Dynamic assessment methods, devices, storage media, and terminals for vulnerabilities.

Abstract

This specification discloses a dynamic assessment method, apparatus, storage medium, and terminal for vulnerabilities. The method involves periodically acquiring the current call chain of the target interface corresponding to a vulnerability that has been assessed as not requiring patching. The current call chain is compared with the historical call chain of the target interface, which was present during the last vulnerability assessment. If the change in the current call chain compared to the historical call chain reaches a preset condition, the target vulnerability is reassessed. By periodically monitoring vulnerabilities assessed as not requiring patching and comparing the current and historical call chains of the corresponding target interface, changes in the call chain that reach preset conditions indicate a significant change in the impact scope of the current target vulnerability. This allows for a reassessment and remediation of whether the target vulnerability needs patching, facilitating timely risk prevention and response.

Description

Technical Field

[0001] This specification relates to the field of computer network security technology, and in particular to a dynamic assessment method, apparatus, storage medium, and terminal for vulnerabilities. Background Technology

[0002] When new vulnerabilities emerge in a system, security technicians typically consider multiple key factors to determine whether a vulnerability needs to be patched. Taking into account factors such as the scope of impact and patching costs, some vulnerabilities may be assessed as requiring no patching. However, as services evolve, the impact of these vulnerabilities may change, consequently altering the security risks they pose. These changes are often difficult to detect in a timely manner, making these unpatched vulnerabilities vulnerable to exploitation by attackers, leading to a series of serious security consequences and causing significant losses to businesses and users. Summary of the Invention

[0003] This specification provides a method, apparatus, storage medium, and terminal for dynamic vulnerability assessment, which can solve the technical problem of difficulty in conducting long-term and effective vulnerability assessment in related technologies.

[0004] Firstly, embodiments of this specification provide a dynamic assessment method for vulnerabilities, the method comprising:

[0005] The current call chain of the target interface corresponding to the target vulnerability is obtained periodically. The target vulnerability mentioned above is a vulnerability that has been assessed as not needing to be fixed.

[0006] Compare the current call chain with the historical call chain of the target interface. The historical call chain is the call chain of the target interface when the target vulnerability was last evaluated.

[0007] If the degree of change in the current call chain compared to the historical call chain reaches a preset condition, the target vulnerability will be reassessed.

[0008] In one possible implementation, before periodically acquiring the current call chain of the target vulnerability, the method further includes: when a new vulnerability is detected, acquiring the initial call chain of the target interface corresponding to the new vulnerability, and assessing whether the new vulnerability needs to be fixed; if the new vulnerability does not need to be fixed, then the new vulnerability is taken as the target vulnerability and the initial call chain is taken as the historical call chain of the target interface, and the target vulnerability is continuously monitored based on the information of the target interface and the historical call chain.

[0009] In one possible implementation, the assessment of whether the newly added vulnerability needs to be fixed includes: assessing the scope of impact of the newly added vulnerability based on the initial call chain, and determining whether the newly added vulnerability needs to be fixed based on the scope of impact.

[0010] In one possible implementation, after assessing whether the newly added vulnerability needs to be fixed, the method further includes: if the newly added vulnerability needs to be fixed, generating a vulnerability work order corresponding to the newly added vulnerability and sending the vulnerability work order to a preset vulnerability fixing node; if the newly added vulnerability does not need to be fixed, performing preset mitigation measures on the newly added vulnerability.

[0011] In one possible implementation, the aforementioned pre-defined mitigation measures include at least one of application firewall rule blocking and whitelist access control.

[0012] In one possible implementation, the above-mentioned continuous monitoring of the target vulnerability based on the information of the target interface and the historical call chain includes: creating key-value pairs corresponding to the target vulnerability; using the interface identifier of the target interface and the application system identifier corresponding to the target interface as the key in the key-value pairs, and using the historical call chain of the target interface as the value in the key-value pairs; storing the key-value pairs in a preset monitoring set, wherein the preset monitoring set is used to store key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0013] In one possible implementation, the aforementioned preset conditions include at least one of the following: adding a new external exposure surface, adding a new critical call, and adding a preset number of ordinary calls.

[0014] In one possible implementation, after re-evaluating the target vulnerability, the process further includes: if the target vulnerability needs to be fixed, generating a vulnerability work order corresponding to the target vulnerability and sending the vulnerability work order to a preset vulnerability fixation node; if the target vulnerability does not need to be fixed, updating the historical call chain of the target interface to the current call chain.

[0015] In one possible implementation, the method further includes: performing vulnerability monitoring on at least one interface based on a preset monitoring program, wherein the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0016] Secondly, embodiments of this specification provide a dynamic assessment device for vulnerabilities, the device comprising:

[0017] The vulnerability timing mapping module is used to periodically obtain the current call chain of the target interface corresponding to the target vulnerability. The target vulnerability mentioned above is a vulnerability that has been assessed as not needing to be fixed.

[0018] The call chain comparison module is used to compare the current call chain with the historical call chain of the target interface. The historical call chain is the call chain of the target interface when the target vulnerability was last evaluated.

[0019] The vulnerability reassessment module is used to reassess the target vulnerability if the degree of change in the current call chain compared to the historical call chain reaches a preset condition.

[0020] In one possible implementation, the aforementioned dynamic vulnerability assessment device further includes: a vulnerability monitoring and management module, used to obtain the initial call chain of the target interface corresponding to the newly added vulnerability when a new vulnerability is detected, and to assess whether the newly added vulnerability needs to be fixed; if the newly added vulnerability does not need to be fixed, then the newly added vulnerability is used as the target vulnerability and the initial call chain is used as the historical call chain of the target interface, and the target vulnerability is continuously monitored based on the information of the target interface and the historical call chain.

[0021] In one possible implementation, the vulnerability monitoring and management module is used to assess the impact scope of the newly added vulnerability based on the initial call chain, and determine whether the newly added vulnerability needs to be fixed based on the impact scope.

[0022] In one possible implementation, the aforementioned dynamic vulnerability assessment device further includes: a vulnerability processing module, configured to generate a vulnerability work order corresponding to the newly added vulnerability and send the vulnerability work order to a preset vulnerability repair node if the newly added vulnerability needs to be repaired; and to perform preset mitigation measures on the newly added vulnerability if the newly added vulnerability does not need to be repaired.

[0023] In one possible implementation, the aforementioned pre-defined mitigation measures include at least one of application firewall rule blocking and whitelist access control.

[0024] In one possible implementation, the vulnerability monitoring and management module is used to create key-value pairs corresponding to the target vulnerability; use the interface identifier of the target interface and the application system identifier corresponding to the target interface as the key in the key-value pairs, and use the historical call chain of the target interface as the value in the key-value pairs; store the key-value pairs in a preset monitoring set, which is used to store key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0025] In one possible implementation, the aforementioned preset conditions include at least one of the following: adding a new external exposure surface, adding a new critical call, and adding a preset number of ordinary calls.

[0026] In one possible implementation, the aforementioned dynamic vulnerability assessment device further includes: a call link update module, configured to generate a vulnerability work order corresponding to the target vulnerability and send the vulnerability work order to a preset vulnerability repair node if the target vulnerability needs to be repaired; and update the historical call link of the target interface to the current call link if the target vulnerability does not need to be repaired.

[0027] In one possible implementation, the aforementioned dynamic vulnerability assessment device further includes: an interface vulnerability monitoring module, used to perform vulnerability monitoring on at least one interface based on a preset monitoring program, wherein the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0028] Thirdly, embodiments of this specification provide a computer program product containing instructions that, when run on a computer or processor, cause the computer or processor to perform the steps of the method described above.

[0029] Fourthly, embodiments of this specification provide a computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the steps of the method described above.

[0030] Fifthly, embodiments of this specification provide a terminal including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is adapted to be loaded by the processor and to execute the steps of the method described above.

[0031] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0032] This specification provides a dynamic vulnerability assessment method. It periodically acquires the current call chain of the target interface corresponding to a vulnerability that has been assessed as not requiring patching. The current call chain is compared with the historical call chain of the target interface at the time of the last vulnerability assessment. If the change in the current call chain compared to the historical call chain reaches a preset condition, the target vulnerability is reassessed. Periodic monitoring of vulnerabilities assessed as not requiring patching, comparing the current call chain of the target interface corresponding to the vulnerability with the historical call chain of the interface at the time of the last assessment, indicates a change in the scope of the vulnerability's impact. If the change in the call chain reaches a preset condition, it suggests that the impact of the current target vulnerability may have expanded or worsened. This allows for a reassessment and remediation of whether the target vulnerability needs patching, facilitating timely risk prevention and response, and preventing long-term latency and continuous amplification of risks. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 An exemplary system architecture diagram of a dynamic vulnerability assessment method provided in the embodiments of this specification;

[0035] Figure 2 A flowchart illustrating a dynamic vulnerability assessment method provided in an embodiment of this specification;

[0036] Figure 3 A flowchart illustrating a dynamic vulnerability assessment method provided in an embodiment of this specification;

[0037] Figure 4 A logic flowchart of a dynamic vulnerability assessment method provided in the embodiments of this specification;

[0038] Figure 5 A structural block diagram of a dynamic vulnerability assessment device provided in the embodiments of this specification;

[0039] Figure 6 This is a schematic diagram of the structure of a terminal provided in an embodiment of this specification. Detailed Implementation

[0040] To make the features and advantages of the embodiments of this specification more apparent and understandable, the technical solutions of the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the embodiments of this specification.

[0041] In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those in this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the embodiments in this specification as detailed in the appended claims. Furthermore, in the description of the embodiments in this specification, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; the word "and / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist, for example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Additionally, in the description of the embodiments in this specification, "multiple" refers to two or more.

[0042] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0043] When new vulnerabilities emerge in a system, security technicians typically assess whether a vulnerability needs patching based on factors such as vulnerability severity rating, distribution of affected assets, effectiveness of existing protection strategies, and remediation costs. Therefore, after comprehensive evaluation, some vulnerabilities may be deemed as requiring no patching. However, as services evolve and change, the factors initially used for assessment may subtly change. For example, code refactoring of core modules may create dangerous coupling between previously isolated vulnerabilities; the reuse of interfaces during cloud data migration may lead to the inheritance of vulnerabilities; vulnerabilities that initially had a smaller impact may have a larger external exposure due to service expansion; or, with technological advancements, original risk mitigation measures may become ineffective due to new attack methods.

[0044] In standard vulnerability monitoring processes, once a vulnerability is marked as "no patch required," ongoing monitoring for that type of vulnerability ceases. This results in vulnerabilities assessed as requiring no patching remaining unmonitored. Consequently, when the scope of a vulnerability changes, the system struggles to detect the potential risks inherent in those historical vulnerabilities. This persistent defensive blind spot significantly increases the risk of attack. In this situation, the system's initial security level gradually declines over time, making these overlooked vulnerabilities vulnerable to exploitation by attackers. This can lead to a range of security consequences, such as the leakage of core corporate data, system crashes, and violations of user privacy, causing substantial losses for both users and the company.

[0045] Therefore, this specification provides a dynamic assessment method for vulnerabilities to solve the aforementioned technical problem of difficulty in conducting long-term and effective assessments of vulnerabilities.

[0046] Please see Figure 1 , Figure 1 This is an exemplary system architecture diagram of a dynamic vulnerability assessment method provided in the embodiments of this specification.

[0047] like Figure 1 As shown, the system architecture may include a terminal 101, a network 102, and a server 103. The network 102 serves as the medium for providing a communication link between the terminal 101 and the server 103. The network 102 may include various types of wired or wireless communication links, such as wired communication links including fiber optic cables, twisted-pair cables, or coaxial cables, and wireless communication links including Bluetooth communication links, Wireless-Fidelity (Wi-Fi) communication links, or microwave communication links, etc.

[0048] Terminal 101 can interact with server 103 via network 102 to receive messages from or send messages to server 103. Alternatively, terminal 101 can interact with server 103 via network 102 to receive messages or data sent to server 103 by other users. Terminal 101 can be hardware or software. When terminal 101 is hardware, it can be various electronic devices, including but not limited to smartphones, tablets, laptops, and desktop computers. When terminal 101 is software, it can be installed in the aforementioned electronic devices and can be implemented as multiple software programs or software modules (e.g., to provide distributed services) or as a single software program or software module; no specific limitation is made here.

[0049] In the embodiments of this specification, terminal 101 periodically obtains the current call chain of the target interface corresponding to the target vulnerability, where the target vulnerability is assessed as a vulnerability that does not need to be fixed; then, terminal 101 compares the current call chain with the historical call chain of the target interface, where the historical call chain is the call chain of the target interface when the target vulnerability was last assessed; if the degree of change of the current call chain compared with the historical call chain reaches a preset condition, terminal 101 can reassess the target vulnerability.

[0050] Server 103 can be a business server providing various services. It should be noted that server 103 can be hardware or software. When server 103 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 103 is software, it can be implemented as multiple software programs or software modules (e.g., used to provide distributed services), or as a single software program or software module; no specific limitations are made here.

[0051] Alternatively, the system architecture may not include server 103. In other words, server 103 may be an optional device in the embodiments of this specification. That is, the method provided in the embodiments of this specification can be applied to a system structure that only includes terminal 101. The embodiments of this specification do not limit this.

[0052] It should be understood that Figure 1 The number of terminals, networks, and servers shown is only illustrative; the number can be any number of terminals, networks, and servers depending on the implementation requirements.

[0053] Please see Figure 2 , Figure 2 This is a flowchart illustrating a dynamic vulnerability assessment method provided in an embodiment of this specification. The execution entity in this embodiment can be a terminal performing the dynamic vulnerability assessment, a processor within the terminal performing the dynamic vulnerability assessment method, or a dynamic vulnerability assessment service within the terminal performing the dynamic vulnerability assessment method. For ease of description, the following example uses a processor within a terminal as the execution entity to illustrate the specific execution process of the dynamic vulnerability assessment method.

[0054] like Figure 2 As shown, dynamic assessment methods for vulnerabilities can include at least:

[0055] S202. Periodically obtain the current call chain of the target interface corresponding to the target vulnerability, which is assessed as a vulnerability that does not need to be fixed.

[0056] Optionally, the applications, systems, devices, services, and code programs related to the vulnerability are the scope of the vulnerability's impact. When the scope of the vulnerability's impact changes, new risks are likely to emerge. Therefore, in order to avoid the latent and continuous amplification of risks, it is necessary to dynamically and continuously monitor unpatched vulnerabilities.

[0057] In the embodiments of this specification, for target vulnerabilities that have been assessed as not requiring repair, considering the target interface corresponding to the target vulnerability, such as the systems and applications that call the target interface, the code programs that use the interface, etc., the impact of the target vulnerability in the entire system is determined. Therefore, by monitoring the call chain of the target interface, it is possible to determine whether the impact of the target vulnerability has changed.

[0058] Specifically, the current call chain information of the target interface corresponding to the target vulnerability can be obtained periodically at pre-set time intervals. When obtaining the current call chain, probes embedded in the service mesh can be used to record full call characteristics in real time, including service node topology, parameter passing path, and dependent component versions, to fully depict the entire call chain of the target interface and comprehensively reflect the various impacts associated with the target vulnerability.

[0059] S204. Compare the current call chain with the historical call chain of the target interface. The historical call chain is the call chain of the target interface when the target vulnerability was last evaluated.

[0060] Optionally, after successfully obtaining the current call chain of the target interface, it is necessary to compare and analyze it with the historical call chain of the target interface. The historical call chain of the target interface refers to the call chain obtained and recorded during the last assessment of the target vulnerability. The historical call chain fully reflects the interaction logic, data flow, and collaborative relationships between modules involved in the target interface within the system at that time, and is an important reference for assessing changes in the impact of the target vulnerability.

[0061] Specifically, when comparing the current call chain with historical call chains, a series of algorithms and metrics can be used to measure the degree of change between the two. These metrics may involve multiple dimensions such as changes in call chain length, additions or subtractions of key nodes, changes in data transmission paths, and fluctuations in interface call frequency. Changes in the call chain can clearly reveal the changes in the impact of the target vulnerability on the system, and thus determine what kind of handling strategy is needed.

[0062] S206. If the degree of change in the current call chain compared to the historical call chain reaches the preset condition, the target vulnerability will be re-evaluated.

[0063] Optionally, once the degree of change in the current call chain compared to the historical call chain reaches a pre-set threshold, it means that the target interface's operating environment, logic, or interaction with surrounding modules may have undergone significant changes. Such changes are highly likely to affect the status of the target vulnerability, causing vulnerabilities that were previously deemed unpatched to pose new security risks in the current environment. In this case, it is necessary to promptly reassess the target vulnerability, considering the new system operating conditions, requirements, and security policies, to re-determine whether the vulnerability requires patching, ensuring that the system's security and stability remain within a controllable range.

[0064] In the embodiments of this specification, the preset conditions for quantifying the degree of change in the call chain include at least one of the following: an increase in external exposure, an increase in critical calls, and an increase in a preset number of ordinary calls. Specifically, if the target interface has an increased external exposure, it indicates that the target interface is vulnerable to attacks launched from the public network; if the target interface is increasingly called by core programs or critical systems, it indicates that the target interface has become more important, and thus the target vulnerability has become more significant; if the target interface has an increased number of application calls (e.g., more than three ordinary application calls), it indicates that the exposure surface of the target vulnerability has increased, and its risk has increased. Therefore, when the degree of change in the call chain of the target interface meets any of the preset conditions, it indicates that the current risk has increased and timely control is required. The preset conditions can be set based on expert experience or formulated through neural network models; this embodiment of the specification does not limit this.

[0065] It should be noted that, in addition to the system proactively triggering a reassessment process for target vulnerabilities according to a scheduled period, the system also supports manual triggering of the reassessment process for target vulnerabilities by technical personnel. For example, when technical personnel have made new developments on the target interface, they can manually trigger the reassessment process for the target vulnerability corresponding to the target interface, thereby enabling timely investigation and handling of the risks brought about by the target vulnerability.

[0066] This specification provides a dynamic vulnerability assessment method. It periodically acquires the current call chain of the target interface corresponding to a target vulnerability, which is assessed as not requiring patching. The current call chain is compared with the historical call chain of the target interface at the time of the last vulnerability assessment. If the change in the current call chain compared to the historical call chain reaches a preset condition, the target vulnerability is reassessed. Periodic monitoring of vulnerabilities assessed as not requiring patching, comparing the current call chain of the target interface corresponding to the vulnerability with the historical call chain at the time of the last assessment, indicates a change in the scope of the vulnerability's impact. If the change in the call chain reaches a preset condition, it suggests that the impact of the current target vulnerability may have expanded or worsened. This allows for a reassessment and remediation of whether the target vulnerability needs patching, facilitating timely risk prevention and response, and preventing long-term latency and continuous amplification of risks.

[0067] Please see Figure 3 , Figure 3 This is a flowchart illustrating a dynamic vulnerability assessment method provided in an embodiment of this specification.

[0068] like Figure 3 As shown, dynamic assessment methods for vulnerabilities can include at least:

[0069] S302. Perform vulnerability monitoring on at least one interface based on a preset monitoring program, wherein the preset monitoring program has at least one of the following functions: vulnerability scanning, penetration testing, and intelligence monitoring.

[0070] Optionally, please refer to Figure 4 , Figure 4 This is a flowchart illustrating a dynamic vulnerability assessment method provided in an embodiment of this specification. Figure 4 As shown, the system allows for the pre-set monitoring program to automatically monitor various interfaces within the system for vulnerabilities. This pre-set monitoring program possesses one of the following functions: vulnerability scanning, penetration testing, or intelligence monitoring. It can perform comprehensive and in-depth vulnerability detection, providing a solid guarantee for the secure operation of the system through continuous automated monitoring. This allows administrators to promptly understand the system's security status and take appropriate measures for remediation and prevention.

[0071] S304. When a new vulnerability is detected, obtain the initial call chain of the target interface corresponding to the new vulnerability, and assess whether the new vulnerability needs to be fixed.

[0072] Alternatively, please continue reading Figure 4When a new vulnerability is detected, it is first necessary to assess it to determine whether it needs to be patched. Specifically, this assessment typically considers factors such as the difficulty of exploiting the vulnerability, the actual impact on core system functions and critical data after exploitation, and the cost required to patch it, to determine whether the new vulnerability does not require immediate patching. In the embodiments described in this specification, the initial call chain of the target interface corresponding to the new vulnerability is obtained, and the impact scope of the new vulnerability is assessed based on the initial call chain, thereby determining whether the new vulnerability needs to be patched based on the impact scope.

[0073] S306. If a new vulnerability needs to be fixed, a vulnerability work order corresponding to the new vulnerability will be generated and sent to the preset vulnerability fixation node; if a new vulnerability does not need to be fixed, preset mitigation measures will be implemented for the new vulnerability.

[0074] Please continue reading. Figure 4 Understandably, if the assessment results indicate that a new vulnerability needs to be patched, the patching process will be initiated. Specifically, this involves generating a vulnerability ticket for the new vulnerability and sending it to a pre-defined vulnerability patching node. Typically, the relevant security technicians will receive the vulnerability ticket at the patching node and promptly mitigate the risk to ensure the overall security of the system.

[0075] If a newly added vulnerability is assessed as not requiring patching, pre-defined mitigation measures can be implemented. These measures, such as adjusting system configurations, restricting access permissions, applying firewall rules, or using whitelist access control, can reduce the risk of exploitation. Alternatively, if the vulnerability risk is low and may be assessed as acceptable, no action is necessary.

[0076] S308. If the newly added vulnerability does not need to be fixed, the newly added vulnerability will be used as the target vulnerability and the initial call chain will be used as the historical call chain of the target interface. The target vulnerability will be continuously monitored based on the information of the target interface and the historical call chain.

[0077] Optionally, if the newly added vulnerability does not need to be fixed at present, the newly added vulnerability should be used as the target vulnerability and the initial call chain should be used as the historical call chain of the target interface, so as to continuously monitor the target vulnerability based on the information of the target interface and the historical call chain.

[0078] For details, please continue reading Figure 4To dynamically monitor changes in the impact of target vulnerabilities, a pre-defined monitoring set can be used to uniformly store key-value pairs corresponding to all target vulnerabilities requiring continuous monitoring, thereby enabling periodic checks on all target vulnerabilities. The pre-defined monitoring set can be configured to verify the interface call chains of all recorded vulnerabilities at regular intervals to automate dynamic monitoring. The interval can be 7 days, 30 days, etc., and this specification does not specifically limit the specific intervals in the embodiments.

[0079] For target vulnerabilities initially assessed as requiring no remediation, a key-value pair corresponding to the vulnerability is created. The target interface's identifier and the corresponding application system identifier (TraceID) are used as the key, and the target interface's historical call chain is used as the value. Storing this key-value pair in a pre-defined monitoring set enables global monitoring. A Trace ID is a globally unique identifier used to identify the entire trace of a single user request or transaction in a distributed system. It is generated when the identified entity first enters the system and maintains consistency and uniqueness throughout all related processing. In other words, all transactions related to the target vulnerability carry this identifier, facilitating their association and forming a complete trace chain.

[0080] S310: Periodically obtain the current call chain of the target interface corresponding to the target vulnerability, which is assessed as a vulnerability that does not need to be fixed.

[0081] S312. Compare the current call chain with the historical call chain of the target interface. The historical call chain is the call chain of the target interface when the target vulnerability was last evaluated. If the change in the current call chain compared with the historical call chain reaches the preset condition, the target vulnerability is re-evaluated.

[0082] For details regarding steps S310-S312, please refer to steps S202-S204, which will not be repeated here.

[0083] S314. If the target vulnerability needs to be fixed, a vulnerability work order corresponding to the target vulnerability is generated and sent to the preset vulnerability fixation node; if the target vulnerability does not need to be fixed, the historical call chain of the target interface is updated to the current call chain.

[0084] Optionally, such as Figure 4As shown, if the target vulnerability is assessed as needing to be patched, a vulnerability ticket can be generated and sent to the preset vulnerability patching node. Alternatively, other preset patching strategies can be adaptively adopted. If the target vulnerability does not need to be patched, the vulnerability can be mitigated or the risk can be accepted directly. In addition, the value corresponding to the target vulnerability in the preset monitoring set needs to be refreshed synchronously. The current call chain obtained in real time is saved as the new value in the key-value pair. That is, the historical call chain of the target interface is updated to the current call chain, thereby ensuring that the impact information of the target vulnerability recorded in the set has reliable timeliness and achieving long-term controllability of security risks.

[0085] This specification provides a dynamic vulnerability assessment method. Based on a preset monitoring program, at least one interface is monitored for vulnerabilities to comprehensively capture vulnerabilities in the system and promptly and accurately identify new vulnerabilities. When a new vulnerability is detected, the initial call chain of the target interface corresponding to the new vulnerability is obtained, and the impact scope of the new vulnerability is assessed based on the initial call chain to determine whether the new vulnerability needs to be fixed. If the new vulnerability needs to be fixed, a vulnerability work order is generated and sent to a preset vulnerability remediation node. If the new vulnerability does not need to be fixed, preset mitigation measures are implemented to promptly reduce the risk level of the vulnerability in the system. If the new vulnerability does not need to be fixed, the new vulnerability is used as the target vulnerability, and the initial call chain is used as the historical call chain of the target interface. The target vulnerability is continuously monitored based on the information of the target interface and the historical call chain to achieve regular checks on all target vulnerabilities. The system periodically retrieves the current call chain of the target interface corresponding to the target vulnerability. The target vulnerability is assessed as not requiring patching. The current call chain is compared with the historical call chain of the target interface. If the change in the current call chain compared to the historical call chain meets preset conditions, the target vulnerability is reassessed. This enhances the visualization of security risks and improves the efficiency of emergency response for such vulnerabilities. If the target vulnerability requires patching, a vulnerability ticket is generated and sent to a preset vulnerability patching node. If the target vulnerability does not require patching, the historical call chain of the target interface is updated to the current call chain, ensuring that the impact information of the target vulnerability recorded in the set is reliable and timely, achieving long-term controllable security risks.

[0086] Please see Figure 5 , Figure 5 This is a structural block diagram of a dynamic vulnerability assessment device provided in an embodiment of this specification. Figure 5 As shown, the dynamic assessment device 500 for vulnerabilities includes:

[0087] The vulnerability timing mapping module 510 is used to periodically obtain the current call chain of the target interface corresponding to the target vulnerability, which is assessed as a vulnerability that does not need to be fixed.

[0088] The call chain comparison module 520 is used to compare the current call chain with the historical call chain of the target interface. The historical call chain is the call chain of the target interface when the target vulnerability was last evaluated.

[0089] The vulnerability reassessment module 530 is used to reassess the target vulnerability if the degree of change in the current call chain compared to the historical call chain reaches a preset condition.

[0090] Optionally, the dynamic assessment device 500 for vulnerabilities further includes: a vulnerability monitoring and management module, which is used to obtain the initial call chain of the target interface corresponding to the new vulnerability when a new vulnerability is detected, and to assess whether the new vulnerability needs to be fixed; if the new vulnerability does not need to be fixed, the new vulnerability is used as the target vulnerability and the initial call chain is used as the historical call chain of the target interface, and the target vulnerability is continuously monitored based on the information of the target interface and the historical call chain.

[0091] Optionally, the vulnerability monitoring and management module is used to assess the impact scope of newly added vulnerabilities based on the initial call chain, and determine whether the newly added vulnerabilities need to be fixed based on the impact scope.

[0092] Optionally, the dynamic assessment device 500 for vulnerabilities further includes: a vulnerability processing module, used to generate a vulnerability work order corresponding to the new vulnerability and send the vulnerability work order to a preset vulnerability repair node if the new vulnerability needs to be repaired; and to perform preset mitigation measures on the new vulnerability if the new vulnerability does not need to be repaired.

[0093] Optionally, the default mitigation measures include at least one of application firewall rule blocking and whitelist access control.

[0094] Optionally, the vulnerability monitoring and management module is used to create key-value pairs corresponding to the target vulnerability; use the interface identifier of the target interface and the application system identifier corresponding to the target interface as the key in the key-value pair, and use the historical call chain of the target interface as the value in the key-value pair; store the key-value pairs in a preset monitoring set, which is used to store key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0095] Optionally, the preset conditions include at least one of the following: adding a new external exposure surface, adding a new critical call, or adding a preset number of ordinary calls.

[0096] Optionally, the dynamic assessment device 500 for vulnerabilities further includes: a call chain update module, used to generate a vulnerability work order corresponding to the target vulnerability and send the vulnerability work order to a preset vulnerability repair node if the target vulnerability needs to be repaired; if the target vulnerability does not need to be repaired, update the historical call chain of the target interface to the current call chain.

[0097] Optionally, the dynamic assessment device 500 for vulnerabilities further includes: an interface vulnerability monitoring module, used to perform vulnerability monitoring on at least one interface based on a preset monitoring program, wherein the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0098] This specification provides a dynamic vulnerability assessment device, comprising a vulnerability timing module for periodically acquiring the current call chain of the target interface corresponding to the target vulnerability (the target vulnerability is assessed as not requiring patching); a call chain comparison module for comparing the current call chain with the historical call chain of the target interface (the historical call chain is the call chain of the target interface at the time of the last vulnerability assessment); and a vulnerability reassessment module for reassessing the target vulnerability if the degree of change in the current call chain compared to the historical call chain reaches a preset condition. Periodic monitoring of vulnerabilities assessed as not requiring patching, comparing the current call chain of the target interface corresponding to the target vulnerability with the historical call chain of the interface at the time of the last assessment, indicates that the scope of the vulnerability's impact has changed. If the degree of change in the call chain reaches a preset condition, it indicates that the scope of the current target vulnerability's impact may have expanded or worsened. This allows for a reassessment and remediation of whether the target vulnerability needs patching, facilitating timely risk prevention and response, and preventing long-term latency and continuous amplification of risks.

[0099] This specification provides a computer program product containing instructions that, when run on a computer or processor, cause the computer or processor to perform the steps of any of the methods described above.

[0100] This specification also provides a computer storage medium that can store multiple instructions adapted for loading by a processor and executing the steps of any of the methods described in the above embodiments.

[0101] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a terminal provided in an embodiment of this specification. Figure 6 As shown, terminal 600 may include: at least one terminal processor 601, at least one network interface 604, user interface 603, memory 605, and at least one communication bus 602.

[0102] The communication bus 602 is used to enable communication between these components.

[0103] The user interface 603 may include a display screen and a camera. Optionally, the user interface 603 may also include a standard wired interface and a wireless interface.

[0104] The network interface 604 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0105] The terminal processor 601 may include one or more processing cores. The terminal processor 601 connects to various parts within the terminal 600 using various interfaces and lines, and performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 605, and by calling data stored in the memory 605. Optionally, the terminal processor 601 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The terminal processor 601 may integrate one or more of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content to be displayed on the screen; and the modem handles wireless communication. It is understood that the modem may also be implemented as a separate chip without being integrated into the terminal processor 601.

[0106] The memory 605 may include random access memory (RAM) or read-only memory (ROM). Optionally, the memory 605 may include a non-transitory computer-readable storage medium. The memory 605 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 605 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 605 may also be at least one storage device located remotely from the aforementioned terminal processor 601. Figure 6 As shown, the memory 605, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a dynamic vulnerability assessment program.

[0107] exist Figure 6 In the terminal 600 shown, the user interface 603 is mainly used to provide an input interface for the user and to obtain the user's input data; while the terminal processor 601 can be used to call the dynamic vulnerability assessment program stored in the memory 605 and specifically perform the following operations:

[0108] The current call chain of the target interface corresponding to the target vulnerability is obtained periodically. The target vulnerability is one that has been assessed as not requiring patching.

[0109] Compare the current call chain with the historical call chain of the target interface. The historical call chain is the call chain of the target interface when the target vulnerability was last evaluated.

[0110] If the current call chain changes to the historical call chain to the extent that a preset condition is met, the target vulnerability will be reassessed.

[0111] In some embodiments, before the terminal processor 601 performs the periodic acquisition of the current call chain of the target vulnerability, it further performs the following steps: when a new vulnerability is detected, it acquires the initial call chain of the target interface corresponding to the new vulnerability and assesses whether the new vulnerability needs to be fixed; if the new vulnerability does not need to be fixed, it uses the new vulnerability as the target vulnerability and the initial call chain as the historical call chain of the target interface, and continuously monitors the target vulnerability based on the information of the target interface and the historical call chain.

[0112] In some embodiments, when the terminal processor 601 performs an assessment of whether a newly added vulnerability needs to be fixed, it specifically performs the following steps: assessing the scope of impact of the newly added vulnerability based on the initial call chain, and determining whether the newly added vulnerability needs to be fixed based on the scope of impact.

[0113] In some embodiments, after evaluating whether a newly added vulnerability needs to be fixed, the terminal processor 601 further performs the following steps: if the newly added vulnerability needs to be fixed, a vulnerability work order corresponding to the newly added vulnerability is generated and the vulnerability work order is sent to a preset vulnerability fixing node; if the newly added vulnerability does not need to be fixed, preset mitigation measures are performed on the newly added vulnerability.

[0114] In some embodiments, the preset mitigation measures include at least one of application firewall rule blocking and whitelist access control.

[0115] In some embodiments, when the terminal processor 601 performs continuous monitoring of a target vulnerability based on information and historical call chains of the target interface, it specifically performs the following steps: creating key-value pairs corresponding to the target vulnerability; using the interface identifier of the target interface and the application system identifier corresponding to the target interface as the key in the key-value pairs, and using the historical call chains of the target interface as the value in the key-value pairs; storing the key-value pairs in a preset monitoring set, wherein the preset monitoring set is used to store key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

[0116] In some embodiments, the preset conditions include at least one of adding an externally exposed surface, adding a critical call, and adding a preset number of ordinary calls.

[0117] In some embodiments, after re-evaluating the target vulnerability, the terminal processor 601 further performs the following steps: if the target vulnerability needs to be fixed, a vulnerability work order corresponding to the target vulnerability is generated and the vulnerability work order is sent to a preset vulnerability fixation node; if the target vulnerability does not need to be fixed, the historical call chain of the target interface is updated to the current call chain.

[0118] In some embodiments, the terminal processor 601 further performs the following steps: performing vulnerability monitoring on at least one interface based on a preset monitoring program, wherein the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

[0119] In the several embodiments provided in this specification, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0120] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0121] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this specification are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The aforementioned available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)).

[0122] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0123] Furthermore, it should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the call chain data involved in this specification were all obtained under fully authorized conditions.

[0124] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0125] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0126] The above is a description of a dynamic vulnerability assessment method, apparatus, storage medium, and terminal provided in the embodiments of this specification. For those skilled in the art, based on the ideas of the embodiments of this specification, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation on the embodiments of this specification.

Claims

1. A dynamic assessment method for vulnerabilities, characterized in that, The method includes: The current call chain of the target interface corresponding to the target vulnerability is obtained periodically, and the target vulnerability is evaluated as a vulnerability that does not need to be fixed. The current call chain is compared with the historical call chain of the target interface, where the historical call chain is the call chain of the target interface when the target vulnerability was last evaluated; If the degree of change of the current call chain compared with the historical call chain reaches a preset condition, the target vulnerability is re-evaluated; the preset condition includes at least one of the following: adding an external exposure surface, adding a critical call, or adding a preset number of ordinary calls; The method of periodically acquiring the current call chain of the target interface corresponding to the target vulnerability includes: using a probe script tool pre-embedded in the service mesh to record the full call characteristics of the target interface in the network environment in real time. The full call characteristics include at least one of the following: full service node topology, full parameter transmission path, and full dependent component version.

2. The method according to claim 1, characterized in that, Before periodically obtaining the current call chain of the target vulnerability, the method further includes: When a new vulnerability is detected, the initial call chain of the target interface corresponding to the new vulnerability is obtained, and it is assessed whether the new vulnerability needs to be fixed. If the newly added vulnerability does not need to be fixed, then the newly added vulnerability is taken as the target vulnerability and the initial call chain is taken as the historical call chain of the target interface. The target vulnerability is continuously monitored based on the information of the target interface and the historical call chain.

3. The method according to claim 2, characterized in that, The assessment of whether the newly added vulnerability needs to be fixed includes: The impact scope of the newly added vulnerability is assessed based on the initial call chain, and it is determined whether the newly added vulnerability needs to be fixed based on the impact scope.

4. The method according to claim 2, characterized in that, After assessing whether the newly added vulnerability needs to be fixed, the process also includes: If the newly added vulnerability needs to be fixed, a vulnerability work order corresponding to the newly added vulnerability is generated and the vulnerability work order is sent to the preset vulnerability repair node; If the newly added vulnerability does not need to be fixed, then a preset mitigation measure will be implemented for the newly added vulnerability.

5. The method according to claim 4, characterized in that, The preset mitigation measures include at least one of application firewall rule blocking and whitelist access control.

6. The method according to claim 2, characterized in that, The continuous monitoring of the target vulnerability based on information from the target interface and the historical call chain includes: Create the key-value pair corresponding to the target vulnerability; The interface identifier of the target interface and the application system identifier corresponding to the target interface are used as the keys in the key-value pair, and the historical call chain of the target interface is used as the values ​​in the key-value pair; The key-value pairs are stored in a preset monitoring set, which is used to store key-value pairs corresponding to all target vulnerabilities that need to be continuously monitored.

7. The method according to claim 3, characterized in that, The reassessment of the target vulnerability also includes: If the target vulnerability needs to be fixed, a vulnerability work order corresponding to the target vulnerability is generated and the vulnerability work order is sent to the preset vulnerability repair node; If the target vulnerability does not need to be fixed, then the historical call chain of the target interface will be updated to the current call chain.

8. The method according to claim 1, characterized in that, The method further includes: Vulnerability monitoring is performed on at least one interface based on a preset monitoring program, wherein the preset monitoring program has at least one of the functions of vulnerability scanning, penetration testing, and intelligence monitoring.

9. A dynamic assessment device for vulnerabilities, characterized in that, The device includes: The vulnerability timing mapping module is used to periodically obtain the current call chain of the target interface corresponding to the target vulnerability, wherein the target vulnerability is assessed as a vulnerability that does not need to be fixed. The call chain comparison module is used to compare the current call chain with the historical call chain of the target interface, wherein the historical call chain is the call chain of the target interface when the target vulnerability was last evaluated; The vulnerability reassessment module is used to reassess the target vulnerability if the degree of change of the current call chain compared with the historical call chain reaches a preset condition; the preset condition includes at least one of the following: adding an external exposure surface, adding a critical call, and adding a preset number of ordinary calls; The vulnerability timing mapping module is also used to record the full call characteristics of the target interface in the network environment in real time through a probe script tool pre-embedded in the service mesh. The full call characteristics include at least one of the following: full service node topology, full parameter transmission path, and full dependent component version.

10. A computer program product containing instructions, characterized in that, When the computer program product is run on a computer or processor, it causes the computer or processor to perform the steps of the method as described in any one of claims 1 to 8.

11. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions adapted for loading by a processor and executing the steps of the method as described in any one of claims 1 to 8.

12. A terminal, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any one of claims 1 to 8.

Images