Method, device and equipment for processing component vulnerability misinformation and medium
By automatically parsing and matching component vulnerability scanning reports and secure access control configuration policies, and generating and applying project-level suppression rule files, the problem of inefficient handling of component vulnerability false alarms in the existing technology is solved, and fast and efficient false alarm processing is achieved.
Patent Information
- Application Number
- CN202411770864.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-04
- Publication Date
- 2025-03-14
AI Technical Summary
The prior art is inefficient when handling component vulnerabilities in multiple dimensions, and requires manual copying and pasting of suppression rules into the suppression rule file one by one, which cannot quickly deal with component vulnerabilities.
By parsing the component vulnerability scan report URL, obtaining the pipeline task name and component vulnerability scan report address, parsing the report to obtain the initial vulnerability component, matching the security access control configuration policy to generate a list of vulnerability components, and generating a target project-level suppression rule file based on the list information, which is automatically applied to the pipeline to suppress component vulnerability information.
Without manually copying the suppression rules one by one, it can quickly generate and apply project-level suppression rule files, improving the efficiency of component vulnerability false alarms and reducing the time and energy of manual operations.
Smart Images
Figure CN119622745A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer security technology, and in particular to a method, device, equipment and medium for processing component vulnerability false positives. Background Art
[0002] Component vulnerabilities refer to security defects or errors in third-party components (such as libraries, frameworks, services, etc.) used in the software development process. These component vulnerabilities may lead to security issues such as unauthorized access, data leakage, and denial of service, posing a threat to overall security. Usually, component vulnerabilities need to be detected. During the detection process, the situation where a component that does not have a vulnerability is mistakenly marked as having a vulnerability is called a component vulnerability false positive.
[0003] False positives of component vulnerabilities may cause developers and security personnel to waste time and energy dealing with non-existent vulnerabilities, thus affecting the overall security detection and response efficiency. Therefore, in order to reduce the interference and burden caused by false positives of component vulnerabilities, suppression rules need to be generated.
[0004] Currently, suppression rules are generated for a single dimensional component by manually clicking on the service system page. When there are multiple dimensional component vulnerability false alarms, it is necessary to manually copy the suppression rules one by one and paste them into the suppression rule file. In other words, the efficiency of generating suppression rule files is currently low, and component vulnerability false alarms cannot be processed quickly. Summary of the invention
[0005] The present application provides a method, device, equipment and medium for processing component vulnerability false alarms. When there are multiple component vulnerability false alarms, there is no need to manually copy the suppression rules one by one and paste them into the suppression rule file. The suppression rule file corresponding to the pipeline with component vulnerability false alarms can be quickly generated, thereby improving the processing efficiency of component vulnerability false alarms and improving the R&D processing efficiency to a certain extent.
[0006] In a first aspect, the present application provides a method for processing component vulnerability false positives, the method comprising:
[0007] Parsing the component vulnerability scanning report uniform resource locator URL to obtain a pipeline task name and a component vulnerability scanning report address; the pipeline corresponding to the pipeline task name is the pipeline with component vulnerability false alarms;
[0008] Obtain the component vulnerability scan report according to the component vulnerability scan report address;
[0009] Parsing the component vulnerability scanning report to obtain an initial vulnerable component with a vulnerability;
[0010] Obtaining a security access control configuration policy corresponding to the pipeline with component vulnerability false alarms, wherein the security access control configuration policy is used to characterize the security conditions for terminating the pipeline;
[0011] Matching the initial vulnerability component with the security access control configuration policy to generate a vulnerability component list; the vulnerability component list is used to store component vulnerability information of the target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy;
[0012] According to the component vulnerability information in the vulnerable component list, a target project-level suppression rule file is obtained so that the pipeline suppresses the component vulnerability information configured in the target project-level suppression rule file.
[0013] Optionally, obtaining a target project-level suppression rule file according to the component vulnerability information in the vulnerable component list includes:
[0014] Generate a new project-level suppression rule file according to the component vulnerability information in the vulnerability component list;
[0015] Determine whether there is a project-level suppression rule file with the same name as the pipeline task name in the suppression rule library;
[0016] If there is no project-level suppression rule file with the same name in the suppression rule library, obtaining the target project-level suppression rule file as the newly created project-level suppression rule file;
[0017] If a project-level suppression rule file with the same name exists in the suppression rule library, the newly created project-level suppression rule file is added to the existing project-level suppression rule file to obtain the target project-level suppression rule file.
[0018] Optionally, the method further comprises:
[0019] After the pipeline task that was terminated by the security access control configuration policy is restarted, the pipeline executes component vulnerability scanning to query whether the target project-level suppression rule file exists;
[0020] If the target project-level suppression rule file exists, the assembly line suppresses the component vulnerability information of the organization-level suppression rule file and the component vulnerability information configured in the target project-level suppression rule file;
[0021] If the target project-level suppression rule file does not exist, the pipeline suppresses the component vulnerability information configured in the organization-level suppression rule file.
[0022] Optionally, obtaining the component vulnerability scanning report includes:
[0023] Sending a download request to the pipeline corresponding to the pipeline task name, wherein the download request indicates obtaining the component vulnerability scanning report;
[0024] Download the vulnerability scan report of the component in question.
[0025] Optionally, parsing the component vulnerability scanning report to obtain an initial vulnerability component having a vulnerability includes:
[0026] Parse the component vulnerability scanning report to obtain a json format file of the component vulnerability scanning report;
[0027] The initial vulnerability component is screened out from the json format file, where the initial vulnerability component is a component containing a common platform enumeration CPE or a package uniform resource locator PURL.
[0028] Optionally, matching the initial vulnerability component with the security access control configuration policy to generate a vulnerability component list includes:
[0029] Matching the initial vulnerability component with the security access control configuration policy to obtain the target vulnerability component, where the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy;
[0030] The vulnerable component list is generated according to the component vulnerability information of the target vulnerable component.
[0031] Optionally, the component vulnerability information includes at least one of a component file name, a component version, a CPE, a PURL, and a vulnerability risk level.
[0032] In a second aspect, the present application further provides a device for processing component vulnerability false alarms, the device comprising:
[0033] The first parsing unit is used to parse the component vulnerability scanning report uniform resource locator URL to obtain the pipeline task name and the component vulnerability scanning report address; the pipeline corresponding to the pipeline task name is the pipeline with component vulnerability false alarm;
[0034] An acquisition unit, configured to acquire the component vulnerability scan report according to the component vulnerability scan report address;
[0035] A second parsing unit is used to parse the component vulnerability scanning report to obtain an initial vulnerable component with a vulnerability;
[0036] A first obtaining unit is used to obtain a security access control configuration policy corresponding to the pipeline with component vulnerability false alarm, wherein the security access control configuration policy is used to represent a security condition for terminating the pipeline;
[0037] A matching unit, used to match the initial vulnerability component with the security access control configuration policy to generate a vulnerability component list; the vulnerability component list is used to store component vulnerability information of a target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy;
[0038] The second obtaining unit is used to obtain a target project-level suppression rule file according to the component vulnerability information in the vulnerability component list, so that the pipeline suppresses the component vulnerability information configured in the target project-level suppression rule file.
[0039] Optionally, the second obtaining unit is specifically configured to:
[0040] Generate a new project-level suppression rule file according to the component vulnerability information in the vulnerability component list;
[0041] Determine whether there is a project-level suppression rule file with the same name as the pipeline task name in the suppression rule library;
[0042] If there is no project-level suppression rule file with the same name in the suppression rule library, obtaining the target project-level suppression rule file as the newly created project-level suppression rule file;
[0043] If a project-level suppression rule file with the same name exists in the suppression rule library, the newly created project-level suppression rule file is added to the existing project-level suppression rule file to obtain the target project-level suppression rule file.
[0044] Optionally, the device further comprises an automatic starting unit; the automatic starting unit is used to:
[0045] The pipeline that is suspended by the security access control configuration policy and is transmitted through the pipeline interface is obtained, and the pipeline that is suspended by the security access control configuration policy is restarted.
[0046] Optionally, the acquisition unit is specifically used to:
[0047] Sending a download request to the pipeline corresponding to the pipeline task name, wherein the download request indicates obtaining the component vulnerability scanning report;
[0048] Download the vulnerability scan report of the component in question.
[0049] Optionally, the second parsing unit is specifically used to:
[0050] Parse the component vulnerability scanning report to obtain a json format file of the component vulnerability scanning report;
[0051] The initial vulnerability component is screened out from the json format file, where the initial vulnerability component is a component containing a common platform enumeration CPE or a package uniform resource locator PURL.
[0052] Optionally, the matching unit is specifically used to:
[0053] Matching the initial vulnerability component with the security access control configuration policy to obtain the target vulnerability component, where the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy;
[0054] The vulnerable component list is generated according to the component vulnerability information of the target vulnerable component.
[0055] Optionally, the component vulnerability information includes at least one of a component file name, a component version, a CPE, a PURL, and a vulnerability risk level.
[0056] In a third aspect, the present application further provides an electronic device, the electronic device comprising a processor and a memory:
[0057] The memory is used to store computer programs;
[0058] The processor is used to execute the method provided in the first aspect according to the computer program.
[0059] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method provided in the first aspect above.
[0060] It can be seen that this application has the following beneficial effects:
[0061] The present application provides a method, device, equipment and medium for processing component vulnerability false alarms. In the method, a component vulnerability scanning report uniform resource locator URL is parsed to obtain a pipeline task name and a component vulnerability scanning report address; the pipeline corresponding to the pipeline task name is a pipeline with component vulnerability false alarms; according to the component vulnerability scanning report address, a component vulnerability scanning report is obtained; the component vulnerability scanning report is parsed to obtain an initial vulnerability component with a vulnerability; a security access control configuration policy corresponding to the pipeline with component vulnerability false alarms is obtained, and the security access control configuration policy is used to characterize the security conditions for terminating the pipeline; the initial vulnerability component is matched with the security access control configuration policy to generate a vulnerability component list; the vulnerability component list is used to store component vulnerability information of a target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy; according to the component vulnerability information in the vulnerability component list, a target project-level suppression rule file is obtained, so that the pipeline suppresses the component vulnerability information configured in the target project-level suppression rule file. In this way, first obtain the component vulnerability scanning report URL, you can get the component vulnerability scanning report and the pipeline with component vulnerability false alarms, then, according to the security access control configuration policy corresponding to the pipeline with component vulnerability false alarms, match the target vulnerability component from the initial vulnerability component, and automatically generate the target project-level suppression rule file, that is, there is no need to manually copy the suppression rules one by one and paste them into the suppression rule file. Only provide the component vulnerability scanning report URL corresponding to the pipeline with component vulnerability false alarms, and you can quickly generate the corresponding project-level suppression rule file, so that the pipeline can suppress the component vulnerability information configured in the target project-level suppression rule file, thereby improving the processing efficiency of component vulnerability false alarms and improving the R&D processing efficiency to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS
[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.
[0063] Figure 1 A flowchart of a method for processing component vulnerability false alarms in an embodiment of the present application;
[0064] Figure 2 It is a schematic diagram of the overall framework of the system for processing component vulnerability false alarms in an embodiment of the present application;
[0065] Figure 3 This is a processing sequence diagram of the component vulnerability false alarm processing system in the embodiment of the present application;
[0066] Figure 4A schematic diagram of the structure of a component vulnerability false alarm processing device 400 provided in an embodiment of the present application;
[0067] Figure 5 A schematic diagram of the structure of an electronic device 500 provided in an embodiment of the present application. DETAILED DESCRIPTION
[0068] The multiple involved in the embodiments of the present application means greater than or equal to two. It should be noted that in the description of the embodiments of the present application, the words "first", "second", etc. are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order.
[0069] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings and specific implementation methods. It is understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. In addition, it should be noted that, for ease of description, only the parts related to the present application are shown in the accompanying drawings, not all structures.
[0070] The applicant has found that the processing of component vulnerability false alarms in the prior art is to generate suppression rules for a single dimensional component by manually clicking on the service system page, wherein a single dimensional component is such as a single component or multiple components under a single Common Vulnerabilities & Exposures (CVE) number, and one CVE number covers multiple components, and these components have the same CVE vulnerability. When there are false alarms of vulnerabilities in multiple dimensional components (such as multiple components or multiple CVE numbers), it is necessary to manually copy the suppression rules one by one and paste them into the suppression rule file. That is, the efficiency of generating suppression rule files is currently low, and component vulnerability false alarms cannot be processed quickly.
[0071] Based on this, an embodiment of the present application provides a method, device, equipment and medium for processing component vulnerability false alarms. In the method, a component vulnerability scanning report uniform resource locator (URL) is parsed to obtain a pipeline task name and a component vulnerability scanning report address; the pipeline corresponding to the pipeline task name is a pipeline with component vulnerability false alarms; according to the component vulnerability scanning report address, a component vulnerability scanning report is obtained; the component vulnerability scanning report is parsed to obtain an initial vulnerability component with a vulnerability; a security access control configuration policy corresponding to the pipeline with component vulnerability false alarms is obtained, and the security access control configuration policy is used to characterize the security conditions for terminating the pipeline; the initial vulnerability component is matched with the security access control configuration policy to generate a vulnerability component list; the vulnerability component list is used to store component vulnerability information of the target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy; according to the component vulnerability information in the vulnerability component list, a target project-level suppression rule file is obtained; and the component vulnerability information configured in the target project-level suppression rule file is suppressed.
[0072] In this way, first obtain the component vulnerability scanning report URL, you can get the component vulnerability scanning report and the pipeline with component vulnerability false alarms, then, according to the security access control configuration policy corresponding to the pipeline with component vulnerability false alarms, match the target vulnerability component from the initial vulnerability component, and automatically generate the target project-level suppression rule file, that is, there is no need to manually copy the suppression rules one by one and paste them into the suppression rule file. Only provide the component vulnerability scanning report URL corresponding to the pipeline with component vulnerability false alarms, and you can quickly generate the corresponding project-level suppression rule file, so that the pipeline can suppress the component vulnerability information configured in the target project-level suppression rule file, thereby improving the processing efficiency of component vulnerability false alarms and improving the R&D processing efficiency to a certain extent.
[0073] To facilitate understanding of the specific implementation of a method for processing false positive component vulnerability reports provided in an embodiment of the present application, the following will be described in conjunction with the accompanying drawings.
[0074] It should be noted that the subject of the component vulnerability false alarm processing method can be the component vulnerability false alarm processing device provided in the embodiment of the present application, and the component vulnerability false alarm processing device can be carried in an electronic device or a functional module of an electronic device. The electronic device in the embodiment of the present application can be any device that can implement the component vulnerability false alarm processing method in the embodiment of the present application, for example, it can be a component vulnerability false alarm processing system.
[0075] See also Figure 1 , is a flow chart of a method for processing component vulnerability false alarms in an embodiment of the present application. The method can be applied to a component vulnerability false alarm processing device, and the component vulnerability false alarm processing device can be as follows Figure 4 The processing device 400 for component vulnerability false alarms shown in FIG. 4 is a component vulnerability false alarm processing device, or the component vulnerability false alarm processing device can also be integrated in Figure 5 Functional modules in the electronic device 500 are shown.
[0076] For example, the following steps may be included:
[0077] S1, parse the component vulnerability scan report URL to obtain the pipeline task name and component vulnerability scan report address.
[0078] It should be noted that the pipeline corresponding to the pipeline task name is a pipeline with component vulnerability false alarms, and the component vulnerability scanning report address is used to obtain the component vulnerability scanning report.
[0079] As an example, it is determined that a certain aborted pipeline has a component vulnerability false positive. Assume that the aborted pipeline includes components A, B, and C. Components A, B, and C are all identified as vulnerable components, but components A and C are actually false positives and do not have vulnerabilities. Under normal circumstances, suppression rules for components A and C need to be generated and written into the project-level suppression rule file.
[0080] S2, obtaining a component vulnerability scan report according to the component vulnerability scan report address.
[0081] During the specific implementation process, a query is performed based on the component vulnerability scanning report address to obtain the component vulnerability scanning report.
[0082] In a possible implementation, a query request is sent to the pipeline where the component vulnerability false alarm exists, and the component vulnerability scanning report is downloaded locally.
[0083] S3, parse the component vulnerability scanning report to obtain the initial vulnerable component with vulnerabilities.
[0084] It should be noted that the initial vulnerability component includes at least one component. In the embodiment of the present application, the component vulnerability scanning report is parsed to obtain the vulnerability disposal components including component A, component B and component C.
[0085] In a possible implementation, S3 provided in the embodiment of the present application may include:
[0086] S31, parsing the component vulnerability scanning report to obtain a json format file of the component vulnerability scanning report;
[0087] S32, filter out the initial vulnerability component from the json format file, the initial vulnerability component is a component containing a common platform enumeration (Common Platform Enumeration, CPE) or a package uniform resource locator (Package Uniform Resource Locator, PURL).
[0088] It should be noted that the CPE referred to in the embodiments of the present application refers to the CPE combined with the CVE number, and the PURL refers to the PURL combined with the CVE number, because CPE and PURL alone cannot represent that a component has a vulnerability. When CPE and CVE numbers are combined or PURL and CVE numbers are combined, the component is considered to be an initial vulnerable component that is identified as possibly having a security vulnerability.
[0089] S4, obtain the security access control configuration policy corresponding to the pipeline with component vulnerability false alarm, and the security access control configuration policy is used to represent the security conditions for terminating the pipeline.
[0090] It should be noted that the security conditions for terminating the pipeline may include the Common Vulnerability Scoring System (CVSS) level or CVSS score. The CVSS level and CVSS score are mainly used to mark the vulnerability level, that is, the severity of the vulnerability.
[0091] S5, matches the initial vulnerable components with the security access control configuration policy to generate a vulnerable component list.
[0092] It should be noted that the vulnerability component list is used to store component vulnerability information of a target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy, and the target vulnerability component includes at least one component.
[0093] The component vulnerability information may include at least one of a component file name, a component version, a CPE, a PURL, and a vulnerability risk level.
[0094] As an example, obtain the security access control configuration policy corresponding to the pipeline with component vulnerability false alarms, obtain components A and C among components A, B and C that comply with the security access control configuration policy, that is, components with component vulnerability false alarms, and generate suppression rules for components A and C.
[0095] In a possible implementation, S5 provided in the embodiment of the present application may include:
[0096] S51, matching the initial vulnerability component with the security access control configuration policy to obtain a target vulnerability component, where the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy.
[0097] S52, generating a vulnerable component list according to the component vulnerability information of the target vulnerable component.
[0098] S6, obtaining a target project-level suppression rule file according to the component vulnerability information in the vulnerability component list, so that the pipeline suppresses the component vulnerability information configured in the target project-level suppression rule file.
[0099] In a possible implementation, in an embodiment of the present application, obtaining a target project-level suppression rule file based on component vulnerability information in a vulnerability component list may include: S61, generating a new project-level suppression rule file based on component vulnerability information in the vulnerability component list. S62, determining whether there is a project-level suppression rule file with the same name as the pipeline task name in the suppression rule library. S63, if there is no project-level suppression rule file with the same name in the suppression rule library, obtaining the target project-level suppression rule file as a new project-level suppression rule file. S64, if there is a project-level suppression rule file with the same name in the suppression rule library, adding the new project-level suppression rule file to the existing project-level suppression rule file to obtain the target project-level suppression rule file.
[0100] It should be noted that in order to add project-level suppression rules to the pipeline, the present application stipulates that the pipeline name (that is, the pipeline task name) includes the project name. For example, the pipeline name of the abc system version 1.0 is abc_V1.0+develop. A project-level suppression rule file is generated based on the pipeline name, for example, the project-level suppression rule file is generated as the abc_V1.0-suppressions.xml file.
[0101] In one possible implementation, an embodiment of the present application can automatically start a pipeline that has been terminated by a security policy, that is, after obtaining the target project-level suppression rule file, obtain the pipeline that has been terminated by the security access control configuration policy transmitted through the pipeline interface, and restart the pipeline that has been terminated by the security access control configuration policy.
[0102] In one possible implementation, the embodiment of the present application may also include: after the pipeline task that was terminated by the security access control configuration policy is restarted, the pipeline executes a component vulnerability scan to query whether there is a target project-level suppression rule file; if there is a target project-level suppression rule file, the pipeline suppresses the component vulnerability information of the organization-level suppression rule file and the component vulnerability information configured in the target project-level suppression rule file; if there is no target project-level suppression rule file, the pipeline suppresses the component vulnerability information configured in the organization-level suppression rule file, thereby realizing automated processing of project-level vulnerability false alarms, shortening the processing time from when the pipeline is terminated by the security policy to when it is resumed, improving the processing efficiency of component vulnerability false alarms, and improving R&D processing efficiency while ensuring software development security.
[0103] It should be noted that the organization-level suppression rule file is written after the entire organization is evaluated, and the project-level suppression rule file is written after the entire project is evaluated. In the specific implementation process, the organization-level suppression rule file and the project-level suppression rule file can be stored in the same target location.
[0104] Normally, suppression is multi-level, and each pipeline corresponds to a project-level suppression rule file. All pipelines have their own unique suppression rule files based on the public organization-level suppression rule files. When performing a specific scan, it will check whether there is a project-level suppression rule file A. If so, it will merge the project-level suppression rule file A with the organization-level suppression rule file B, that is, the project-level suppression rule file A + organization-level suppression rule file B will be used during the scan. If there is no project-level suppression rule file A, the organization-level suppression rule file B will be used during the scan.
[0105] According to the above example, the rules in the abc_V1.0-suppressions.xml file and the organization-level suppression rule file will be used for suppression during scanning.
[0106] In this way, through the method for processing component vulnerability false alarms provided in the embodiment of the present application, there is no need to manually copy the suppression rules one by one and paste them into the suppression rule file. Only the component vulnerability scanning report URL corresponding to the pipeline with component vulnerability false alarms is provided, and the corresponding project-level suppression rule file can be quickly generated to suppress the component vulnerability information based on the project-level suppression rule file, thereby improving the processing efficiency of component vulnerability false alarms and improving the R&D processing efficiency to a certain extent.
[0107] In order to make the method provided in the embodiment of the present application clearer and easier to understand, Figure 2 and Figure 3 A specific example of this method is described below. Figure 2 As shown, it is a schematic diagram of the overall framework of the component vulnerability false alarm processing system 20 in the embodiment of the present application, such as Figure 3 As shown, it is a processing timing diagram of a component vulnerability false alarm processing system 20 provided in an embodiment of the present application.
[0108] The component vulnerability false alarm processing device may be, for example, a false alarm processing device 22 in a component vulnerability false alarm processing system 20 . The component vulnerability false alarm processing system 20 includes a third-party system 21 , a false alarm processing device 22 and a database 23 .
[0109] In a possible implementation, the embodiment of the present application can use JAVA language, scripting language JavaScript language and relational database management system (RDBMS) MySQL database to write the false alarm processing device 22, and the false alarm processing device 22 may include a task scheduling module 221, a data parsing module 222, a rule generation module 223 and a file management module 224;
[0110] Among them, the task scheduling module 221 is responsible for receiving, processing, scheduling and interacting with the third-party system 21; the data analysis module 222 is responsible for parsing and filtering false positive vulnerability component information; the rule generation module 223 is responsible for assembling and generating suppression rules, matching rule files, and generating suppression rule files; the file management module 224 is responsible for downloading and uploading files.
[0111] The third-party system 21 may include a business process platform 211 and a continuous integration system 212. The database 23 may include a suppression rule base 231, a memory database 232 and a file database 233. The suppression rule base 231 may include an organization-level rule file repository and a project-level rule file storage, and the file database 233 is used to store received files. The memory database 232 is used to temporarily store data before and after processing, and the suppression rule base 231 is used to store organization-level suppression rule files and project-level suppression rule files.
[0112] In one possible implementation, the continuous integration system is also referred to as a continuous integration pipeline.
[0113] Combine the following Figure 2 The overall framework diagram of the component vulnerability false alarm processing system 20 is provided to illustrate the execution process of the component vulnerability false alarm processing method, which may include the following steps:
[0114] 1. The business process platform 211 sends a component vulnerability false alarm processing request to the task scheduling module 221 .
[0115] 2. The task scheduling module 221 receives the component vulnerability false alarm processing request and sends a request to the continuous integration system 212 to obtain the component vulnerability scanning report of the suspended pipeline.
[0116] 3. The task scheduling module 221 receives the component vulnerability scanning report sent by the continuous integration system 212.
[0117] 4. The file management module 224 downloads the component vulnerability scanning report to the local computer.
[0118] 5. The file management module 224 stores the component vulnerability scanning report in the file database 233 .
[0119] 6. The data analysis module 222 obtains the component vulnerability scanning report from the file database 233.
[0120] 7. The data analysis module 222 analyzes the data of the component vulnerability scanning report.
[0121] 8. The task scheduling module 221 sends a request to the continuous integration system 212 to obtain the security access control configuration policy.
[0122] 9. The task scheduling module 221 receives the security access control configuration policy returned by the continuous integration system 212 .
[0123] 10. The data analysis module 222 screens data that complies with the security access control configuration policy.
[0124] 11. The data analysis module 222 sends the data that complies with the security access control configuration policy to the memory database 232 for temporary storage.
[0125] 12. The data analysis module 222 sends the vulnerability component information to the business process platform 211.
[0126] 13. The task scheduling module 221 obtains the process approval status returned by the business process platform 211.
[0127] 14. The task scheduling module 221 sends a request to generate a suppression rule to the rule generation module 223 .
[0128] 15. The rule generation module 223 generates suppression rules, matches the pipeline name with the suppression rule file in the suppression rule library, and determines whether there is a suppression rule file with the same name to generate a project-level suppression rule file.
[0129] 16. The task scheduling module 221 starts the pipeline that was terminated by the security access control policy so that the pipeline suppresses the component vulnerability information configured in the project-level suppression rule file.
[0130] for Figure 3 , by interacting with the business process platform 211, the continuous integration system 212, and the suppression rule library 231, functions such as automatic generation of project-level suppression rule files are realized, and the timing diagram process is as follows:
[0131] 1. After confirming that there is a false alarm of component vulnerability on the suspended production line, the applicant creates a new application process on the business process platform 211.
[0132] 2. The applicant enters the component vulnerability scan report URL during the application process.
[0133] 3. The applicant clicks the “Get component vulnerability information” button on the business process platform 211 to trigger the false alarm processing device 22 .
[0134] 4. The business process platform 211 sends the pipeline component vulnerability scanning report URL filled in by the applicant to the false alarm processing device 22.
[0135] 5. The false alarm processing device 22 parses the component vulnerability scanning report URL and obtains the pipeline task name and the component vulnerability scanning report address in the database 23.
[0136] 6. The false alarm processing device 22 sends a download request to the continuous integration system 212 to request downloading of the component vulnerability scanning report.
[0137] 7. The false alarm processing device 22 downloads the component vulnerability scanning report to the local computer and parses the json format file.
[0138] 8. The false alarm processing device 22 screens out the component containing the CPE or PURL value and determines that the component is a vulnerable component with a vulnerability.
[0139] 9. The false alarm processing device 22 reads the vulnerability risk level of the vulnerability component with the vulnerability.
[0140] 10. The false alarm processing device 22 sends a request to the continuous integration system 212 to obtain the security access control configuration policy, where the security access control configuration policy represents the security conditions for terminating the pipeline.
[0141] 11. The continuous integration system 212 returns the security access control configuration strategy to the false alarm processing device 22.
[0142] 12. The false alarm processing device 22 analyzes the security access control configuration policy, matches the vulnerability components that comply with the security access control configuration policy, generates a vulnerability component list, parses the json format file and writes the vulnerability component file name, version, CVE number, and vulnerability risk level into the vulnerability component list.
[0143] In a possible implementation, in order to ensure the accuracy of adding suppression rules, a manual approval step can be added, that is, steps 13 to 17 are selectively executed.
[0144] 13. The false alarm processing device 22 returns the list of vulnerable components to the process form.
[0145] 14. The applicant confirms the existence of the component with false vulnerability report according to the process form and enters the explanation information.
[0146] 15. The applicant submits to the security expert for approval.
[0147] 16. The security expert approves and agrees to add suppression rules to the applied pipeline.
[0148] 17. The business process platform 211 sends the approval status to the false alarm processing device 22.
[0149] 18. The false alarm processing device 22 requests the suppression rule library 231 to obtain the suppression rule file name in the suppression rule library 231.
[0150] 19. The false alarm processing device 22 matches the parsed pipeline name with the suppression rule file in the suppression rule library 231 to determine whether there is a suppression rule file with the same name.
[0151] 20. The false alarm processing device 22 generates a project-level suppression rule file in a specific format based on information such as CPE, PURL, component file name, component version, etc.
[0152] Among them, CPE is the CPE associated with the CVE number, and PURL is the CURL associated with the CVE number.
[0153] 21. If there is no file with the same name in the suppression rule library 231, a new complete project-level suppression rule file is created. If there is a file with the same name in the suppression rule library 231, the suppression rules are appended to the existing project-level suppression rule file.
[0154] 22. The false alarm processing device 22 transmits the matched pipeline that is terminated by the security access control configuration policy through the pipeline interface and restarts the pipeline.
[0155] 23. After the pipeline task is restarted, a component vulnerability scan is performed to check whether there is a project-level suppression rule file. If so, the component vulnerability information configured in the organization-level suppression rule file and the component vulnerability information configured in the project-level suppression rule file are suppressed. If not, the component vulnerability information configured in the project-level suppression rule file is suppressed.
[0156] 24. End the process.
[0157] In the embodiments of the present application, on the one hand, the existing business process platform and the continuous integration system are connected to realize the self-service application and self-service addition functions of the project-level component vulnerability suppression rules. The applicant only needs to provide the component vulnerability scan report URL to automatically read the vulnerability data corresponding to the component vulnerability scan report URL and automatically add the suppression rules, which greatly reduces the workload of R&D personnel in checking the review results, manually querying the suppression rules and assembling them in the process of sorting out the component vulnerability false alarm information, and avoids the situation that the review experts cannot be present at the same time during the offline review process; on the other hand, the false alarm processing device is combined with the business process platform, so that the false alarm processing device can process the suppression rule applications of multiple projects in parallel, achieve the effect of parallel application and processing, and further improve the processing efficiency of component vulnerability false alarms; at the same time, the embodiment of the present application is combined with the continuous integration system, and after automatically matching and generating the project-level pipeline suppression rules, it can automatically start the pipeline that is terminated by the security access control configuration policy (that is, the approved pipeline), shorten the processing time from the pipeline being terminated by the security access control configuration policy to the recovery, and improve the R&D processing efficiency while ensuring the safety of software development.
[0158] See also Figure 4 The embodiment of the present application further provides a component vulnerability false alarm processing device 400, the device 400 comprising:
[0159] The first parsing unit 401 is used to parse the component vulnerability scanning report uniform resource locator URL to obtain the pipeline task name and the component vulnerability scanning report address; the pipeline corresponding to the pipeline task name is the pipeline with component vulnerability false alarm;
[0160] An acquisition unit 402 is used to acquire the component vulnerability scan report according to the component vulnerability scan report address;
[0161] The second parsing unit 403 is used to parse the component vulnerability scanning report to obtain an initial vulnerable component with a vulnerability;
[0162] A first obtaining unit 404 is used to obtain a security access control configuration policy corresponding to the pipeline with component vulnerability false alarm, wherein the security access control configuration policy is used to represent a security condition for terminating the pipeline;
[0163] A matching unit 405 is used to match the initial vulnerability component with the security access control configuration policy to generate a vulnerability component list; the vulnerability component list is used to store component vulnerability information of a target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy;
[0164] The second obtaining unit 406 is used to obtain a target project-level suppression rule file according to the component vulnerability information in the vulnerable component list, so that the pipeline suppresses the component vulnerability information configured in the target project-level suppression rule file.
[0165] Optionally, the second obtaining unit 406 is specifically configured to:
[0166] Generate a new project-level suppression rule file according to the component vulnerability information in the vulnerability component list;
[0167] Determine whether there is a project-level suppression rule file with the same name as the pipeline task name in the suppression rule library;
[0168] If there is no project-level suppression rule file with the same name in the suppression rule library, obtaining the target project-level suppression rule file as the newly created project-level suppression rule file;
[0169] If a project-level suppression rule file with the same name exists in the suppression rule library, the newly created project-level suppression rule file is added to the existing project-level suppression rule file to obtain the target project-level suppression rule file.
[0170] Optionally, the device further comprises an automatic starting unit 408; the automatic starting unit 408 is used to:
[0171] The pipeline that is suspended by the security access control configuration policy and is transmitted through the pipeline interface is obtained, and the pipeline that is suspended by the security access control configuration policy is restarted.
[0172] Optionally, the acquiring unit 402 is specifically configured to:
[0173] Sending a download request to the pipeline corresponding to the pipeline task name, wherein the download request indicates obtaining the component vulnerability scanning report;
[0174] Download the vulnerability scan report of the component in question.
[0175] Optionally, the second parsing unit 403 is specifically configured to:
[0176] Parse the component vulnerability scanning report to obtain a json format file of the component vulnerability scanning report;
[0177] The initial vulnerability component is screened out from the json format file, where the initial vulnerability component is a component containing a common platform enumeration CPE or a package uniform resource locator PURL.
[0178] Optionally, the matching unit 405 is specifically configured to:
[0179] Matching the initial vulnerability component with the security access control configuration policy to obtain the target vulnerability component, where the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy;
[0180] The vulnerable component list is generated according to the component vulnerability information of the target vulnerable component.
[0181] Optionally, the component vulnerability information includes at least one of a component file name, a component version, a CPE, a PURL, and a vulnerability risk level.
[0182] It should be noted that the specific implementation method of the device 400 and the technical effects achieved can be found in Figure 1 The relevant description in the method shown.
[0183] In addition, the present application embodiment also provides an electronic device 500, such as Figure 5 As shown, the electronic device 500 includes a processor 501 and a memory 502:
[0184] The memory 502 is used to store computer programs;
[0185] The processor 501 is used to execute according to the computer program Figure 1 The method provided.
[0186] In addition, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method provided by the embodiment of the present application.
[0187] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.
[0188] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device embodiment described above is only schematic, in which the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the goals of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0189] The above is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. It should be noted that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the present application, and these improvements and modifications should also be regarded as the protection scope of the present application.
Claims
1. A method for processing component vulnerability false alarms, characterized in that: The method comprises: Parsing the component vulnerability scanning report uniform resource locator URL to obtain a pipeline task name and a component vulnerability scanning report address; the pipeline corresponding to the pipeline task name is the pipeline with component vulnerability false alarms; Obtain the component vulnerability scan report according to the component vulnerability scan report address; Parsing the component vulnerability scanning report to obtain an initial vulnerable component with a vulnerability; Obtaining a security access control configuration policy corresponding to the pipeline with component vulnerability false alarms, wherein the security access control configuration policy is used to characterize the security conditions for terminating the pipeline; Matching the initial vulnerability component with the security access control configuration policy to generate a vulnerability component list; the vulnerability component list is used to store component vulnerability information of the target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy; According to the component vulnerability information in the vulnerable component list, a target project-level suppression rule file is obtained so that the pipeline suppresses the component vulnerability information configured in the target project-level suppression rule file.
2. The method according to claim 1, characterized in that The obtaining of a target project-level suppression rule file according to the component vulnerability information in the vulnerability component list includes: Generate a new project-level suppression rule file according to the component vulnerability information in the vulnerability component list; Determine whether there is a project-level suppression rule file with the same name as the pipeline task name in the suppression rule library; If there is no project-level suppression rule file with the same name in the suppression rule library, obtaining the target project-level suppression rule file as the newly created project-level suppression rule file; If a project-level suppression rule file with the same name exists in the suppression rule library, the newly created project-level suppression rule file is added to the existing project-level suppression rule file to obtain the target project-level suppression rule file.
3. The method according to claim 1, characterized in that The method further comprises: After the pipeline task that was terminated by the security access control configuration policy is restarted, the pipeline executes component vulnerability scanning to query whether the target project-level suppression rule file exists; If the target project-level suppression rule file exists, the assembly line suppresses the component vulnerability information of the organization-level suppression rule file and the component vulnerability information configured in the target project-level suppression rule file; If the target project-level suppression rule file does not exist, the pipeline suppresses the component vulnerability information configured in the organization-level suppression rule file.
4. The method according to claim 1, characterized in that The obtaining of the component vulnerability scanning report includes: Sending a download request to the pipeline corresponding to the pipeline task name, wherein the download request indicates obtaining the component vulnerability scanning report; Download the vulnerability scan report of the component in question.
5. The method according to claim 1, characterized in that The step of parsing the component vulnerability scanning report to obtain an initial vulnerability component having a vulnerability includes: Parse the component vulnerability scanning report to obtain a json format file of the component vulnerability scanning report; The initial vulnerability component is screened out from the json format file, where the initial vulnerability component is a component containing a common platform enumeration CPE or a package uniform resource locator PURL.
6. The method according to claim 1, characterized in that The step of matching the initial vulnerability component with the security access control configuration policy to generate a vulnerability component list includes: Matching the initial vulnerability component with the security access control configuration policy to obtain the target vulnerability component, where the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy; The vulnerable component list is generated according to the component vulnerability information of the target vulnerable component.
7. The method according to claim 1, characterized in that The component vulnerability information includes at least one of a component file name, a component version, a CPE, a PURL, and a vulnerability risk level.
8. A device for processing component vulnerability false alarms, characterized in that: The device comprises: The first parsing unit is used to parse the component vulnerability scanning report uniform resource locator URL to obtain the pipeline task name and the component vulnerability scanning report address; the pipeline corresponding to the pipeline task name is the pipeline with component vulnerability false alarm; An acquisition unit, configured to acquire the component vulnerability scan report according to the component vulnerability scan report address; A second parsing unit is used to parse the component vulnerability scanning report to obtain an initial vulnerable component with a vulnerability; A first obtaining unit is used to obtain a security access control configuration policy corresponding to the pipeline with component vulnerability false alarm, wherein the security access control configuration policy is used to represent a security condition for terminating the pipeline; A matching unit, used to match the initial vulnerability component with the security access control configuration policy to generate a vulnerability component list; the vulnerability component list is used to store component vulnerability information of a target vulnerability component; the target vulnerability component is a vulnerability component in the initial vulnerability component that complies with the security access control configuration policy; The second obtaining unit is used to obtain a target project-level suppression rule file according to the component vulnerability information in the vulnerability component list, so that the pipeline suppresses the component vulnerability information configured in the target project-level suppression rule file.
9. An electronic device, characterized in that: The electronic device comprises a processor and a memory: The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 7 according to the computer program.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method according to any one of claims 1 to 7.