Vulnerability scanning method and device and electronic equipment

Abstract

The invention provides a vulnerability scanning method and device and electronic equipment. The method is applied to a vulnerability scanning service module of a cloud platform, and comprises the following steps: determining a to-be-scanned host according to a vulnerability scanning request of a client; determining a target scanning engine module used for executing scanning operation on the to-be-scanned host, and mounting the snapshot file to a target directory; sending the vulnerability scanning task to a target scanning engine module to enable the target scanning engine module to execute scanning operation on the snapshot file mounted on the target directory; and acquiring a vulnerability scanning result from the target scanning engine module, sending the vulnerability scanning result to the client, and deleting the snapshot file. Based on the above scheme, the vulnerability scanning service module supports a scanning engine module of a network security POD deployed on the cloud platform to directly scan a user host in an intranet environment of the cloud platform, a user does not need to provide a host account password, and the scanning process does not need to occupy user host resources.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a vulnerability scanning method, device and electronic device. Background Art

[0002] At present, cloud platform providers generally provide vulnerability scanning services to customers. Since this service is for all customers, the vulnerability scanning engine is generally deployed in the public service area. The vulnerability scanning engine located in the public service area can only scan the customer's public network address. If you want to scan the customer's intranet address, the customer needs to provide a jump server with a public network address, and the customer needs to provide the username and password of the device to be scanned. Summary of the invention

[0003] In order to overcome the problems existing in the related art, the present application provides a vulnerability scanning method, device and electronic device.

[0004] According to a first aspect of an embodiment of the present application, a vulnerability scanning method is provided, the method being applied to a vulnerability scanning service module of a cloud platform, the method comprising:

[0005] Determine a host to be scanned according to a vulnerability scanning request from a client, wherein the host to be scanned is located in a virtualized POD of a cloud platform;

[0006] Determine a target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in a network security POD of a cloud platform;

[0007] Generate a snapshot file of the host to be scanned, and mount the snapshot file to a target directory;

[0008] Sending a vulnerability scanning task to the target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory;

[0009] The vulnerability scanning result is obtained from the target scanning engine module and sent to the client, and the snapshot file is deleted.

[0010] According to a second aspect of an embodiment of the present application, a vulnerability scanning method is provided, the method being applied to a target scanning engine module of a cloud platform, the target scanning engine module being deployed in a network security POD of the cloud platform, the method comprising:

[0011] According to the vulnerability scanning task sent by the vulnerability scanning service module, a snapshot file mounted on the target directory is determined, wherein the snapshot file is generated by the vulnerability scanning service module according to the host to be scanned and mounted to the target directory, the host to be scanned is determined by the vulnerability scanning service module according to the vulnerability scanning request of the client, and the host to be scanned is located in the virtualized POD of the cloud platform;

[0012] Performing a scan operation on the snapshot file to obtain a vulnerability scan result;

[0013] The vulnerability scanning result is sent to the vulnerability scanning service module, so that the vulnerability scanning service module sends the vulnerability scanning result to the client and deletes the snapshot file.

[0014] According to a third aspect of an embodiment of the present application, a vulnerability scanning device is provided, the device being applied to a vulnerability scanning service module of a cloud platform, the device comprising:

[0015] A host determination module, used to determine a host to be scanned according to a vulnerability scanning request from a client, wherein the host to be scanned is located in a virtualized POD of a cloud platform;

[0016] An engine determination module, used to determine a target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in a network security POD of a cloud platform;

[0017] A snapshot generation module, used to generate a snapshot file of the host to be scanned, and mount the snapshot file to a target directory;

[0018] A task sending module, used for sending a vulnerability scanning task to the target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory;

[0019] The result acquisition module is used to obtain the vulnerability scanning result from the target scanning engine module and send it to the client, and delete the snapshot file.

[0020] According to a fourth aspect of an embodiment of the present application, a vulnerability scanning device is provided, the device is applied to a target scanning engine module of a cloud platform, the target scanning engine module is deployed in a network security POD of the cloud platform, and the device includes:

[0021] A snapshot determination module, used to determine a snapshot file mounted on a target directory according to a vulnerability scanning task sent by a vulnerability scanning service module, wherein the snapshot file is generated by the vulnerability scanning service module according to a host to be scanned and mounted to the target directory, the host to be scanned is determined by the vulnerability scanning service module according to a vulnerability scanning request of a client, and the host to be scanned is located in a virtualized POD of a cloud platform;

[0022] A scanning module, used to perform a scanning operation on the snapshot file to obtain a vulnerability scanning result;

[0023] The result sending module is used to send the vulnerability scanning result to the vulnerability scanning service module, so that the vulnerability scanning service module sends the vulnerability scanning result to the client and deletes the snapshot file.

[0024] According to a fifth aspect of an embodiment of the present application, there is provided an electronic device, including:

[0025] A memory and one or more processors; the memory is coupled to the processor; wherein the memory stores computer program code, the computer program code includes computer instructions, and when the computer instructions are executed by the processor, the electronic device executes the method as described above.

[0026] According to a sixth aspect of an embodiment of the present application, there is provided a computer-readable storage medium, comprising computer instructions, which, when executed on an electronic device, enables the electronic device to execute the method described above.

[0027] According to a seventh aspect of the embodiments of the present application, a computer program product is provided. When the computer program product is run on a computer, the computer is enabled to execute the method described above.

[0028] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0029] The present application provides a vulnerability scanning method, which is applied to a vulnerability scanning service module of a cloud platform. The method includes: determining a host to be scanned according to a vulnerability scanning request of a client, wherein the host to be scanned is located in a virtualized POD of the cloud platform; determining a target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in the network security POD of the cloud platform; generating a snapshot file of the host to be scanned, and mounting the snapshot file to a target directory; sending a vulnerability scanning task to the target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory; obtaining a vulnerability scanning result from the target scanning engine module and sending it to the client, and deleting the snapshot file.

[0030] Based on the above solution, the vulnerability scanning service module of this application supports using the scanning engine module to directly scan the user host in the cloud platform intranet environment. The user does not need to provide the host account password, and the scanning process does not need to occupy the user's host resources, which does not affect the user experience.

[0031] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0033] Figure 1 A schematic diagram of a process flow of a vulnerability scanning method provided in an embodiment of the present application;

[0034] Figure 2 A system framework diagram of the vulnerability scanning method provided in an embodiment of the present application;

[0035] Figure 3 A schematic diagram of the process of the vulnerability scanning method provided in an embodiment of the present application;

[0036] Figure 4 Another flowchart of the vulnerability scanning method provided in the embodiment of the present application;

[0037] Figure 5 A schematic diagram of a vulnerability scanning device provided in an embodiment of the present application;

[0038] Figure 6 Another schematic diagram of a vulnerability scanning device provided in an embodiment of the present application;

[0039] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, the terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to be used as limitations on the present application.

[0041] It should be noted that in this application, "at least one" means one or more, and "more than one" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The terms "first", "second", "third", etc. (if any) in the specification, claims and drawings of this application are used to distinguish similar objects, rather than to describe a specific order or sequence.

[0042] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0043] Next, the embodiments of the present application are described in detail.

[0044] The present application embodiment provides a vulnerability scanning method, which is applied to a vulnerability scanning service module of a cloud platform, such as Figure 1 As shown, the method may include the following steps:

[0045] Step 110: Determine a host to be scanned according to a vulnerability scanning request from the client, wherein the host to be scanned is located in a virtualized POD of the cloud platform;

[0046] Step 120: determining a target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in a network security POD of the cloud platform;

[0047] Step 130: Generate a snapshot file of the host to be scanned, and mount the snapshot file to the target directory;

[0048] Step 140: Send a vulnerability scanning task to a target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory;

[0049] Step 150: Obtain vulnerability scanning results from the target scanning engine module and send them to the client, and delete the snapshot file.

[0050] POD is the smallest deployable computing unit in Kubernetes, which means a collection of virtualized containers, that is, a collection of a group (one or more) of containers. In this embodiment, the cloud platform includes multiple PODs divided according to functions, such as the above-mentioned virtualized POD refers to a collection of hosts provided by users, and the network security POD refers to a collection of security services provided for user hosts. In addition, it can also include an operation and maintenance management POD, which refers to a collection of operation and maintenance management services provided for user hosts.

[0051] like Figure 2 As shown, in this embodiment, the vulnerability scanning service module is deployed in the operation and maintenance management POD of the cloud platform, the host to be scanned requested by the client is located in the virtualization POD of the cloud platform, and the network security POD includes one or more scanning engine modules. Among them, in this embodiment, the scanning engine module used to perform scanning operations on the host to be scanned is called the target scanning engine module.

[0052] Specifically, the vulnerability scanning service module determines the host to be scanned according to the vulnerability scanning request of the client, wherein the number of hosts to be scanned can be one or more. For example, the user can specify one, multiple or even all hosts in the entire virtual private cloud instance to be scanned in the vulnerability scanning request.

[0053] As a specific implementation method, the vulnerability scanning service module of this embodiment can determine the host to be scanned according to the vulnerability scanning request of the client in the following manner: determine the target virtual private cloud according to the virtual private cloud identifier in the vulnerability scanning request of the client; determine the host to be scanned deployed in the target virtual private cloud according to the host identifier in the vulnerability scanning request of the client.

[0054] After determining the host to be scanned, the vulnerability scanning service module can further determine the target scanning engine module used to perform the scanning operation on the host to be scanned. For example, the target scanning engine module can be assigned to the host to be scanned according to the load and busy status of each scanning engine module in the network security POD. The user can also be allowed to specify any scanning engine module as the target scanning engine module, which is not limited in this embodiment.

[0055] As a specific implementation, this embodiment can determine the target scanning engine module for performing scanning operations on the host to be scanned in the following manner: select the scanning engine module with the lowest load value from all scanning engine modules of the network security POD as the target scanning engine module for performing scanning operations on the host to be scanned.

[0056] In traditional vulnerability scanning solutions, the scanning engine directly performs scanning operations on the host to be scanned, occupying the resources of the user's virtual private cloud instance and affecting the user experience. To overcome the above problem, this embodiment generates a snapshot file of the host to be scanned and mounts the snapshot file to the target directory, so that the scanning engine module can scan the vulnerabilities of the host to be scanned by scanning the snapshot file in the target directory without occupying user resources, thereby improving the user experience.

[0057] Exemplarily, a preset directory can be set for each scanning engine module in the network security POD. At this time, this embodiment can mount the snapshot file to the target directory in the following manner: determine the preset directory of the target scanning engine module as the target directory, and mount the snapshot file to the target directory.

[0058] As a specific implementation method, the vulnerability scanning service module of this embodiment can generate a vulnerability scanning task in the following way: use the IP address of the target scanning engine module as the scanning address; use the target directory where the snapshot file is located as the scanning directory; and generate a vulnerability scanning task based on the scanning address and scanning directory.

[0059] It is understandable that, since each scanning engine module in this embodiment is deployed on the network security POD of the cloud platform, the reliability is high. Therefore, the vulnerability scanning service module does not need the user to provide authentication information such as the username and password of the host to be scanned. However, it can be required that the vulnerability scanning task generated by the vulnerability scanning service module must carry the account and password of the scanning engine module, so as to avoid malicious, batch vulnerability scanning tasks being sent to the network security POD. Among them, the same account and password can be set for each scanning engine module, or different account and password can be set for different scanning engine modules respectively. This embodiment does not limit this.

[0060] Therefore, as a preferred implementation, the vulnerability scanning service module of this embodiment can generate a vulnerability scanning task in the following way: using the IP address of the target scanning engine module as the scanning address; using the target directory where the snapshot file is located as the scanning directory; and generating a vulnerability scanning task based on the scanning address, scanning directory, and the account password of the target scanning engine module.

[0061] After the target scanning engine module receives the vulnerability scanning task sent by the vulnerability scanning service module, it performs a scanning operation on the snapshot file mounted in the target directory to obtain the vulnerability scanning result. After that, the vulnerability scanning service module obtains the vulnerability scanning result from the target scanning engine module and sends it to the client, and deletes the snapshot file. At this point, the vulnerability scanning is completed.

[0062] Combine the following Figure 3 , the vulnerability scanning method of this embodiment is further explained.

[0063] First, let’s introduce the main components:

[0064] Vulnerability scanning service (i.e. the vulnerability scanning service module mentioned above): a containerized operation and maintenance management Pod deployed in the cloud platform intranet environment, which can directly access the computing services of the cloud platform;

[0065] Computing service: Operation and maintenance management POD deployed in the cloud platform intranet environment;

[0066] Scanning engine (i.e. the scanning engine module mentioned above): deployed in the network security POD area of ​​the cloud platform intranet environment, with multiple PODs to support concurrent execution of large-scale scanning tasks.

[0067] Based on the above components, such as Figure 3 As shown, the vulnerability scanning method includes the following steps:

[0068] 1. The customer logs in to the cloud console, issues a vulnerability scan task (i.e. the vulnerability scan request) in the vulnerability scan service interface, and selects the virtual machine to be scanned (i.e. the host to be scanned).

[0069] 2. The missed scanning service saves the missed scanning task information and selects an idle or lightly loaded scanning engine (i.e., the target scanning engine module mentioned above) from the managed scanning engines;

[0070] 3. The missed scan service calls the computing service to create a snapshot for the virtual machine to be scanned, and mounts the snapshot to the preset directory of the selected scanning engine, such as / scan / vmid, where vmid is the instance ID of the virtual machine to be scanned;

[0071] 4. Send a scan task (i.e. the above-mentioned vulnerability scan task) to the selected scan engine, where the scan IP address is the scan engine's own IP address, the scan account password is the scan engine's own account password, and the scan directory is the snapshot's mount directory;

[0072] 5. The scanning engine performs scanning operations according to the scanning task information;

[0073] 6. After the scan is completed, the missed scan service obtains the scan results from the scan engine;

[0074] 7. The missed scan service saves the scan results to the customer scan task, cancels the mount, and deletes the snapshot;

[0075] 8. Mark the missed scan tasks as completed and notify the customer of the scan results.

[0076] It can be seen from the above technical scheme that this embodiment provides a vulnerability scanning method, which is applied to the vulnerability scanning service module of the cloud platform, and the method includes: determining the host to be scanned according to the vulnerability scanning request of the client, wherein the host to be scanned is located in the virtualized POD of the cloud platform; determining the target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in the network security POD of the cloud platform; generating a snapshot file of the host to be scanned, and mounting the snapshot file to the target directory; sending a vulnerability scanning task to the target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory; obtaining the vulnerability scanning result from the target scanning engine module and sending it to the client, and deleting the snapshot file.

[0077] Based on the above scheme, the vulnerability scanning service module of this embodiment supports using the scanning engine module to directly scan the user host in the cloud platform intranet environment, without the user providing the host account password, and the scanning process does not need to occupy the user's host resources, and does not affect the user experience.

[0078] The embodiment of the present application also provides a vulnerability scanning method, which is applied to a target scanning engine module of a cloud platform, and the target scanning engine module is deployed in a network security POD of the cloud platform, such as Figure 4 As shown, the method comprises the following steps:

[0079] Step 410: Determine a snapshot file mounted on a target directory according to the vulnerability scanning task sent by the vulnerability scanning service module, wherein the snapshot file is generated by the vulnerability scanning service module according to a host to be scanned and mounted to the target directory, the host to be scanned is determined by the vulnerability scanning service module according to a vulnerability scanning request of the client, and the host to be scanned is located in a virtualized POD of the cloud platform;

[0080] Step 420: Perform a scan operation on the snapshot file to obtain a vulnerability scan result;

[0081] Step 430: Send the vulnerability scanning result to the vulnerability scanning service module, so that the vulnerability scanning service module sends the vulnerability scanning result to the client and deletes the snapshot file.

[0082] As a specific implementation, the method specifically determines the snapshot file mounted on the target directory in the following manner: taking the preset directory of the target scanning engine module itself as the target directory, and determining the snapshot file mounted on the target directory.

[0083] As a specific implementation, before determining the snapshot file mounted in the target directory according to the vulnerability scanning task, the method further includes: authenticating the account and password of the target scanning engine module in the vulnerability scanning task. Only if the authentication is passed, the following steps are executed. Figure 4Vulnerability scanning method shown.

[0084] The present application also provides a vulnerability scanning device, which is applied to a vulnerability scanning service module of a cloud platform, such as Figure 5 As shown, the device comprises:

[0085] A host determination module 510 is used to determine a host to be scanned according to a vulnerability scanning request from a client, wherein the host to be scanned is located in a virtualized POD of a cloud platform;

[0086] The engine determination module 520 is used to determine a target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in a network security POD of a cloud platform;

[0087] A snapshot generation module 530 is used to generate a snapshot file of the host to be scanned, and mount the snapshot file to a target directory;

[0088] A task sending module 540, configured to send a vulnerability scanning task to the target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory;

[0089] The result acquisition module 550 is used to obtain the vulnerability scanning result from the target scanning engine module and send it to the client, and delete the snapshot file.

[0090] The embodiment of the present application also provides a vulnerability scanning device, which is applied to a target scanning engine module of a cloud platform, and the target scanning engine module is deployed in a network security POD of the cloud platform, such as Figure 6 As shown, the device comprises:

[0091] The snapshot determination module 610 is used to determine the snapshot file mounted in the target directory according to the vulnerability scanning task sent by the vulnerability scanning service module, wherein the snapshot file is generated by the vulnerability scanning service module according to the host to be scanned and mounted to the target directory, the host to be scanned is determined by the vulnerability scanning service module according to the vulnerability scanning request of the client, and the host to be scanned is located in the virtualized POD of the cloud platform;

[0092] The scanning module 620 is used to perform a scanning operation on the snapshot file to obtain a vulnerability scanning result;

[0093] The result sending module 630 is used to send the vulnerability scanning result to the vulnerability scanning service module, so that the vulnerability scanning service module sends the vulnerability scanning result to the client and deletes the snapshot file.

[0094] An embodiment of the present application also provides an electronic device, comprising: a memory and one or more processors; the memory is coupled to the processor; wherein computer program code is stored in the memory, the computer program code comprises computer instructions, and when the computer instructions are executed by the processor, the electronic device executes the method as described above.

[0095] The structure of the electronic device can refer to Figure 7 The structure of the electronic device 100 is shown.

[0096] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0097] An embodiment of the present application further provides a computer-readable storage medium, including computer instructions, which, when executed on an electronic device, enables the electronic device to execute the method described above.

[0098] The computer-readable storage medium includes but is not limited to any one of the following: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0099] The present application also provides a computer program product, which, when executed on a computer, enables the computer to execute the method described above.

[0100] Among them, the electronic device, computer-readable storage medium, and computer program product provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0101] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0102] In the several embodiments provided in the present application, it should be understood that the disclosed method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of modules or units, which can be electrical, mechanical or other forms.

[0103] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0104] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A vulnerability scanning method, characterized in that: The method is applied to a vulnerability scanning service module of a cloud platform, and the method comprises: Determine a host to be scanned according to a vulnerability scanning request from a client, wherein the host to be scanned is located in a virtualized POD of a cloud platform; Determine a target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in a network security POD of a cloud platform; Generate a snapshot file of the host to be scanned, and mount the snapshot file to a target directory; Sending a vulnerability scanning task to the target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory; The vulnerability scanning result is obtained from the target scanning engine module and sent to the client, and the snapshot file is deleted.

2. The method according to claim 1, characterized in that The method specifically mounts the snapshot file to the target directory in the following manner: A preset directory of the target scanning engine module is determined as a target directory, and the snapshot file is mounted to the target directory.

3. The method according to claim 1, characterized in that The method specifically determines the target scanning engine module for performing a scanning operation on the host to be scanned by: A scanning engine module with the lowest load value is selected from all scanning engine modules of the network security POD to serve as a target scanning engine module for performing a scanning operation on the host to be scanned.

4. The method according to claim 1, characterized in that: The method specifically generates a vulnerability scanning task in the following manner: Using the IP address of the target scanning engine module as the scanning address; Using the target directory where the snapshot file is located as a scanning directory; A vulnerability scanning task is generated according to the scanning address, the scanning directory and the account password of the target scanning engine module.

5. The method according to claim 1, characterized in that The method specifically determines the host to be scanned according to the vulnerability scanning request of the client in the following manner: Determine a target virtual private cloud according to a virtual private cloud identifier in a vulnerability scanning request from a client; A host to be scanned that is deployed in the target virtual private cloud is determined according to a host identifier in a vulnerability scanning request from a client.

6. A vulnerability scanning method, characterized in that: The method is applied to a target scanning engine module of a cloud platform, and the target scanning engine module is deployed in a network security POD of the cloud platform. The method includes: According to the vulnerability scanning task sent by the vulnerability scanning service module, a snapshot file mounted on the target directory is determined, wherein the snapshot file is generated by the vulnerability scanning service module according to the host to be scanned and mounted to the target directory, the host to be scanned is determined by the vulnerability scanning service module according to the vulnerability scanning request of the client, and the host to be scanned is located in the virtualized POD of the cloud platform; Performing a scan operation on the snapshot file to obtain a vulnerability scan result; The vulnerability scanning result is sent to the vulnerability scanning service module, so that the vulnerability scanning service module sends the vulnerability scanning result to the client and deletes the snapshot file.

7. The method according to claim 6, characterized in that The method specifically determines the snapshot file mounted in the target directory in the following manner: The preset directory of the target scanning engine module itself is used as the target directory, and the snapshot file mounted on the target directory is determined.

8. A vulnerability scanning device, characterized in that: The device is applied to a vulnerability scanning service module of a cloud platform, and the device comprises: A host determination module, used to determine a host to be scanned according to a vulnerability scanning request from a client, wherein the host to be scanned is located in a virtualized POD of a cloud platform; An engine determination module, used to determine a target scanning engine module for performing a scanning operation on the host to be scanned, wherein the target scanning engine module is deployed in a network security POD of a cloud platform; A snapshot generation module, used to generate a snapshot file of the host to be scanned, and mount the snapshot file to a target directory; A task sending module, used for sending a vulnerability scanning task to the target scanning engine module, so that the target scanning engine module performs a scanning operation on the snapshot file mounted in the target directory; The result acquisition module is used to obtain the vulnerability scanning result from the target scanning engine module and send it to the client, and delete the snapshot file.

9. A vulnerability scanning device, characterized in that: The device is applied to a target scanning engine module of a cloud platform, and the target scanning engine module is deployed in a network security POD of the cloud platform. The device includes: A snapshot determination module, used to determine a snapshot file mounted on a target directory according to a vulnerability scanning task sent by a vulnerability scanning service module, wherein the snapshot file is generated by the vulnerability scanning service module according to a host to be scanned and mounted to the target directory, the host to be scanned is determined by the vulnerability scanning service module according to a vulnerability scanning request of a client, and the host to be scanned is located in a virtualized POD of a cloud platform; A scanning module, used to perform a scanning operation on the snapshot file to obtain a vulnerability scanning result; The result sending module is used to send the vulnerability scanning result to the vulnerability scanning service module, so that the vulnerability scanning service module sends the vulnerability scanning result to the client and deletes the snapshot file.

10. An electronic device, characterized in that: include: A memory and one or more processors; the memory is coupled to the processor; wherein the memory stores computer program code, the computer program code includes computer instructions, and when the computer instructions are executed by the processor, the electronic device executes the method as described in any one of claims 1-7.

11. A computer-readable storage medium comprising computer instructions, characterized in that: When the computer instructions are executed on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 7.

12. A computer program product, characterized in that When the computer program product is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

Images