System security scanning method and device, electronic equipment and storage medium

Abstract

The application relates to a system security scanning method and device, electronic equipment and a storage medium. An added resource in a system is acquired, the added resource comprising an added domain name and an added IP address. In response to a system security scanning request, the network state of the added resource is acquired. In the case that the network state of the added resource is online, it is determined whether a target page corresponding to the added resource is a valid page. In the case that the target page is a valid page, the added resource corresponding to the target page is subjected to security scanning processing. A vulnerability scan is then initiated in a targeted manner. In the process of the vulnerability scan, a multi-dimensional identification technology is used to analyze the page features of the added resource, a newly online business page is quickly and accurately identified, resource vulnerabilities are quickly determined in the early stage of resource online, system security repair is carried out in a targeted manner, the complication of vulnerability problems is prevented, and the repair difficulty is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of system security, and particularly relates to a system security scanning method and device, electronic equipment and a storage medium. BACKGROUND

[0002] With the rapid development of Internet technology, the business iteration speed of Internet companies is continuously accelerated to adapt to the needs of the market and users. However, this rapid iteration also brings new challenges, especially in system security; the newly online business system often first focuses on the implementation of business functions, and ignores the importance of security protection, which makes the new system after going online easy to become the target of hacker attacks, and thus may face security risks such as key information leakage.

[0003] The external network of the Internet company is widely exposed, and the IP address, port and domain name are frequently updated, which makes security monitoring extremely difficult. The number of monitoring reaches hundreds of thousands to millions, and with the rapid iteration of business systems and the continuous addition of new functions, the emergence and repair of vulnerabilities become more complex.

[0004] Therefore, it is urgent to develop a system security scanning method, device, electronic equipment and storage medium to solve one or more of the above problems. SUMMARY

[0005] In view of this, in order to solve the above technical problems or part of the technical problems, the embodiments of the present application provide a system security scanning method, device, electronic equipment and storage medium.

[0006] In a first aspect, the present application provides a system security scanning method, which comprises:

[0007] Obtaining a newly added resource in a system, wherein the newly added resource comprises a newly added domain name and a newly added IP address;

[0008] In response to a system security scanning request, obtaining a network state of the newly added resource;

[0009] In the case that the network state of the newly added resource is online, determining whether a target page corresponding to the newly added resource is a valid page;

[0010] In the case that the target page is a valid page, performing security scanning processing on the newly added resource corresponding to the target page.

[0011] In one possible implementation, the determination of whether the target page corresponding to the newly added resource is a valid page comprises:

[0012] Determining whether the target page corresponding to the newly added resource is a return page;

[0013] In a case where the target page corresponding to the new resource is a non-return page, it is determined whether a parameter length of a request parameter corresponding to the target page meets a preset parameter length requirement;

[0014] In a case where the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page.

[0015] In a case where the parameter length of the request parameter does not meet the preset parameter length requirement, it is determined whether the target page is rendered by a page through a network protocol corresponding to the new resource.

[0016] In a case where the target page is not rendered by the page, the target page corresponding to the new resource is a valid page.

[0017] In one possible implementation, the method further includes:

[0018] In a case where the target page corresponding to the new resource meets a preset invalid condition, the target page corresponding to the new resource is an invalid page.

[0019] The preset invalid condition is that the target page is a return page or the target page is rendered by a page.

[0020] Stopping a security scanning process of the invalid page.

[0021] In one possible implementation, before the determination of whether the target page corresponding to the new resource is a valid page, the method further includes:

[0022] Obtaining a network protocol corresponding to the new resource;

[0023] Obtaining the target page corresponding to the new resource by using the network protocol, and obtaining a parameter length of a request parameter corresponding to the target page in the process of obtaining the target page corresponding to the new resource.

[0024] In one possible implementation, the method further includes:

[0025] In a case where the target page corresponding to the new resource is an invalid page, re-obtaining the target page corresponding to the new resource according to a preset protocol identification period, and determining whether the target page is a valid page.

[0026] In one possible implementation, the method further includes:

[0027] In a case where the network state of the new resource is offline, re-executing the step of obtaining the network state of the new resource according to a preset detection period.

[0028] In a possible implementation, the newly added resource in the acquisition system includes:

[0029] The system is probed by using a network protocol, and the newly added domain name and the newly added IP address in the system are obtained;

[0030] Alternatively,

[0031] The system is interfaced by using a system work order, and the newly added domain name and the newly added IP address in the system are obtained.

[0032] In a second aspect, the present application provides a system security scanning device, the device comprising:

[0033] A resource acquisition module is configured to acquire a newly added resource in a system, wherein the newly added resource includes a newly added domain name and a newly added IP address;

[0034] A network state acquisition module is configured to acquire a network state of the newly added resource in response to a system security scanning request;

[0035] A judgment module is configured to judge whether a target page corresponding to the newly added resource is a valid page in a case where the network state of the newly added resource is online;

[0036] A security scanning module is configured to perform security scanning processing on the newly added resource corresponding to the target page in a case where the target page is a valid page.

[0037] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the system security scanning method of any one of the embodiments of the first aspect when executing the computer program.

[0038] In a fourth aspect, the present application further provides a computer storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the steps of the system security scanning method of any one of the embodiments of the first aspect.

[0039] Compared with the prior art, the above technical solution provided in the embodiments of the present application has the following advantages: the system security scanning method provided in the embodiments of the present application acquires newly added resources in a system, identifies the newly added resources in time, and includes the newly added resources in a security scanning detection process, acquires the network state of the newly added resources in time, judges whether a business system is online, and then initiates a vulnerability scanning in a targeted manner, analyzes the page features of the newly added resources by using multi-dimensional identification technology in the process of vulnerability scanning, quickly and accurately identifies a newly online business page, determines resource vulnerabilities in an early stage of resource online, performs system security repair in a targeted manner, prevents the complication of vulnerability problems, and thus reduces the repair difficulty. BRIEF DESCRIPTION OF DRAWINGS

[0040] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings required by the embodiments or the prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, other drawings can be obtained based on these drawings without any creative effort.

[0042] One or more embodiments are illustrated by way of example in the drawings that are not intended to be limiting of the application, and the same or similar reference numbers in different drawings represent the same or similar elements unless otherwise stated. The drawings are for purposes of illustrating the exemplary embodiments and are not intended to limit the present application.

[0043] Figure 1 A flowchart of a system security scanning method provided by an embodiment of the present application is shown in the figure;

[0044] Figure 2 A flowchart of a system security scanning method provided by an embodiment of the present application is shown in the figure;

[0045] Figure 3 A flowchart of a system security scanning method provided by an embodiment of the present application is shown in the figure;

[0046] Figure 4 A flowchart of a multi-dimensional content recognition method provided by an embodiment of the present application is shown in the figure;

[0047] Figure 5 A structural diagram of a system security scanning device provided by an embodiment of the present application is shown in the figure;

[0048] Figure 6 A structural diagram of an electronic device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0049] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without any creative effort fall within the protection scope of the present application.

[0050] The following disclosure provides a number of different embodiments or examples for implementing different aspects of the present application. In order to simplify the disclosure of the present application, components and arrangements of specific examples are described below. They are, of course, merely examples and are in no way intended to limit the application. Moreover, the application can be implemented in various examples with differing components and / or arrangements. Such changes, additions, deletions and modifications to the examples are therefore intended to be within the scope of the application.

[0051] In order to solve the problems in the prior art that the Internet company has a wide external network exposure, the IP address, port and domain name are updated frequently, it is difficult to monitor security, the number of orders reaches hundreds of thousands to millions, even if the enterprise internal security team can update the information about the new domain name and IP in time, there is a timeliness problem, which causes delay of business deployment; and the rapid iteration of business systems and the continuous addition of new functions make the emergence and repair of vulnerabilities more complex; and in the process of vulnerability scanning, although the traditional vulnerability scanning tool can identify the newly added domain name, when the business system is not completely deployed, large-scale black box scanning not only has poor effect, but also wastes resources, based on the above technical problems, the present application provides a system security scanning method and device, electronic equipment and storage medium, which can realize targeted initiation of vulnerability scanning, analysis of page characteristics of newly added resources in the process of vulnerability scanning, rapid and accurate identification of newly online business pages, targeted system security repair and prevention of vulnerability problem complexity, thereby reducing the repair difficulty.

[0052] Figure 1 A flowchart of a system security scanning method provided by an embodiment of the present application is shown in FIG. Figure 1 The method specifically includes the following steps.

[0053] S101, acquiring a newly added resource in a system, the newly added resource including a newly added domain name and a newly added IP address.

[0054] In this embodiment, the newly added domain name and IP address information in the system are effectively acquired through external black box detection technology or internal fuxi system work order docking mechanism.

[0055] Specifically, the external black box detection technology can periodically scan and monitor the network environment, timely discover the newly added domain name and IP address, and feed back these information to the system administrator. The internal fuxi system work order docking mechanism allows the system administrator to request the fuxi system to automatically detect and acquire the newly added domain name and IP address information through the submission of a work order. The above two methods can ensure that the system administrator can timely master the newly added domain name and IP address outside and inside the system, thereby better managing and maintaining the system security.

[0056] S102, in response to a system security scanning request, obtaining the network state of the added resource;

[0057] In this embodiment, after obtaining the added resource in the system, a scanning task is periodically started to detect the network state of the added resource, so as to ensure that the network connection of the resource is known in time, effectively monitor and manage the added resource, so that the added resource can work normally, thereby ensuring the stability and reliability of the system.

[0058] S103, in the case that the network state of the added resource is online, judging whether the target page corresponding to the added resource is a valid page;

[0059] In this embodiment, when the system detects that there is an added resource, and judges that the added resource is online, the system will use multi-dimensional recognition technology for further analysis and judgment. Specifically, the added resource is identified and analyzed by a plurality of different parameters and characteristics to determine whether the added resource corresponds to a valid page in the system. Through the judgment process, it is ensured that the system will not waste scanning resources on invalid pages when scanning and processing resources, so that the system can more efficiently utilize its resources, and ensure the accuracy and effectiveness of the scanning and processing process.

[0060] The multi-dimensional recognition technology analyzes the characteristics of the returned content to analyze whether the system page corresponding to the added resource is a valid page. Specifically, the technology can check the characteristics of the Nginx default page or the company standard return page, and use keywords to determine whether there is a business change. Or when encountering a non-keyword recognition situation, the multi-dimensional recognition technology can also evaluate the richness of the page content by analyzing the length of the payload. In addition, it can also assist in judgment by identifying the special case of JavaScript (JS) rendering page; it can quickly and accurately identify the newly online business page, thereby providing strong support for business monitoring and management.

[0061] S104, in the case that the target page is a valid page, performing security scanning processing on the added resource corresponding to the target page.

[0062] In this embodiment, the added resource is subjected to security scanning processing when it is determined that the page corresponding to the added resource is a valid page. The security scanning process includes but is not limited to vulnerability scanning, malicious code detection, and permission verification, etc. Through security scanning, potential security risks of the added resource can be effectively identified and prevented, and the security and reliability of the system can be ensured.

[0063] After obtaining the security scanning result, a security scanning report can be generated according to the security scanning result, and the security scanning report and security repair suggestions are sent to the system administrator, and guidance for repair operation is provided; the repair suggestions include but are not limited to patch installation, configuration modification, permission adjustment, etc., to help the system administrator understand the specific implementation steps of the repair suggestions, ensure the accuracy and effectiveness of the repair process, so as to ensure that the system administrator can quickly take measures according to the report content and repair the discovered security vulnerabilities in time.

[0064] After the system administrator completes the security repair, the security scanning is performed again to verify the repair effect; by comparing the scanning results before and after the repair, the system can evaluate the effectiveness of the repair measures, and ensure that all potential security problems have been properly solved, if new security problems are found in the verification process, the system will restart the repair process until the system security reaches the expected standard.

[0065] The system security scanning method provided in the embodiment can quickly identify the existence of the newly added resources by monitoring and obtaining the newly added resource information in the system in real time, and as soon as the newly added resources are detected, the system will immediately include them in the detection process of the security scanning, to ensure that these resources can be timely evaluated for security, and then the system will monitor and obtain the network state information of the newly added resources in real time, so as to determine whether the business system has been successfully put online; once it is confirmed that the business system has been put online, the system will initiate a vulnerability scan in a targeted manner, to ensure that potential security vulnerabilities can be found in the early stage of the resource going online; in the process of the vulnerability scan, the system uses multi-dimensional identification technology to analyze the page features of the newly added resources, which can quickly and accurately identify the newly online business pages, so that the deployment of the security scanning is more efficient. Through the above scanning mode, the system can quickly determine the potential vulnerabilities of the resources in the early stage of the resource going online, and perform system security repair in a targeted manner, to avoid the vulnerabilities becoming more complex over time, effectively prevent the complication of the vulnerabilities, thereby reducing the difficulty of vulnerability repair, improving the security of the entire system, and ensuring the stable operation of the business.

[0066] Figure 2 A flowchart of a system security scanning method provided in the embodiment of the present application is shown in Figure 2 The method specifically includes:

[0067] S201, determining whether the target page corresponding to the newly added resource is a return page;

[0068] The return page in the business system is used to return some information, and does not provide actual content or function; therefore, in the process of determining whether the target page corresponding to the newly added resource is a valid page, it is first determined whether the target page is a return page, to avoid wasting resources on pages without actual business value.

[0069] In this embodiment, the system administrator can set specific rules to identify the return page. For example, the return page usually has a specific URL pattern, return status code or return content format. By analyzing these characteristics, the system can effectively identify the return page, thereby avoiding unnecessary security scanning of these pages.

[0070] S202, in the case that the target page corresponding to the new resource is a non-return page, it is judged whether the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement;

[0071] S203, in the case that the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page;

[0072] In this embodiment, when the target page is a non-return page, that is, the target page is a page actually participating in the business process, in order to further confirm the validity of the target page, the length of the request parameter is judged in the process of obtaining the target page, and the richness of the page content is assisted by judging the parameter length of the request parameter;

[0073] Specifically, by the parameter length evaluation method, it is evaluated whether the target page meets the expected valid page standard; it is checked whether the length of the request parameter is within a reasonable range, so as to judge whether the target page is valid. If the parameter length meets the expectation, the page is a valid business page; otherwise, if the parameter length is abnormal, the page is a non-valid business page.

[0074] S204, in the case that the parameter length of the request parameter does not meet the preset parameter length requirement, it is judged whether the target page is rendered by the network protocol corresponding to the new resource;

[0075] S205, in the case that the target page is not rendered by the page, the target page corresponding to the new resource is a valid page.

[0076] In this embodiment, in the case that the parameter length of the target page request parameter meets the preset parameter length requirement, it is further judged whether the target page is rendered by the page, so as to ensure the richness and validity of the page content. Page rendering usually involves technologies such as JavaScript, which is used to dynamically generate page content; by analyzing the network protocol, the system can judge whether the target page is generated by the page rendering technology; if the target page is not rendered by the page, that is, the page content is static, the page can be considered as a valid page.

[0077] After confirming that the target page is a valid page, the system will perform a security scan on the new resource, including vulnerability scanning, malicious code detection, and permission verification, etc. Through these scanning processes, the system can comprehensively evaluate the security status of the new resource, ensuring system security and reliability.

[0078] The system security scanning method provided in this embodiment can identify resource protocols and page content through a timing task under the online condition of the new resource, store the length of the http content and the return parameter, determine whether there is a change in the multi-dimensional recognition of the message content through the length of the http content and the return parameter, i.e., determine whether the page is a valid page through return page judgment, payload length judgment, and js page rendering judgment, and in the case where the page of the new resource is determined to be a valid page in the presence of changes, call a multi-level scanner plug-in to perform page scanning. The method can quickly identify the newly online valid business page, thereby performing security scanning deployment on the valid page and providing security scanning efficiency.

[0079] In an optional scheme of the embodiment of the application, the method further comprises:

[0080] In the case where the target page corresponding to the new resource meets a preset invalid condition, the target page corresponding to the new resource is an invalid page.

[0081] The preset invalid condition is that the target page is a return page or the target page is rendered by a page.

[0082] Stop the security scanning process of the invalid page.

[0083] In this embodiment, when the target page corresponding to the new resource fails to meet the preset valid condition, i.e., the target page fails to meet the predetermined standard or requirement, the target page corresponding to the new resource will be regarded as an invalid page. In this case, the system will immediately stop further security scanning process on the invalid page, ensuring the rationality and security of resource allocation, and avoiding unnecessary resource waste and potential security risks on the invalid page. In this way, the system can more efficiently utilize resources, ensuring that only the pages meeting the valid condition will be subjected to further security check, thereby improving the overall security and resource utilization efficiency.

[0084] In an optional scheme of the embodiment of the application, before judging whether the target page corresponding to the new resource is a valid page, the method further comprises:

[0085] Obtain the network protocol corresponding to the new resource.

[0086] The network protocol is used to obtain the target page corresponding to the new resource, and in the process of obtaining the target page corresponding to the new resource, the parameter length of the request parameter corresponding to the target page is obtained.

[0087] In this embodiment, the network protocol corresponding to the new resource is analyzed to determine whether it conforms to the protocol type supported by the business system.

[0088] Specifically, in order to ensure the compatibility and security of the new resource, the system first analyzes the network protocol used by the new resource. The business system usually supports specific protocol types, such as HTTP, HTTPS, FTP, etc. By analyzing the network protocol of the new resource, the system can determine whether it conforms to the protocol type supported by the business system. If the protocol used by the new resource is no longer supported in the list, the resource may not work properly or there may be security risks, so it can be considered as an invalid resource.

[0089] In order to further confirm the validity of the new resource, the system will analyze the URL pattern of the new resource, which usually contains path, query parameters and other information. By analyzing these information, the system can determine whether the new resource conforms to the URL specification of the business system; if the URL pattern does not conform to the specification, the resource may not be able to be accessed normally or there may be potential security problems, so it can be considered as an invalid resource. In the case where the URL pattern of the new resource conforms to the business system specification, it is determined whether the new resource has access permission.

[0090] By using the above-mentioned network protocol, the target page corresponding to the new resource can be successfully obtained, and in the process of obtaining the target page corresponding to the new resource, the parameter length of the request parameter corresponding to the target page is obtained.

[0091] In an optional scheme of the embodiment of the application, the method further comprises:

[0092] In the case where the target page corresponding to the new resource is an invalid page, the target page corresponding to the new resource is reacquired according to a preset protocol identification period, and it is determined whether the target page is a valid page.

[0093] In this embodiment, in the case where the target page corresponding to the new resource is identified as an invalid page, the system will automatically reacquire the target page corresponding to the new resource according to the pre-set protocol identification period, and then the system will judge the reacquired target page to determine whether it is a valid page.

[0094] After confirming that the target page is a valid page, the newly added resource is subjected to security scanning processes such as vulnerability scanning, malicious code detection, and permission verification. The security scanning process of the valid page is a key step to ensure system security. Vulnerability scanning can discover potential security vulnerabilities, malicious code detection can identify and remove possible malicious code, and permission verification can ensure that the access permissions of the resource are correctly set to prevent unauthorized access. Through the periodic detection and security scanning of newly added resources, the system can timely discover and handle the security risks of newly added resources, thereby ensuring the stable operation of the entire business system.

[0095] In an optional scheme of the embodiment of the present application, the method further comprises:

[0096] In the case where the network state of the newly added resource is offline, the step of obtaining the network state of the newly added resource is re-executed according to a preset detection period.

[0097] In the embodiment, in the case where the network state of the newly added resource is offline, the system will re-execute the step of obtaining the network state of the newly added resource according to a preset detection period.

[0098] Specifically, when it is detected that the network connection state of the newly added resource is offline, the system will not immediately give up trying, but will periodically perform detection according to a preset time interval. This detection period can be fixed or dynamically adjusted to adapt to different network environments and needs. In this way, the system can continuously monitor the network state of the resource when it is offline, and once the network is restored to normal, the system will be able to timely discover and perform corresponding processing, thereby ensuring the availability of the resource and the stability of the system.

[0099] In an optional scheme of the embodiment of the present application, the newly added resource in the system comprises:

[0100] The system is subjected to detection processing using a network protocol to obtain the newly added domain name and the newly added IP address in the system;

[0101] Alternatively,

[0102] The system is subjected to interfacing processing using a system work order to obtain the newly added domain name and the newly added IP address in the system.

[0103] In the embodiment, the newly added resource comprises a newly added domain name / IP of an external system and a newly added domain name / IP of an internal system;

[0104] Specifically, the external system uses black box detection to add domain names / IP, and the internal system uses fuxi system work order to interface to find new domain names / IP. The external system uses black box detection technology to identify and discover new domain names and IP addresses. Specifically, network changes are detected by simulating network requests and responses. In this way, the system can discover new resources in the external network environment in a timely manner, ensuring timely updating and synchronization of the business system. The internal system interfaces with the work order system to obtain new domain names and IP addresses. The work order system records all changes and additions of internal resources. Through the interface with the work order system, the system can obtain the latest information of internal resources in real time, ensuring the accuracy and integrity of internal resources.

[0105] The new resource monitoring method provided by the embodiment includes internal monitoring and external monitoring. Internal monitoring is mainly responsible for real-time monitoring and management of internal resources of the system, ensuring reasonable allocation and use of resources, preventing abuse and waste of internal resources. External monitoring is mainly responsible for timely discovery and integration of external new resources, ensuring that these resources can be quickly and effectively integrated into the entire network system, thereby improving the overall performance and reliability of the network. Through this dual mechanism, whether internal or external system new resources can be captured and managed in a timely and accurate manner, maintaining high stability and security, ensuring normal operation of the network and safe transmission of data.

[0106] Figure 3 A system security scanning method provided by the embodiment of the present application is shown in the step schematic diagram as Figure 3 The system security scanning method first discovers new domain names or IP addresses through external black box detection technology or internal fuxi system work order interface. Then, the new domain names or IP addresses are sent to the timing task detection resource online module for further processing. In this module, it is first determined whether the network status of the new domain names or IP addresses is online. Only when the new resources are confirmed to be online, the next step will be performed.

[0107] After confirming that the new resources are online, the system will identify the protocol type used by these resources and obtain the corresponding page content. The obtained resource protocol and page content will be further stored, including HTTP content and the parameter length of the returned request parameter. Based on the collected information, the system will analyze the message content in multiple dimensions to determine whether there is a page change. If it is confirmed that there is a page change, it means that the page corresponding to the new resource is valid. Then the system will call the multi-level scanner plug-in to perform in-depth scanning of the new resources.

[0108] After the scanning process is completed, the scanning results are recorded and stored in the scanning records. By analyzing these scanning records, the system can identify potential security vulnerabilities. Once a security vulnerability is found, the system will follow up and handle the vulnerability through the SOC (Security Operations Center) system, ensuring that appropriate security measures are taken in a timely manner to address these vulnerabilities, thereby ensuring the security and stability of the entire system.

[0109] Figure 4 The steps of the multi-dimensional content identification provided in the embodiments of the present application are shown in the schematic diagram as shown in the figure. Figure 4 In the process of adding resources for multi-dimensional content identification, it is first determined whether the page corresponding to the added resource is a company standard return page. If it is a return page, no further follow-up is required for the page, and the page corresponding to the added resource is directly determined to be an invalid page.

[0110] If the page corresponding to the added resource is a non-return page, the parameter length of the request parameter corresponding to the page is determined. In this embodiment, the payload length is determined to determine the richness of the page content. If the length requirement is met, the corresponding page is a valid page. If the length requirement is not met, it is determined whether the page exists js page rendering. If the length requirement is not met but there is no js page rendering, the page is also a valid page. If the length requirement is not met but there is js page rendering, the page is an invalid page. Through the above analysis of the return page, the parameter length, and the rendering condition, the valid page corresponding to the added resource is determined, and the resource corresponding to the valid page is scanned to realize the pertinence and efficiency of the scanning.

[0111] In this embodiment, when the page corresponding to the added resource is a non-return page, the request parameter corresponding to the page needs to be judged in detail. Specifically, the length of the payload is checked to evaluate the richness of the page content. If the length of the payload meets certain requirements, the corresponding page is considered to be valid. However, if the length of the payload does not meet the requirements, it is further analyzed whether the page exists JavaScript page rendering. If the page does not exist JavaScript page rendering under the condition that the length of the payload does not meet the requirements, the page is considered to be valid. On the contrary, if the page exists JavaScript page rendering under the condition that the length of the payload does not meet the requirements, the page is determined to be invalid.

[0112] By comprehensively analyzing the returned page, parameter length, and page rendering, the effective page corresponding to the added resource can be determined, and the resource corresponding to the effective page is scanned for security; in this way, the scanning process is targeted and efficient, thereby improving the overall security.

[0113] In this embodiment, the multi-dimensional content recognition technology is not limited to analyzing the page content, but also includes comprehensive evaluation of other attributes of the added resource; for example, the system checks whether the domain name of the added resource conforms to the domain name policy of the company, and whether the IP address belongs to a trusted IP segment. In addition, the system also analyzes the geographic location of the added resource to ensure that the source of the resource is legal and safe.

[0114] In addition, the system security scanning method also includes real-time monitoring and alarm mechanism for the scanning results. Once it is found that the added resource has security vulnerabilities or other abnormal conditions, the system will immediately generate an alarm information and notify the relevant security management personnel through email, SMS, instant messaging and other ways, so that the security problem can be responded and handled in time, thereby reducing the security risk.

[0115] The system security scanning method provided in this embodiment realizes comprehensive, efficient and safe scanning and processing of the added resource through internal and external monitoring, multi-dimensional content recognition, machine learning optimization, real-time monitoring and alarm, etc. Through this comprehensive security scanning method, the stable operation of the network system can be ensured, the safe transmission of data can be ensured, and a safe and reliable network environment can be provided for users.

[0116] Figure 5 A structural schematic diagram of a system security scanning device provided in an embodiment of the present application is shown in Figure 5 The device specifically includes:

[0117] The resource acquisition module 501 is configured to acquire the added resource in the system, and the added resource includes an added domain name and an added IP address.

[0118] The network state acquisition module 502 is configured to acquire the network state of the added resource in response to a system security scanning request.

[0119] The judgment module 503 is configured to determine whether the target page corresponding to the added resource is an effective page when the network state of the added resource is online.

[0120] The security scanning module 504 is configured to perform security scanning on the added resource corresponding to the target page when the target page is an effective page.

[0121] In a possible implementation, the judging module 503 is further configured to determine whether the target page corresponding to the new resource is a return page; in the case where the target page corresponding to the new resource is not a return page, determine whether the parameter length of the request parameter corresponding to the target page meets a preset parameter length requirement; in the case where the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page; in the case where the parameter length of the request parameter does not meet the preset parameter length requirement, determine whether the target page is rendered by a page by using a network protocol corresponding to the new resource; in the case where the target page is not rendered by a page, the target page corresponding to the new resource is a valid page.

[0122] In a possible implementation, the security scanning module 504 is further configured to, in the case where the target page corresponding to the new resource meets a preset invalid condition, determine that the target page corresponding to the new resource is an invalid page; the preset invalid condition is that the target page is a return page or the target page is rendered by a page; and stop the security scanning process of the invalid page.

[0123] In a possible implementation, the network state obtaining module 502 is further configured to obtain a network protocol corresponding to the new resource; obtain the target page corresponding to the new resource by using the network protocol, and obtain the parameter length of the request parameter corresponding to the target page in the process of obtaining the target page corresponding to the new resource.

[0124] In a possible implementation, the security scanning module 504 is further configured to, in the case where the target page corresponding to the new resource is an invalid page, reobtain the target page corresponding to the new resource according to a preset protocol identification period, and determine whether the target page is a valid page.

[0125] In a possible implementation, the judging module 503 is further configured to, in the case where the network state of the new resource is offline, reexecute the step of obtaining the network state of the new resource according to a preset detection period.

[0126] In a possible implementation, the resource obtaining module 501 is further configured to perform a detection process on a system by using a network protocol, to obtain a new domain name and a new IP address in the system; or perform an interfacing process on the system by using a system work order, to obtain the new domain name and the new IP address in the system.

[0127] The system security scanning apparatus provided in the embodiment can be a system security scanning apparatus as shown in Figure 5 , and can perform all steps of system security scanning as shown in Figures 1-4 , and thus the system security scanning apparatus canFigures 1-4 The technical effects of the system security scanning are specifically described with reference to Figures 1-4 For brevity, the related descriptions are not repeated here.

[0128] The apparatus embodiments described above are merely illustrative, wherein the units shown as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment.

[0129] Figure 6 A structural schematic diagram of an electronic device provided by the embodiment of the present application is shown in Figure 6 The embodiment of the present application provides an electronic device, which comprises a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602 and the memory 603 complete mutual communication through the communication bus 604; the memory 603 is used for storing a computer program; the processor 601 is used for executing the program stored on the memory 603 to realize the steps of the system security scanning method provided by any one of the method embodiments:

[0130] Obtaining a new resource in a system, the new resource comprising a new domain name and a new IP address; in response to a system security scanning request, obtaining a network state of the new resource; in a case where the network state of the new resource is online, judging whether a target page corresponding to the new resource is a valid page; in a case where the target page is a valid page, performing security scanning processing on the new resource corresponding to the target page.

[0131] In one possible implementation, it is judged whether the target page corresponding to the new resource is a return page; in a case where the target page corresponding to the new resource is a non-return page, it is judged whether a parameter length of a request parameter corresponding to the target page meets a preset parameter length requirement; in a case where the parameter length of the request parameter meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page; in a case where the parameter length of the request parameter does not meet the preset parameter length requirement, it is judged whether the target page is rendered by a page through a network protocol corresponding to the new resource; in a case where the target page is not rendered by the page, the target page corresponding to the new resource is a valid page.

[0132] In a possible implementation, in a case where the target page corresponding to the new resource satisfies a preset invalid condition, the target page corresponding to the new resource is an invalid page; the preset invalid condition is that the target page is a return page or the target page is rendered by a page; and the security scanning process of the invalid page is stopped.

[0133] In a possible implementation, a network protocol corresponding to the new resource is acquired; a target page corresponding to the new resource is acquired by using the network protocol, and in the process of acquiring the target page corresponding to the new resource, a parameter length of a request parameter corresponding to the target page is acquired.

[0134] In a possible implementation, in a case where the target page corresponding to the new resource is an invalid page, the target page corresponding to the new resource is reacquired according to a preset protocol identification period, and it is determined whether the target page is a valid page.

[0135] In a possible implementation, in a case where the network state of the new resource is offline, the step of acquiring the network state of the new resource is re-executed according to a preset detection period.

[0136] In a possible implementation, a system is detected by using a network protocol, to obtain a new domain name and a new IP address in the system; or the system is interfaced by using a system work order, to obtain the new domain name and the new IP address in the system.

[0137] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions essentially or in other words, the part that contributes to the related art can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0138] It is to be understood that the terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The terms "comprises", "comprising", "includes", "including" and "has" are inclusive and therefore specify the presence of stated features, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof. The method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order

[0139] The above description is merely that of the specific embodiments of the application and as such is not to be taken in a limiting sense. Various modifications and alterations of the embodiments described herein will become apparent to those skilled in the art from the foregoing description, which does not limit the generality presented. It is the intention that all such modifications and alterations be considered equaliy by the spirit and scope of this application. It is therefore intended to cover in the appended claims all such changes and alterations that come within the scope of this application.

Claims

1. A system security scanning method, characterized by, The method comprises the following steps: acquiring a new resource in a system, wherein the new resource comprises a new domain name and a new IP address; in response to a system security scanning request, acquiring a network state of the new resource; in a case where the network state of the new resource is online, determining whether a target page corresponding to the new resource is a valid page; the step of determining whether the target page corresponding to the new resource is a valid page comprises the following steps: determining whether the target page corresponding to the new resource is a return page; in a case where the target page corresponding to the new resource is not a return page, determining whether a parameter length of a request parameter corresponding to the target page meets a preset parameter length requirement; in a case where the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page; in a case where the parameter length of the request parameter does not meet the preset parameter length requirement, determining whether the target page is rendered by a page through a network protocol corresponding to the new resource; in a case where the target page is not rendered by the page, the target page corresponding to the new resource is a valid page; in a case where the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page, which comprises a case where a parameter length of a payload meets a preset parameter length requirement, wherein the parameter length of the payload is used to evaluate the richness of page content; in a case where the target page is a valid page, performing a security scanning process on the new resource corresponding to the target page.

2. The method of claim 1, wherein, The method further comprises the following steps: in a case where the target page corresponding to the new resource meets a preset invalid condition, the target page corresponding to the new resource is an invalid page; the preset invalid condition is that the target page is a return page or the target page is rendered by a page; stopping the security scanning process of the invalid page.

3. The method of claim 1, wherein, Before the step of determining whether the target page corresponding to the new resource is a valid page, the method further comprises the following steps: acquiring a network protocol corresponding to the new resource; acquiring the target page corresponding to the new resource by using the network protocol, and acquiring a parameter length of a request parameter corresponding to the target page in the process of acquiring the target page corresponding to the new resource.

4. The method of claim 1, wherein, The method further comprises the following steps: in a case where the target page corresponding to the new resource is an invalid page, reacquiring the target page corresponding to the new resource according to a preset protocol identification period, and determining whether the target page is a valid page.

5. The method of claim 1, wherein, The method further comprises the following steps: in a case where the network state of the new resource is offline, re-executing the step of acquiring the network state of the new resource according to a preset detection period.

6. The method of claim 1, wherein, The step of acquiring the new resource in the system comprises the following steps: performing a detection process on the system by using a network protocol, and obtaining the new domain name and the new IP address in the system; or performing an interfacing process on the system by using a system work order, and obtaining the new domain name and the new IP address in the system.

7. A system security scanning apparatus, characterized by comprising: The method comprises the following steps: The resource acquisition module is configured to acquire a new resource in a system, wherein the new resource comprises a new domain name and a new IP address. The network state acquisition module is configured to acquire a network state of the new resource in response to a system security scanning request. The judgment module is configured to judge whether a target page corresponding to the new resource is a valid page when the network state of the new resource is online. The judgment of whether the target page corresponding to the new resource is a valid page comprises: judging whether the target page corresponding to the new resource is a return page; when the target page corresponding to the new resource is not a return page, judging whether a parameter length of a request parameter corresponding to the target page meets a preset parameter length requirement; when the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page; when the parameter length of the request parameter does not meet the preset parameter length requirement, judging whether the target page passes page rendering through a network protocol corresponding to the new resource; when the target page does not pass the page rendering, the target page corresponding to the new resource is a valid page. When the parameter length of the request parameter corresponding to the target page meets the preset parameter length requirement, the target page corresponding to the new resource is a valid page, which comprises: when a parameter length of a payload meets a preset parameter length requirement, the target page corresponding to the new resource is a valid page, wherein the parameter length of the payload is used to evaluate the richness of page content. The security scanning module is configured to perform security scanning processing on the new resource corresponding to the target page when the target page is a valid page.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by the processor to implement the steps of the system security scanning method in any one of claims 1-6.

9. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the steps of the system security scanning method in any one of claims 1-6.

Images