Script generation method and device and storage medium

Abstract

The invention discloses a script generation method and device and a storage medium, and the method comprises the steps: determining a markup language corresponding to a bug according to the bug information of a repairing object bug; determining a repair instruction corresponding to the vulnerability at least according to the markup language; and converting the repair instruction into a repair script for repairing the vulnerability. Therefore, by determining the corresponding markup language according to the vulnerability information, further determining the repair instruction and converting the repair instruction into the repair script, the repair script can be generated for a new vulnerability, the vulnerability repair cost is reduced, the repair efficiency is improved, and the user experience is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of system security technology, and in particular to a script generation method, device and storage medium. Background Art

[0002] With the development of the Internet and mobile Internet, a large number of various applications have emerged, which has also stimulated the development of private cloud and public cloud service infrastructure. The security of these cloud service infrastructures is related to the privacy and data security of users, so it is very important to repair vulnerabilities in these servers. However, the existing vulnerability repair methods can only repair vulnerabilities when there are existing repair scripts, and cannot generate new repair scripts for vulnerabilities, resulting in high cost and low efficiency of vulnerability repair. Summary of the invention

[0003] In order to solve the existing technical problems, the embodiments of the present invention provide a script generation method, device and storage medium.

[0004] The technical solution of the present invention is achieved in this way:

[0005] An embodiment of the present invention provides a script generation method, the method comprising:

[0006] Determine the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired;

[0007] Determining, at least based on the markup language, a repair instruction corresponding to the vulnerability;

[0008] The repair instruction is converted into a repair script for repairing the vulnerability.

[0009] In the above scheme, determining the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired includes:

[0010] Determine at least one markup language of a repair stage according to the vulnerability information, wherein repairing the vulnerability includes: repairing the vulnerability in at least one repair stage.

[0011] In the above solution, converting the repair instruction into a repair script for repairing the vulnerability includes at least one of the following:

[0012] Combining the repair instructions, and converting the combined repair instructions into a repair script;

[0013] Determine the operating environment type of the repair object, and convert the repair instruction into a repair script corresponding to the operating environment type.

[0014] In the above solution, the step of determining the operating environment type of the repair object and converting the repair instruction into a repair script corresponding to the operating environment type includes:

[0015] According to the operating environment type of the repair object, a mapping table is searched for the repair instructions corresponding to different operating environment types, and the repair instructions are converted into a repair script corresponding to the operating environment type in the mapping table.

[0016] In the above solution, the repair instruction includes identification information corresponding to the repair object; and determining the operating environment type of the repair object includes:

[0017] Determine identification information corresponding to the repair object in the repair instruction;

[0018] The operating environment type of the repair object is determined according to the identification information.

[0019] In the above solution, the method further includes: verifying the repair script; the verifying the repair script includes at least one of the following:

[0020] Determine a first execution result of a repair instruction in the repair script, and verify the repair instruction according to the first execution result;

[0021] A second execution result of the repair script in the simulation environment is determined, and the repair script is verified according to the second execution result.

[0022] In the above scheme, the method further comprises:

[0023] Determine a repair script library, and store the repair script in the repair script library;

[0024] According to the vulnerability information of the vulnerability of the repair object, the repair script corresponding to the vulnerability information is determined from the repair script library. An embodiment of the present invention provides a script generation device, the device comprising: a first determination module, a second determination module, and an execution module; wherein,

[0025] The first determination module is used to determine the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired;

[0026] The second determination module is used to determine the repair instruction corresponding to the vulnerability at least according to the markup language;

[0027] The execution module is used to convert the repair instruction into a repair script for repairing the vulnerability.

[0028] In the above solution, the first determination module is specifically used to: determine a markup language of at least one repair stage according to the vulnerability information, wherein repairing the vulnerability includes: repairing the vulnerability in at least one repair stage.

[0029] In the above solution, the execution module is specifically used to: combine the repair instructions and convert the combined repair instructions into a repair script;

[0030] Determine the operating environment type of the repair object, and convert the repair instruction into a repair script corresponding to the operating environment type.

[0031] In the above scheme, the execution module is specifically used to: according to the operating environment type of the repair object, find a mapping table in which the repair instruction corresponds to different operating environment types, and convert the repair instruction into a repair script corresponding to the operating environment type in the mapping table.

[0032] In the above solution, the repair instruction includes identification information corresponding to the repair object; the execution module is specifically used to: determine the identification information corresponding to the repair object in the repair instruction;

[0033] The operating environment type of the repair object is determined according to the identification information.

[0034] In the above solution, the device further includes a verification module; the verification module is specifically used to: determine a first execution result of the repair instruction in the repair script, and verify the repair instruction according to the first execution result;

[0035] A second execution result of the repair script in the simulation environment is determined, and the repair script is verified according to the second execution result.

[0036] In the above solution, the device further comprises a storage module; the storage module is specifically used to: determine a repair script library, and store the repair script in the repair script library;

[0037] According to the vulnerability information of the vulnerability of the repair object, the repair script corresponding to the vulnerability information is determined from the repair script library.

[0038] In a third aspect, an embodiment of the present invention further provides a script generating device, comprising a memory, a processor, and an executable program stored in the memory and capable of being run by the processor, wherein the processor executes any step of the script generating method when running the executable program.

[0039] In a fourth aspect, an embodiment of the present invention further provides a storage medium having an executable program stored thereon, wherein the executable program, when executed by a processor, implements the steps of any one of the script generation methods.

[0040] The script generation method, device and storage medium provided in the embodiment of the present invention determine the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired; determine the repair instruction corresponding to the vulnerability at least according to the markup language; and convert the repair instruction into a repair script for repairing the vulnerability. In the scheme of the embodiment of the present invention, by determining the corresponding markup language according to the vulnerability information, further determining the repair instruction and converting it into a repair script, a repair script can be generated for a new vulnerability, reducing the cost of vulnerability repair, improving the efficiency of repair, and enhancing the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of a flow chart of a script generation method provided by an embodiment of the present invention;

[0042] Figure 2 A schematic diagram of the repair phase of a script generation method provided by an embodiment of the present invention;

[0043] Figure 3 A diagram showing the composition of a repair script generator of a script generation method provided by an embodiment of the present invention;

[0044] Figure 4 A vulnerability batch repair system of a script generation method provided by an embodiment of the present invention;

[0045] Figure 5 A schematic diagram of the structure of a script generation device provided by an embodiment of the present invention;

[0046] Figure 6 A schematic diagram of the structure of another script generating device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In the related art, vulnerability repair can verify the repair effect of the first repair patch based on the simulation platform. If the deviation value is too large, the second repair patch is used to perform indirect vulnerability repair. Vulnerability repair can also generate a repair script based on the vulnerability situation, and generate a docker image based on the target system configuration, and use the repair script for the docker image. If the repair is successful, it will be repaired on the target system. The proof of concept (POC) script generation method may include: crawling the vulnerability repair code from the network, obtaining the restricted call code and related variables and space definitions in the vulnerability repair code, generating a POC script based on this information, testing and obtaining the results, and determining the vulnerability repair results based on the comparison with the test results.

[0048] However, the above method has the following problems:

[0049] First, the vulnerability repair method can only repair the vulnerability when there is an existing repair script, and cannot repair the vulnerabilities in batches;

[0050] Second, the vulnerability repair method can only be used when there is an existing repair script. If there is no existing script, the vulnerability cannot be repaired;

[0051] Third, the POC script generation method can only handle vulnerabilities that already have repair methods, but cannot handle vulnerabilities that do not have repair methods. In addition, existing repair methods may also cause new vulnerabilities, and vulnerabilities cannot be repaired in batches.

[0052] Based on this, various embodiments of the present invention provide a script generation method, including: determining a markup language corresponding to the vulnerability based on vulnerability information of a vulnerability to be repaired; determining a repair instruction corresponding to the vulnerability based at least on the markup language; and converting the repair instruction into a repair script for repairing the vulnerability.

[0053] The present invention will be further described in detail below in conjunction with the embodiments.

[0054] Figure 1 A flowchart of a script generation method provided by an embodiment of the present invention; Figure 1 As shown, the method includes:

[0055] Step 101: Determine the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired;

[0056] Step 102: determining a repair instruction corresponding to the vulnerability at least according to the markup language;

[0057] Step 103: Convert the repair instruction into a repair script for repairing the vulnerability.

[0058] In some embodiments, the method is applied to a control device, which is used to control script generation; for example, the control device may be a script generator; the script generator may include but is not limited to: a preset repair function component, a markup language, and an interpreter.

[0059] In a possible implementation, the repair object may be a software object and / or a hardware object where a vulnerability occurs.

[0060] In a possible implementation, the vulnerability information may be information for indicating specific circumstances of the vulnerability of the repair object.

[0061] In a possible implementation, the markup language may be a code for mapping the same repair function of the repair object under different operating environments; the operating environment may refer to the hardware environment and software environment required for the operation of the repair object.

[0062] In a possible implementation, the repair instruction may be an instruction for repairing a vulnerability.

[0063] In a possible implementation, the repair script may be an executable file for repairing a vulnerability.

[0064] Specifically, based on the vulnerability information of the vulnerability, the specific type of the vulnerability is determined; based on the vulnerability information, the markup language specifically corresponding to the vulnerability is determined; based on the vulnerability information, the markup language is divided into at least one repair stage, and each repair stage corresponds to at least one specific markup language; based on the vulnerability information, the corresponding markup language is used in each repair stage to generate repair instructions to repair the problems prompted in the vulnerability information; based on a mapping table corresponding to different operating environment types of repair instructions, the generated repair instructions are converted into a repair script corresponding to the operating environment type of the repair object, and the repair script repairs the vulnerability in the operating environment of the repair object in the form of native instructions.

[0065] Exemplarily, the repair object may be a Windows system, the vulnerability may be that the browser version is too low, and the vulnerability information may include but is not limited to: the browser version is too low, the vulnerability risk is low, and the latest version of the software needs to be reinstalled; based on the vulnerability information, three repair stages can be determined, including: preparation stage, repair stage, and post-repair stage.

[0066] According to the vulnerability information, the markup language of the save function can be used in the preparation stage to generate repair instructions for saving the data of the old version of the browser; the markup language of the uninstall function can be used in the repair stage to generate repair instructions for uninstalling the old version of the browser, and the markup language of the install function can be used to generate repair instructions for installing the latest version of the browser; the markup language of the restart function can be used in the post-repair stage to generate repair instructions for reloading the latest version of the browser.

[0067] After the repair instruction is generated, the mapping relationship between the repair instruction and the Windows system can be determined, and the repair instruction can be converted into a repair script that can be run on the Windows system; through the repair script, the browser is uninstalled and reinstalled under the Windows system to repair the vulnerability.

[0068] In some embodiments, determining the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired includes:

[0069] Determine at least one markup language of a repair stage according to the vulnerability information, wherein repairing the vulnerability includes: repairing the vulnerability in at least one repair stage.

[0070] Specifically, based on the vulnerability information corresponding to the vulnerability of the repair object, determine the type of vulnerability and how to repair the vulnerability, determine the markup language of at least one repair stage, and use the corresponding markup language in at least one repair stage according to the prompts of the vulnerability information to repair the vulnerability in stages.

[0071] Exemplarily, the repair objects may include but are not limited to: software programs, hardware systems, and servers; the vulnerabilities of the repair objects may include but are not limited to: version is too low, configuration is unreasonable, and middleware version is too old; the vulnerability information corresponding to the vulnerability of the repair object may be the error information corresponding to the vulnerability. For example, when the vulnerability is that the version is too low, the vulnerability information may be "version is too low, please upgrade to the latest version". Users can determine the markup language of at least one corresponding repair stage based on the vulnerability information corresponding to the vulnerability.

[0072] Here, repairing the vulnerability can be divided into at least one repair stage. In the embodiment of the present invention, there is no specific limitation on the number of repair stages, which can be set according to actual application requirements. For example, Figure 2 A schematic diagram of the repair phase of a script generation method provided by an embodiment of the present invention, such as Figure 2 As shown, the repair stage can be three, namely, the preparation stage, the repair stage, and the post-repair stage;

[0073] Each repair phase of the markup language corresponds to a specific repair function, for example, the preparation phase corresponds to the markup language of saving data and stopping services, the repairing phase corresponds to the markup language of updating configuration and reinstalling, and the post-repair phase corresponds to the markup language of restarting the server.

[0074] Exemplarily, the format of the markup language may be to use symbols to enclose keywords, and the symbols may include but are not limited to: [] symbols, <> symbols, and the symbols may be set according to actual application requirements, and are not specifically limited here;

[0075] For example, the markup language may include, but is not limited to: [beforeFix], [fixNow], [afterFix], [find], [replace], [modify], [start], [restart], [install], [uninstall], [installpkg], [delete], [wait], [verify], [os];

[0076] Here, [beforeFix] can indicate determining the preparation stage, [fixNow] can indicate determining the repair stage, [afterFix] can indicate determining the post-repair stage, [find] can indicate the search function, [replace] can indicate the replace function, [modify] can indicate the modify function, [start] can indicate the start function, [restart] can indicate the restart function, [install] can indicate the install function, [uninstall] can indicate the uninstall function, [installpkg] can indicate the install file package function, [delete] can indicate the delete function, [wait] can indicate the wait function, [verify] can indicate the verify function, and [os] can indicate the operating environment function;

[0077] The keywords may be words representing the functional meaning of the markup language, for example, the markup language [install] may represent the installation function, and [delete] may represent the deletion function; each markup language may be followed by a body that executes the function, for example, [install] Android 7.0.0 may represent the installation of version 7.0.0 of Android; the markup language and the corresponding body are in the same line and may constitute a repair instruction; if the repair instruction is a loop operation, {} may be used to wrap the loop part, and () may be used at the end of the loop to wrap the end condition of the loop operation, for example, the end condition may include but is not limited to: the number of loops reached, the middleware update completed, etc.; by clearly defining the usage rules of the markup language, users who do not understand code writing can also generate correct repair scripts through the markup language in a short time according to the usage rules.

[0078] In a possible implementation, step 102 may include: determining a repair instruction corresponding to the vulnerability at least based on the markup language and a preset repair function component.

[0079] In a possible implementation, the preset repair function component refers to a pre-stored custom component used to preliminarily configure repair instructions to repair vulnerabilities.

[0080] Specifically, the preset repair function component can be a repair component pre-stored on the server or locally, which can be used to repair common middleware (such as nginx, apache, activemq, etc.) in the repair object using a preset method. The preset method may include but is not limited to: stop, install, restart, and reload configuration; the user can drag the preset repair function component to the corresponding repair stage for simple configuration to repair the vulnerability; if the preset repair function component cannot complete the repair of the vulnerability, the preset repair function component and markup language can be used to determine the repair instructions and repair the vulnerability.

[0081] Exemplarily, the preset repair function component may be at least one preset repair function preset for common vulnerabilities; when the vulnerability is that the browser version is too low, the user may first search whether there is a corresponding preset repair function in the preset repair function component;

[0082] If there is a corresponding preset repair function, drag the preset repair function component that saves data to the preparation stage, drag the reinstalled preset repair function component to the repairing stage, and drag the restarted preset repair function component to the post-repair stage to complete the configuration generation of the repair script;

[0083] If there is no corresponding preset repair function, a corresponding repair script is generated using a markup language to complete the corresponding preset repair function.

[0084] Through the above method, the corresponding markup language is determined according to the vulnerability information, and the repair instructions are further determined and converted into a repair script. A repair script can be generated for new vulnerabilities, reducing the cost of vulnerability repair, improving the efficiency of repair, and enhancing the user experience.

[0085] In some embodiments, converting the repair instruction into a repair script for repairing the vulnerability includes at least one of the following:

[0086] Combining the repair instructions, and converting the combined repair instructions into a repair script;

[0087] Determine the operating environment type of the repair object, and convert the repair instruction into a repair script corresponding to the operating environment type.

[0088] In a possible implementation, the above steps may be performed by an interpreter.

[0089] In a possible implementation, the interpreter may perform the above steps based on preset rules. The preset rules may include the above steps, which will not be described in detail here.

[0090] Specifically, the functions in the repair instructions are replaced with other repair instructions, and different repair instructions are combined (i.e., nested) according to corresponding functions to convert them into repair scripts;

[0091] According to the mapping table of finding the repair instructions corresponding to different operating environment types, the repair instructions are converted into repair scripts corresponding to the operating environment type.

[0092] Exemplarily, different repair instructions can be combined with each other to complete a task together; for example, the repair instruction "[replace]filename key1 key2 line" can mean replacing the content of the line where the keyword "key1" of the file "filename" is located with "key2", and the repair instruction "[find]filename" can mean searching for a file with the file name "filename". The two repair instructions can be combined with each other, that is, the repair instruction "[replace]([find]filename key1 key2line)" can mean first searching for a file with the file name "filename", and then replacing the content of the line where the keyword "key1" is located with "key2". By combining the repair instructions above, the repair instructions can be made more concise and clear, further improving the efficiency of vulnerability repair.

[0093] Exemplarily, the repair instruction may be an uninstall instruction (i.e., an uninstall instruction). A mapping table of uninstall instructions corresponding to different operating environments is searched. In the mapping table, the uninstall instruction is mapped to the instruction "aptremove vsftpd" in the Ubuntu system and to the instruction "yum-y remove vsftpd" in the CentOS system.

[0094] Exemplarily, the repair instructions are combined, and / or the repair instructions are converted into a repair script corresponding to the operating environment type, which can be executed by the interpreter according to preset rules.

[0095] Through the above method, the repair instructions are mapped into repair scripts corresponding to different operating environment types, which can improve the applicability of the repair scripts, reduce the learning cost of users writing repair scripts, save manpower and time, and improve the efficiency of vulnerability repair.

[0096] In some embodiments, determining the operating environment type of the repair object and converting the repair instruction into a repair script corresponding to the operating environment type includes:

[0097] According to the operating environment type of the repair object, a mapping table is searched for the repair instructions corresponding to different operating environment types, and the repair instructions are converted into a repair script corresponding to the operating environment type in the mapping table.

[0098] In a possible implementation, the above steps may be performed by an interpreter.

[0099] In a possible implementation, the interpreter may perform the above steps based on preset rules. The preset rules may include the above steps, which will not be described in detail here.

[0100] Specifically, the markup language can be used to map the same predetermined operation of the repair object in different operating environments. In different operating environments, the functions represented by the repair instructions generated by the markup language are the same.

[0101] For example, for the uninstall instruction (uninstall instruction) in the markup language, if the operating environment type of the repair object is Ubuntu system, find the uninstall instruction corresponding to the Ubuntu system in the mapping table, and convert the uninstall instruction into the uninstall instruction "apt remove" of the Ubuntu system; if the operating environment type of the repair object is CentOS system, find the corresponding uninstall instruction in the CentOS system in the mapping table, and convert the uninstall instruction into the uninstall instruction "yum -y" of the CentOS system. Under different operating environments, the uninstall instruction represents the uninstall function.

[0102] Here, the mapping table may be a container stored in a server or locally according to a key / value pair storage correspondence relationship, and by searching the correspondence relationship, the repair script corresponding to the repair instruction under the operating environment type of the repair object is determined.

[0103] Exemplarily, the repair instruction is converted into a repair script corresponding to the operating environment type in the mapping table, which can be executed by an interpreter according to preset rules.

[0104] Through the above method, by searching the mapping table, the repair instructions are mapped to corresponding repair scripts under different operating environment types. Users do not need to understand the script writing rules corresponding to different operating environment types, and can also quickly and easily complete the generation of repair scripts, thereby reducing the difficulty of vulnerability repair and improving the user experience.

[0105] In some embodiments, the repair instruction includes identification information corresponding to the repair object; and determining the operating environment type of the repair object includes:

[0106] Determine identification information corresponding to the repair object in the repair instruction;

[0107] The operating environment type of the repair object is determined according to the identification information. Specifically, the identification information may be an identification used to uniquely indicate the operating environment type of the repair object.

[0108] Exemplarily, the identification information may be the markup language [os], and the repair instruction "[os]type version" may be used to determine that the operating environment type of the repair object is type system version. For example, "[os]centos 7.5" may indicate that the operating environment type of the repair object is centos system version 7.5. After determining the operating environment type of the repair object, the interpreter may convert the repair instruction into a native instruction corresponding to the operating environment type.

[0109] By using the above method, the operating environment type of the repair object is determined according to the identification information, which can improve the efficiency of converting the repair instructions into the repair script and further reduce the time cost of repairing the vulnerability.

[0110] In some embodiments, the method further includes: verifying the repair script; the verifying the repair script includes at least one of the following: determining a first execution result of a repair instruction in the repair script, and verifying the repair instruction according to the first execution result;

[0111] A second execution result of the repair script in the simulation environment is determined, and the repair script is verified according to the second execution result.

[0112] In a possible implementation, the above steps may be performed by an interpreter.

[0113] In a possible implementation, the interpreter may perform the above steps based on preset rules. The preset rules may include the above steps, which will not be described in detail here.

[0114] In some specific implementations, the first execution result refers to an execution result corresponding to the repair instruction, which is used to verify whether the function corresponding to the repair instruction is executed normally;

[0115] The second execution result refers to the execution result of the repair script in the simulation environment, which is used to verify whether the repair script can repair the vulnerability.

[0116] Specifically, when determining the repair script, a first execution result may be generated for a specific repair instruction in the repair script, and the repair instruction may be verified according to the first execution result.

[0117] Exemplarily, when generating the repair script, a verification script may be generated according to a user's selection, and the verification script may be used to verify the first execution result of the repair instruction.

[0118] For example, a verification instruction for verifying the startup of the software is generated, and the verification instruction verifies whether the start instruction is executed successfully according to the execution result of the start instruction.

[0119] Exemplarily, generating a verification script to verify the first execution result of the repair instruction may be executed by an interpreter according to preset rules.

[0120] In a possible implementation, after the repair script is determined, the repair script may be run in a simulation environment, and the repair script may be verified according to a second execution result after the running.

[0121] Here, the simulation environment may be a virtual operating system used to support programs or scripts to reproduce or find problems; the simulation environment may include but is not limited to: Docker, Podman, ZeroVM.

[0122] Through the above method, the repair instructions and repair scripts are verified, and the execution results of the repair scripts generated by users can be fed back in time, thereby improving the efficiency of vulnerability repair and reducing the trial and error cost of users in repairing vulnerabilities.

[0123] In some embodiments, the method further comprises: determining a repair script library, storing the repair script in the repair script library;

[0124] According to the vulnerability information of the vulnerability of the repair object, the repair script corresponding to the vulnerability information is determined from the repair script library.

[0125] Specifically, after the repair script is generated, the vulnerability is repaired according to the repair script; after the repair is completed, the repair script can be stored in the repair script library in association with the vulnerability information of the repair object vulnerability; if the same vulnerability is encountered again, a matching query is performed in the repair script library through the vulnerability information to determine the repair script corresponding to the vulnerability information, and the vulnerability is repaired again.

[0126] Here, at least one repair script may be stored in the repair script library.

[0127] Exemplarily, the vulnerability information of the vulnerability to be repaired indicates that the version of the edge browser under the Windows 10 system is too low. After the vulnerability is repaired by the repair script determined according to the vulnerability information, it is stored in the repair script library in association with the vulnerability information such as Windows 10 and the version of the edge browser is too low. When the same vulnerability appears again, the repair script is searched according to the vulnerability information to repair the edge browser.

[0128] In a possible implementation, common vulnerabilities of the repair object may include, but are not limited to: old middleware version, unreasonable configuration, and program upgrade required.

[0129] For example, for vulnerabilities in old middleware versions, you can first uninstall the old version of the middleware and then install the new version of the middleware, or you can directly install the new version of the middleware; for example, for the middleware vsftpd, you can uninstall it by repairing the command "[uninstall] vsftpd" and then install it using "[install] vsftpd".

[0130] To address the vulnerabilities caused by unreasonable configuration, you can modify or update the configuration of the middleware. For example, the configuration file nginx.conf of the middleware nginx can be modified by repairing the instruction "[replace]nginx.conf server_tokens "server_tokens off;" line".

[0131] For vulnerabilities that require program upgrades, you can install a new version of the program; for example, you can install the customer service by repairing the command "[installpkg]customer.zip".

[0132] Through the above method, the repair script determined according to the vulnerability information is stored in the repair script library. When the same vulnerability is encountered again, the vulnerability is repaired directly by matching the repair script according to the vulnerability information. This can avoid the user from using the markup language to generate the repair script again, improve the efficiency of vulnerability repair, and further reduce the user's learning cost.

[0133] According to the method provided by the embodiment of the present invention, the user can easily and quickly complete the generation of the repair script through simple configuration or writing markup language. The user does not need to have a deep understanding of the repair technology, and can generate correct repair instructions based on the markup language, thereby reducing the threshold and cost of vulnerability repair and improving the user experience.

[0134] Figure 3 A repair script generator structure diagram of a script generation method provided by an embodiment of the present invention; Figure 3 As shown, the repair script generator (equivalent to the script generator) includes: a preset repair function component, a markup language, a markup language interpreter (equivalent to an interpreter), a repair script, and a verification script; wherein,

[0135] The preset repair function component is used to drag to the corresponding repair stage (such as the pre-repair stage, the repair stage, and the post-repair stage) to configure the repair script;

[0136] The markup language is used to map the same operation of the repair object under different operating systems; the repair instruction is determined according to the markup language and the preset repair function component;

[0137] The markup language interpreter is used to convert the repair instruction into a repair script according to preset rules;

[0138] The repair script is used to repair the vulnerability;

[0139] The verification script is used to determine the running result of the repair instruction and verify the repair instruction according to the running result.

[0140] Figure 4 A batch vulnerability repair system provided by an embodiment of the present invention is as follows: Figure 4 As shown, the system includes: a repair management machine, a server to be repaired, and a simulation environment; the repair management machine includes: vulnerability management, server management, message agent, and repair script generator; the server to be repaired includes: an executor, a verifier, a monitor, and a message agent; wherein,

[0141] The server management is used to manage all servers (equivalent to repair objects), obtain server configuration information, and maintain the health status of servers;

[0142] The vulnerability management is used to manage vulnerability information, including but not limited to: vulnerability name, vulnerability description, vulnerability risk value, server IP, server system information; the vulnerability information can be imported by the vulnerability scanning system or manually created; the vulnerability management detects the existence of a vulnerability in the server and sends the vulnerability information to the repair script generator for repair;

[0143] The repair script generator (equivalent to the script generator) is used to execute Figure 1 The method;

[0144] The message agent of the repair management machine is used to send the repair script to the server to be repaired;

[0145] The executor is used to execute the repair script;

[0146] The monitor is used to read the output of the executor, monitor the status of the repair script execution and return the message to the repair management machine;

[0147] The message agent of the server to be repaired is used to return the status of the execution of the repair script to the repair management machine;

[0148] The simulation environment is used to verify whether the repair script can repair the server vulnerability.

[0149] The following provides multiple specific examples in combination with any of the above embodiments:

[0150] Determining the repair solution for a vulnerable script is divided into three steps (i.e., divided into three repair stages), such as Figure 2As shown: preparatory work before repair (i.e. preparation stage), repair work (i.e. repair stage), post-repair work (i.e. post-repair stage); preparatory work before repair: used to prepare for the work before repair, such as saving data, stopping services, etc.; repair work: carry out specific repair work, such as updating configuration, uninstalling software, reinstalling, etc.; post-repair work: carry out the follow-up work after repair, such as restarting the server, loading configuration, etc.; each step requires the repair content to be specified by the repair script generator (i.e. script generator).

[0151] The repair script generator is composed of three parts: preset repair components (i.e. preset repair function components), markup language, and markup language interpreter (i.e. interpreter); preset repair components provide preset repair components for common middleware, such as nginx, apache, activemq, etc.: stop, install, restart, reload configuration, send commands to the server, etc.; drag the corresponding preset repair component to the corresponding repair step (i.e. repair stage), perform simple configuration, and the configuration of the repair script can be completed; the repair system also provides markup language, and if the preset repair component cannot meet the function, the markup language is provided for the repairer to use; the markup language interpreter is responsible for parsing the markup language into the repair instructions of the corresponding system according to the built-in rules (equivalent to the preset rules) (equivalent to converting the repair instructions into a repair script for repairing vulnerabilities); the repair patch provides the files or programs required for the repair (equivalent to calling the repair patch through the repair instruction to repair the vulnerability). The markup language includes the following categories:

[0152] [beforeFix], [fixNow], [afterFix], [find], [replace], [modify], [start], [restart], [install], [uninstall], [installpkg], [delete], [wait], [verify], [os], etc. The purpose of using preset repair function components and markup languages ​​is to reduce the difficulty of writing (i.e. generating) repair scripts. The generation process of repair scripts is as follows:

[0153] (1) The user creates a repair step (i.e., determines a repair stage), and the user creates the repair step by dragging a preset repair component and writing in a markup language and native instructions;

[0154] (2) Each line is a repair instruction. The markup language is wrapped in []. Parameters are separated by spaces. If there are spaces in the parameters, they are wrapped in double quotes. If the repair instruction is a loop operation, the part that needs to be looped can be wrapped in curly braces, and the end condition of the loop, such as the number of loops, can be marked with parentheses at the end. [os]type version (equivalent to identification information) needs to be added before the native instruction to specify the operating system executed by the native instruction (equivalent to determining the operating environment type of the repair object based on the identification information). For example, [os]centos 7.5 means the centos system version 7.5.

[0155] (3) The markup language interpreter converts the repair instructions entered by the user in the second step into a repair script according to built-in rules (equivalent to preset rules) (i.e., converts the repair instructions into a repair script for repairing the vulnerability);

[0156] (4) Repair script execution verification: the system will verify the repair script in a simulated environment.

[0157] Exemplarily, the markup language interpreter converts the repair instruction into a repair script based on built-in rules (equivalent to the interpreter executing steps based on preset rules), wherein the built-in rules (equivalent to preset rules) may include:

[0158] 1) Command mapping. [Command] There is a mapping table in the repair system that corresponds to different systems. "Command" corresponds to different operations in different operating systems. For example, uninstall corresponds to "apt remove" in Ubuntu system and "yum -y" in CentOS system.

[0159] Here, it is equivalent to searching a mapping table corresponding to different operating environment types of repair instructions according to the operating environment type of the repair object, and converting the repair instructions into a repair script corresponding to the operating environment type in the mapping table.

[0160] 2) [Commands] can be combined with each other to complete a task. [replace]filename key1key2line means to replace the content of the line containing the keyword "key1" in the file "filename" with "key2", [find]filename means to search for the file "filename" in the system, and [replace]([find]filename)key1 key2line means to search for the file "filename" in the system first, and then replace the matching "key1" line with "key2".

[0161] Here, it is equivalent to combining the repair instructions and converting the combined repair instructions into a repair script.

[0162] 3) For example, for the uninstall command, the repair script generator will generate corresponding uninstall software commands according to different server types, for example, Ubuntu system: apt remove vsftpd; CentOS system: yum-y removevsftpd.

[0163] Here, it is equivalent to determining the operating environment type of the repair object and converting the repair instruction into a repair script corresponding to the operating environment type.

[0164] 4) While generating the repair script, the repair script generator can also generate a script for the execution result of a certain instruction based on the user's choice, and verify it through the verifier; for example, for the start instruction, an instruction will be generated to verify whether the software is successfully started.

[0165] Here, it is equivalent to determining the first execution result of the repair instruction in the repair script, and verifying the repair instruction according to the first execution result.

[0166] For the three common server vulnerabilities, the usual repair methods are as follows:

[0167] 1) The middleware version is too old: You can uninstall it first and then install it, or directly install the new version of the middleware. For example, for vsftpd, if you need to install a new version, you can use [uninstall] vsftpd to uninstall it and [install] vsftpd to install it.

[0168] 2) Improper configuration: The middleware configuration needs to be modified or updated. For example, for the nginx configuration file nginx.conf, [replace] nginx.conf server_tokens "server_tokens off;" line.

[0169] 3) Program upgrade: A new version of the program needs to be installed. For example, for customer services, you can use [installpkg]customer.zip to install.

[0170] The server batch vulnerability automatic repair system includes: Figure 4 As shown in the figure, it consists of eight modules: server management, vulnerability management, patch management, repair script generator (i.e., script generator), repair script executor, repair script monitor, verifier, and message agent. The repair manager is responsible for server management, vulnerability management, patch management, generating repair scripts through the repair script generator, and issuing repair scripts through the message agent. The executor, verifier, monitor, and message agent are running on the server to be repaired.

[0171] Among them, server management is responsible for managing all servers, obtaining server configuration information, and maintaining the online and healthy status of servers;

[0172] Vulnerability management is responsible for managing vulnerability information; vulnerability information can be imported from the vulnerability scanning system, or manually create vulnerabilities that need to be repaired; vulnerability related information includes vulnerability name, vulnerability description, vulnerability risk value, server IP, server system information, etc.

[0173] Generate a repair script for the vulnerability using the automatic script generation tool provided by the system before, during and after repair (equivalent to three repair stages), and verify the repair script in a simulated environment (i.e., determine the second execution result of the repair script in the simulated environment, and verify the repair script based on the second execution result);

[0174] The repair manager sends the vulnerability repair script to the server to be repaired (i.e., the repair object) through the message agent. The repair executor on the server to be repaired executes the vulnerability repair script. The repair script monitor reads the output of the repair script executor, monitors the execution status of the repair script, and feeds back to the repair manager through the message agent.

[0175] The vulnerability repair results are verified by the validator and fed back to the repair service management machine through the message agent.

[0176] Figure 5 A schematic diagram of the structure of another script generation device provided by an embodiment of the present invention, such as Figure 5 As shown, the device can be applied to intelligent electronic devices such as servers and computers; the device 50 includes: a first determination module 501, a second determination module 502, an execution module 503, a verification module 504 and a storage module 505;

[0177] The first determining module 501 is used to determine the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired;

[0178] The second determination module 502 is used to determine the repair instruction corresponding to the vulnerability at least according to the markup language;

[0179] The execution module 503 is used to convert the repair instruction into a repair script for repairing the vulnerability.

[0180] Specifically, the first determining module 501 is used to determine a markup language of at least one repair stage according to the vulnerability information, wherein repairing the vulnerability includes: repairing the vulnerability in at least one repair stage.

[0181] Specifically, the execution module 503 is used to combine the repair instructions and convert the combined repair instructions into a repair script;

[0182] Determine the operating environment type of the repair object, and convert the repair instruction into a repair script corresponding to the operating environment type.

[0183] Specifically, the execution module 503 is used to search for a mapping table in which the repair instruction corresponds to different operating environment types according to the operating environment type of the repair object, and convert the repair instruction into a repair script corresponding to the operating environment type in the mapping table.

[0184] Specifically, the repair instruction includes identification information corresponding to the repair object; the execution module 503 is used to determine the identification information corresponding to the repair object in the repair instruction;

[0185] The operating environment type of the repair object is determined according to the identification information.

[0186] Specifically, the verification module 504 is used to determine a first execution result of the repair instruction in the repair script, and verify the repair instruction according to the first execution result;

[0187] A second execution result of the repair script in the simulation environment is determined, and the repair script is verified according to the second execution result.

[0188] Specifically, the storage module 505 is used to determine a repair script library and store the repair script in the repair script library;

[0189] According to the vulnerability information of the vulnerability of the repair object, the repair script corresponding to the vulnerability information is determined from the repair script library. It should be noted that: when the script generation device provided in the above embodiment implements the corresponding script generation method, it only uses the division of the above program modules as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the device provided in the above embodiment and the corresponding Figure 1 The embodiments of the method shown belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0190] To implement the method of the embodiment of the present invention, the embodiment of the present invention provides a script generation device, such as Figure 6 As shown, the device 60 includes: a processor 601 and a memory 602 for storing a computer program that can be run on the processor; wherein,

[0191] When the processor 601 is used to run the computer program, it executes: determining the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired; determining the repair instruction corresponding to the vulnerability at least according to the markup language; converting the repair instruction into a repair script for repairing the vulnerability. Specifically, the first device can execute the following Figure 1 The method shown, and Figure 1 The script generation method embodiments shown belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0192] In practical application, such as Figure 6 As shown, the device 60 may also include: at least one network interface 603. The various components in the script generating device 60 are coupled together via a bus system 604. It is understood that the bus system 604 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 6 In the figure, various buses are marked as bus system 604. There may be at least one processor 601. The network interface 603 is used for wired or wireless communication between the script generating device 60 and other devices.

[0193] The memory 602 in the embodiment of the present invention is used to store various types of data to support the operation of the device 60 .

[0194] The method disclosed in the above embodiment of the present invention can be applied to the processor 601, or implemented by the processor 601. The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 601 or the instruction in the form of software. The above processor 601 may be a general processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 601 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 602. The processor 601 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0195] In an exemplary embodiment, the script generating device 60 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0196] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored; when the computer program is executed by a processor, the computer program performs the following operations: determining a markup language corresponding to the vulnerability according to vulnerability information of the vulnerability to be repaired; determining a repair instruction corresponding to the vulnerability according to at least the markup language; and converting the repair instruction into a repair script for repairing the vulnerability. Specifically, the computer program can also perform the following operations: Figure 1 The method shown, and Figure 1 The method embodiments shown belong to the same concept, and their specific implementation processes are detailed in the method embodiments, which will not be repeated here.

[0197] In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0198] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0199] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0200] A person skilled in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), disks or optical disks, etc. Various media that can store program codes.

[0201] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0202] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0203] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0204] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A script generation method, characterized in that: The method comprises: Determine the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired; Determining, at least based on the markup language, a repair instruction corresponding to the vulnerability; The repair instruction is converted into a repair script for repairing the vulnerability.

2. The method according to claim 1, characterized in that The step of determining the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired includes: Determine at least one markup language of a repair stage according to the vulnerability information, wherein repairing the vulnerability includes: repairing the vulnerability in at least one repair stage.

3. The method according to claim 1, characterized in that The converting the repair instruction into a repair script for repairing the vulnerability includes at least one of the following: Combining the repair instructions, and converting the combined repair instructions into a repair script; Determine the operating environment type of the repair object, and convert the repair instruction into a repair script corresponding to the operating environment type.

4. The method according to claim 3, characterized in that The determining the operating environment type of the repair object and converting the repair instruction into a repair script corresponding to the operating environment type includes: According to the operating environment type of the repair object, a mapping table is searched for the repair instructions corresponding to different operating environment types, and the repair instructions are converted into a repair script corresponding to the operating environment type in the mapping table.

5. The method according to claim 3, characterized in that: The repair instruction includes identification information corresponding to the repair object; The determining the operating environment type of the repair object includes: Determine identification information corresponding to the repair object in the repair instruction; The operating environment type of the repair object is determined according to the identification information.

6. The method according to claim 1, characterized in that The method further includes: verifying the repair script; the verifying the repair script includes at least one of the following: Determine a first execution result of a repair instruction in the repair script, and verify the repair instruction according to the first execution result; A second execution result of the repair script in the simulation environment is determined, and the repair script is verified according to the second execution result.

7. The method according to claim 1, characterized in that The method further comprises: Determine a repair script library, and store the repair script in the repair script library; According to the vulnerability information of the vulnerability of the repair object, the repair script corresponding to the vulnerability information is determined from the repair script library.

8. A script generation device, characterized in that: The device comprises: a first determining module, a second determining module, and an executing module; wherein, The first determination module is used to determine the markup language corresponding to the vulnerability according to the vulnerability information of the vulnerability to be repaired; The second determination module is used to determine the repair instruction corresponding to the vulnerability at least according to the markup language; The execution module is used to convert the repair instruction into a repair script for repairing the vulnerability.

9. A script generating device, characterized in that: The device includes a network interface, a memory and a processor; wherein the network interface is used to realize connection communication between components; the memory is used to store a computer program that can be run on the processor; and the processor is used to execute the method described in any one of claims 1 to 7 when running the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and when the computer program is executed by at least one processor, the method according to any one of claims 1 to 7 is implemented.

Images