Dynamic assessment method and device for vulnerabilities, storage medium and terminal

Abstract

The embodiment of the invention discloses a dynamic assessment method and device for vulnerabilities, a storage medium and a terminal. Regularly acquiring a current calling link of a target interface corresponding to a target vulnerability, wherein the target vulnerability is evaluated as a vulnerability which does not need to be repaired; comparing the current calling link with a historical calling link of the target interface, wherein the historical calling link is the calling link of the target interface when the target vulnerability is evaluated last time; and if the change degree of the current call link relative to the historical call link reaches a preset condition, re-evaluating the target vulnerability. The vulnerability which is evaluated to be not required to be repaired is monitored regularly, the current calling link and the historical calling link of the corresponding target interface are compared, and if the change degree of the calling link reaches a preset condition, the influence range of the current target vulnerability also changes greatly; therefore, whether the target vulnerability needs to be repaired is evaluated and handled again, and the risk can be prevented and handled in time.

Description

Technical Field

[0001] The embodiments of this specification relate to the technical field of computer network security, and particularly to a dynamic assessment method, device, storage medium, and terminal for vulnerabilities. Background Art

[0002] When new vulnerabilities appear in the system, security technicians usually comprehensively consider multiple key factors to determine whether the vulnerabilities need to be repaired. Considering factors such as the scope of influence and repair cost, some vulnerabilities may be evaluated as not requiring repair. However, with the continuous development of services, the scope of influence involved in these vulnerabilities may change, and thus the security risks brought by the vulnerabilities also change. However, these changes are often difficult to be perceived in a timely manner, resulting in these un-repaired vulnerabilities being easily exploited by attackers, triggering a series of serious security consequences and causing huge losses to enterprises and users. Summary of the Invention

[0003] The embodiments of this specification provide a dynamic assessment method, device, storage medium, and terminal for vulnerabilities, which can solve the technical problem in the related art that it is difficult to evaluate vulnerabilities effectively in the long term.

[0004] In a first aspect, the embodiments of this specification provide a dynamic assessment method for vulnerabilities, and the method includes: Regularly obtain the current call link of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair; Compare the current call link with the historical call link of the target interface, where the historical call link is the call link of the target interface when the target vulnerability was last evaluated; If the degree of change of the current call link compared to the historical call link reaches a preset condition, re-evaluate the target vulnerability.

[0005] In a possible implementation manner, before regularly obtaining the current call link of the target vulnerability, it further includes: when detecting the appearance of a new vulnerability, obtain the initial call link of the target interface corresponding to the new vulnerability, and evaluate whether the new vulnerability needs to be repaired; if the new vulnerability does not need to be repaired, use the new vulnerability as the target vulnerability and the initial call link as the historical call link of the target interface, and continuously monitor the target vulnerability based on the information of the target interface and the historical call link.

[0006] In a possible implementation manner, evaluating whether the new vulnerability needs to be repaired includes: evaluating the scope of influence corresponding to the new vulnerability based on the initial call link, and determining whether the new vulnerability needs to be repaired according to the scope of influence.

[0007] In a possible implementation, after evaluating whether the newly added vulnerability needs to be repaired, the following steps are further included: if the newly added vulnerability needs to be repaired, generate a vulnerability work order corresponding to the newly added vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the newly added vulnerability does not need to be repaired, perform a preset mitigation measure on the newly added vulnerability.

[0008] In a possible implementation, the preset mitigation measure includes at least one of applying firewall rule interception and whitelist access control.

[0009] In a possible implementation, the continuous monitoring of the target vulnerability based on the information of the target interface and the historical call link includes: creating a key-value pair corresponding to the target vulnerability; using the interface identifier of the target interface and the application system identifier corresponding to the target interface as the key in the key-value pair, and using the historical call link of the target interface as the value in the key-value pair; storing the key-value pair in a preset monitoring set, and the preset monitoring set is used to store the key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0010] In a possible implementation, the preset conditions include at least one of a newly added externally exposed surface, a newly added critical call, and a newly added preset number of ordinary calls.

[0011] In a possible implementation, after re-evaluating the target vulnerability, the following steps are further included: if the target vulnerability needs to be repaired, generate a vulnerability work order corresponding to the target vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the target vulnerability does not need to be repaired, update the historical call link of the target interface at this time to the current call link.

[0012] In a possible implementation, the method further includes: performing vulnerability monitoring on at least one interface based on a preset monitoring program, and the preset monitoring program has at least one function of vulnerability scanning, penetration testing, and intelligence monitoring.

[0013] In a second aspect, an embodiment of this specification provides a dynamic evaluation device for vulnerabilities, and the device includes: A vulnerability time-point characterization module, configured to periodically obtain the current call link of a target interface corresponding to a target vulnerability, where the target vulnerability is a vulnerability that is evaluated as not needing to be repaired; A call link comparison module, configured to compare the current call link with the historical call link of the target interface, where the historical call link is the call link of the target interface when the target vulnerability was last evaluated; A vulnerability re - evaluation module is used to re - evaluate the target vulnerability if the degree of change of the current call chain compared to the historical call chain reaches a preset condition.

[0014] In a possible implementation manner, the above - mentioned dynamic evaluation device for vulnerabilities further includes: a vulnerability monitoring and management module, which is used to, when detecting the emergence of a new vulnerability, obtain the initial call chain of the target interface corresponding to the new vulnerability and evaluate whether the new vulnerability needs to be repaired; if the new vulnerability does not need to be repaired, then use the new vulnerability as the target vulnerability and the initial call chain as the historical call chain of the target interface, and continuously monitor the target vulnerability based on the information of the target interface and the historical call chain.

[0015] In a possible implementation manner, the above - mentioned vulnerability monitoring and management module is used to evaluate the influence scope corresponding to the new vulnerability based on the initial call chain, and determine whether the new vulnerability needs to be repaired according to the influence scope.

[0016] In a possible implementation manner, the above - mentioned dynamic evaluation device for vulnerabilities further includes: a vulnerability handling module, which is used to, if the new vulnerability needs to be repaired, generate a vulnerability work order corresponding to the new vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the new vulnerability does not need to be repaired, then perform a preset mitigation measure on the new vulnerability.

[0017] In a possible implementation manner, the above - mentioned preset mitigation measure includes at least one of applying firewall rule interception and whitelist access control.

[0018] In a possible implementation manner, the above - mentioned vulnerability monitoring and management module is used to create a key - value pair corresponding to the target vulnerability; use the interface identifier of the target interface and the application system identifier corresponding to the target interface as the keys in the key - value pair, and use the historical call chain of the target interface as the value in the key - value pair; store the key - value pair in a preset monitoring set, and the preset monitoring set is used to store the key - value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0019] In a possible implementation manner, the above - mentioned preset condition includes at least one of a new externally exposed surface, a new critical call, and a new preset number of ordinary calls.

[0020] In a possible implementation manner, the above - mentioned dynamic evaluation device for vulnerabilities further includes: a call chain update module, which is used to, if the target vulnerability needs to be repaired, generate a vulnerability work order corresponding to the target vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the target vulnerability does not need to be repaired, then update the historical call chain of the target interface at this time to the current call chain.

[0021] In a possible implementation manner, the above-mentioned dynamic evaluation device for vulnerabilities further includes: an interface vulnerability monitoring module, which is used to monitor vulnerabilities of at least one interface based on a preset monitoring program, and the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0022] In a third aspect, an embodiment of this specification provides a computer program product containing instructions. When the computer program product runs on a computer or a processor, the computer or the processor is caused to execute the steps of the above-mentioned method.

[0023] In a fourth aspect, an embodiment of this specification provides a computer storage medium. The computer storage medium stores multiple instructions, and the instructions are suitable for being loaded and executed by a processor to execute the steps of the above-mentioned method.

[0024] In a fifth aspect, an embodiment of this specification provides a terminal, including a memory, a processor, and a computer program stored on the memory and executable on the processor. The computer program is suitable for being loaded and executed by the processor to execute the steps of the above-mentioned method.

[0025] The beneficial effects brought by the technical solutions provided in some embodiments of this specification at least include: An embodiment of this specification provides a dynamic evaluation method for vulnerabilities, which periodically obtains the current call link of a target interface corresponding to a target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair; compares the current call link with the historical call link of the target interface, and the historical call link is the call link of the target interface when the target vulnerability was last evaluated; if the degree of change of the current call link compared with the historical call link reaches a preset condition, the target vulnerability is re-evaluated. Timely monitoring is performed on vulnerabilities evaluated as not requiring repair, and the current call link of the target interface corresponding to the target vulnerability is compared with the historical call link of this interface during the last evaluation. The change in the call link represents that the influence range of the vulnerability has also changed. Then, if the degree of change of the call link reaches the preset condition, it means that the influence range of the current target vulnerability may be enlarged or aggravated, and then the target vulnerability is re-evaluated for whether it needs to be repaired and disposed of, which is beneficial to timely prevention and response to risks and avoids long-term latent and continuous amplification of risks. Description of the Drawings

[0026] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of this specification. For those skilled in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0027] Figure 1 Exemplary system architecture diagram of a dynamic evaluation method for vulnerabilities provided by the embodiments of this specification; Figure 2 Schematic flow diagram of a dynamic evaluation method for vulnerabilities provided by the embodiments of this specification; Figure 3 Schematic flow diagram of a dynamic evaluation method for vulnerabilities provided by the embodiments of this specification; Figure 4 Logical flow diagram of a dynamic evaluation method for vulnerabilities provided by the embodiments of this specification; Figure 5 Structural block diagram of a dynamic evaluation device for vulnerabilities provided by the embodiments of this specification; Figure 6 Schematic structural diagram of a terminal provided by the embodiments of this specification. Detailed implementation manners

[0028] To make the features and advantages of the embodiments of this specification more obvious and understandable, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this specification. Obviously, the described embodiments are only a part of the embodiments of this specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope protected by the embodiments of this specification.

[0029] When the following description involves the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all the implementation manners consistent with the embodiments of this specification. On the contrary, they are only examples of devices and methods consistent with some aspects of the embodiments of this specification as detailed in the appended claims. And in the description of the embodiments of this specification, unless otherwise specified, " / " means "or". For example, A / B can represent A or B. The "and / or" in the text is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this specification, "a plurality of" means two or more than two.

[0030] Hereinafter, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as implying or indicating relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of such features.

[0031] In response to new vulnerabilities emerging in the system, security technicians often first evaluate whether a vulnerability needs to be fixed based on dimensions such as vulnerability severity rating, affected asset distribution, effectiveness of existing protection strategies, and repair costs. Therefore, after comprehensive evaluation, some vulnerabilities may be evaluated as not requiring repair. However, as the service continues to develop and change, the various factors used for evaluation may change quietly. For example, code refactoring of core modules may cause dangerous coupling of originally isolated vulnerabilities; the reuse of interfaces during cloud data migration may lead to inheritance of vulnerabilities; vulnerabilities with a relatively small original impact scope may have more external exposure surfaces due to service expansion; or with the development of technology, original risk mitigation measures may become ineffective due to new attack methods.

[0032] According to the conventional vulnerability monitoring process, once a vulnerability is marked as "not requiring repair", long-term continuous monitoring of such vulnerabilities will no longer be carried out. This results in those vulnerabilities that have been evaluated as not requiring repair actually being in a state of lacking continuous monitoring. Then when the impact scope of the vulnerability changes, the system is difficult to detect the potential risks existing in this historical vulnerability in a timely manner. The long-term existence of this defense blind spot greatly increases the risk of the vulnerability being attacked. In this case, the initial security level of the system will gradually decline over time, and these overlooked vulnerabilities are easily exploited by attackers, thereby triggering a series of security consequences, such as leakage of enterprise core data, system paralysis, and infringement of user privacy, causing huge losses to users and enterprises.

[0033] Therefore, the embodiments of this specification provide a dynamic evaluation method for vulnerabilities to solve the above technical problem of being difficult to evaluate vulnerabilities effectively in the long term.

[0034] Please refer to Figure 1 , Figure 1 which is an exemplary system architecture diagram of a dynamic evaluation method for vulnerabilities provided by the embodiments of this specification.

[0035] As Figure 1 shown, the system architecture may include a terminal 101, a network 102, and a server 103. The network 102 is used to provide a medium for the communication link between the terminal 101 and the server 103. The network 102 may include various types of wired communication links or wireless communication links. For example, wired communication links include optical fibers, twisted pairs, or coaxial cables, and wireless communication links include Bluetooth communication links, Wireless-Fidelity (Wi-Fi) communication links, or microwave communication links, etc.

[0036] The terminal 101 can interact with the server 103 via the network 102 to receive messages from the server 103 or send messages to the server 103. Alternatively, the terminal 101 can interact with the server 103 via the network 102 to receive messages or data sent by other users to the server 103. The terminal 101 can be either hardware or software. When the terminal 101 is hardware, it can be various electronic devices, including but not limited to smartphones, tablets, laptop portable computers, and desktop computers, etc. When the terminal 101 is software, it can be installed in the above-listed electronic devices, and can be implemented as multiple software or software modules (for example, to provide distributed services), or can be implemented as a single software or software module, and no specific limitation is made here.

[0037] In the embodiments of this specification, the terminal 101 periodically obtains the current call link of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair; then, the terminal 101 compares the current call link with the historical call link of the target interface, and the historical call link is the call link of the target interface when the target vulnerability was last evaluated; if the degree of change of the current call link compared to the historical call link reaches a preset condition, then the terminal 101 can re-evaluate the target vulnerability.

[0038] The server 103 can be a business server that provides various services. It should be noted that the server 103 can be either hardware or software. When the server 103 is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or can be implemented as a single server. When the server 103 is software, it can be implemented as multiple software or software modules (for example, to provide distributed services), or can be implemented as a single software or software module, and no specific limitation is made here.

[0039] Alternatively, the system architecture may not include the server 103. In other words, the server 103 can be an optional device in the embodiments of this specification, that is, the method provided in the embodiments of this specification can be applied to a system structure that only includes the terminal 101, and no limitation is made in the embodiments of this specification.

[0040] It should be understood that Figure 1 the numbers of the terminal, network, and server are only illustrative, and according to the implementation requirements, there can be any number of terminals, networks, and servers.

[0041] Please refer to Figure 2 , Figure 2It is a schematic flowchart of a dynamic evaluation method for vulnerabilities provided by an embodiment of this specification. The execution subject of the embodiment of this specification can be a terminal that executes the dynamic evaluation of vulnerabilities, or a processor in the terminal that executes the dynamic evaluation method for vulnerabilities, or a dynamic evaluation service for vulnerabilities in the terminal that executes the dynamic evaluation method for vulnerabilities. For the convenience of description, hereinafter, taking the execution subject as the processor in the terminal as an example, the specific execution process of the dynamic evaluation method for vulnerabilities will be introduced.

[0042] As Figure 2 shown, the dynamic evaluation method for vulnerabilities can at least include: S202. Regularly obtain the current call chain of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability that has been evaluated as not requiring repair.

[0043] Optionally, applications, systems, devices, services, code programs, etc. related to the vulnerability, that is, the scope of influence corresponding to the vulnerability. Then, when the scope of influence of the vulnerability changes, new risks are likely to appear. Therefore, in order to avoid the latent and continuous amplification of risks, it is necessary to dynamically and continuously monitor the unpatched vulnerabilities.

[0044] In the embodiment of this specification, for the target vulnerability that has been evaluated as not requiring repair, considering that what the target interface corresponding to the target vulnerability contacts, such as the systems and applications that call the target interface, the code programs that use the interface, etc., determines the impact surface of the target vulnerability in the entire system. Then, monitoring the call chain of the target interface can determine whether the impact surface of the target vulnerability has changed.

[0045] Specifically, it can be cycled at a preset time interval to regularly obtain the current call chain information of the target interface corresponding to the target vulnerability. When obtaining the current call chain, the probe implanted in the service mesh can be used to real-time depict the full call characteristics including service node topology, parameter transfer path, dependent component version, etc., and conduct a full-link characterization of the target interface at the call level to comprehensively reflect each impact surface associated with the target vulnerability.

[0046] S204. Compare the current call chain with the historical call chain of the target interface, where the historical call chain is the call chain of the target interface when the target vulnerability was last evaluated.

[0047] Optionally, after successfully obtaining the current call chain of the target interface, it is necessary to compare and analyze it with the historical call chain of the target interface. At this time, the historical call chain of the target interface refers to the call chain situation of the target interface obtained and recorded during the previous evaluation of the target vulnerability. The historical call chain fully reflects the interaction logic, data flow, and collaboration relationship between modules involved in the target interface in the system at that time, and is an important reference basis for evaluating the change in the impact scope of the target vulnerability.

[0048] Specifically, when comparing the current call chain with the historical call chain, a series of algorithms and metrics can be used to measure the degree of change between the two. These metrics may involve multiple dimensions such as the change in the length of the call chain, the addition or deletion of key nodes, the change in the data transmission path, and the fluctuation of the interface call frequency. From the change in the call chain, the change in the impact scope of the target vulnerability in the system at this time can be clarified, and then it can be judged what kind of handling strategy the target vulnerability needs.

[0049] S206. If the degree of change of the current call chain compared with the historical call chain reaches the preset condition, re-evaluate the target vulnerability.

[0050] Optionally, once it is found that the degree of change of the current call chain compared with the historical call chain reaches the pre-set condition threshold, this means that the operating environment, logic, or interaction relationship with surrounding modules of the target interface may have changed significantly. And this change is very likely to affect the state of the target vulnerability, making the vulnerability that was originally determined not to need repair may have new security risks in the current environment. At this time, it is necessary to re-evaluate the target vulnerability in a timely manner, and comprehensively consider the new system operating conditions, requirements, and security policies to determine again whether the vulnerability needs to be repaired to ensure that the security and stability of the system are always within a controllable range.

[0051] In the embodiments of this specification, the preset conditions for quantifying the degree of change of the call chain include at least one of a newly added external exposure surface, a newly added key call, and a newly added preset number of ordinary calls. Among them, if the target interface has a newly added external exposure surface, it means that the target interface is vulnerable to attacks initiated by attackers from the public network; if the target interface is newly called by the core program or key system, it means that the target interface becomes more important, and thus the target vulnerability becomes more important; if the target interface has multiple application calls added (for example, more than 3 ordinary application calls are added), it means that the exposure surface of the target vulnerability increases and its risk becomes larger. Then when the degree of change of the call chain of the target interface meets any one of the preset conditions, it can be explained that the current risk has expanded and timely control is required. The preset conditions can be set according to expert experience or formulated through a neural network model, and the embodiments of this specification do not limit this.

[0052] It should be noted that in addition to the system actively triggering the process of re - evaluating target vulnerabilities according to a regular cycle, the system also supports technicians to manually trigger the process of re - evaluating target vulnerabilities. For example, when technicians perform new development on a target interface, they can manually trigger the process of re - evaluating the target vulnerabilities corresponding to the target interface, so as to achieve timely detection and handling of the risks brought by the target vulnerabilities.

[0053] In the embodiments of this specification, a dynamic evaluation method for vulnerabilities is provided. Timely obtain the current call chain of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair; compare the current call chain with the historical call chain of the target interface, and the historical call chain is the call chain of the target interface when the target vulnerability was last evaluated; if the degree of change of the current call chain compared to the historical call chain reaches a preset condition, then re - evaluate the target vulnerability. Timely monitor the vulnerabilities evaluated as not requiring repair, compare the current call chain of the target interface corresponding to the target vulnerability with the historical call chain at the time of the last evaluation of this interface. The change in the call chain represents that the scope of influence of the vulnerability has also changed. Then, if the degree of change of the call chain reaches the preset condition, it indicates that the scope of influence of the current target vulnerability may be enlarged or aggravated, and then re - evaluate whether the target vulnerability needs to be repaired and handle it, which is conducive to timely prevention and response to risks, and avoids long - term latent and continuous amplification of risks.

[0054] Please refer to Figure 3 , Figure 3 which is a schematic flowchart of a dynamic evaluation method for vulnerabilities provided by the embodiments of this specification.

[0055] As Figure 3 shown, the dynamic evaluation method for vulnerabilities can at least include: S302. Perform vulnerability monitoring on at least one interface based on a preset monitoring program, and the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0056] Optionally, please refer to Figure 4 , Figure 4 which is a logical flowchart of a dynamic evaluation method for vulnerabilities provided by the embodiments of this specification. As Figure 4 shown, in the system, a preset monitoring program can be set to perform automated vulnerability monitoring on each interface in the system. The preset monitoring program has one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring, and can comprehensively and deeply capture vulnerabilities in the system. Through this continuous automated monitoring, it provides a solid guarantee for the safe operation of the system, enabling the administrator to timely understand the security status of the system and take corresponding measures for repair and prevention.

[0057] S304. When a newly discovered vulnerability is detected, obtain the initial call chain of the target interface corresponding to the newly discovered vulnerability, and evaluate whether the newly discovered vulnerability needs to be fixed.

[0058] Optionally, please continue to refer to Figure 4 , when a newly discovered vulnerability is detected, it is first necessary to evaluate the newly discovered vulnerability to confirm whether the newly discovered vulnerability needs to be fixed. Specifically, generally, it is considered based on multiple factors such as the difficulty of exploiting the vulnerability, the actual impact on the system's core functions and critical data after exploitation, and the cost required to fix the vulnerability, to determine whether the newly discovered vulnerability is a vulnerability that does not need to be fixed temporarily. In the embodiments of this specification, specifically, obtain the initial call chain of the target interface corresponding to the newly discovered vulnerability, and based on the initial call chain, evaluate the impact scope corresponding to the newly discovered vulnerability, so as to determine whether the newly discovered vulnerability needs to be fixed according to the impact scope.

[0059] S306. If the newly discovered vulnerability needs to be fixed, generate a vulnerability work order corresponding to the newly discovered vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the newly discovered vulnerability does not need to be fixed, perform a preset mitigation measure on the newly discovered vulnerability.

[0060] Please continue to refer to Figure 4 , it can be understood that if the evaluation result shows that the newly discovered vulnerability needs to be fixed, then promote the repair process of the newly discovered vulnerability. Specifically, it can be reflected in generating a vulnerability work order corresponding to the newly discovered vulnerability and sending the vulnerability work order to a preset vulnerability repair node. Usually, the corresponding security technicians will receive the vulnerability work order at the vulnerability repair node and perform timely risk elimination processing on the vulnerability to ensure the overall security of the system.

[0061] If the newly discovered vulnerability is evaluated as not needing to be fixed, then a preset mitigation measure can be performed on the newly discovered vulnerability to reduce the risk of the vulnerability being exploited through some temporary technical means or management measures, such as adjusting system configurations, restricting access permissions, applying firewall rules to intercept, white list access control, etc. Or when the vulnerability risk is relatively small, the risk may also be evaluated as acceptable, and in this case, no processing is required for the vulnerability.

[0062] S308. If the newly discovered vulnerability does not need to be fixed, use the newly discovered vulnerability as the target vulnerability and the initial call chain as the historical call chain of the target interface, and continuously monitor the target vulnerability based on the information of the target interface and the historical call chain.

[0063] Optionally, if the newly discovered vulnerability does not need to be fixed temporarily at present, it is necessary to use the newly discovered vulnerability as the target vulnerability and the initial call chain as the historical call chain of the target interface, so as to continuously monitor the target vulnerability based on the information of the target interface and the historical call chain.

[0064] Specifically, please continue to refer to Figure 4 , in order to dynamically monitor the change of the impact surface of target vulnerabilities, all key-value pairs corresponding to the target vulnerabilities that need to be continuously monitored can be uniformly stored through a preset monitoring set, so as to realize the timed check of all target vulnerabilities. The preset monitoring set can be configured to check the interface call link of all recorded vulnerabilities according to a certain period to realize the automation of dynamic monitoring. The timing period can be 7 days, 30 days, etc., and the embodiments of this specification do not make specific limitations on this.

[0065] Then, for the target vulnerabilities that are first evaluated as not requiring repair, first create the key-value pairs corresponding to the target vulnerabilities. Among them, the interface identifier of the target interface and the application system identifier (TraceID) corresponding to the target interface are used as the key in the key-value pair, and the historical call link of the target interface is used as the value in the key-value pair. Then, storing the key-value pairs into the preset monitoring set can realize global monitoring. Trace (tracking ID) is a globally unique identifier used to identify the entire trace of a single user request or transaction in a distributed system. It is generated when the object to be identified first enters the system and can maintain consistency and uniqueness during all related processing processes. That is, all transactions related to the target vulnerability will carry this identifier, so as to associate them and form a complete trace chain.

[0066] S310. Timely obtain the current call link of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair.

[0067] S312. Compare the current call link with the historical call link of the target interface. The historical call link is the call link of the target interface when the target vulnerability was last evaluated; if the change degree of the current call link compared with the historical call link reaches the preset condition, re-evaluate the target vulnerability.

[0068] Regarding steps S310 - S312, please refer to the detailed description in steps S202 - S204, and will not be elaborated here.

[0069] S314. If the target vulnerability needs to be repaired, generate a vulnerability work order corresponding to the target vulnerability and send the vulnerability work order to the preset vulnerability repair node; if the target vulnerability does not need to be repaired, update the historical call link of the target interface at this time to the current call link.

[0070] Optionally, as Figure 4As shown, if the target vulnerability is evaluated as needing to be fixed at this time, a vulnerability work order corresponding to the target vulnerability can be generated and sent to a preset vulnerability repair node, or other targeted preset repair strategies can be adaptively adopted. If the target vulnerability does not need to be fixed, the target vulnerability is mitigated or the risk is directly accepted. In addition, it is also necessary to synchronously refresh the value corresponding to the target vulnerability in the preset monitoring set, and save the current call chain obtained in real time as the new value in the key-value pair, that is, update the historical call chain of the target interface at this time to the current call chain, so as to ensure that the impact surface information of the target vulnerability recorded in the set has reliable timeliness and achieve long-term controllability of security risks.

[0071] In the embodiments of this specification, a dynamic evaluation method for vulnerabilities is provided. Based on a preset monitoring program, at least one interface is monitored for vulnerabilities to comprehensively capture vulnerabilities in the system and timely and accurately detect newly emerging vulnerabilities in the system. When a newly emerging vulnerability is detected, the initial call chain of the target interface corresponding to the newly emerging vulnerability is obtained, and the impact range corresponding to the newly emerging vulnerability is evaluated based on the initial call chain, so as to determine whether the newly emerging vulnerability needs to be fixed according to the impact range. If the newly emerging vulnerability needs to be fixed, a vulnerability work order corresponding to the newly emerging vulnerability is generated and sent to a preset vulnerability repair node; if the newly emerging vulnerability does not need to be fixed, a preset mitigation measure is executed on the newly emerging vulnerability to timely reduce the risk level of the vulnerability in the system. If the newly emerging vulnerability does not need to be fixed, the newly emerging vulnerability is used as the target vulnerability and the initial call chain is used as the historical call chain of the target interface, and the target vulnerability is continuously monitored based on the information of the target interface and the historical call chain to achieve regular checks on all target vulnerabilities. The current call chain of the target interface corresponding to the target vulnerability is obtained regularly. The target vulnerability is a vulnerability that is evaluated as not needing to be fixed. The current call chain is compared with the historical call chain of the target interface. If the degree of change of the current call chain compared with the historical call chain reaches a preset condition, the target vulnerability is re-evaluated, enhancing the visualization of security risks and at the same time improving the emergency response efficiency of such vulnerabilities. If the target vulnerability needs to be fixed, a vulnerability work order corresponding to the target vulnerability is generated and sent to a preset vulnerability repair node; if the target vulnerability does not need to be fixed, the historical call chain of the target interface at this time is updated to the current call chain to ensure that the impact surface information of the target vulnerability recorded in the set has reliable timeliness and achieve long-term controllability of security risks.

[0072] Please refer to Figure 5 , Figure 5 which is a structural block diagram of a dynamic evaluation device for vulnerabilities provided by the embodiments of this specification. As Figure 5 shown, the dynamic evaluation device 500 for vulnerabilities includes: The vulnerability timing characterization module 510 is used to periodically obtain the current call chain of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair. The call chain comparison module 520 is used to compare the current call chain with the historical call chain of the target interface, where the historical call chain is the call chain of the target interface during the previous evaluation of the target vulnerability. The vulnerability re-evaluation module 530 is used to re-evaluate the target vulnerability if the degree of change of the current call chain compared to the historical call chain reaches a preset condition.

[0073] Optionally, the dynamic vulnerability assessment device 500 for vulnerabilities further includes: a vulnerability monitoring and management module, which is used to, when detecting the emergence of a new vulnerability, obtain the initial call chain of the target interface corresponding to the new vulnerability, and evaluate whether the new vulnerability needs to be repaired; if the new vulnerability does not need to be repaired, then use the new vulnerability as the target vulnerability and the initial call chain as the historical call chain of the target interface, and continuously monitor the target vulnerability based on the information of the target interface and the historical call chain.

[0074] Optionally, the vulnerability monitoring and management module is used to evaluate the impact scope corresponding to the new vulnerability based on the initial call chain, and determine whether the new vulnerability needs to be repaired according to the impact scope.

[0075] Optionally, the dynamic vulnerability assessment device 500 for vulnerabilities further includes: a vulnerability handling module, which is used to, if the new vulnerability needs to be repaired, generate a vulnerability work order corresponding to the new vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the new vulnerability does not need to be repaired, then perform a preset mitigation measure on the new vulnerability.

[0076] Optionally, the preset mitigation measure includes at least one of applying a firewall rule interception and whitelist access control.

[0077] Optionally, the vulnerability monitoring and management module is used to create a key-value pair corresponding to the target vulnerability; use the interface identifier of the target interface and the application system identifier corresponding to the target interface as the keys in the key-value pair, and use the historical call chain of the target interface as the value in the key-value pair; store the key-value pair in a preset monitoring set, where the preset monitoring set is used to store the key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0078] Optionally, the preset condition includes at least one of a new externally exposed surface, a new critical call, and a new preset number of ordinary calls.

[0079] Optionally, the dynamic vulnerability assessment device 500 further includes: a call link update module, configured to generate a vulnerability work order corresponding to the target vulnerability and send the vulnerability work order to a preset vulnerability repair node if the target vulnerability needs to be repaired; if the target vulnerability does not need to be repaired, update the historical call link of the target interface at this time to the current call link.

[0080] Optionally, the dynamic vulnerability assessment device 500 further includes: an interface vulnerability monitoring module, configured to monitor at least one interface for vulnerabilities based on a preset monitoring program, and the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0081] In an embodiment of this specification, a dynamic vulnerability assessment device is provided. Among them, a vulnerability timing characterization module is configured to periodically obtain the current call link of a target interface corresponding to a target vulnerability, and the target vulnerability is a vulnerability that is evaluated as not requiring repair; a call link comparison module is configured to compare the current call link with the historical call link of the target interface, and the historical call link is the call link of the target interface when the target vulnerability was last evaluated; a vulnerability re-evaluation module is configured to re-evaluate the target vulnerability if the degree of change of the current call link compared to the historical call link reaches a preset condition. Timely monitoring is performed on vulnerabilities that are evaluated as not requiring repair, the current call link of the target interface corresponding to the target vulnerability is compared with the historical call link of the interface during the last evaluation, and the change in the call link represents a change in the impact scope of the vulnerability. Then, if the degree of change of the call link reaches the preset condition, it indicates that the impact scope of the current target vulnerability may have expanded or become more serious, and thus a re-evaluation and disposal of whether the target vulnerability needs to be repaired are carried out, which is beneficial to timely prevention and response to risks and avoids long-term latent and continuous amplification of risks.

[0082] An embodiment of this specification provides a computer program product containing instructions. When the computer program product runs on a computer or a processor, the computer or the processor is caused to execute the steps of the method in any one of the above embodiments.

[0083] An embodiment of this specification also provides a computer storage medium. The computer storage medium can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor to execute the steps of the method in any one of the above embodiments.

[0084] Please refer to Figure 6 , Figure 6 which is a schematic structural diagram of a terminal provided by an embodiment of this specification. As Figure 6 shown, the terminal 600 may include: at least one terminal processor 601, at least one network interface 604, a user interface 603, a memory 605, and at least one communication bus 602.

[0085] Among them, the communication bus 602 is used to implement connection communication between these components.

[0086] Among them, the user interface 603 may include a display screen (Display), a camera (Camera), and optionally, the user interface 603 may further include a standard wired interface and a wireless interface.

[0087] Among them, the network interface 604 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0088] Among them, the terminal processor 601 may include one or more processing cores. The terminal processor 601 connects various parts within the entire terminal 600 through various interfaces and lines, and by running or executing instructions, programs, code sets, or instruction sets stored in the memory 605, as well as calling data stored in the memory 605, it executes various functions of the terminal 600 and processes data. Optionally, the terminal processor 601 may be implemented in at least one of the hardware forms of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The terminal processor 601 may integrate one or several combinations of a central processing unit (CPU), a graphics processing unit (GPU), and a modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communication. It can be understood that the above-mentioned modem may not be integrated into the terminal processor 601 and may be implemented separately by a single chip.

[0089] Among them, the memory 605 may include a Random Access Memory (RAM), or may include a Read-Only Memory (ROM). Optionally, the memory 605 includes a non-transitory computer-readable storage medium. The memory 605 can be used to store instructions, programs, codes, code sets, or instruction sets. The memory 605 may include a program storage area and a data storage area. Among them, the program storage area can store instructions for implementing the operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area can store the data involved in the above-mentioned method embodiments. Optionally, the memory 605 may also be at least one storage device located far from the aforementioned terminal processor 601. As Figure 6 shown, the memory 605, as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a dynamic evaluation program for vulnerabilities.

[0090] In Figure 6 the terminal 600 shown, the user interface 603 is mainly used to provide an input interface for the user to obtain the data input by the user; while the terminal processor 601 can be used to call the dynamic evaluation program for vulnerabilities stored in the memory 605 and specifically perform the following operations: Regularly obtain the current call link of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair; Compare the current call link with the historical call link of the target interface, where the historical call link is the call link of the target interface when the target vulnerability was last evaluated; If the degree of change of the current call link compared with the historical call link reaches a preset condition, re-evaluate the target vulnerability.

[0091] In some embodiments, before the terminal processor 601 executes the step of regularly obtaining the current call link of the target vulnerability, it also specifically performs the following steps: when it is detected that a new vulnerability appears, obtain the initial call link of the target interface corresponding to the new vulnerability, and evaluate whether the new vulnerability needs to be repaired; if the new vulnerability does not need to be repaired, use the new vulnerability as the target vulnerability and the initial call link as the historical call link of the target interface, and continuously monitor the target vulnerability based on the information of the target interface and the historical call link.

[0092] In some embodiments, when the terminal processor 601 executes the evaluation of whether a newly added vulnerability needs to be repaired, the following steps are specifically executed: based on the initial call chain, evaluate the impact scope corresponding to the newly added vulnerability, and determine whether the newly added vulnerability needs to be repaired according to the impact scope.

[0093] In some embodiments, after the terminal processor 601 executes the evaluation of whether a newly added vulnerability needs to be repaired, the following steps are also specifically executed: if the newly added vulnerability needs to be repaired, generate a vulnerability work order corresponding to the newly added vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the newly added vulnerability does not need to be repaired, execute a preset mitigation measure on the newly added vulnerability.

[0094] In some embodiments, the preset mitigation measures include at least one of applying firewall rule interception and whitelist access control.

[0095] In some embodiments, when the terminal processor 601 executes continuous monitoring of a target vulnerability based on the information of the target interface and the historical call chain, the following steps are specifically executed: create a key-value pair corresponding to the target vulnerability; use the interface identifier of the target interface and the application system identifier corresponding to the target interface as the key in the key-value pair, and use the historical call chain of the target interface as the value in the key-value pair; store the key-value pair in a preset monitoring set, and the preset monitoring set is used to store the key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0096] In some embodiments, the preset conditions include at least one of a newly added externally exposed surface, a newly added critical call, and a newly added preset number of ordinary calls.

[0097] In some embodiments, after the terminal processor 601 executes the re-evaluation of the target vulnerability, the following steps are also specifically executed: if the target vulnerability needs to be repaired, generate a vulnerability work order corresponding to the target vulnerability and send the vulnerability work order to a preset vulnerability repair node; if the target vulnerability does not need to be repaired, update the historical call chain of the target interface at this time to the current call chain.

[0098] In some embodiments, the terminal processor 601 also specifically executes the following steps: perform vulnerability monitoring on at least one interface based on a preset monitoring program, and the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0099] In several embodiments provided in this specification, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces, and the indirect couplings or communication connections of devices or modules can be in electrical, mechanical or other forms.

[0100] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they can be located in one place or distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0101] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the processes or functions described above in the embodiments of this specification are generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above computer instructions can be stored in a computer-readable storage medium or transmitted through the above computer-readable storage medium. The above computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center in a wired (such as coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more integrated available media. The above available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a Digital Versatile Disc (DVD)), or a semiconductor medium (for example, a Solid State Disk (SSD)), etc.

[0102] It should be noted that, for the foregoing method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should know that the embodiments of this specification are not limited by the described action sequence, because according to the embodiments of this specification, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments of this specification.

[0103] In addition, it should be noted that the information (including but not limited to user equipment information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the call link data involved in this specification are all obtained under sufficient authorization.

[0104] The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve the desired result. Additionally, the processes depicted in the figures do not necessarily require the specific order or sequential order shown to achieve the desired result. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] In the above embodiments, the descriptions of the various embodiments have their own focuses. For the parts not detailed in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0106] The above is the description of a dynamic assessment method, device, storage medium, and terminal for vulnerabilities provided by the embodiments of this specification. For those skilled in the art, according to the idea of the embodiments of this specification, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to the embodiments of this specification.

Claims

1. A dynamic evaluation method for vulnerabilities, characterized in that The method includes: Timely obtaining the current call link of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair; Comparing the current call link with the historical call link of the target interface, where the historical call link is the call link of the target interface when the target vulnerability was last evaluated; If the degree of change of the current call link compared to the historical call link reaches a preset condition, re-evaluate the target vulnerability.

2. The method according to claim 1, characterized in that, Before timely obtaining the current call link of the target vulnerability, it further includes: When a new vulnerability is detected, obtaining the initial call link of the target interface corresponding to the new vulnerability and evaluating whether the new vulnerability needs to be repaired; If the new vulnerability does not need to be repaired, taking the new vulnerability as the target vulnerability and the initial call link as the historical call link of the target interface, and continuously monitoring the target vulnerability based on the information of the target interface and the historical call link.

3. The method according to claim 2, wherein Evaluating whether the new vulnerability needs to be repaired includes: Evaluating the impact scope corresponding to the new vulnerability based on the initial call link, and determining whether the new vulnerability needs to be repaired according to the impact scope.

4. The method according to claim 2, wherein After evaluating whether the new vulnerability needs to be repaired, it further includes: If the new vulnerability needs to be repaired, generating a vulnerability work order corresponding to the new vulnerability and sending the vulnerability work order to a preset vulnerability repair node; If the new vulnerability does not need to be repaired, performing a preset mitigation measure on the new vulnerability.

5. The method according to claim 4, wherein The preset mitigation measure includes at least one of applying firewall rule interception and whitelist access control.

6. The method according to claim 2, wherein Continuously monitoring the target vulnerability based on the information of the target interface and the historical call link includes: Creating a key-value pair corresponding to the target vulnerability; Taking the interface identifier of the target interface and the application system identifier corresponding to the target interface as the keys in the key-value pair, and taking the historical call link of the target interface as the value in the key-value pair; Storing the key-value pair in a preset monitoring set, where the preset monitoring set is used to store the key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

7. The method according to claim 1, characterized in that, The preset condition includes at least one of a new externally exposed surface, a new critical call, and a new preset number of ordinary calls.

8. The method according to claim 3, wherein After re-evaluating the target vulnerability, it further includes: If the target vulnerability needs to be repaired, generating a vulnerability work order corresponding to the target vulnerability and sending the vulnerability work order to a preset vulnerability repair node; If the target vulnerability does not need to be repaired, updating the historical call link of the target interface at this time to the current call link.

9. The method according to claim 1, wherein The method further includes: Performing vulnerability monitoring on at least one interface based on a preset monitoring program, where the preset monitoring program has at least one function of vulnerability scanning, penetration testing, and intelligence monitoring.

10. A dynamic evaluation device for vulnerabilities, characterized in that, The device includes: A vulnerability timing characterization module for timely obtaining the current call link of the target interface corresponding to the target vulnerability, where the target vulnerability is a vulnerability evaluated as not requiring repair; A call link comparison module, configured to compare the current call link with the historical call link of the target interface, where the historical call link is the call link of the target interface when the target vulnerability was last evaluated; A vulnerability re-evaluation module, configured to re-evaluate the target vulnerability if the degree of change of the current call link compared to the historical call link reaches a preset condition.

11. A computer program product comprising instructions, characterized in that, When the computer program product runs on a computer or a processor, the computer or the processor is caused to execute the steps of the method according to any one of claims 1 to 9.

12. A computer storage medium, characterized in that, The computer storage medium stores multiple instructions, and the instructions are adapted to be loaded and executed by a processor to execute the steps of the method according to any one of claims 1 to 9.

13. A terminal, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images