Response system of loophole closed-loop management based on active detection and loophole verification

Abstract

The invention provides a response system for loophole closed-loop management based on active detection and loophole verification, which is characterized in that an asset detector collects asset information which can be detected in flow, and a loophole detector performs targeted loophole detection according to the asset information of the asset detector; the asset and vulnerability information is synchronized with a vulnerability analyzer, the vulnerability analyzer converges vulnerability information and compares and verifies the vulnerability information with a vulnerability library, and vulnerabilities needing to be re-scanned are fed back to a vulnerability detector and an asset detector through a work order system; and finally, the vulnerability analyzer feeds back a result to the generator to form a vulnerability report, and a major industry vulnerability library is locally formed. According to the method, vulnerability verification is carried out on the actively detected vulnerability result, and attention to vulnerability changes is continuously kept, so that closed-loop management of vulnerability security is ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and in particular relates to a response system for vulnerability closed-loop management based on active detection and vulnerability verification. Background Art

[0002] In the increasingly severe network security environment, the Internet security problem of using security vulnerabilities to carry out network attacks has always accompanied the application development of the Internet industry, just like the shadow under the sun. In recent years, the forms of network security threats have also undergone different changes. The attack methods have changed from simple tool attacks downloaded by individual hobbyists to attack programs specially written by organized professional technicians. The purpose of the attack has changed from proving personal technical strength to stealing commercial or national information. The changes in new attack methods will still exploit various vulnerabilities, such as the IE browser overflow vulnerability exploited in the Google Aurora attack incident and the FEATHEADER remote code execution vulnerability of the EXCEL program exploited in the Shady RAT attack incident. In fact, attackers do not always exploit 0day vulnerabilities during the attack process, such as the FEATHEADER remote code execution vulnerability. On the contrary, most attacks exploit known vulnerabilities. For attackers, all aspects of the IT system are vulnerable, including common operating system vulnerabilities, application system vulnerabilities, weak passwords, as well as easily overlooked incorrect security configuration issues, and unnecessary accounts, services, ports, etc. that violate the principle of minimization. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides a response system for vulnerability closed-loop management based on active detection and vulnerability verification.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] The present invention provides a response system for vulnerability closed-loop management based on active detection and vulnerability verification, comprising: an asset detector, a vulnerability detector, a vulnerability analyzer, a vulnerability library, a work order system, a generator and a major industry vulnerability library; the asset detector detects asset information in traffic, the vulnerability detector detects vulnerability information according to the asset information detected by the asset detector, the asset information and vulnerability information are synchronized to the vulnerability analyzer, the vulnerability analyzer converges the vulnerability information and compares and verifies it with the vulnerability library, screens out vulnerabilities that need to be rescanned and feeds them back to the vulnerability detector and the asset detector through the work order system, the vulnerability analyzer outputs the vulnerability results of the assets, and a major industry vulnerability library is formed through the generator.

[0006] Optionally, the asset information detected by the asset detector includes software, hardware and services that constitute the information system.

[0007] Optionally, the vulnerability detector performs a vulnerability information detection process as follows:

[0008] Create vulnerability scanning tasks, configure scanning targets and scanning settings;

[0009] Start the vulnerability scanning task and start scanning the target for vulnerabilities;

[0010] View and export scan results, and summarize the scan results;

[0011] Analyze scan results and support trend analysis and comparative analysis of multiple scan results.

[0012] Optionally, the vulnerability detector detects vulnerability information by generating a vulnerability scanning task and scheduling a lower-level scanner device to perform online scanning, which specifically includes:

[0013] After the user selects a template, configures parameters, and selects a device from the interface, a task policy is created within the scheduling engine;

[0014] The scheduling engine detects that there is a new task policy and the task policy meets the prerequisite for creating a task, and the scheduling engine creates a corresponding task internally; the scheduling engine splits the task according to the task configuration, target situation and the device scannable range, and each subtask corresponds to a device; when the subtask is sent to the corresponding device, if an abnormal situation occurs, the scheduling engine recycles the target and device involved in the subtask, and re-sends the target to the new device, and the original device is temporarily silent;

[0015] The device's scan results are uploaded to the specified directory through the interface file in the form of text in different log types.

[0016] Optionally, the vulnerability analyzer includes an asset vulnerability discovery module and an asset vulnerability analysis module; the asset vulnerability discovery module collects vulnerability information and compares it with the vulnerability library to screen out vulnerabilities that need to be rescanned; the asset vulnerability analysis module calculates the vulnerability value of the vulnerability and gives a vulnerability level assessment for evaluating asset network risks.

[0017] Optionally, the asset network risk is calculated as follows:

[0018]

[0019] In the formula, r n Indicates the asset network risk. A network has n hosts in total, and they are arranged from high to low in terms of host risk: hw1 , r hw2 ,r hw3 …r hwn , is the influence coefficient, is the convergence coefficient, is the impact base, a 1 This is a fixed value for rhw1.

[0020] Optionally, the vulnerability library includes a product vulnerability library, a password dictionary library, a configuration template, an asset tag correction module, a vulnerability plug-in library and a knowledge base upgrade.

[0021] Optionally, the work order system is implemented using a BPM process engine.

[0022] Optionally, the generator associates the POC information with the vulnerability matching information between the vulnerability information and the vulnerability library to generate a vulnerability report and vulnerability rules.

[0023] Optionally, in the major industry vulnerability database, major vulnerability selection rules include: selecting major vulnerabilities by vulnerability tags; selecting major vulnerabilities according to existing attribute field contents of the vulnerabilities and advanced query condition rules; selecting major vulnerabilities based on vulnerability scenario classification, identification and marking.

[0024] The beneficial effect of the present invention is that the present invention verifies the vulnerability results of active detection and keeps a close eye on the changes in vulnerabilities to ensure closed-loop management of vulnerability security. The present invention fully considers that the industry vulnerability management work has been carried out for many years. In risk management work, vulnerability management can prevent problems before they occur. It is the management link with the highest investment and effect ratio. It has been fully recognized by various industries and has been widely used in infrastructure construction and practice. Therefore, the present invention further enriches the vulnerability management link, completing the vulnerability closed loop from active detection-vulnerability verification-vulnerability re-scanning-report generation. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a composition diagram of the response system for closed-loop vulnerability management based on active detection and vulnerability verification.

[0026] Figure 2 It is a distribution map of asset discovery functions.

[0027] Figure 3 This is a schematic diagram of a vulnerability detector scanning for vulnerabilities.

[0028] Figure 4 This is a schematic diagram of the vulnerability analyzer analyzing vulnerabilities.

[0029] Figure 5 It is a schematic diagram of the generator associating POC information according to vulnerability matching information.

[0030] Figure 6 It is a schematic diagram of vulnerability analysis system. DETAILED DESCRIPTION

[0031] The present invention will now be described in further detail with reference to the accompanying drawings.

[0032] Before describing the present invention in detail, the following terms are explained. Vulnerability detection is a way of vulnerability discovery, which refers to the process of identifying, discovering and evaluating security vulnerabilities in systems, applications or networks. These vulnerabilities may be exploited by hackers to cause data leakage, system intrusion or other security incidents. Vulnerability rules refer to standards and specifications for identifying and responding to potential security vulnerabilities in the fields of security protection and information security. These rules are usually formulated by security experts or organizations to guide how to detect, evaluate and deal with security flaws in systems or applications. Vulnerability verification is the proof of the results and current status of vulnerabilities. Vulnerability verification is an important concept in the field of information security. It mainly refers to the process of confirming and testing vulnerabilities in systems, networks or applications. Its purpose is to verify the existence, exploitability and potential impact of vulnerabilities.

[0033] like Figure 1 As shown, the present invention proposes a response system for closed-loop vulnerability management based on active detection and vulnerability verification, including: asset detectors, vulnerability detectors, vulnerability analyzers, vulnerability libraries, work order systems, generators, and major industry vulnerability libraries. The asset detector collects asset information that can be detected in the traffic, and the vulnerability detector performs targeted vulnerability detection based on the asset information of the asset detector; the asset and vulnerability information are synchronized with the vulnerability analyzer, and the vulnerability analyzer converges the vulnerability information and compares and verifies it with the vulnerability library. The vulnerabilities that need to be re-scanned are fed back to the vulnerability detector and the asset detector through the work order system; finally, the vulnerability analyzer feeds back the results to the generator to form a vulnerability report, and a major industry vulnerability library is formed locally.

[0034] Vulnerability detectors and asset detectors are used to search for vulnerabilities and asset information, and to exchange data to keep vulnerabilities and assets matched. The results of vulnerability detectors and asset detectors are shared with the vulnerability analyzer, which analyzes vulnerability information synchronously. In addition to its own capabilities, the vulnerability information analysis process also needs to match the vulnerability library information. At the same time, the vulnerability detection content of the vulnerability detector also needs to match the vulnerability library. Vulnerability-related information and assets are matched, and the vulnerability analyzer outputs relevant asset vulnerability information and distributes it to the responsible person through the work order system. The responsible person makes corrections and re-scans through the vulnerability detector and asset detector. The asset vulnerability results output by the vulnerability analyzer are formed into major industry vulnerabilities through the generator, and a major industry vulnerability library is formed to complete the accumulation of localized vulnerability experience.

[0035] 1. Asset detector

[0036] Assets are a collection of resources such as software, hardware, and services that make up an information system. They have customer value and are the main objects of security mechanism protection and security management. According to the object-oriented design principle, security services will be carried out around assets. Security data from different fields are intertwined in the core database of assets, forming various business relationships, thereby generating value output that customers care about. Only by accurately identifying and effectively managing assets first can a series of subsequent security mechanisms be effectively implemented as expected.

[0037] As an important part of environmental perception in the security field, asset management is responsible for the maintenance of various security objects throughout their life cycle, from discovery or import, ongoing management, risk analysis, change monitoring, and offline destruction. It specifically provides configuration management and statistical analysis functions such as adding, deleting, modifying, checking, importing and exporting various network assets.

[0038] Asset discovery functions are distributed as follows: Figure 2 As shown. It is mainly divided into two categories: scanning task discovery and data analysis discovery. The focus of asset discovery is on asset discovery in the form of scanning tasks. Scanning discovery is specified through scanning strategies; asset discovery needs to be linked with permission management to complete the authorization of asset domains; asset data needs to be linked with metadata management to complete the standardized storage of asset data. Asset lifecycle management supervises all states of assets: registration, change, and delisting.

[0039] 2. Vulnerability Detector

[0040] The vulnerability detection process is:

[0041] 1) Create a scan task, configure the scan target and scan settings;

[0042] 2) Start the scanning task and start scanning the target system for vulnerabilities;

[0043] 3) View and export scan results, summarize and view scan results, and export them into a specific format;

[0044] 4) Scan result data analysis, supporting trend analysis and comparative analysis of multiple scan results.

[0045] like Figure 3 As shown in the figure, by generating vulnerability scanning tasks, the lower-level scanner devices are scheduled to perform online scanning. It mainly involves two parts: task management and scheduling engine. The lower-level devices rely on the A interface channel provided by the southbound to issue device commands and return results.

[0046] Task strategy: After the user selects a template, configures parameters, selects a device, and clicks OK, a task strategy is created within the scheduling engine.

[0047] Task: When the scheduling engine detects that a new task policy has been added and the policy meets the prerequisite for creating a task (such as the execution time has arrived), the scheduling engine creates a corresponding task internally (periodic task: that is, a task policy is executed periodically to create multiple tasks).

[0048] Subtask: The scheduling engine splits the task according to the task configuration, target situation, device scan range, and target reachability. The splitting logic is as follows: The device splits at least one subtask according to the subtask splitting logic, and a subtask must be sent to one device.

[0049] Subtask recycling: When a subtask is sent to a device and an abnormal situation occurs, such as "no progress and results are reported and timeout occurs, and recycling is required", the scheduling engine will recycle the target and device involved in the subtask, and try to resend the target to a new device, and the original device will be temporarily "silent".

[0050] Subtask message: It is the agreement between the platform and the scanner to upload the scanning results in the form of text in different log types (message types) through the A interface file to the platform's specified directory.

[0051] Subtask result tolerance: If message loss occurs in the task result, if the difference between the sum of all messages counted by the subtask result and the sum of all messages reported by the device is less than 5 or the difference between the messages / the sum of all messages reported by the device is less than 10%, it is within the acceptable tolerance of the platform and will not be recycled.

[0052] Task progress: number of subtask scan targets / total number of task scannable targets*accumulated subtask progress.

[0053] Task abnormality threshold: Except for fatal internal errors, if the number of subtask abnormal completions exceeds 3 times and the number of failed scan targets is greater than 3%, the task will be directly set as failed.

[0054] 3. Vulnerability Analyzer

[0055] The vulnerability analyzer consists of two major modules:

[0056] 1) Asset vulnerability discovery: including scanning task management + third-party data management, completing online vulnerability scanning of assets or specific target IP / URLs, and importing offline results; third-party vulnerability data access.

[0057] 2) Asset vulnerability analysis: unified analysis of multi-source vulnerabilities, vulnerability value calculation, and statistical analysis of vulnerabilities in different dimensions.

[0058] like Figure 4 As shown, the vulnerability analysis includes the following:

[0059] 1) First, score the vulnerability dimensions for the discovered vulnerability issues;

[0060] 2) Vulnerability scoring in the single host dimension;

[0061] 3) Configuration compliance score of a single host;

[0062] 4) Asset vulnerability score in the single host dimension;

[0063] 5) Vulnerability scores for asset groups containing multiple assets;

[0064] 6) Give a vulnerability level assessment based on the score.

[0065] The calculation principles of asset risk assessment conform to the barrel principle, marginal utility, convergence, median, and approximation. The value range is [0, 10] and the minimum granularity is 0.01.

[0066] Vulnerability analysis system such as Figure 6 As shown. The vulnerability assessment algorithm is as follows:

[0067] Risk=P(Exploit)*Businessimpact=[CVSS_score*Asset_weight]*Business_impact;

[0068] The risk assessment object can be a single vulnerability*single asset, multiple vulnerabilities*single asset, a single vulnerability*asset group, or multiple vulnerabilities*asset group;

[0069] For the asset_weight in the risk composition, the Businessimpact system provides a default configuration, and the blue link can be scored by the user;

[0070] The risk assessment result is a risk value, which is classified into risk categories according to the CVSS risk level.

[0071] The asset network risk adopts the asset weight in asset management. Compared with the host risk value, the asset weight has less impact. The weighted risk value of the host is r hw for:

[0072]

[0073] Asset network risk refers to the risk that an asset may be attacked, which is basically equivalent to asset vulnerability risk. The number of vulnerabilities and vulnerability levels of assets are the sources of asset risk. Vulnerability is equivalent to vulnerability, and vulnerability level assessment is equivalent to vulnerability level assessment, which is used to assess the risk value that vulnerabilities will bring to assets, using a 1-10 point system.

[0074] Assume that a network has n hosts in total. The enhanced risk value list arranged from high to low according to the host danger level is: hw1 ,r hw2 ,r hw3 …r hwn , asset network risk n The calculation algorithm is as follows:

[0075]

[0076] in: is the influence coefficient; is the convergence coefficient; is the impact base; a 1 is the value of rhw1; what is calculated here is the asset risk value of the entire network. The asset risk value of the entire network is based on the risk value of a single asset, so rhw1 is a fixed value.

[0077] 4. Vulnerability Library

[0078] This component is one of the core components of the present invention. The vulnerability library includes a product vulnerability library, a password dictionary library, a configuration template, an asset tag correction module, a vulnerability plug-in library, and a knowledge base upgrade.

[0079] The three elements of platform risk assessment are assets, vulnerabilities and threats, and the core lies in vulnerability management. The system provides a built-in vulnerability library that covers most known vulnerabilities, including system / WEB / configuration areas, asset types covering Linux / Windows / MAC / IOS / Android, component types including common general components and frameworks such as Openssl / Discuz / Java / Oracle / Flash, etc., and standard organizations such as CVE / CWE / CPE, CNNVD / CNCVE, OWSAP, WASC, BUGTRAQ, etc.

[0080] Supports tracking and recording of vulnerability information from product vulnerability libraries (CVE, NVD, CNVD, CNNVD, etc.) and vulnerability intelligence libraries from different sources, obtains the latest vulnerability information as soon as possible, and provides full, authoritative, and high-quality vulnerability information. The attribute dimension vulnerability asset types cover mainstream operating systems, embedded systems, network devices, middleware, and application software asset types. Supports tracking and recording of the initial receipt, verification, and early warning of each vulnerability.

[0081] At the same time, it supports users to customize and add various vulnerability notices and emergency notifications of their own company and industry, supports standardized and unified descriptions of multi-source vulnerabilities, provides complete vulnerability field display and customization capabilities, supports product vulnerability classification and grading, and establishes a local product vulnerability knowledge base for the enterprise as a standard and basis for vulnerability management. Through continuous operation accumulation, a real internal enterprise vulnerability knowledge base can be formed, including vulnerability descriptions, risk assessments, repair plans, false alarm experience bases, etc., to facilitate internal sharing and archiving, and help enterprises to manage vulnerabilities efficiently and intelligently.

[0082] 5. Work Order System

[0083] Based on work orders and tasks, multiple links are processed in the scene. In order to achieve the decoupling of process and business and achieve the purpose of flexible configuration of process, this platform is implemented using the Camunda process engine. The workflow platform is the basis of the work order task process and is implemented using the standard BPM process engine. The BPM process engine is independent of the business and can implement any operation of complex workflows and custom workflows. The basic functions of the workflow platform are model management, model design, model deployment, classification management, and instance management.

[0084] To facilitate operation and maintenance, we provide classification management for work orders such as agent work orders, completed work orders, completed work orders, my applications, draft boxes, etc. We provide a clear work order list, clearly mark the detailed information of various work orders, and can track work orders through status flow. We support the transfer of responsible persons and multi-account collaborative processing, and support complete recording of the entire process for subsequent archiving and retention.

[0085] 6. Generator

[0086] like Figure 5 As shown, the generator associates the POC information with the vulnerability matching information to generate vulnerability reports, vulnerability rules, etc. Vulnerability scanning plug-in (vulnerability fingerprint, POC code) data is provided for the vulnerability to verify the existence and exploitability of the vulnerability, verify the authenticity of the vulnerability existence, detection and repair methods, etc., as the basis for subsequent vulnerability closed-loop management. Vulnerability matching information refers to the process of matching the rule base in the vulnerability discovery process mentioned above.

[0087] At the same time, it provides fingerprint plug-in customization capabilities, can add POC files in a standard format, and provides a POC execution engine, which can quickly call POC scanning to perform vulnerability detection and verification. Through the continuous accumulation of POC, enterprise vulnerability detection experience can be formed and the detection scope can be expanded.

[0088] Principle description:

[0089] 1) POC list management (enhanced component) provides POC list display: fields include POC ID (primary key), product vulnerability ID, name, POC type (vulnerability POC / vulnerability EXP / vulnerability fingerprint), status (consistent with product vulnerability), content description, POC file attachment, file HASH, POC plug-in file list, plug-in HASH list, engine ID list.

[0090] 2) Product vulnerability library associated with POC ID display product vulnerability library displays the relevant POC ID list.

[0091] 3) Product vulnerability library association vulnerability verification capability Product vulnerability library association shows whether the vulnerability is verifiable (leakage scanning or POC engine supports custom plug-in scanning).

[0092] 4) The scanner loads the API interface for the verifiable vulnerability encapsulation plug-in, and the leak scanner provides an API interface to support loading the modified POC plug-in for the verifiable vulnerability range.

[0093] 6)POC form local operation A single form supports uploading and downloading POC files and POC plug-ins, and provides automatic generation and comparison of HASH mechanisms.

[0094] 7)POC list operation: The list supports local addition, deletion, modification and query. Single record reference form operation; supports batch selection and operation.

[0095] 8)POC extraction (from intelligence source) supports extraction of POC content and POC files from intelligence sources.

[0096] 9) POC engine source list management: Provides a list of POC plug-in running engines, including engine ID, engine type (version detection, password guessing, host scanning, WEB scanning), engine description, engine (including dependent libraries) file download, help file download

[0097] 10) POC plug-in library preset data.

[0098] 7. Major Industry Vulnerability Database

[0099] Used to store major industry vulnerabilities and regularly evaluate major industry vulnerabilities based on the generator results. Set up operational scenarios for major vulnerabilities and implement differentiated vulnerability management requirement baselines, such as special scans with different troubleshooting methods and frequencies, monitoring and alarm strategies, and repair and assurance requirements. Vulnerability management solutions can be differentiated by scenario, focusing on key vulnerabilities, improving resource utilization, and meeting the requirements for timely reporting of troubleshooting results.

[0100] 1. Critical Vulnerability Selection Rules

[0101] Supports filtering rules for major vulnerabilities, such as tags, etc.:

[0102] 1) Provide product vulnerability tag management and support the selection of major vulnerabilities by tag;

[0103] 2) Supports selecting major vulnerabilities based on the existing attribute field content of product vulnerabilities and advanced query condition rules;

[0104] 3) Provide scenario classification of major vulnerabilities, and identification and marking of major vulnerability scenarios for industry assessments.

[0105] 2. Major Vulnerability Database Management Strategy

[0106] For major vulnerabilities in different scenarios, they need to be managed differently in subsequent business processes:

[0107] 1) Major vulnerabilities are divided into scenarios and stored and managed using different vulnerability libraries;

[0108] 2) Major vulnerabilities are product vulnerabilities, and their related system vulnerabilities require specified asset policies;

[0109] 3) Different management strategies can be configured for major vulnerability libraries in different business scenarios, such as global unified management and special strategies for major vulnerability libraries.

[0110] In summary, the present invention provides an implementation method of an asset detector, an implementation method of a vulnerability detector, and a method for establishing a major industry vulnerability library; the asset network risk adopts the asset weight in asset management, and relative to the host risk value, a weighted risk value r_hw algorithm for the host is proposed; the scanner loads an API interface for verifiable vulnerability encapsulation plug-ins, and the leak scan provides an API interface for the verifiable vulnerability range to support the scheduling method of loading the modified POC plug-in.

[0111] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A response system for closed-loop vulnerability management based on active detection and vulnerability verification, characterized by: include: Asset detectors, vulnerability detectors, vulnerability analyzers, vulnerability libraries, work order systems, generators, and major industry vulnerability libraries; The asset detector detects asset information in the traffic, and the vulnerability detector detects vulnerability information based on the asset information detected by the asset detector. The asset information and vulnerability information are synchronized to the vulnerability analyzer. The vulnerability analyzer converges the vulnerability information and compares and verifies it with the vulnerability library, screens out the vulnerabilities that need to be rescanned, and feeds them back to the vulnerability detector and the asset detector through the work order system. The vulnerability analyzer outputs the vulnerability results of the assets, and forms a major industry vulnerability library through the generator.

2. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: The asset information detected by the asset detector includes the software, hardware and services that constitute the information system.

3. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: The vulnerability detector performs the following process to detect vulnerability information: Create vulnerability scanning tasks, configure scanning targets and scanning settings; Start the vulnerability scanning task and start scanning the target for vulnerabilities; View and export scan results, and summarize the scan results; Analyze scan results and support trend analysis and comparative analysis of multiple scan results.

4. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: The vulnerability detector detects vulnerability information by generating a vulnerability scanning task and scheduling a lower-level scanner device to perform online scanning, specifically including: After the user selects a template, configures parameters, and selects a device from the interface, a task policy is created within the scheduling engine; The scheduling engine detects that there is a new task policy and the task policy meets the prerequisite for creating a task, and the scheduling engine creates a corresponding task internally; the scheduling engine splits the task according to the task configuration, target situation and the device scannable range, and each subtask corresponds to a device; when the subtask is sent to the corresponding device, if an abnormal situation occurs, the scheduling engine recycles the target and device involved in the subtask, and re-sends the target to the new device, and the original device is temporarily silent; The device's scan results are uploaded to the specified directory through the interface file in the form of text in different log types.

5. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: The vulnerability analyzer includes an asset vulnerability discovery module and an asset vulnerability analysis module; the asset vulnerability discovery module collects vulnerability information and compares and verifies it with the vulnerability library to screen out vulnerabilities that need to be rescanned; the asset vulnerability analysis module calculates the vulnerability value of the vulnerability and gives a vulnerability level assessment for evaluating asset network risks.

6. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 5, characterized in that: The asset network risk is calculated as follows: In the formula, r n Indicates the asset network risk. A network has n hosts in total, and they are arranged from high to low in terms of the host risk level: hw1 , r hw2 ,r hw3 …r hwn , is the influence coefficient, is the convergence coefficient, To affect the base, a1 is the fixed value of rhw1.

7. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: The vulnerability library includes a product vulnerability library, a password dictionary library, a configuration template, an asset tag correction module, a vulnerability plug-in library and a knowledge base upgrade.

8. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: The work order system is implemented using a BPM process engine.

9. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: The generator associates the POC information with the vulnerability matching information between the vulnerability information and the vulnerability library, and generates a vulnerability report and vulnerability rules.

10. The vulnerability closed-loop management response system based on active detection and vulnerability verification as claimed in claim 1, characterized in that: In the major industry vulnerability database, the major vulnerability selection rules include: selecting major vulnerabilities by vulnerability tags; selecting major vulnerabilities according to the existing attribute field content of the vulnerability and advanced query condition rules; selecting major vulnerabilities based on vulnerability scenario classification, identification and marking.

Images