A method and system for improving vulnerability detection and vulnerability rectification efficiency

Abstract

The present invention relates to a method and system for improving the efficiency of vulnerability detection and vulnerability rectification. The method includes the following processes: using a probe to identify various services, middleware, applications and other information running on the machine, and sending the information to a vulnerability management system; establishing an asset ledger in the vulnerability management system to form an asset model diagram; the threat intelligence module will access the Internet threat intelligence library in real time, monitor threats in real time, and give vulnerability repair suggestions; by vulnerability type, classify and perform one-click version repair and other repairs. The present invention classifies information system assets into correspondences with vulnerability threat intelligence, performs vulnerability comparison according to vulnerability type, and effectively improves the efficiency of vulnerability investigation; by classifying vulnerability rectification, one-click upgrades are performed on vulnerabilities that only require upgraded versions, greatly improving the efficiency of vulnerability repair, and improving the accuracy of subsequent vulnerability detection and repair by maintaining asset models.

Description

Technical Field

[0001] The present invention relates to a security device for a computer system, and in particular to a method and a system for improving the efficiency of vulnerability detection and vulnerability rectification. Background Art

[0002] With the rapid development of Internet technology, the situation of network attacks is becoming increasingly severe, and there are more and more problems with computers. Hackers at home and abroad often exploit potential vulnerabilities in computers and use them to carry out various destructive activities, causing many losses to individuals and enterprises. At the least, data leaks may occur, and at worst, computers may be controlled, causing huge economic losses and other risks.

[0003] There is no absolutely secure system. In order to protect the information system of an enterprise from attacks by lawless elements, it is necessary to constantly discover and repair its own vulnerabilities and improve security. Power grid enterprises not only have great economic benefits, but also bear great social value, which is related to the national economy and people's livelihood. How to ensure the safe and stable operation of the information system of power grid enterprises and timely discover and rectify vulnerabilities has always been the focus and hot spot of the industry.

[0004] The terminals and devices in the information system are complex, and the middleware, databases, application services, and even the underlying protocols running on them all have potential vulnerability risks. The current information system lacks a feasible model that relates to its operating services, software and hardware equipment. It automatically detects threat intelligence on the Internet and performs unified and classified automated vulnerability detection locally based on the principles of timely discovery and immediate disposal.

[0005] Existing technologies mainly perform batch scanning on a single server interface or web link, mainly using payload attacks. Vulnerability detection is based on method calls and payload vulnerability detection. However, in actual application, an enterprise's information system is very large, and unclassified payload attacks on all server interfaces are obviously very time-consuming and inefficient. Summary of the invention

[0006] The present invention will automatically build an information system asset model based on the actual information system, classify the services and hardware running on it, classify them through threat intelligence, verify vulnerabilities in batches, and give vulnerability repair suggestions to maximize the efficiency of vulnerability detection and check the list of assets affected by the vulnerability. The specific technical solution is as follows:

[0007] In a first aspect, the present invention provides a method for improving vulnerability detection and vulnerability rectification efficiency, comprising the following process:

[0008] S100: Establish a central information system server and personal terminal connection model, and deploy an application probe on it. The probe can identify various services, middleware, applications and other information running on the machine, and send the information to the vulnerability management system;

[0009] S200: In the vulnerability management system, an asset ledger is established based on the information pushed by each server and personal terminal, which can record in detail the application services and versions, middleware, databases, open ports and other information on each machine to form an asset model diagram;

[0010] S300: The threat intelligence module will access the Internet threat intelligence library in real time, including the CVE library, CNVD, and threat intelligence from various security vendors, monitor threats related to the asset model in real time, and output a list of assets that may be involved through comparison, and provide vulnerability repair suggestions;

[0011] S400: Classify by vulnerability type and perform one-click version repair and other repairs. If the third-party version can be upgraded to repair the vulnerability, a one-click upgrade test can be performed in the corresponding test environment. After the test passes, the production environment will be upgraded synchronously. For other vulnerabilities, vulnerability repair suggestions will be displayed, and security personnel will promote vulnerability rectification.

[0012] S500: Version update or component update. The version inconsistency caused by server component changes or vulnerability repairs is automatically updated to the asset model through manual maintenance or agent probe identification.

[0013] In a second aspect, the present invention provides a system for improving vulnerability detection and vulnerability rectification efficiency, comprising:

[0014] The central information system server is used to communicate with the personal terminal and deploy application probes on it. The probes can identify information such as various services, middleware, and applications running on the machine and send the information to the vulnerability management system;

[0015] The vulnerability management system is used to establish an asset ledger based on the information pushed by the central information system server and personal terminals, record the application services and versions, middleware, databases, open ports and other information on each machine, and form an asset model diagram;

[0016] The threat intelligence module is used to access the Internet threat intelligence library in real time, including the CVE library, CNVD, and threat intelligence from various security vendors, monitor threats related to the asset model in real time, and output a list of assets that may be involved through comparison, and provide vulnerability repair suggestions.

[0017] The present invention matches the information system asset classification with the vulnerability threat intelligence, and compares the vulnerabilities according to the vulnerability types, which effectively improves the efficiency of vulnerability investigation. By classifying the vulnerability rectification, the vulnerabilities that only need to be upgraded can be upgraded with one click, which greatly improves the efficiency of vulnerability repair, and improves the accuracy of subsequent vulnerability detection and repair by maintaining the asset model. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a schematic diagram of the system structure for improving the efficiency of vulnerability detection and vulnerability rectification of the present invention. DETAILED DESCRIPTION

[0019] A method for improving vulnerability detection and vulnerability rectification efficiency includes the following process:

[0020] S100: Establish a central information system server and personal terminal connection model, and deploy an application probe on it. The probe can identify various services, middleware, applications and other information running on the machine, and send the information to the vulnerability management system;

[0021] S200: In the vulnerability management system, an asset ledger is established based on the information pushed by each server and personal terminal, which can record in detail the application services and versions, middleware, databases, open ports and other information on each machine to form an asset model diagram;

[0022] S300: The threat intelligence module will access the Internet threat intelligence library in real time, including the CVE library, CNVD, and threat intelligence from various security vendors, monitor threats related to the asset model in real time, and output a list of assets that may be involved through comparison, and provide vulnerability repair suggestions;

[0023] S400: Classify by vulnerability type and perform one-click version repair and other repairs. If the third-party version can be upgraded to repair the vulnerability, a one-click upgrade test can be performed in the corresponding test environment. After the test passes, the production environment will be upgraded synchronously. For other vulnerabilities, vulnerability repair suggestions will be displayed, and security personnel will promote vulnerability rectification.

[0024] S500: Version update or component update. The version inconsistency caused by server component changes or vulnerability repairs is automatically updated to the asset model through manual maintenance or agent probe identification.

[0025] A system for improving vulnerability detection and vulnerability rectification efficiency that implements the above method includes:

[0026] The central information system server is used to communicate with the personal terminal and deploy application probes on it. The probes can identify information such as various services, middleware, and applications running on the machine and send the information to the vulnerability management system;

[0027] The vulnerability management system is used to establish an asset ledger based on the information pushed by the central information system server and personal terminals, record the application services and versions, middleware, databases, open ports and other information on each machine, and form an asset model diagram;

[0028] The threat intelligence module is used to access the Internet threat intelligence library in real time, including the CVE library, CNVD, and threat intelligence from various security vendors, monitor threats related to the asset model in real time, and output a list of assets that may be involved through comparison, and provide vulnerability repair suggestions.

Claims

1. A method for improving vulnerability detection and vulnerability rectification efficiency, characterized in that: The process includes the following: S100: Establish a central information system server and personal terminal connection model, and deploy an application probe on it. The probe can identify various services, middleware, and application information running on the machine, and send the information to the vulnerability management system; S200: In the vulnerability management system, an asset ledger is established based on the information pushed by each server and personal terminal, which can record in detail the application services and versions, middleware, database, and open port information on each machine to form an asset model diagram; S300: The threat intelligence module will access the Internet threat intelligence library in real time, including the CVE library, CNVD, and threat intelligence from various security vendors, monitor threats related to the asset model in real time, and output a list of assets that may be involved through comparison, and provide vulnerability repair suggestions; S400: Classify by vulnerability type and perform one-click version repair and other repairs. If the third-party version can be upgraded to repair the vulnerability, a one-click upgrade test can be performed in the corresponding test environment. After the test passes, the production environment will be upgraded synchronously. For other vulnerabilities, vulnerability repair suggestions will be displayed, and security personnel will promote vulnerability rectification. S500: Version update or component update. The version inconsistency caused by server component changes or vulnerability repairs is automatically updated to the asset model through manual maintenance or agent probe identification.

2. A system for improving vulnerability detection and vulnerability rectification efficiency that implements the method for improving vulnerability detection and vulnerability rectification efficiency as described in claim 1, characterized in that: include: The central information system server is used to communicate with the personal terminal and deploy application probes on it, which can identify various services, middleware, and application information running on the machine and send the information to the vulnerability management system; The vulnerability management system is used to establish an asset ledger based on the information pushed by the central information system server and personal terminals, record the application services and versions, middleware, database, and open port information on each machine, and form an asset model diagram; The threat intelligence module is used to access the Internet threat intelligence library in real time, including the CVE library, CNVD, and threat intelligence from various security vendors, monitor threats related to the asset model in real time, and output a list of assets that may be involved through comparison, and provide vulnerability repair suggestions.

Images