Database security scanning method and device, electronic equipment and storage medium

Abstract

The invention relates to a database security scanning method and device, electronic equipment and a storage medium, and the method comprises the steps: controlling a target database to execute a target function based on the category of the target database obtained by performing category recognition on the target database; under the condition that the target database executes the target function, collecting security information data of the target database; wherein the security information data comprises basic security information and authorization authentication information. According to the method, the security information data of the target database can be collected when the target database executes the target function of the database, so that the security analysis is performed according to the basic security information to obtain the first vulnerability result, and the intrusion simulation is performed on the target database according to the authorization authentication information to obtain the second vulnerability result; and generating a vulnerability scanning result according to the first vulnerability result and the second vulnerability result, thereby realizing rapid and comprehensive vulnerability scanning of the target database.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a database security scanning method, device, electronic device and storage medium. Background Art

[0002] A large amount of user data is stored in the database. Once the user data is leaked, changed or destroyed, it will cause very serious consequences. At present, testers mainly use manual vulnerability testing methods, supplemented by penetration testing tools for testing. Faced with increasingly complex attack methods and increasingly rich functions, manual testing by testers and general penetration testing tools alone cannot meet the security needs of the database. Therefore, a more intelligent and systematic database security scanning method is needed to comprehensively analyze the vulnerabilities of database products. Summary of the invention

[0003] The present application provides a database security scanning method, device, electronic device and storage medium to solve the technical problem of how to quickly and comprehensively scan database vulnerabilities.

[0004] In a first aspect, the present application provides a database security scanning method, the method comprising:

[0005] Based on the category of the target database obtained by classifying the target database, controlling the target database to execute a target function;

[0006] In the case where the target database executes the target function, collecting security information data of the target database; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of front-end web page information, back-end core database information, document security information and core user information;

[0007] Perform security analysis based on the basic security information to determine a first vulnerability result;

[0008] Performing a simulated intrusion on the target database according to the authorization authentication information to determine a second vulnerability result;

[0009] A vulnerability scanning result is generated according to the first vulnerability result and the second vulnerability result.

[0010] Optionally, based on the category of the target database obtained by identifying the category of the target database, controlling the target database to execute the target function includes:

[0011] Performing category identification on the target database to determine the category of the target database;

[0012] Obtaining a preset mapping relationship; wherein the mapping relationship is a mapping relationship between a database category and a database function;

[0013] Determine all target functions included in the target database according to the mapping relationship and the category of the target database;

[0014] The target database is controlled to execute all the target functions in sequence.

[0015] Optionally, performing security analysis according to the basic security information to determine a first vulnerability result includes:

[0016] Performing semantic analysis on the basic security information by using natural language processing technology to obtain semantic analysis results;

[0017] A first vulnerability result of the target database is determined from the semantic analysis result.

[0018] Optionally, simulating an intrusion on the target database according to the authorization authentication information to determine a second vulnerability result includes:

[0019] Connecting to the target database according to the authorization authentication information;

[0020] Get the preset vulnerability library;

[0021] Performing a simulated intrusion on the target database based on the vulnerability library to obtain an intrusion return result;

[0022] A second vulnerability result of the target database is determined according to the intrusion return result.

[0023] Optionally, simulating an intrusion on the target database according to the authorization authentication information to determine a second vulnerability result includes:

[0024] Obtaining a pre-trained deep learning model; wherein the deep learning model is used to identify database vulnerabilities based on input database information;

[0025] Inputting the target database information obtained by logging into the target database based on the authorization authentication information into the deep learning model, and obtaining an output result output by the deep learning model;

[0026] The output result is used as the second vulnerability result.

[0027] Optionally, simulating an intrusion on the target database based on the vulnerability library to obtain an intrusion return result includes:

[0028] Determining at least one target vulnerability library for simulated intrusion based on the intrusion priority of the vulnerability library;

[0029] According to the intrusion priority, based on all the target vulnerability libraries, simulate intrusion on the target database to obtain intrusion return results;

[0030] Correspondingly, after determining the second vulnerability result of the target database according to the intrusion return result, the method further includes:

[0031] The intrusion priority of the vulnerability library is adjusted according to the second vulnerability result.

[0032] Optionally, the method further comprises:

[0033] Obtaining the installation environment of the target database;

[0034] Establishing a security scanning task for the installation environment based on black box scanning technology;

[0035] Determine a third vulnerability result according to the scanning result of the security scanning task;

[0036] Accordingly, generating a vulnerability scanning result according to the first vulnerability result and the second vulnerability result includes:

[0037] Collecting and summarizing the first vulnerability result, the second vulnerability result, and the third vulnerability result to obtain a vulnerability scanning result;

[0038] Generate vulnerability repair prompt information according to the vulnerability scanning result.

[0039] In a second aspect, the present application provides a database security scanning device, the device comprising:

[0040] A function execution module, used for controlling the target database to execute a target function based on the category of the target database obtained by classifying the target database;

[0041] A collection module, used for collecting security information data of the target database when the target database executes the target function; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of front-end web page information, back-end core database information, document security information and core user information;

[0042] A first vulnerability determination module, configured to perform security analysis based on the basic security information and determine a first vulnerability result;

[0043] A second vulnerability determination module, configured to simulate an intrusion on the target database according to the authorization authentication information to determine a second vulnerability result;

[0044] A result generating module is used to generate a vulnerability scanning result according to the first vulnerability result and the second vulnerability result.

[0045] In a third aspect, the present application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0046] Memory, used to store computer programs;

[0047] The processor is used to implement the database security scanning method described in any one of the embodiments of the first aspect when executing the program stored in the memory.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the database security scanning method as described in any one of the embodiments of the first aspect is implemented.

[0049] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application controls the target database to execute the target function based on the category of the target database obtained by classifying the target database; collects the security information data of the target database when the target database executes the target function; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of the front-end web page information, the back-end core database information, the document security information and the core user information; performs security analysis according to the basic security information to determine the first vulnerability result; simulates intrusion on the target database according to the authorization authentication information to determine the second vulnerability result; generates vulnerability scanning results according to the first vulnerability result and the second vulnerability result. The method can collect the security information data of the target database when the target database executes the target function of the database, thereby performing security analysis according to the basic security information to obtain the first vulnerability result, performing simulated intrusion on the target database according to the authorization authentication information to obtain the second vulnerability result, and then generating vulnerability scanning results according to the first vulnerability result and the second vulnerability result, so as to realize a fast and comprehensive vulnerability scan of the target database. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0051] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0052] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0053] Figure 1 A system architecture diagram of a database security scanning method provided in one embodiment of the present application;

[0054] Figure 2 A schematic diagram of a database security scanning method provided by an embodiment of the present application;

[0055] Figure 3 A schematic diagram of a database security scanning method provided by an embodiment of the present application;

[0056] Figure 4 A schematic diagram of the structure of a database security scanning device provided by one embodiment of the present application;

[0057] Figure 5 A schematic diagram of the structure of an electronic device provided in accordance with an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0059] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0060] In order to solve the technical problem of how to quickly and comprehensively scan database vulnerabilities in the prior art, the present application provides a database security scanning method, device, electronic device and storage medium, which can realize fast and comprehensive vulnerability scanning of the target database.

[0061] The first embodiment of the present application provides a database security scanning method, which can be applied to Figure 1The system architecture shown in the figure includes at least a database security scanning system 101 and a database 102, and the database security scanning system 101 and the database 102 establish a communication connection. The method can be applied to the database security scanning system 101 in the system architecture, and the database that is security scanned using the method can be called a target database. Next, based on the system architecture, the database security scanning method is described in detail, as shown in FIG. Figure 2 , the database security scanning method includes:

[0062] Step 201 : Based on the category of the target database obtained by performing category identification on the target database, control the target database to execute a target function.

[0063] The database security scanning system can identify the functions of the target database by the category of the target database, and control the target database to perform the target functions, for example, control the target database to perform backup and recovery, redistribution, parameter distribution, and new cluster addition functions.

[0064] In one embodiment, based on the category of the target database obtained by performing category identification on the target database, controlling the target database to execute the target function includes: performing category identification on the target database to determine the category of the target database; obtaining a preset mapping relationship; wherein the mapping relationship is a mapping relationship between the database category and the database function; determining all target functions included in the target database according to the mapping relationship and the category of the target database; and controlling the target database to execute all target functions in sequence.

[0065] In this embodiment, the preset mapping relationship includes a mapping relationship between database categories and database functions. For example, if the category of the target database is identified as a Class A database, and the Class A database includes functions 1, 2, 3, and 4, the target database can be controlled to execute functions 1, 2, 3, and 4 in sequence. If the category of the target database is identified as a Class B database, and the functions included in the Class B database are functions 5, 6, and 7, the target database can be controlled to execute functions 5, 6, and 7 in sequence. Through the preset mapping relationship, all target functions included in the target database can be quickly determined based on the category of the target database obtained by identifying the category of the target database, thereby accurately controlling the target database to execute all target functions in sequence. It should be noted that the above-mentioned specific functions can be functions such as backup and recovery, redistribution, parameter distribution, and new cluster addition, without limitation.

[0066] Step 202, when the target database executes the target function, collect security information data of the target database; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of front-end web page information, back-end core database information, document security information and core user information.

[0067] When collecting data, you can enable the crawler function to dynamically collect the security information data of the target database. In order to comprehensively collect the security information data of the target database, the basic security information may include the front-end web page information, the back-end core database information, the document security information and the core user information, and the authorization and authentication information may include the address of the target database, the authorization confirmation information, the authorization time information, the package frequency information and the authentication information, etc., without restriction.

[0068] Step 203: Perform security analysis based on the basic security information to determine a first vulnerability result.

[0069] In one embodiment, security analysis is performed based on basic security information to determine a first vulnerability result, including: performing semantic analysis on the basic security information through natural language processing technology to obtain a semantic analysis result; and determining a first vulnerability result of the target database from the semantic analysis result.

[0070] In this embodiment, natural language processing technology can be used to perform semantic analysis on basic security information, such as analyzing the hypertext markup language HTML code, JavaScript scripts, and user input information of the page to obtain semantic analysis results, and identify the first vulnerability results of potential target databases from the semantic analysis results.

[0071] Step 204: simulate intrusion into the target database according to the authorization authentication information to determine a second vulnerability result.

[0072] In one embodiment, a simulated intrusion is performed on a target database according to the authorization authentication information, and the step of determining the second vulnerability result includes at least the following two methods.

[0073] The first method is to connect to the target database according to the authorization authentication information; obtain a preset vulnerability library; simulate an intrusion on the target database based on the vulnerability library and obtain the intrusion return result; and determine the second vulnerability result of the target database according to the intrusion return result.

[0074] In this method, the target database can be connected through authorization and authentication information, a package can be sent to the target database based on a preset vulnerability library, an intrusion into the target database can be simulated, the intrusion return result can be obtained, and a second vulnerability result of the target database can be analyzed based on the intrusion return result.

[0075] In one embodiment, a simulated intrusion is performed on a target database based on a vulnerability library to obtain an intrusion return result, including: determining at least one target vulnerability library for simulated intrusion based on the intrusion priority of the vulnerability library; and simulating an intrusion on the target database based on all target vulnerability libraries according to the intrusion priority to obtain an intrusion return result.

[0076] In this embodiment, when simulating an intrusion on a target database based on a vulnerability library, the target vulnerability library for simulating the intrusion can be determined according to the intrusion priority in the vulnerability library, and the target vulnerability library with a high intrusion priority is preferentially used for simulating the intrusion to obtain the intrusion return result. Since the target vulnerability library with a high intrusion priority is the most likely vulnerability to occur in practice, the pertinence of identifying the real vulnerability of the target database is improved.

[0077] Furthermore, after determining the second vulnerability result of the target database according to the intrusion return result, the method further includes: adjusting the intrusion priority of the vulnerability database according to the second vulnerability result.

[0078] In this embodiment, the intrusion priority of the vulnerability library can be adjusted according to the second vulnerability result. For example, if the target database is invaded according to the target vulnerability library with the highest priority in this simulated intrusion, and it is determined that the second vulnerability result of the target database includes the vulnerability corresponding to the target vulnerability library, the intrusion priority of the target vulnerability library is further increased. If the target database is invaded according to the target vulnerability library with the highest priority in this simulated intrusion, and it is determined that the second vulnerability result of the target database does not include the vulnerability corresponding to the target vulnerability library, the intrusion priority of the target vulnerability library can be slightly reduced, so that the intrusion priority can be dynamically adjusted according to the result of each simulated intrusion, so that it meets the use requirements, and continuously digs deeper into higher priority vulnerabilities in actual applications.

[0079] The second method is to obtain a pre-trained deep learning model; wherein the deep learning model is used to identify database vulnerabilities based on input database information; the target database information obtained by logging into the target database based on the authorization authentication information is input into the deep learning model to obtain the output result of the deep learning model; and the output result is used as the second vulnerability result.

[0080] In this embodiment, a deep learning model can be introduced during vulnerability identification, and the deep learning model can be pre-trained. For example, by injecting vulnerabilities, the deep learning model can identify common security vulnerabilities, such as cross-site scripting (XSS) vulnerabilities, structured query language SQL injection vulnerabilities, command injection vulnerabilities, etc., and during learning, the database information can be used to correspond to the vulnerabilities finally identified. Therefore, during use, there is no need to inject vulnerabilities. Only the target database information obtained by logging into the target database with the authorization authentication information needs to be input into the deep learning model to obtain the output result of the deep learning model, so that the second vulnerability result can be obtained more quickly.

[0081] Of course, in actual use, in order to improve the accuracy of the second vulnerability result, the above two methods can be used at the same time to determine the second vulnerability result. For example, the preliminary vulnerability identification result is determined based on the output result of the deep learning model, and then the vulnerability priority in the first method is corrected based on the preliminary vulnerability identification result, which can identify vulnerabilities more specifically and improve the accuracy and speed of vulnerability identification.

[0082] Step 205: Generate a vulnerability scanning result according to the first vulnerability result and the second vulnerability result.

[0083] The method can collect security information data of the target database when the target database executes the target function of the database, thereby performing a security analysis based on the basic security information therein to obtain a first vulnerability result, performing a simulated intrusion on the target database based on the authorization and authentication information therein to obtain a second vulnerability result, and then generating a vulnerability scanning result based on the first vulnerability result and the second vulnerability result, thereby realizing a rapid and comprehensive vulnerability scan of the target database.

[0084] In one embodiment, the method further includes: obtaining an installation environment of the target database; establishing a security scanning task for the installation environment based on black box scanning technology; and determining a third vulnerability result according to a scanning result of the security scanning task.

[0085] In this embodiment, a security scanning task for the installation environment of the target database can be established based on the black box scanning technology, and the third vulnerability result can be determined according to the scanning result of the security scanning task. For example, the expired component vulnerability can be identified through the security scanning task. Accordingly, the vulnerability scanning result is generated according to the first vulnerability result and the second vulnerability result, including: collecting and summarizing the first vulnerability result, the second vulnerability result and the third vulnerability result to obtain the vulnerability scanning result; generating vulnerability repair prompt information according to the vulnerability scanning result.

[0086] In a specific embodiment, the database security scanning system has the functions of executing database related functions, data collection functions, vulnerability analysis functions, security scanning functions, and repair suggestion functions, so as to avoid testers spending a lot of energy on manual testing and missing tests. Figure 3 ,include:

[0087] Step S1, function execution.

[0088] The database security scanning system supports the automatic execution of database-related functions. The database security scanning system includes the functions of various types of database systems and can automatically identify the category of the target database system. Testers only need to click the corresponding button to easily implement a complex function with one click. They can also record the corresponding macro files and upload them to the scanning system to supplement the corresponding functions, thereby achieving comprehensive coverage of the database system functions.

[0089] Step S2, data collection.

[0090] During the execution of database functions, the database security scanning system automatically performs data collection functions and enables the crawler function to dynamically collect the front-end web page information, back-end core database information, document security information, core user information and authorization authentication information of the target database system.

[0091] Step S3, vulnerability analysis.

[0092] During the data collection process, the vulnerability analysis module in the database security scanning system analyzes the front-end web page, back-end core database, document security, and core user security of the database system respectively, and uses the authorization and authentication information of the database to send packets to the target database according to the vulnerability library to simulate intrusion, inject anomalies into the database, obtain the intrusion return results, and summarize the vulnerability results of the penetration test in the vulnerability analysis module (the vulnerability results can be placed in the result library). Black box scanning technology can be introduced, and security scanning tasks can be established through the security scanning module in the database security scanning system. The scanning results are collected and summarized to obtain the scanning results (the scanning results can be placed in the result library). The priority of the identified vulnerabilities can be increased in the vulnerability library, and higher priority vulnerabilities can be further explored in subsequent analysis. Among them, the vulnerability library is used to provide attack methods for vulnerability analysis, and the results of vulnerability analysis can adjust and enrich the vulnerability library.

[0093] Step S4: repair suggestion.

[0094] According to the result library of the vulnerability analysis module and the security scanning module, the database vulnerability test scan results are presented in the repair suggestion module, and corresponding vulnerability solution prompts are provided, and the repair suggestions are sent to the R&D for repair (step S5 R&D repair). After the repair is completed, the database security scanning method can be used to re-scan to confirm whether the vulnerability is repaired normally. Of course, the database security scanning system can also include a monitoring module, which can use the monitoring function to regularly scan the Web page, discover new vulnerabilities in a timely manner, monitor the illegal intrusion behavior of users, and issue an alarm on the page to maintain environmental security.

[0095] In this embodiment, by designing targeted tests based on the database system, comprehensively executing database-related functions, crawling to collect data information, adjusting vulnerability priorities after vulnerability analysis is completed, and providing repair suggestions for vulnerability results, a comprehensive combination of testing and repair is achieved.

[0096] Based on the same technical concept, the second embodiment of the present application provides a database security scanning device, such as Figure 4 , the device comprises:

[0097] A function execution module 401 is used to control the target database to execute a target function based on the category of the target database obtained by classifying the target database;

[0098] A collection module 402 is used to collect security information data of the target database when the target database executes the target function; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of front-end web page information, back-end core database information, document security information and core user information;

[0099] A first vulnerability determination module 403, configured to perform security analysis based on the basic security information to determine a first vulnerability result;

[0100] A second vulnerability determination module 404, configured to simulate an intrusion on the target database according to the authorization authentication information to determine a second vulnerability result;

[0101] The result generating module 405 is configured to generate a vulnerability scanning result according to the first vulnerability result and the second vulnerability result.

[0102] The device can collect security information data of the target database when the target database executes the target function of the database, thereby performing a security analysis based on the basic security information therein to obtain a first vulnerability result, performing a simulated intrusion on the target database based on the authorization authentication information therein to obtain a second vulnerability result, and then generating a vulnerability scanning result based on the first vulnerability result and the second vulnerability result, thereby realizing a rapid and comprehensive vulnerability scan of the target database.

[0103] like Figure 5 As shown, an embodiment of the present application provides an electronic device, including a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0104] Memory 113, used for storing computer programs;

[0105] In one embodiment of the present application, the processor 111 is used to execute the program stored in the memory 113 to implement the database security scanning method provided by any of the above method embodiments, including:

[0106] Based on the category of the target database obtained by classifying the target database, controlling the target database to execute a target function;

[0107] In the case where the target database executes the target function, collecting security information data of the target database; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of front-end web page information, back-end core database information, document security information and core user information;

[0108] Perform security analysis based on the basic security information to determine a first vulnerability result;

[0109] Performing a simulated intrusion on the target database according to the authorization authentication information to determine a second vulnerability result;

[0110] A vulnerability scanning result is generated according to the first vulnerability result and the second vulnerability result.

[0111] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0112] The communication interface is used for communication between the above terminal and other devices.

[0113] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0114] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0115] An embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the database security scanning method provided by any of the aforementioned method embodiments is implemented.

[0116] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0118] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0119] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. In the description, the use of suffixes such as "module", "component" or "unit" used to represent elements is only for the purpose of facilitating the description of the present application and has no specific meaning in itself. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0120] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A database security scanning method, characterized in that: The method comprises: Based on the category of the target database obtained by classifying the target database, controlling the target database to execute a target function; In the case where the target database executes the target function, collecting security information data of the target database; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of front-end web page information, back-end core database information, document security information and core user information; Perform security analysis based on the basic security information to determine a first vulnerability result; Performing a simulated intrusion on the target database according to the authorization authentication information to determine a second vulnerability result; A vulnerability scanning result is generated according to the first vulnerability result and the second vulnerability result.

2. The method according to claim 1, characterized in that: Based on the category of the target database obtained by classifying the target database, controlling the target database to execute a target function includes: Performing category identification on the target database to determine the category of the target database; Obtaining a preset mapping relationship; wherein the mapping relationship is a mapping relationship between a database category and a database function; Determine all target functions included in the target database according to the mapping relationship and the category of the target database; The target database is controlled to execute all the target functions in sequence.

3. The method according to claim 1, characterized in that Performing a security analysis based on the basic security information to determine a first vulnerability result includes: Performing semantic analysis on the basic security information by using natural language processing technology to obtain semantic analysis results; A first vulnerability result of the target database is determined from the semantic analysis result.

4. The method according to claim 1, characterized in that: Performing a simulated intrusion on the target database according to the authorization authentication information to determine a second vulnerability result includes: Connecting to the target database according to the authorization authentication information; Get the preset vulnerability library; Performing a simulated intrusion on the target database based on the vulnerability library to obtain an intrusion return result; A second vulnerability result of the target database is determined according to the intrusion return result.

5. The method according to claim 1, characterized in that Performing a simulated intrusion on the target database according to the authorization authentication information to determine a second vulnerability result includes: Obtaining a pre-trained deep learning model; wherein the deep learning model is used to identify database vulnerabilities based on input database information; Inputting the target database information obtained by logging into the target database based on the authorization authentication information into the deep learning model, and obtaining an output result output by the deep learning model; The output result is used as the second vulnerability result.

6. The method according to claim 4, characterized in that Performing a simulated intrusion on the target database based on the vulnerability library to obtain an intrusion return result includes: Determining at least one target vulnerability library for simulated intrusion based on the intrusion priority of the vulnerability library; According to the intrusion priority, based on all the target vulnerability libraries, simulate intrusion on the target database to obtain intrusion return results; Correspondingly, after determining the second vulnerability result of the target database according to the intrusion return result, the method further includes: The intrusion priority of the vulnerability library is adjusted according to the second vulnerability result.

7. The method according to claim 1, characterized in that The method further comprises: Obtaining the installation environment of the target database; Establishing a security scanning task for the installation environment based on black box scanning technology; Determine a third vulnerability result according to the scanning result of the security scanning task; Accordingly, generating a vulnerability scanning result according to the first vulnerability result and the second vulnerability result includes: Collecting and summarizing the first vulnerability result, the second vulnerability result, and the third vulnerability result to obtain a vulnerability scanning result; Generate vulnerability repair prompt information according to the vulnerability scanning result.

8. A database security scanning device, characterized in that: The device comprises: A function execution module, used for controlling the target database to execute a target function based on the category of the target database obtained by classifying the target database; A collection module, used for collecting security information data of the target database when the target database executes the target function; wherein the security information data includes basic security information and authorization authentication information; the basic security information includes at least one of front-end web page information, back-end core database information, document security information and core user information; A first vulnerability determination module, configured to perform security analysis based on the basic security information and determine a first vulnerability result; A second vulnerability determination module, configured to simulate an intrusion on the target database according to the authorization authentication information to determine a second vulnerability result; A result generating module is used to generate a vulnerability scanning result according to the first vulnerability result and the second vulnerability result.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the database security scanning method described in any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the database security scanning method according to any one of claims 1 to 7 is implemented.

Images