addresses are sent to the scheduled task detection resource online module for further processing; in this module, it will first determine whether the network status of these newly added domain names or IP addresses is online. Only when the newly added resources are confirmed to be online will the next step of operation be performed.

[0107] After confirming that the newly added resources are online, the system will periodically identify the protocol types used by these resources and obtain the corresponding page content. The obtained resource protocols and page content will be further stored, including HTTP content and the parameter length of the return request parameters. Based on the collected information, the system will determine whether there is a page change through multi-dimensional message content analysis. If it is confirmed that there is a page change, it means that the page corresponding to the newly added resource is valid, then the system will call the multi-level scanner plug-in to perform in-depth scanning and processing on these new resources.

[0108] After the scanning process is completed, the scanning results will be recorded and stored in the scanning records. By analyzing these scanning records, the system can identify potential security vulnerabilities. Once a security vulnerability is found, the system will follow up and handle the vulnerability through the SOC (Security Operations Center) system to ensure that appropriate security measures are taken in time to deal with these vulnerabilities, thereby ensuring the security and stability of the entire system.

[0109] Figure 4 A schematic diagram of the steps of multi-dimensional content recognition provided in an embodiment of the present application, such as Figure 4 As shown, in the process of multi-dimensional content identification of new resources, first determine whether the page corresponding to the new resource is a company standard return page. If it is a return page, there is no need to follow up on the page, and directly determine that the page corresponding to the new resource is an invalid page;

[0110] If the page corresponding to the newly added resource is a non-return page, the parameter length of the request parameter corresponding to the page is judged. In this embodiment, the payload length is judged, and the richness of the page content is determined by judging the payload length. If the length requirement is met, the corresponding page is a valid page. If the length requirement is not met, it is determined whether there is a js page rendering for the page. If the length requirement is not met but there is no js page rendering, the page is also a valid page; if the length requirement is not met but there is js page rendering, the page is an invalid page; through the above analysis of the return page, parameter length and rendering situation, the valid page corresponding to the newly added resource is determined, and the resources corresponding to the valid page are security scanned to achieve targeted and efficient scanning.

[0111] In this embodiment, when the page corresponding to the newly added resource is a non-return page, it is necessary to make a detailed judgment on the request parameters corresponding to the page. Specifically, the length of the payload is checked to evaluate the richness of the page content. If the length of the payload meets certain requirements, the corresponding page can be considered valid. However, if the length of the payload does not meet the requirements, it is necessary to further analyze whether there is JavaScript page rendering on the page; if there is no JavaScript page rendering on the page when the payload length does not meet the requirements, the page is considered a valid page. On the contrary, if there is JavaScript page rendering on the page when the payload length does not meet the requirements, the page is judged as an invalid page.

[0112] Through comprehensive analysis of the returned page, parameter length, and page rendering, we can determine the valid page corresponding to the newly added resources and perform a security scan on the resources corresponding to the valid page. In this way, we can ensure that the scanning process is targeted and efficient, thereby improving overall security.

[0113] In this embodiment, the multi-dimensional content recognition technology is not limited to the analysis of page content, but also includes a comprehensive evaluation of other attributes of the newly added resources; for example, the system will check whether the domain name of the newly added resource complies with the company's domain name policy and whether the IP address belongs to a trusted IP segment. In addition, the system will also analyze the geographic location of the newly added resources to ensure that the source of the resources is legal and safe.

[0114] In addition, the system security scanning method also includes real-time monitoring and alarm mechanisms for scanning results. Once a new resource is found to have a security vulnerability or other abnormal situation, the system will immediately generate an alarm message and notify the relevant security managers through email, SMS, instant messaging and other methods, so as to ensure that security issues can be responded to and handled in a timely manner, thereby reducing security risks.

[0115] The system security scanning method provided in this embodiment realizes comprehensive, efficient and secure scanning and processing of new resources through technical means such as internal and external monitoring, multi-dimensional content recognition, machine learning optimization, real-time monitoring and alarm. Through this comprehensive security scanning method, the stable operation of the network system can be ensured, and the secure transmission of data can be guaranteed, thereby providing users with a safe and reliable network environment.

[0116] Figure 5 A schematic diagram of the structure of a system security scanning device provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the device specifically includes:

[0117] Resource acquisition module 501, used to acquire new resources in the system, the new resources including new domain names and new IP addresses;

[0118] The network status acquisition module 502 is used to respond to the system security scan request and acquire the network status of the newly added resource;

[0119] A judgment module 503 is used to judge whether a target page corresponding to the newly added resource is a valid page when the network status of the newly added resource is online;

[0120] The security scanning module 504 is used to perform a security scanning process on the newly added resources corresponding to the target page when the target page is a valid page.

[0121] In one possible implementation, the judgment module 503 is also used to judge whether the target page corresponding to the newly added resource is a return page; when the target page corresponding to the newly added resource is a non-return page, judge whether the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement; when the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the newly added resource is a valid page; when the parameter length of the request parameter does not meet the preset parameter length requirement, judge whether the target page passes page rendering through the network protocol corresponding to the newly added resource; when the target page does not pass page rendering, the target page corresponding to the newly added resource is a valid page.

[0122] In one possible implementation, the security scanning module 504 is also used to, when the target page corresponding to the newly added resource meets a preset invalidity condition, the target page corresponding to the newly added resource is an invalid page; the preset invalidity condition is that the target page is a return page, or the target page is rendered through the page; and stop the security scanning processing of the invalid page.

[0123] In a possible implementation, the network status acquisition module 502 is also used to obtain the network protocol corresponding to the newly added resource; use the network protocol to obtain the target page corresponding to the newly added resource, and in the process of obtaining the target page corresponding to the newly added resource, obtain the parameter length of the request parameter corresponding to the target page.

[0124] In a possible implementation, the security scanning module 504 is further configured to, when the target page corresponding to the newly added resource is an invalid page, reacquire the target page corresponding to the newly added resource according to a preset protocol recognition cycle, and determine whether the target page is a valid page.

[0125] In a possible implementation manner, the judgment module 503 is further configured to, when the network status of the newly added resource is offline, re-execute the step of obtaining the network status of the newly added resource according to a preset detection cycle.

[0126] In a possible implementation, the resource acquisition module 501 is also used to detect and process the system using a network protocol to obtain new domain names and new IP addresses in the system; or, to dock the system using a system work order to obtain new domain names and new IP addresses in the system.

[0127] The system security scanning device provided in this embodiment can be as follows Figure 5 The system security scanning device shown in can be executed as follows Figure 1-4 All steps of system security scanning in Figure 1-4 The technical effect of the system security scan is shown. For details, please refer to Figure 1-4 For the sake of brevity, the relevant description is not repeated here.

[0128] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0129] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, an embodiment of the present application provides an electronic device, including a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604; the memory 603 is used to store computer programs; the processor 601 is used to execute the program stored in the memory 603, and implement the steps of the system security scanning method provided by any of the above method embodiments:

[0130] Acquire new resources in the system, the new resources including new domain names and new IP addresses; respond to system security scan requests to acquire the network status of the new resources; when the network status of the new resources is online, determine whether a target page corresponding to the new resources is a valid page; when the target page is a valid page, perform security scanning on the new resources corresponding to the target page.

[0131] In one possible implementation, determine whether the target page corresponding to the newly added resource is a return page; if the target page corresponding to the newly added resource is a non-return page, determine whether the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement; if the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the newly added resource is a valid page; if the parameter length of the request parameter does not meet the preset parameter length requirement, determine whether the target page passes page rendering through the network protocol corresponding to the newly added resource; if the target page does not pass page rendering, the target page corresponding to the newly added resource is a valid page.

[0132] In one possible implementation, when the target page corresponding to the newly added resource meets a preset invalidity condition, the target page corresponding to the newly added resource is an invalid page; the preset invalidity condition is that the target page is a return page, or the target page is rendered through the page; and the security scanning process of the invalid page is stopped.

[0133] In a possible implementation, a network protocol corresponding to the newly added resource is obtained; a target page corresponding to the newly added resource is obtained using the network protocol, and in the process of obtaining the target page corresponding to the newly added resource, a parameter length of a request parameter corresponding to the target page is obtained.

[0134] In a possible implementation, when the target page corresponding to the newly added resource is an invalid page, the target page corresponding to the newly added resource is reacquired according to a preset protocol recognition cycle, and it is determined whether the target page is a valid page.

[0135] In a possible implementation manner, when the network status of the newly added resource is offline, the step of obtaining the network status of the newly added resource is re-executed according to a preset detection period.

[0136] In one possible implementation, the system is detected and processed using a network protocol to obtain newly added domain names and newly added IP addresses in the system; or, the system is docked and processed using a system work order to obtain newly added domain names and newly added IP addresses in the system.

[0137] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0138] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0139] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A system security scanning method, characterized in that: include: Acquire new resources in the system, the new resources including new domain names and new IP addresses; In response to a system security scan request, obtaining a network status of the newly added resource; When the network status of the newly added resource is online, determining whether the target page corresponding to the newly added resource is a valid page; When the target page is a valid page, a security scan is performed on the newly added resources corresponding to the target page.

2. The method according to claim 1, characterized in that The determining whether the target page corresponding to the newly added resource is a valid page includes: Determine whether the target page corresponding to the newly added resource is a return page; In the case where the target page corresponding to the newly added resource is a non-return page, determining whether the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement; In the case where the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the newly added resource is a valid page; In the case that the parameter length of the request parameter does not meet the preset parameter length requirement, determining whether the target page is rendered through the network protocol corresponding to the newly added resource; In the case where the target page fails to pass page rendering, the target page corresponding to the newly added resource is a valid page.

3. The method according to claim 2, characterized in that The method further comprises: In the case where the target page corresponding to the newly added resource meets the preset invalid condition, the target page corresponding to the newly added resource is an invalid page; The preset invalid condition is that the target page is a return page, or the target page is rendered by page; Stop the security scanning process of the invalid page.

4. The method according to claim 1, characterized in that: Before determining whether the target page corresponding to the newly added resource is a valid page, the method further includes: Obtaining the network protocol corresponding to the newly added resource; The target page corresponding to the newly added resource is obtained by using the network protocol, and in the process of obtaining the target page corresponding to the newly added resource, the parameter length of the request parameter corresponding to the target page is obtained.

5. The method according to claim 1, characterized in that The method further comprises: In the case that the target page corresponding to the newly added resource is an invalid page, the target page corresponding to the newly added resource is reacquired according to a preset protocol recognition cycle, and it is determined whether the target page is a valid page.

6. The method according to claim 1, characterized in that The method further comprises: When the network status of the newly added resource is offline, the step of obtaining the network status of the newly added resource is re-executed according to a preset detection period.

7. The method according to claim 1, characterized in that The newly added resources in the acquisition system include: Detecting the system using a network protocol to obtain newly added domain names and newly added IP addresses in the system; or, The system is connected using a system work order to obtain a newly added domain name and a newly added IP address in the system.

8. A system security scanning device, characterized in that: include: A resource acquisition module is used to acquire new resources in the system, wherein the new resources include new domain names and new IP addresses; A network status acquisition module, used to obtain the network status of the newly added resource in response to a system security scan request; A judgment module, used for judging whether a target page corresponding to the newly added resource is a valid page when the network status of the newly added resource is online; The security scanning module is used to perform security scanning processing on the newly added resources corresponding to the target page when the target page is a valid page.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the system security scanning method according to any one of claims 1 to 7 are implemented.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the system security scanning method according to any one of claims 1 to 7 are implemented.

Images