Vulnerability processing method and device, equipment and storage medium

Abstract

The invention discloses a vulnerability processing method and device, equipment and a storage medium, and the method comprises the steps: carrying out the component analysis of a to-be-detected application program, and obtaining the application component information of the application program; performing vulnerability analysis on the application component information by utilizing pre-collected vulnerability intelligence information, and determining a vulnerability scanning range; executing a vulnerability scanning task based on the vulnerability scanning range, and determining vulnerability information according to a scanning result; and based on the vulnerability information, carrying out risk assessment on vulnerabilities, and carrying out vulnerability disposal according to an assessment result. According to the method and the device, the security vulnerabilities in the application program are identified by analyzing the components of the application program in detail and combining the vulnerability information updated in real time, and meanwhile, the vulnerabilities are subjected to risk assessment and disposal, and corresponding vulnerability disposal measures are taken according to the risk assessment result, so that the security vulnerabilities in the application program are eliminated. Therefore, the security vulnerabilities in the application program can be efficiently and accurately identified and processed.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to vulnerability processing methods, devices, equipment and storage media. Background Art

[0002] In the field of information technology, identifying and handling security vulnerabilities in applications is a critical task. As software complexity increases, modern applications are often built with multiple programming languages, frameworks, and third-party libraries. The security issues of these components directly affect the security of the overall application. Cybersecurity threats continue to evolve, and new vulnerabilities and attack methods emerge in an endless stream, posing a challenge to application security.

[0003] In addition, the practice of agile development and continuous integration / continuous deployment (CI / CD) has led to frequent software updates, and security testing needs to be quickly integrated into the development cycle. At the same time, the popularity of cloud services and microservice architectures has increased the complexity of application deployment, further exacerbating the risk of security vulnerabilities. Although the widespread use of open source components has brought convenience to development, it has also introduced unknown security vulnerabilities. The development and application of these technologies have made efficient and accurate identification and handling of security vulnerabilities in applications an important issue facing the technology field. Summary of the invention

[0004] The main purpose of this application is to provide a vulnerability handling method, device, equipment and storage medium, aiming to solve the technical problem of how to efficiently and accurately identify and handle security vulnerabilities in applications.

[0005] To achieve the above purpose, the present application provides a vulnerability processing method, which comprises the following steps:

[0006] Perform component analysis on the application to be detected to obtain application component information of the application;

[0007] Perform vulnerability analysis on the application component information using the vulnerability intelligence information collected in advance to determine the vulnerability scanning scope;

[0008] Execute a vulnerability scanning task based on the vulnerability scanning scope, and determine vulnerability information according to the scanning result;

[0009] Based on the vulnerability information, a risk assessment is performed on the vulnerability, and the vulnerability is handled according to the assessment results.

[0010] In one embodiment, the vulnerability intelligence information includes affected component information, and the step of performing vulnerability analysis on the application component information using the pre-collected vulnerability intelligence information to determine the vulnerability scanning scope includes:

[0011] The vulnerability scanning scope is determined by screening the first application program that includes the impact component in the application components of the application program.

[0012] In one embodiment, the step of performing a vulnerability scanning task based on the vulnerability scanning scope and determining vulnerability information according to the scanning result includes:

[0013] According to the vulnerability priority order obtained in advance, the vulnerability information is determined by comparing the vulnerability intelligence information with the application component information within the vulnerability scanning range.

[0014] In one embodiment, before the step of performing vulnerability analysis on the application component information using the pre-collected vulnerability intelligence information, the step further includes:

[0015] Perform data preprocessing on the vulnerability intelligence information collected in advance;

[0016] The vulnerabilities are prioritized according to the vulnerability intelligence information to obtain a vulnerability priority order.

[0017] In one embodiment, the vulnerability scanning task is executed in a manner that combines periodic execution and triggered execution.

[0018] In one embodiment, the step of performing risk assessment on the vulnerability based on the vulnerability information and handling the vulnerability according to the assessment result includes:

[0019] Based on the vulnerability information, comprehensively evaluate the severity of the vulnerability, the possibility of being exploited, the potential business impact, and specific security requirements to determine the risk level of the vulnerability and the vulnerability handling strategy;

[0020] A repair priority is determined based on the risk level, and a vulnerability handling strategy is executed according to the repair priority.

[0021] In one embodiment, after the step of performing component analysis on the application to be detected and obtaining application component information of the application, the following step is further performed:

[0022] Deploy the application to a runtime environment.

[0023] In addition, to achieve the above-mentioned purpose, the present application also provides a vulnerability processing device, the vulnerability processing device comprising:

[0024] An acquisition module, used to perform component analysis on the application to be detected and acquire application component information of the application;

[0025] An analysis module, used to perform vulnerability analysis on the application component information using pre-collected vulnerability intelligence information to determine the vulnerability scanning scope;

[0026] An execution module, used to execute a vulnerability scanning task based on the vulnerability scanning scope, and determine vulnerability information according to the scanning result;

[0027] The rectification module is used to perform risk assessment on the vulnerability based on the vulnerability information and to handle the vulnerability according to the assessment results.

[0028] In addition, to achieve the above-mentioned purpose, the present application also provides a terminal device, which includes a memory, a processor, and a vulnerability handling program stored in the memory and executable on the processor, and the vulnerability handling program implements the steps of the vulnerability handling method described above when executed by the processor.

[0029] In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a vulnerability handling program is stored, and when the vulnerability handling program is executed by a processor, the steps of the vulnerability handling method described above are implemented.

[0030] One or more technical solutions proposed in this application have at least the following technical effects:

[0031] The present application adopts a technical solution of performing component analysis on the application to be detected, obtaining application component information of the application, comparing and analyzing the application component information with vulnerability intelligence information collected in advance, executing vulnerability scanning tasks based on the scanning scope, determining vulnerability information based on the scanning results, conducting risk assessment on the vulnerability based on the vulnerability information, and handling the vulnerability based on the assessment results.

[0032] By analyzing the components of the application to be tested, we can obtain comprehensive application component information, and compare and analyze these component information with the vulnerability intelligence information collected in advance, so as to make the vulnerability scanning scope more accurate and avoid the waste of resources caused by blind scanning. Therefore, by conducting a detailed analysis of the components of the application, combined with the vulnerability intelligence information updated in real time, it is possible to efficiently and accurately identify security vulnerabilities in the application. At the same time, by conducting risk assessment and disposal of vulnerabilities, according to the results of risk assessment, taking corresponding vulnerability disposal measures, such as fixing vulnerabilities, upgrading components or adjusting security policies, etc., the security of the application is effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flowchart of a first exemplary embodiment of the vulnerability handling method of the present application;

[0034] Figure 2 This is a flow chart of a second exemplary embodiment of the vulnerability handling method of the present application;

[0035] Figure 3 This is a schematic diagram of the module structure of the vulnerability processing device according to an embodiment of the present application;

[0036] Figure 4 A schematic diagram of the device structure of the hardware operating environment involved in the vulnerability handling method in the embodiment of the present application.

[0037] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0038] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] The main technical solution of this application is: perform component analysis on the application to be detected to obtain application component information, and deploy the application to the running environment, use the vulnerability intelligence information collected in advance to perform vulnerability analysis on the application component information to determine the vulnerability scanning scope; execute the vulnerability scanning task based on the vulnerability scanning scope, and determine the vulnerability information according to the scanning results; based on the vulnerability information, perform risk assessment on the vulnerability, and handle the vulnerability according to the assessment results.

[0040] This application actually takes into account that common vulnerability scanning methods have problems of low efficiency and insufficient accuracy when dealing with security vulnerabilities in applications. Specifically, common vulnerability scanning methods often rely on static rules and policies, which are difficult to adapt to the complex and changing characteristics of modern applications, such as the mixed use of multiple programming languages, frameworks and third-party libraries, and the frequent updates brought about by agile development and continuous integration / continuous deployment (CI / CD) practices. In addition, the popularity of cloud services and microservices architectures has increased the complexity of application deployment, further exacerbating the risk of security vulnerabilities.

[0041] Based on this, the embodiment of the present application proposes a solution: perform component analysis on the application to be detected, obtain the application component information of the application, and deploy the application to the running environment; perform data preprocessing on the vulnerability intelligence information; perform vulnerability priority sorting based on the vulnerability intelligence information collected in advance to obtain the vulnerability priority order. Perform vulnerability analysis on the application component information using the vulnerability intelligence information to determine the vulnerability scanning scope; perform vulnerability scanning tasks based on the vulnerability scanning scope, determine vulnerability information based on the scanning results, perform risk assessment on the vulnerability based on the vulnerability information, and perform vulnerability disposal based on the assessment results.

[0042] Specifically, the following are the detailed steps of the first exemplary embodiment of the vulnerability processing method of this application:

[0043] Reference Figure 1 , Figure 1This is a flowchart of the first exemplary embodiment of the vulnerability processing method of the present application. In this embodiment, the vulnerability processing method includes steps S10 to S40:

[0044] Step S10, performing component analysis on the application to be detected to obtain application component information of the application;

[0045] It should be noted that before extracting the application code from the code repository and performing component analysis on the application code, a component management system is pre-built. The specific construction process is as follows:

[0046] First, classify and sort out the components. Specifically, identify all components used in the application code base, including open source libraries, frameworks, and system components. Classify them according to the technology stack (such as front-end, back-end, database, etc.) and the functions in the application. Classify the security risks according to the history of security vulnerabilities and the wide range of use of the components. Focus on components with a large number of historical vulnerabilities or known serious security issues, record the classification and classification information, and form a component risk level assessment report. Secondly, select a suitable software component analysis tool, integrate it into the CI / CD pipeline, automatically scan the application source code during the build and test phase, analyze the component information used by the application, and mainly analyze the project dependency files such as package.json and pom.xml to automatically identify and generate identification. Then, design a unified format that includes component name, version number, source, license type, and other information. Naming specifications must follow industry standards, such as using the naming conventions of Maven, NPM, or PyPi. Establish a metadata table to standardize the storage of identification information, and regularly update and review the identification information to avoid confusion. Secondly, build an internal component library to record all third-party libraries, frameworks, and dependencies used in all applications.

[0047] When performing component analysis, first, you need to identify the various components in the application. This includes identifying third-party libraries, frameworks, and dependencies in the application. For example, you can use the PackageManager class to obtain the component information of the application, and then analyze the component information. The PackageInfo object obtained by the PackageManager can contain information such as the package name (packageName), version number (versionCode), version name (versionName), etc., so as to obtain the application component information of the application.

[0048] Additionally, analyze how components interact with each other. This can be done by analyzing the AndroidManifest.xml file, which defines the application's components and the relationships between them.

[0049] Step S20, using the pre-collected vulnerability intelligence information to perform vulnerability analysis on the application component information to determine the vulnerability scanning scope;

[0050] In a feasible implementation manner, step S20 may include steps S51 to S52:

[0051] Step S51, pre-processing and abnormality checking of the pre-collected vulnerability intelligence information;

[0052] Step S52: sort the vulnerability priorities according to the vulnerability intelligence information to obtain the vulnerability priority order.

[0053] It should be noted that the collection of vulnerability intelligence information is first carried out based on the needs assessment. Specifically, based on the needs assessment of the assets, technology stacks, business areas, etc. that need to be monitored, the required services are subscribed according to the assessment results, and the corresponding API access rights are configured. Set monitoring parameters such as keywords, vulnerability severity levels, etc. to ensure that only relevant intelligence is received. The subscription platform can be combined with a commercial platform or an open source platform, or the two can complement each other. The commercial platform can provide high-quality threat intelligence information, and the open source platform can provide free vulnerability information.

[0054] At the same time, internal vulnerability standards are established to determine the information content of the vulnerabilities that need to be collected, mainly including vulnerability name, vulnerability type, CVE number, vulnerability score, threat level, affected components, affected versions, vulnerability description, vulnerability characteristics, whether there is a POC, repair suggestions, discovery time, data source, intelligence accuracy and other fields. The threat level is assessed by combining automated calculations and manual adjustments, and is divided into four risk levels: critical, high risk, medium risk and low risk, and requires periodic review and adjustment. The calculation of intelligence accuracy distinguishes whether it is the first appearance. If it is not the first appearance, the accuracy of the intelligence already in the library is recalculated based on multi-source data comparison and assigned to the current vulnerability intelligence data; if it is the first appearance, a basic score is given based on the data source, and then calculated based on the component type, vulnerability type, whether there is a POC and other fields.

[0055] Specifically, first use automated tools to collect vulnerability intelligence data from the subscribed platform. Then, perform data preprocessing on the pre-collected vulnerability intelligence information. Data preprocessing includes data cleaning, formatting, and multi-source data comparison of vulnerability intelligence information. Specifically, first extract the required data content based on the original data, remove duplicate vulnerability information, verify the accuracy of the vulnerability information, and exclude erroneous or outdated data. Then, format the cleaned data and map the content to each field of the vulnerability information of the internal standard. After storing the cleaned and formatted data in the database, extract the same vulnerability information from other data sources from the database, and take out the key fields for similarity matching. If there is a large difference in data, manual proofreading is required to check whether there is any abnormality in the data content. If there is an abnormality, it is adjusted and then put into the database.

[0056] Furthermore, vulnerability priorities are sorted according to the vulnerability intelligence information to obtain a vulnerability priority order.

[0057] Based on the vulnerability intelligence data collected above, the vulnerability priority is sorted by combining the comprehensive evaluation results of vulnerability severity assessment and internal assessment, so as to obtain the vulnerability priority order. Specifically, the Common Vulnerability Scoring System (CVSS) is first used to quantitatively evaluate the severity of the vulnerability. The CVSS score takes into account multiple factors such as the exploitability, scope of impact, confidentiality, integrity and availability of the vulnerability, and generates a score for each vulnerability. This score can intuitively reflect the potential threat level of the vulnerability. Then, according to the type of business and focus of the company, an internal assessment is conducted by combining multiple dimensions such as vulnerability type, scope of impact, and whether there is an exploitable POC (Proof of Concept). The internal assessment may include considering whether the vulnerability affects key business systems, whether there are available patches or mitigation measures, and the actual possibility of the vulnerability being exploited. Combining the results of the CVSS score and the internal assessment, the vulnerabilities can be prioritized.

[0058] For example, suppose a remote code execution vulnerability is discovered on a web server. Through CVSS assessment, the vulnerability may receive a high score of 9.8, which means it is a high-risk vulnerability that can be exploited by an attacker to completely control the affected system. If the current business is highly dependent on the web server, there is no patch available, and a public POC has appeared, then the vulnerability will also be considered a very high priority in the internal assessment. Since the remote code execution vulnerability has a high CVSS score, has a significant impact on the current business, and has an exploitable POC, it will be listed as the highest priority vulnerability.

[0059] Based on the above steps, step S20 is executed to perform vulnerability analysis on the application component information using the vulnerability intelligence information collected in advance to determine the vulnerability scanning scope;

[0060] In a feasible implementation, step S20 may include step S21:

[0061] Step S21, determining the vulnerability scanning scope by screening the first application program including the impact component in the application components of the application program.

[0062] Specifically, first, the component information in the vulnerability intelligence is mapped to the internal component library to identify which components are affected. The collected affected components are matched with the components of the application to find out the affected components contained in the application, and the versions of the affected components are compared with the versions used in the application to determine whether they are affected by the vulnerability. Based on the matching results, the applications containing the affected components are determined, and these applications are the first applications that need to be scanned for vulnerabilities.

[0063] Step S30, executing a vulnerability scanning task based on the vulnerability scanning range, and determining vulnerability information according to the scanning result;

[0064] In a feasible implementation, step S30 may include step S31:

[0065] Step S31, according to the pre-acquired vulnerability priority order, the vulnerability information is determined by comparing the vulnerability intelligence information with the application component information within the vulnerability scanning range.

[0066] Specifically, first formulate a vulnerability scanning plan based on the determined vulnerability scanning scope and vulnerability priority ranking. Specifically, the formulation of the vulnerability scanning plan needs to consider the following key factors: first, the scanning schedule, including the start time and end time of the scan, and whether periodic scanning or triggered scanning is required; second, the resource allocation of the scan, that is, determining which scanning tools to use and how much computing resources to allocate for the scan; third, the specific scanning strategy, which includes the depth and breadth of the scan and the scanning methods for different types of vulnerabilities and components.

[0067] After developing a scanning plan, start the vulnerability scanning task. Determine whether there are known vulnerabilities by comparing the vulnerability intelligence information collected in advance with the application component information within the scope of the vulnerability scan. Assume that the currently running application is a web application that uses multiple open source libraries and frameworks, such as Apache HTTP Server, MySQL database, and jQuery library. During the comparison process, check whether the versions of these components match the affected versions recorded in the vulnerability intelligence.

[0068] For example, if vulnerability intelligence shows that a version of Apache HTTP Server (such as 2.4.49) has a remote code execution vulnerability with the CVE number CVE-2024-1234, then it will check whether this specific version of Apache HTTP Server is used in the currently running application. If it is found that the application does use this version of the server, then it can be determined that the vulnerability exists in the currently running application.

[0069] It should be noted that when developing a scanning plan, these known high-risk vulnerabilities should be scanned first because they pose the greatest potential threat. The scanning tool should be arranged to perform a deep scan of all front-end and back-end servers of the web application during off-peak hours, with special attention paid to components related to known vulnerabilities.

[0070] Step S40: Based on the vulnerability information, risk assessment is performed on the vulnerability, and vulnerability disposal is performed according to the assessment result.

[0071] In a feasible implementation, step S40 may include steps S41 to S42:

[0072] Step S41, based on the vulnerability information, comprehensively evaluate the severity of the vulnerability, the possibility of being exploited, the potential business impact, and specific security requirements to determine the risk level of the vulnerability and the vulnerability handling strategy;

[0073] Specifically, a comprehensive assessment is conducted on the discovered vulnerabilities to determine the risk level of each vulnerability and the corresponding disposal strategy. This process first involves an assessment of the severity of the vulnerability, which is usually based on the extent of damage that could be caused if the vulnerability is exploited. For example, if a vulnerability allows unauthorized access to sensitive data, this would be considered severe because it could lead to data leakage.

[0074] The likelihood of exploitation assessment considers the probability that a vulnerability is discovered and exploited by an attacker, which may be related to the complexity of the vulnerability, its degree of publicity, and whether there is known exploit code. For example, a known SQL injection vulnerability has a high likelihood of being exploited because it is easy for attackers to understand and exploit.

[0075] The potential business impact assessment focuses on the impact that a vulnerability could have on business operations. This includes considering the potential impact of the vulnerability on business continuity, financial losses, reputational damage, etc. For example, a vulnerability affecting an online payment system could have a huge impact on the business as it could lead to failed transactions and a loss of customer trust.

[0076] Specific security needs assessments involve considering the organization’s security policies, compliance requirements, and risk tolerance. For example, for organizations that need to comply with strict data protection regulations, any vulnerabilities that could lead to data breaches need to be prioritized.

[0077] After combining these factors, each vulnerability can be assigned a risk level, such as low, medium, or high, and a corresponding disposal strategy can be developed. For high-risk vulnerabilities, the strategy may include applying patches immediately, isolating the affected system, or restricting access to the affected system. For medium-risk vulnerabilities, the strategy may include fixing them during the next maintenance cycle or monitoring their activities. For low-risk vulnerabilities, you may choose to continue monitoring or fix them in future software updates.

[0078] Step S42: determine a repair priority based on the risk level, and execute a vulnerability handling strategy according to the repair priority.

[0079] Specifically, for example, suppose a high-risk cross-site scripting (XSS) vulnerability is discovered, which allows an attacker to execute malicious scripts in the user's browser. Given its high risk level, the disposal strategy may be to apply a patch immediately and restrict access to the affected pages before applying the patch. The priority of fixing this vulnerability needs to be set to the highest, and the development team and security team need to be notified to collaborate to develop, test, and deploy a patch as soon as possible. At the same time, a security advisory may be posted on the website to inform users of the potential risks and provide temporary mitigation measures, such as avoiding the use of certain features or updating browser plug-ins.

[0080] For a medium-risk vulnerability, such as a buffer overflow vulnerability that affects non-core functionality, the treatment strategy might be to add it to the next regularly scheduled security update. Monitor the vulnerability to ensure it is not exploited before the update is released, and possibly notify users of the known risk, but no emergency measures will be taken immediately.

[0081] Reference Figure 2 , Figure 2 This is a flow chart of a second exemplary embodiment of the vulnerability handling method of the present application. Further, based on Figure 1 In the second exemplary embodiment of the present application, step S10: performing component analysis on the application to be detected, and obtaining application component information of the application further includes step S11:

[0082] Step S11, deploying the application to the operating environment.

[0083] It should be noted that the application that has undergone component analysis is deployed to the actual operating environment to ensure that the application can run stably in the real environment and provide a practical test platform for subsequent vulnerability scanning and risk assessment.

[0084] Specifically, you first need to prepare the operating environment, which includes configuring servers, databases, and other necessary infrastructure. For example, if the application is a web-based application, you need to set up a web server such as Apache or Nginx, and a database server such as MySQL or MongoDB. The configuration of these services should follow best security practices, including using strong passwords, applying security patches in a timely manner, and configuring firewall rules.

[0085] Next, deploy the application's code and dependencies to the server. This may involve checking out the code from a version control system such as Git, or getting precompiled binaries from a build server such as Jenkins. During deployment, you need to ensure that all dependencies are properly installed, including library files, frameworks, and other runtime components.

[0086] Taking an actual web application as an example, suppose there is an e-commerce website developed using the Python Flask framework. In step S10, the components of the website have been analyzed, including Flask, database driver, payment gateway interface, etc. In step S11, this e-commerce website is deployed on a cloud server. First, create a new virtual machine instance on a cloud service provider (such as AWS or Azure) and install Nginx as a web server and PostgreSQL as a database server. Then, connect to the virtual machine via SSH, upload the code of the Flask application, and install all required Python packages and modules. Next, configure Nginx to reverse proxy to the Flask application and set up a database to store product information and user data. Finally, start Nginx and the Flask application and perform preliminary tests to ensure that the website can be accessed normally in the browser and that the shopping cart and checkout processes work properly.

[0087] During the deployment process, you also need to consider the consistency of the environment and ensure that the configurations between the development, test, and production environments are as similar as possible to reduce problems caused by environmental differences. In addition, you also need to monitor the log output during the deployment process to promptly discover and resolve deployment problems.

[0088] After deployment is complete, the application will enter the actual running state, users can start to interact, and the security team can start to perform vulnerability scans and monitor the behavior of the application to verify the results of component analysis and identify any new security issues. This step provides a practical basis for subsequent security assessments and vulnerability repairs, and is a key link in ensuring application security.

[0089] Furthermore, in a feasible implementation manner, the vulnerability scanning task is executed in a manner that combines periodic execution and triggered execution.

[0090] It should be noted that the vulnerability scanning task combines two execution modes: periodic execution and triggered execution, to ensure continuous and timely monitoring of application security vulnerabilities. It aims to balance resource consumption and response speed, ensuring that new vulnerabilities can be discovered in a timely manner while avoiding unnecessary impact on system performance due to frequent scanning.

[0091] In terms of periodic execution, vulnerability scanning tasks are automatically triggered according to a predetermined schedule. For example, a weekly or monthly scanning schedule can be set to ensure regular review of applications. This periodic scanning helps to discover new vulnerabilities that may appear over time or are introduced due to software updates. For example, an enterprise may decide to automatically launch a full vulnerability scan of its web application during off-peak hours each week, such as the early morning hours on weekends, to minimize the impact on users while ensuring that potential security issues are discovered and fixed in a timely manner.

[0092] Triggered execution triggers vulnerability scanning when specific events occur. These events may include software updates, configuration changes, deployment of new patches, or the occurrence of security incidents. For example, when an organization deploys new middleware on its web server or updates the database management system, a vulnerability scan can be automatically triggered to check whether these changes have introduced new security vulnerabilities. Such an immediate response helps to quickly identify and fix security issues caused by changes and reduce potential attack surfaces.

[0093] Combining these two execution methods, vulnerability scanning strategies can be more flexible and effective. Periodic execution ensures continuous monitoring, while triggered execution allows for quick response to specific events. For example, an e-commerce platform may perform vulnerability scanning immediately after each new version is released to ensure that the new code does not introduce security vulnerabilities. At the same time, the platform will also set up regular monthly scans to monitor and identify those vulnerabilities that may appear over time.

[0094] At the same time, when implementing step S11, multiple factors need to be considered, including the frequency of scanning, resource availability, business needs and security risks. By properly configuring the periodic execution and triggered execution strategies, security risks can be effectively managed and reduced while ensuring business continuity.

[0095] In addition, the present application also proposes a vulnerability processing device, the vulnerability processing device comprising:

[0096] An acquisition module 10 is used to perform component analysis on the application to be detected and acquire application component information of the application;

[0097] An analysis module 20 is used to perform vulnerability analysis on the application component information using the vulnerability intelligence information collected in advance to determine the vulnerability scanning scope;

[0098] An execution module 30 is used to execute a vulnerability scanning task based on the vulnerability scanning scope and determine vulnerability information according to the scanning result;

[0099] The rectification module 40 is used to perform risk assessment on the vulnerability based on the vulnerability information and perform vulnerability disposal according to the assessment result.

[0100] The vulnerability processing device provided by the present application adopts the vulnerability processing method in the above embodiment, aiming to solve the technical problem of how to efficiently and accurately identify and process security vulnerabilities in applications. Compared with the prior art, the beneficial effects of the vulnerability processing device provided by the present application are the same as the beneficial effects of the vulnerability processing method provided by the above embodiment, and the other technical features in the vulnerability processing device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0101] The present application provides a vulnerability processing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the vulnerability processing method in the above-mentioned embodiment one.

[0102] The vulnerability processing device in the embodiments of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., as well as fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The vulnerability processing device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0103] like Figure 4As shown, the vulnerability processing device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the vulnerability processing device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the vulnerability processing device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a vulnerability processing device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0104] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0105] The vulnerability processing device provided by the present application adopts the vulnerability processing method in the above embodiment, aiming to solve the technical problem of how to efficiently and accurately identify and process security vulnerabilities in applications. Compared with the prior art, the beneficial effects of the vulnerability processing device provided by the present application are the same as the beneficial effects of the vulnerability processing method provided by the above embodiment, and the other technical features in the vulnerability processing device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0106] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0107] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0108] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the vulnerability handling method in the above-mentioned embodiment.

[0109] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0110] The above-mentioned computer-readable storage medium may be included in the vulnerability processing device; or it may exist independently without being assembled into the vulnerability processing device.

[0111] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0112] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0113] The modules involved in the embodiments described in the present application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0114] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned vulnerability handling method, and is intended to solve the technical problem of how to efficiently and accurately identify and handle security vulnerabilities in applications. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the vulnerability handling method provided by the above-mentioned embodiment, and will not be repeated here.

[0115] The present application also provides a computer program product, including a computer program, which implements the steps of the vulnerability processing method as described above when executed by a processor.

[0116] The computer program product provided by this application is intended to solve the technical problem of how to efficiently and accurately identify and handle security vulnerabilities in applications. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the vulnerability handling method provided by the above embodiment, and will not be repeated here.

[0117] Compared with the prior art, the vulnerability processing method, device, equipment, medium and computer product proposed in the embodiment of the present application extracts the business feature information of the target business, performs data standardization processing on the business feature information to obtain standard feature data, performs hash processing on the standard feature data to obtain unique feature data, performs numerical processing and splicing processing on the unique feature data, obtains the first business feature value, accumulates the first business feature value of the target business to obtain the target business feature value, and finally compares the target business feature value with the feature value set to obtain the vulnerability processing result. Compared with the traditional method of identifying duplicate businesses by generating a unique key value or a continuous serial number for each business, it is more efficient, flexible and reliable. Based on the solution of the present application, by subjecting the business of complex scenarios to a series of simple transformations and finally converting it into a comparison of two numbers, the comparison process is very intuitive and efficient. The system only needs to simply compare whether the two values ​​are equal to quickly determine whether the two businesses are exactly the same.

[0118] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0119] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0120] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, a controlled terminal, or a network device, etc.) to execute the method of each embodiment of the present application.

[0121] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A vulnerability processing method, characterized in that: The vulnerability handling method includes: Perform component analysis on the application to be detected to obtain application component information of the application; Perform vulnerability analysis on the application component information using the vulnerability intelligence information collected in advance to determine the vulnerability scanning scope; Execute a vulnerability scanning task based on the vulnerability scanning scope, and determine vulnerability information according to the scanning result; Based on the vulnerability information, a risk assessment is performed on the vulnerability, and the vulnerability is handled according to the assessment results.

2. The vulnerability processing method according to claim 1, characterized in that: The vulnerability intelligence information includes affected component information, and the step of using the pre-collected vulnerability intelligence information to perform vulnerability analysis on the application component information and determine the vulnerability scanning scope includes: The vulnerability scanning scope is determined by screening the first application program that includes the impact component in the application components of the application program.

3. The vulnerability processing method according to claim 1, characterized in that: The step of performing the vulnerability scanning task based on the vulnerability scanning scope and determining the vulnerability information according to the scanning result comprises: According to the vulnerability priority order obtained in advance, the vulnerability intelligence information is compared with the application component information within the vulnerability scanning range to determine the vulnerability information.

4. The vulnerability processing method according to claim 1, characterized in that: Before the step of using the pre-collected vulnerability intelligence information to perform vulnerability analysis on the application component information, the step further includes: Perform data preprocessing on the vulnerability intelligence information collected in advance; The vulnerabilities are prioritized according to the vulnerability intelligence information to obtain a vulnerability priority order.

5. The vulnerability processing method according to claim 1, characterized in that: The vulnerability scanning task is executed by combining periodic execution and triggered execution.

6. The vulnerability processing method according to claim 1, characterized in that: The steps of performing risk assessment on the vulnerability based on the vulnerability information and handling the vulnerability according to the assessment result include: Based on the vulnerability information, comprehensively evaluate the severity of the vulnerability, the possibility of being exploited, the potential business impact, and specific security requirements to determine the risk level of the vulnerability and the vulnerability handling strategy; A repair priority is determined based on the risk level, and a vulnerability handling strategy is executed according to the repair priority.

7. The vulnerability processing method according to claim 1, characterized in that: After the step of performing component analysis on the application to be detected and obtaining application component information of the application, the following step further comprises: Deploy the application to a runtime environment.

8. A vulnerability processing device, characterized in that: The device comprises: An acquisition module, used to perform component analysis on the application to be detected and acquire application component information of the application; An analysis module, used to perform vulnerability analysis on the application component information using pre-collected vulnerability intelligence information to determine the vulnerability scanning scope; An execution module, used to execute a vulnerability scanning task based on the vulnerability scanning scope, and determine vulnerability information according to the scanning result; The rectification module is used to perform risk assessment on the vulnerability based on the vulnerability information and to handle the vulnerability according to the assessment results.

9. A vulnerability processing device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the vulnerability processing method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the vulnerability processing method according to any one of claims 1 to 7 are implemented.

Images