Application security vulnerability processing method and device, equipment and storage medium

Abstract

The invention discloses an application security vulnerability disposal method and device, equipment and a storage medium, and the method comprises the steps: sorting discovered vulnerabilities according to a preset rule, and carrying out the reproduction and principle analysis of the sorted vulnerabilities; scanning the application source code or the binary file through a vulnerability scanning tool, outputting a scanning result, and analyzing the scanning result to obtain vulnerability information; and finally, acquiring a source code, matching a corresponding vulnerability principle rule in combination with the information of the vulnerability principle database, and analyzing whether the source code has vulnerability utilization conditions and whether mitigation measures have been taken by using a static analysis technology. The vulnerability principle and the repair mode are analyzed to form the database, whether the application has the risk or not is judged by combining the application source code and using the static code analysis technology and combining the vulnerability principle database, if the risk does not exist, the component version does not need to be upgraded, and the labor cost of an enterprise on vulnerability repair is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an application security vulnerability handling method, device and storage medium. Background Art

[0002] Currently, the industry's approach to handling application security vulnerabilities discovered through scanning is to provide risk assessment and repair suggestions after the scan is completed, and then track and manage the vulnerability repair status.

[0003] Existing methods for handling application security vulnerabilities are not very developer-friendly, especially for fixing open source component vulnerabilities. Currently, the industry often detects open source component vulnerabilities by analyzing the component dependencies of the application from the source code or binary files, checking the matching of the dependent component versions with the vulnerability database, and outputting vulnerability information if the match is successful. However, it is actually impossible to know whether the vulnerability has an impact on the application, and developers have to spend a lot of time and energy to upgrade component versions and solve compatibility issues. Summary of the invention

[0004] To this end, the present application provides a technical solution for identifying whether the results given by vulnerability scanning tools are risky, thereby solving the problem of reducing the manpower cost of vulnerability repair. To solve the above technical problems, the present invention provides an application security vulnerability handling method, device and storage medium.

[0005] To achieve the above objectives, in a first aspect, the present invention provides a method for handling application security vulnerabilities, which is characterized by comprising:

[0006] Sort the discovered vulnerabilities according to preset rules, and reproduce and analyze the principles of the sorted vulnerabilities;

[0007] The reproduction and principle analysis includes: confirming the exploitation conditions and mitigation measures of the discovered vulnerability to generate vulnerability principle database information;

[0008] Scan the application source code or binary file using a vulnerability scanning tool, output the scanning results, and analyze the scanning results to obtain vulnerability information;

[0009] Obtain the source code and combine it with the vulnerability principle database information to match the corresponding vulnerability principle rules, and then use static analysis technology to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken.

[0010] Furthermore, the confirmation of the exploitation conditions of the vulnerability includes: if the exploitation condition of the vulnerability is an untrusted input to a function, the class name and input parameter position corresponding to the function name of the function are recorded and stored in a configuration library, and in the case of source code, combined with static analysis, if the function is not used in the source code or there is no untrusted input, it is confirmed that there is no security risk.

[0011] Furthermore, if the mitigation measure for the vulnerability is to enable or disable a certain function through a configuration file, the configuration file name and configuration items are recorded and stored in the configuration library. If there is source code, regular matching is used to confirm whether the application has taken mitigation measures for the vulnerability. If so, it is confirmed that there is no security risk.

[0012] Furthermore, if there is no vulnerability exploitation condition or mitigation measures have been taken, the alarm is eliminated, otherwise an alarm is generated.

[0013] In a second aspect, the present invention further provides an application security vulnerability handling device, comprising: a recurrence analysis module, a scanning analysis module, and a verification module;

[0014] The recurrence analysis module is used to sort the discovered vulnerabilities according to preset rules, and reproduce and analyze the principles of the sorted vulnerabilities;

[0015] The reproduction and principle analysis includes: confirming the exploitation conditions and mitigation measures of the discovered vulnerability to generate vulnerability principle database information;

[0016] The scanning and analysis module is used to scan the application source code or binary file through a vulnerability scanning tool, output the scanning result, and analyze the scanning result to obtain vulnerability information;

[0017] The verification module is used to obtain the source code and combine it with the vulnerability principle database information, match the corresponding vulnerability principle rules, and use static analysis technology to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken.

[0018] Furthermore, the confirmation of the exploitation conditions of the vulnerability includes: if the exploitation condition of the vulnerability is an untrusted input to a function, the class name and input parameter position corresponding to the function name of the function are recorded and stored in a configuration library, and in the case of source code, combined with static analysis, if the function is not used in the source code or there is no untrusted input, it is confirmed that there is no security risk.

[0019] Furthermore, if the mitigation measure for the vulnerability is to enable or disable a certain function through a configuration file, the configuration file name and configuration items are recorded and stored in the configuration library. If there is source code, regular matching is used to confirm whether the application has taken mitigation measures for the vulnerability. If so, it is confirmed that there is no security risk.

[0020] Furthermore, if there are no conditions for exploiting the vulnerability or mitigation measures have been taken, the alarm is eliminated, otherwise an alarm is generated.

[0021] In a third aspect, the present invention provides a computing device, comprising:

[0022] A memory for storing program instructions;

[0023] The processor is used to call the program instructions stored in the memory and execute the above-mentioned application security vulnerability handling method according to the obtained program instructions.

[0024] In a fourth aspect, the present invention provides a computer-readable storage medium, including computer-readable instructions. When a computer reads and executes the computer-readable instructions, the above-mentioned application security vulnerability handling method is implemented. The readable medium may be multiple, and the multiple readable media can operate independently of each other.

[0025] Compared with the prior art, the present invention sorts the discovered vulnerabilities according to preset rules, reproduces and analyzes the principles of the sorted vulnerabilities; then scans the application source code or binary file through a vulnerability scanning tool, outputs the scanning results, analyzes the scanning results, and obtains vulnerability information; finally, the source code is obtained and combined with the vulnerability principle database information, and after matching the corresponding vulnerability principle rules, the static analysis technology is used to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken. The vulnerability principle and repair method are analyzed to form a database. Combined with the application source code, static code analysis technology is used in combination with the vulnerability principle database to determine whether the application has risks. If there is no risk, there is no need to upgrade the component version, reducing the manpower cost of the enterprise in vulnerability repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0027] Figure 1 A flowchart of an embodiment of the method for handling application security vulnerabilities provided by the present invention;

[0028] Figure 2 A structural block diagram of an embodiment of the application security vulnerability handling device provided by the present invention;

[0029] Figure 3 A structural diagram of an embodiment of the application security vulnerability handling device provided by the present invention;

[0030] Figure 4 The present invention provides a schematic structural diagram of an electronic device. DETAILED DESCRIPTION

[0031] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0032] It will be understood by those skilled in the art that, unless otherwise stated, the singular forms "a", "an" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0033] In order to make the objectives, technical solutions and advantages of the present invention more clear, the specific implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0034] The core of the present invention is to provide a method for handling application security vulnerabilities. Figure 1 The flowchart of the method for handling application security vulnerabilities provided in this embodiment is shown in FIG. Figure 1 The technical solution of this embodiment is described in detail:

[0035] Step S1: Sort the discovered vulnerabilities according to preset rules, and reproduce and analyze the principles of the sorted vulnerabilities;

[0036] The reproduction and principle analysis includes: confirming the exploitation conditions and mitigation measures of the discovered vulnerability to generate vulnerability principle database information;

[0037] Among them, vulnerability exploitation conditions: a series of conditions or prerequisites that need to be met when exploiting a vulnerability to attack or carry out malicious behavior, usually including whether certain functions need to be enabled or used;

[0038] Vulnerability mitigation measures: refers to response strategies for known vulnerabilities, which aim to reduce the potential risks and impacts of vulnerabilities. They are used to temporarily fix vulnerabilities, reduce the risk of attacks, or limit the ability to exploit vulnerabilities. They usually include temporary remedial measures (such as modifying configuration files, disabling certain functions, etc.) and patch security updates.

[0039] Step S2: Scan the application source code or binary file using a vulnerability scanning tool, output the scanning result, and analyze the scanning result to obtain vulnerability information;

[0040] Step S3: Obtain the source code and combine it with the vulnerability principle database information, match the corresponding vulnerability principle rules, and use static analysis technology to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken.

[0041] In a preferred embodiment, the conditions for confirming the exploitation of the vulnerability include: if the vulnerability exploitation condition is an untrusted input to a function, the class name and input parameter position corresponding to the function name of the function are recorded and stored in a configuration library. In the case of source code, combined with static analysis, if the function is not used in the source code or there is no untrusted input, it is confirmed that there is no security risk.

[0042] In a preferred embodiment, if the mitigation measure for the vulnerability is to enable or disable a function through a configuration file, the configuration file name and configuration items are recorded and stored in the configuration library. If the source code is available, regular matching is used to confirm whether the application has taken mitigation measures for the vulnerability. If so, it is confirmed that there is no security risk.

[0043] In a preferred embodiment, if there is no vulnerability exploitation condition or mitigation measures have been taken, the alarm is eliminated, otherwise an alarm is generated.

[0044] In the scheme of this embodiment, the discovered vulnerabilities are sorted according to preset rules, and the sorted vulnerabilities are reproduced and analyzed in principle; then the application source code or binary file is scanned by a vulnerability scanning tool, the scanning results are output, and the scanning results are analyzed to obtain vulnerability information; finally, the source code is obtained and combined with the vulnerability principle database information, after matching the corresponding vulnerability principle rules, static analysis technology is used to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken. The vulnerability principle and repair method are analyzed to form a database. Combined with the application source code, static code analysis technology is used in combination with the vulnerability principle database to determine whether the application has risks. If there is no risk, there is no need to upgrade the component version, reducing the manpower cost of the enterprise in vulnerability repair.

[0045] For ease of understanding, the present invention provides a specific embodiment for further explanation.

[0046] Example:

[0047] This embodiment provides a method for handling application security vulnerabilities within an enterprise, and the method specifically includes the following steps:

[0048] Step S201: Maintaining an open source vulnerability knowledge base: This step mainly relies on security personnel to analyze the vulnerabilities, extract the vulnerability functions, exploit conditions and mitigation measures, and interpret them into program-understandable configurations for storage.

[0049] Step S202: Use a component vulnerability scanning tool to scan the source code in the source code repository to obtain dependent component information and first vulnerability information.

[0050] The program matches the exploit conditions and mitigation measures in the vulnerability knowledge base for the scan results in step S202, and uses static code analysis technology to analyze whether the vulnerability function in the exploit condition is reachable, and whether mitigation measures have been taken. If the vulnerability function is not reachable or mitigation measures have been taken, it can be considered that the scanned vulnerability is risk-free and does not need to be repaired. Otherwise, the component needs to be upgraded.

[0051] In one embodiment, the present invention provides an application security vulnerability handling device, see Figure 2 The structure diagram of an application security vulnerability handling device provided by this embodiment is shown as well as Figure 3 The structure diagram of an application security vulnerability handling device provided by this embodiment is shown, and the device includes: a recurrence analysis module 10, a scanning analysis module 20, and a verification module 30;

[0052] The recurrence analysis module 10 is used to sort the discovered vulnerabilities according to preset rules, and reproduce and analyze the principles of the sorted vulnerabilities, including: confirming the exploitation conditions and mitigation measures of the discovered vulnerabilities to generate vulnerability principle database information;

[0053] The scanning and analysis module 20 is used to scan the application source code or binary file through a vulnerability scanning tool, output the scanning result, and analyze the scanning result to obtain vulnerability information;

[0054] The verification module 30 is used to obtain the source code and combine it with the vulnerability principle database information, match the corresponding vulnerability principle rules, and use static analysis technology to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken.

[0055] In a preferred embodiment, the conditions for confirming the exploitation of the vulnerability include: if the vulnerability exploitation condition is an untrusted input to a function, the class name and input parameter position corresponding to the function name of the function are recorded and stored in a configuration library. In the case of source code, combined with static analysis, if the function is not used in the source code or there is no untrusted input, it is confirmed that there is no security risk.

[0056] In a preferred embodiment, if the mitigation measure for the vulnerability is to enable or disable a function through a configuration file, the configuration file name and configuration items are recorded and stored in the configuration library. If the source code is available, regular matching is used to confirm whether the application has taken mitigation measures for the vulnerability. If so, it is confirmed that there is no security risk.

[0057] In a preferred embodiment, if there is no vulnerability exploitation condition or mitigation measures have been taken, the alarm is eliminated, otherwise an alarm is generated.

[0058] In the scheme of this embodiment, the discovered vulnerabilities are sorted according to preset rules, and the sorted vulnerabilities are reproduced and analyzed in principle; then the application source code or binary file is scanned by a vulnerability scanning tool, the scanning results are output, and the scanning results are analyzed to obtain vulnerability information; finally, the source code is obtained and combined with the vulnerability principle database information, after matching the corresponding vulnerability principle rules, static analysis technology is used to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken. The vulnerability principle and repair method are analyzed to form a database. Combined with the application source code, static code analysis technology is used in combination with the vulnerability principle database to determine whether the application has risks. If there is no risk, there is no need to upgrade the component version, reducing the manpower cost of the enterprise in vulnerability repair.

[0059] The application security vulnerability handling device of this embodiment is used to implement the aforementioned application security vulnerability handling method. Therefore, the specific implementation method of the application security vulnerability handling device can be seen in the specific implementation method part of the application security vulnerability handling method in the previous text. Therefore, its specific implementation method can refer to the description of the corresponding various partial embodiments. The device provided by the present invention is attached to the method provided by the present invention. Its specific effects can refer to the above method and will not be repeated here.

[0060] In one embodiment, a computing device is provided, comprising:

[0061] A memory for storing program instructions;

[0062] A processor is used to implement the steps of any of the above-mentioned application security vulnerability handling methods when executing the computer program.

[0063] As an example, Figure 4A schematic diagram of the structure of an electronic device applicable to the embodiment of the present application is shown. Figure 4 As shown, the electronic device 2000 includes: a processor 2001 and a memory 2003. The processor 2001 and the memory 2003 are connected, such as through a bus 2002. Optionally, the electronic device 2000 may also include a transceiver 2004. It should be noted that in actual applications, the transceiver 2004 is not limited to one, and the structure of the electronic device 2000 does not constitute a limitation on the embodiments of the present application.

[0064] The processor 2001 is applied in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 2004 may include a receiver and a transmitter. The transceiver 2004 is applied in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0065] Processor 2001 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 2001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0066] The bus 2002 may include a path to transmit information between the above components. The bus 2002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 2002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0067] The memory 2003 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0068] Optionally, the memory 2003 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 2001. The processor 2001 is used to execute the application code stored in the memory 2003 to implement the investment and financing project recommendation method provided in any embodiment of the present application.

[0069] The electronic device provided in the embodiment of the present application is applicable to any embodiment of the above method and will not be described in detail here.

[0070] The present invention provides a method for handling application security vulnerabilities, which has obvious advantages and beneficial effects compared with the prior art. The discovered vulnerabilities are sorted according to preset rules, and the sorted vulnerabilities are reproduced and analyzed in principle. Then, the application source code or binary file is scanned by a vulnerability scanning tool, and the scanning results are output. The scanning results are analyzed to obtain vulnerability information. Finally, the source code is obtained and combined with the vulnerability principle database information, and after matching the corresponding vulnerability principle rules, the static analysis technology is used to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken. The vulnerability principle and repair method are analyzed to form a database. Combined with the application source code, static code analysis technology is used in combination with the vulnerability principle database to determine whether the application has risks. If there is no risk, there is no need to upgrade the component version, thereby reducing the manpower cost of the enterprise in vulnerability repair.

[0071] In one embodiment, a computer-readable storage medium is provided, including computer-readable instructions. When a computer reads and executes the computer-readable instructions, the steps of the above-mentioned method for handling application security vulnerabilities are implemented. The method for handling application security vulnerabilities provided by the present invention has obvious advantages and beneficial effects compared with the prior art. The discovered vulnerabilities are sorted according to preset rules, and the sorted vulnerabilities are reproduced and analyzed in principle; then the application source code or binary file is scanned by a vulnerability scanning tool, and the scanning result is output, and the scanning result is analyzed to obtain vulnerability information; finally, the source code is obtained and combined with the vulnerability principle database information, and after matching the corresponding vulnerability principle rules, the source code is analyzed using static analysis technology to determine whether there are vulnerability exploitation conditions and whether mitigation measures have been taken. The vulnerability principle and repair method are analyzed to form a database. Combined with the application source code, static code analysis technology is used in combination with the vulnerability principle database to determine whether the application has risks. If there is no risk, there is no need to upgrade the component version, thereby reducing the human cost of the enterprise in vulnerability repair.

[0072] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the specific device can be divided into different functional modules to complete all or part of the functions described above.

[0073] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0074] In several embodiments covered by the present application, it should be understood that the disclosed devices, equipment and methods can be implemented in other ways. For example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or it can be an electrical, mechanical or other form of connection.

[0075] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0076] In addition, each functional module in each embodiment of the present application can be implemented in the form of hardware or in the form of software functional modules. If these functional modules are implemented in the form of software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application is essentially or part of the prior art that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a computer program product, which includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer program product is stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)).

[0077] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A method for handling application security vulnerabilities, characterized in that: include: Sort the discovered vulnerabilities according to preset rules, and reproduce and analyze the principles of the sorted vulnerabilities; The reproduction and principle analysis includes: confirming the exploitation conditions and mitigation measures of the discovered vulnerability to generate vulnerability principle database information; Scan the application source code or binary file using a vulnerability scanning tool, output the scanning results, and analyze the scanning results to obtain vulnerability information; Obtain the source code and combine it with the vulnerability principle database information to match the corresponding vulnerability principle rules, and then use static analysis technology to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken.

2. The method for handling application security vulnerabilities according to claim 1, characterized in that: The confirmation of the exploitation conditions of the vulnerability includes: if the exploitation condition of the vulnerability is an untrusted input to a function, the class name and input parameter position corresponding to the function name of the function are recorded and stored in a configuration library, and in the case of source code, combined with static analysis, if the function is not used in the source code or there is no untrusted input, it is confirmed that there is no security risk.

3. The method for handling application security vulnerabilities according to claim 1, characterized in that: If the mitigation measure for the vulnerability is to enable or disable a function through a configuration file, the configuration file name and configuration items are recorded and stored in the configuration library. If the source code is available, regular matching is used to confirm whether the application has taken mitigation measures for the vulnerability. If so, it is confirmed that there is no security risk.

4. The method for handling application security vulnerabilities according to claim 1, characterized in that: If there are no conditions for exploiting the vulnerability or mitigation measures have been taken, the alarm is eliminated; otherwise, an alarm is generated.

5. An application security vulnerability handling device, characterized in that: include: Reproduction analysis module, scanning analysis module, inspection module; The recurrence analysis module is used to sort the discovered vulnerabilities according to preset rules, and reproduce and analyze the principles of the sorted vulnerabilities; The reproduction and principle analysis includes: confirming the exploitation conditions and mitigation measures of the discovered vulnerability to generate vulnerability principle database information; The scanning and analysis module is used to scan the application source code or binary file through a vulnerability scanning tool, output the scanning result, and analyze the scanning result to obtain vulnerability information; The verification module is used to obtain the source code and combine it with the vulnerability principle database information, match the corresponding vulnerability principle rules, and use static analysis technology to analyze whether the source code has vulnerability exploitation conditions and whether mitigation measures have been taken.

6. The application security vulnerability handling device according to claim 5, characterized in that: The confirmation of the exploitation conditions of the vulnerability includes: if the exploitation condition of the vulnerability is an untrusted input to a function, the class name and input parameter position corresponding to the function name of the function are recorded and stored in a configuration library, and in the case of source code, combined with static analysis, if the function is not used in the source code or there is no untrusted input, it is confirmed that there is no security risk.

7. The application security vulnerability handling device according to claim 5, characterized in that: If the mitigation measure for the vulnerability is to enable or disable a function through a configuration file, the configuration file name and configuration items are recorded and stored in the configuration library. If the source code is available, regular matching is used to confirm whether the application has taken mitigation measures for the vulnerability. If so, it is confirmed that there is no security risk.

8. The application security vulnerability handling device according to claim 5, characterized in that: If there are no conditions for exploiting the vulnerability or mitigation measures have been taken, the alarm is eliminated; otherwise, an alarm is generated.

9. A computing device, characterized in that include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 4 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: It includes computer-readable instructions. When a computer reads and executes the computer-readable instructions, it implements the method as claimed in any one of claims 1 to 4. There can be multiple readable media, and the multiple readable media can operate independently of each other.

Images