Network equipment detection method and device, program product, medium and electronic equipment

Abstract

The invention provides a network equipment detection method and device, a program product, a medium and electronic equipment. The method comprises the following steps: acquiring port state information of to-be-detected network equipment, and determining a port scanning strategy according to the port state information; according to the port scanning strategy, scanning the network equipment, and determining open port information and port service information in the network equipment; and performing port detection on the network equipment according to the open port information and the port service information in the network equipment, and determining whether a risk exists in the network equipment or not. The method comprises the following steps: determining a port scanning strategy exclusive to network equipment according to port state information of the network equipment, scanning the network equipment according to the determined port scanning strategy, determining open port information and port service information in the network equipment, and finally detecting the open port in the network equipment to determine the security of the network equipment. And the detection efficiency of the network equipment is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a method and apparatus for detecting network equipment, a program product, a medium, and an electronic device. Background Art

[0002] In the related art, when performing security checks on network devices, a fixed scanning method is usually used to scan and detect different network devices. However, different network devices have different network environments, and using the same scanning method to detect the security of network devices will lead to low security detection efficiency. Summary of the Invention

[0003] In view of this, the present disclosure provides a method and apparatus for detecting a network device, a program product, a medium, and an electronic device.

[0004] According to a first aspect of an embodiment of the present disclosure, a method for detecting a network device is provided, the method comprising:

[0005] Obtaining port status information of the network device to be detected, and determining a port scanning strategy based on the port status information;

[0006] Scan the network device according to the port scanning strategy to determine the open port information and port service information in the network device;

[0007] According to the open port information and port service information in the network device, port detection is performed on the network device to determine whether there is a risk in the network device.

[0008] In one embodiment, obtaining port status information of a network device to be detected and determining a port scanning strategy based on the port status information includes:

[0009] Detecting the online status of the network device;

[0010] If the online status of the network device indicates that the network device is online, performing port identification on the network device to be detected to determine port status information of the network device, wherein the port status information includes at least a port type and a port number;

[0011] The port scanning strategy is determined according to the port status information of the network device.

[0012] In one embodiment, the method further comprises:

[0013] If the online status of the network device indicates that the network device is offline, an offline prompt message is output.

[0014] In one embodiment, performing port detection on the network device based on the open port information and port service information in the network device to determine whether there is a risk in the network device includes:

[0015] Obtaining preset verification information, wherein the verification information includes port information and service information;

[0016] If the open port information matches the port information in the verification information, and the port service information matches the service information in the verification information, determining a first detection script corresponding to the open port information and / or the port service information in a preset script library;

[0017] Detecting the network device by running the first detection script to obtain a first detection result;

[0018] Detecting the network device by running a second detection script in the preset script library to obtain a second detection result;

[0019] Determine whether the network device has a risk based on the first detection result and the second detection result.

[0020] In one embodiment, the method further comprises:

[0021] If the open port information does not match the port information in the verification information, and / or the port service information does not match the service information in the verification information, detecting the network device by running a second detection script in a preset script library to obtain a third detection result;

[0022] Determine whether the network device has a risk based on the third detection result.

[0023] In one embodiment, the method further comprises:

[0024] If the open port information in the network device does not match the port information in the verification information, and / or the port service information in the network device does not match the service information in the verification information, then a prompt message is output based on the open port information and / or the port service information, wherein the prompt message is used to prompt the security configuration rules of the network device.

[0025] According to a second aspect of an embodiment of the present disclosure, a detection device for a network device is provided, the device comprising:

[0026] An acquiring unit, configured to acquire port status information of a network device to be detected and determine a port scanning strategy according to the port status information;

[0027] A scanning unit, configured to scan the network device according to the port scanning strategy, and determine the open port information and port service information in the network device;

[0028] The first detection unit is configured to perform port detection on the network device according to the open port information and port service information in the network device, and determine whether there is a risk in the network device.

[0029] In one embodiment, the acquiring unit is configured to:

[0030] Detecting the online status of the network device;

[0031] If the online status of the network device indicates that the network device is online, performing port identification on the network device to be detected to determine port status information of the network device, wherein the port status information includes at least a port type and a port number;

[0032] The port scanning strategy is determined according to the port status information of the network device.

[0033] In one embodiment, the apparatus further comprises:

[0034] The first output unit is configured to output offline prompt information if the online status of the network device indicates that the network device is offline.

[0035] In one embodiment, the first detection unit is configured to:

[0036] Obtaining preset verification information, wherein the verification information includes port information and service information;

[0037] If the open port information matches the port information in the verification information, and the port service information matches the service information in the verification information, determining a first detection script corresponding to the open port information and / or the port service information in a preset script library;

[0038] Detecting the network device by running the first detection script to obtain a first detection result;

[0039] Detecting the network device by running a second detection script in the preset script library to obtain a second detection result;

[0040] Determine whether the network device has a risk based on the first detection result and the second detection result.

[0041] In one embodiment, the apparatus further comprises:

[0042] a second detection unit, configured to detect the network device by running a second detection script in a preset script library to obtain a third detection result if the open port information does not match the port information in the verification information, and / or the port service information does not match the service information in the verification information;

[0043] Determine whether the network device has a risk based on the third detection result.

[0044] In one embodiment, the apparatus further comprises:

[0045] A second output unit is used to output prompt information based on the open port information and / or the port service information if the open port information in the network device does not match the port information in the verification information, and / or the port service information in the network device does not match the service information in the verification information, wherein the prompt information is used to prompt the security configuration rules of the network device.

[0046] According to a third aspect of an embodiment of the present disclosure, a computer program product is provided, which implements the steps of the method described in the first aspect when executed by a processor.

[0047] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0048] According to a fourth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in the first aspect when executing the program.

[0049] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects:

[0050] By performing preliminary port identification on network devices, determining a port scanning strategy for the network devices based on the port identification results, and then scanning the ports of the network devices according to the determined port scanning strategy, the open port information and port service information of the network devices are determined, and finally the open ports of the network devices are detected to determine the security of the network devices, thereby improving the efficiency of network device detection. In addition, setting specific detection methods for different network devices can improve the accuracy of network device detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a flow chart of a method for detecting a network device according to an exemplary embodiment of the present disclosure;

[0052] Figure 2 is a flow chart of a method for determining a port scanning strategy according to an exemplary embodiment of the present disclosure;

[0053] Figure 3 This is a flow chart of a method for determining whether a network device has risks, shown in an exemplary embodiment of the present disclosure;

[0054] Figure 4 is a flow chart of a method for detecting a network device according to an exemplary embodiment of the present disclosure;

[0055] Figure 5 This is a block diagram of a detection device for a network device shown in an exemplary embodiment of the present disclosure;

[0056] Figure 6 FIG. 4 is a hardware structure diagram of an electronic device shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0057] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0058] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. As used in this disclosure and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0059] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining."

[0060] During network device operation, some ports are opened to facilitate communication between external devices and the device itself. If vulnerabilities exist in these ports, attackers can exploit them and launch attacks on the network they operate on. Therefore, network device testing is essential to ensure network security.

[0061] In some technologies, when performing security testing on network devices, a fixed scanning method is usually used to scan and detect different network devices. However, the network environments of different network devices are not the same. Using the same scanning method to detect the security of network devices will lead to low security detection efficiency. Some other technologies use a POC (Proof of Concept) method to detect open ports in network devices. However, POC detection requires testing the open ports of network devices based on a pre-established vulnerability database. In other words, vulnerabilities that do not exist in the vulnerability database cannot be accurately identified through POC detection, which will lead to low detection accuracy of network devices, and thus lead to poor network security.

[0062] Based on this, the present disclosure provides a method for detecting network devices, which can be applied to computer devices to improve the detection efficiency and accuracy of network devices.

[0063] See Figure 1 As shown in the flow chart, Figure 1 This is a flowchart of a method for detecting a network device illustratively provided by an embodiment of the present disclosure, and the flowchart at least includes:

[0064] S101, obtaining port status information of a network device to be detected, and determining a port scanning strategy according to the port status information.

[0065] The network devices may include routers, switches, firewalls, servers, and other devices. The port status information may include the port type and port number of the network device. The port type may include open ports and closed ports, and may also include information such as the label of the open port and the network service type of the open port. The port scanning strategy may include scanning methods such as TCP (Transmission Control Protocol) scanning, UDP (User Datagram Protocol) scanning, covert scanning, idle scanning, etc., and may also include scanning parameters such as scanning time and scanning target range.

[0066] Before performing a port scan on a network device to be detected, a pre-scan may be performed on the network device, and the port status information of the network device is determined based on the pre-scan result, thereby determining a port scanning strategy for the network device based on the port status information of the network device.

[0067] In some embodiments, the pre-scanning method is implemented using fast scanning technology to achieve purposes such as device activity detection and port identification. For example, a data packet can be sent to a network device using the Ping command, and the response data returned by the network device can be used to determine whether the network device is alive. Another example is a UDP fast scan, which records the response status of the port and determines the port status information of the network device.

[0068] In some embodiments, the method for determining the port scanning strategy can be found in Figure 2 The flowchart shown includes:

[0069] S201: Detect the online status of the network device.

[0070] S202: If the online status of the network device indicates that the network device is online, perform port identification on the network device to be detected to determine port status information of the network device.

[0071] S203: Determine the port scanning strategy according to the port status information of the network device.

[0072] In some embodiments, the online status of a network device can be determined by sending a detection message to the network device and based on the network device's response data to the detection message. If the online status of the network device is detected to indicate that the network device is offline, or if the network device's response data to the detection message indicates that the network device is offline, an offline prompt message indicating that the network device is offline can be output to the staff to remind them that the network device is currently offline, thereby preventing network abnormalities caused by the offline network device.

[0073] When it is determined that the network device is online, the network device can be further identified by port identification to determine the port status information of the network port in the network device, wherein the port status information includes at least the port type and the number of ports. It should be noted that based on the port status information of the network device, the network services corresponding to each port of the network device can be preliminarily estimated. For example, according to the configuration method of conventional network devices, port 21 can correspond to FTP (File Transfer Protocol); port 80 can correspond to HTTP (HyperText Transfer Protocol). Therefore, based on the port status information, the scanning strategy corresponding to each open port in the network device can be determined, and the port scanning strategy can be dynamically adjusted to make the port scanning strategy more compatible with the network device, thereby improving the accuracy and efficiency of port scanning, and further improving the security of the network device.

[0074] After determining the port status information of a network device, a port scanning strategy for detecting the network device can be further determined based on the port type and port number in the port status information. The port type determines the scanning method and target range in the port scanning strategy, while the port number determines the scanning time in the port scanning strategy, which is positively correlated with the number of ports. For example, if a pre-scan reveals that a network device has ports 22 and 80 open, but all other ports are closed, deep fingerprinting or vulnerability detection can be performed on these two ports after determining the port scanning strategy.

[0075] In one embodiment, for ports that use TCP for network services, TCP scanning can be used for detection. For example, ports such as HTTP (port 80) and HTTPS (port 443) in a router can be scanned using TCP, and the greater the number of ports, the longer the scanning time for the network device can be. In another embodiment, for ports that use UDP for network services, UDP scanning can be used for detection. For example, ports such as CoAP (5683) and UPnP (1900) in an IoT (Internet of Things) device can be scanned for security using UDP.

[0076] S102: Scan the network device according to the port scanning strategy to determine open port information and port service information in the network device.

[0077] After a port scanning policy is configured for a network device, a port scan can be performed on the network device according to the port scanning policy to obtain scan results. The scan results include information about open ports and port service information on the network device. The port service information can be a service fingerprint of the port, and the network service corresponding to each port can be determined based on the service fingerprint.

[0078] It's important to note that the pre-scan process is a lightweight scan, used to quickly determine the network environment status and determine subsequent scanning strategies. Therefore, the pre-scan process is relatively short. Furthermore, the pre-scan process can only cover common ports (such as the Top 100) or critical ports. Port scanning, on the other hand, aims to accurately identify open ports, port service fingerprints, and potential vulnerabilities. Therefore, a port scan involves scanning all ports within the scan target range specified in the port scan strategy, detecting potential vulnerabilities on each port.

[0079] After determining the open port information and port service information in the port scan results, you can run the detection script to detect whether there are vulnerabilities in the open ports.

[0080] S103: Perform port detection on the network device according to the open port information and port service information in the network device to determine whether there is a risk in the network device.

[0081] After determining the open port information and port service information in the network device, the possible vulnerabilities of the open ports can be tested according to the detection script to determine whether there are vulnerabilities in the network device and further determine whether the network device is at risk.

[0082] In some embodiments, the method for determining whether a network device is at risk may be as follows: Figure 3 As shown, the details are as follows:

[0083] S301, obtaining preset verification information.

[0084] S302: If the open port information matches the port information in the verification information, and the port service information matches the service information in the verification information, a first detection script corresponding to the open port information and / or the port service information is determined in a preset script library.

[0085] S303: Detect the network device by running the first detection script to obtain a first detection result.

[0086] S304: Detect the network device by running a second detection script in the preset script library to obtain a second detection result.

[0087] S305: Determine whether the network device has risks based on the first detection result and the second detection result.

[0088] To accurately identify vulnerabilities in network devices, a pre-built database can be used to store verification information for network devices, including port information and service information. After performing a port scan on a network device, the verification information for the network device can be obtained from the pre-built database. The open port information and port service information in the port scan results can then be compared to see if they match the verification information. If the open port information in the port scan results matches the port information in the verification information, and the port service information in the port scan results matches the service information in the verification information, the first detection script indicated by the port scan results can be directly executed to obtain a first detection result. For example, if the port scan results determine that port 21 of a network device is open, and the fingerprint of port 21 indicates FTP, then the open port information of the network device can be determined to be port 21, and the port service information indicates FTP service. The port scan results can then be verified based on the verification information. If the port information in the verification information includes port 21, and the port service information corresponding to port 21 indicates FTP service, then the open port information and port service information in the port scan results match the verification information. Therefore, a first detection script can be determined based on port 21 and the FTP service, and the network device can be tested using the first detection script.

[0089] After obtaining the first detection result, the second detection script required for performing a POC test on the network device can be determined based on a conventional preset script library, and the POC test can be performed on the network device using the second detection script to obtain a second detection result. Finally, by summarizing the first and second detection results, it is determined whether the network device is at risk. Because the port scanning detection script has been run on the network device using the first detection script, when performing the POC test, it is only necessary to run some vulnerability scripts that do not restrict ports or services. This, to a certain extent, alleviates the situation of missed reports and false positives caused by relying solely on the POC detection method.

[0090] In some embodiments, if the open port information in the port scan result does not match the port information in the verification information, and / or the port service information in the port scan result does not match the service information in the verification information, a second detection script in a preset script library is run to detect the network device to obtain a third detection result. Based on the third detection result, it is determined whether the network device is at risk.

[0091] It should be noted that if the open port information in the port scan results does not match the port information in the verification information, and / or the port service information in the port scan results does not match the service information in the verification information, it means that the current application configuration of the network device is different from the commonly used configuration method. In this case, it is impossible to directly determine the first detection script corresponding to the network device, indicating that the possibility of the network device containing a specific vulnerability is relatively small. Therefore, the second detection script required for performing a POC test on the network device can be determined through a conventional preset script library, and the POC test can be performed on the network device using the second detection script to obtain a third detection result, and then determine whether the network device is at risk based on the third detection result.

[0092] In other embodiments, if the open port information in the port scan result does not match the port information in the verification information, and / or the port service information in the port scan result does not match the service information in the verification information, prompt information can also be output based on the open port information and / or port service information.

[0093] The prompt information can be determined by analyzing the open port or port service information of the network device, and used to prompt the security configuration rules of the network device. For example, if the open port of the network device is identified as port 21 through port scanning, but the network service corresponding to port 21 does not match the service information in the verification information, then prompt information can be output based on the possible vulnerabilities of port 21. For example, the user is prompted to pay attention to which actions to avoid the occurrence of related vulnerabilities under the premise that the port is an open port. Alternatively, if the port service information of the open port of the network device is identified as FTP service through port scanning, but the open port corresponding to the FTP service does not match the port information in the verification information, then prompt information can be output based on the possible vulnerabilities of the FTP service. For example, the user is prompted to avoid checking a certain item when using the FTP service to avoid the occurrence of related vulnerabilities of the FTP service.

[0094] The disclosed embodiments perform preliminary port identification on network devices, determine a port scanning strategy for the network devices based on the port identification results, and then scan the network device's ports according to the determined port scanning strategy to determine the open port information and port service information in the network device. Finally, the open ports in the network device are detected to determine the security of the network device, thereby improving the efficiency of network device detection. Furthermore, setting specific detection methods for different network devices can improve the accuracy of network device detection.

[0095] In one embodiment, the method for detecting the network device can be found in Figure 4 The flowchart shown is as follows:

[0096] S401, pre-scan the network device to determine the setting parameters of the port scan.

[0097] S402: Scan the ports of the network device according to the set parameters to determine the port opening information and fingerprint recognition results of the network device.

[0098] S403: Determine whether there is a first detection script dedicated to the network device according to the port opening information of the network device and the fingerprint identification result.

[0099] S404: If a first detection script exists, run the first detection script to obtain a first detection result.

[0100] S405: If the first detection script does not exist, output security prompt information based on the port opening information and / or fingerprint recognition result of the network device to prompt the user to adapt to the precautions of the network device.

[0101] S406: Run a second detection script according to a conventional vulnerability database to perform a POC detection on the network device and obtain a second detection result.

[0102] S407: Determine whether the network device has risks based on the first detection result and / or the second detection result.

[0103] Corresponding to the embodiments of the aforementioned method for detecting a network device, the present disclosure also provides embodiments of an apparatus for detecting a network device.

[0104] Please refer to Figure 5 , Figure 5 This is a block diagram schematically illustrating a detection device for a network device according to an embodiment of the present disclosure, wherein the device includes:

[0105] An acquisition unit 501 is configured to acquire port status information of a network device to be detected and determine a port scanning strategy based on the port status information;

[0106] The scanning unit 502 is configured to scan the network device according to the port scanning strategy to determine the open port information and port service information in the network device;

[0107] The first detection unit 503 is configured to perform port detection on the network device according to the open port information and port service information in the network device, and determine whether there is a risk in the network device.

[0108] In one embodiment, the acquiring unit 501 is configured to:

[0109] Detecting the online status of the network device;

[0110] If the online status of the network device indicates that the network device is online, performing port identification on the network device to be detected to determine port status information of the network device, wherein the port status information includes at least a port type and a port number;

[0111] The port scanning strategy is determined according to the port status information of the network device.

[0112] In one embodiment, the apparatus further comprises:

[0113] The first output unit is configured to output offline prompt information if the online status of the network device indicates that the network device is offline.

[0114] In one embodiment, the first detection unit 503 is configured to:

[0115] Obtaining preset verification information, wherein the verification information includes port information and service information;

[0116] If the open port information matches the port information in the verification information, and the port service information matches the service information in the verification information, determining a first detection script corresponding to the open port information and / or the port service information in a preset script library;

[0117] Detecting the network device by running the first detection script to obtain a first detection result;

[0118] Detecting the network device by running a second detection script in the preset script library to obtain a second detection result;

[0119] Determine whether the network device has a risk based on the first detection result and the second detection result.

[0120] In one embodiment, the apparatus further comprises:

[0121] a second detection unit, configured to detect the network device by running a second detection script in a preset script library to obtain a third detection result if the open port information does not match the port information in the verification information, and / or the port service information does not match the service information in the verification information;

[0122] Determine whether the network device has a risk based on the third detection result.

[0123] In one embodiment, the apparatus further comprises:

[0124] A second output unit is used to output prompt information based on the open port information and / or the port service information if the open port information in the network device does not match the port information in the verification information, and / or the port service information in the network device does not match the service information in the verification information, wherein the prompt information is used to prompt the security configuration rules of the network device.

[0125] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0126] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0127] The embodiment of the detection device of the network device disclosed in the present invention can be applied to electronic devices. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the electronic device in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running it. From the hardware level, if Figure 6 The figure shows a hardware structure diagram of an electronic device where the detection device of the network device disclosed in the present invention is located. Figure 6 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in which the device is located in the embodiment may also include other hardware according to the actual function of the electronic device, which will not be described in detail.

[0128] Based on the same inventive concept, the present disclosure further provides a computer program product, which implements the steps of the network device detection method when executed by a processor.

[0129] Based on the same inventive concept, the present disclosure also provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the network device detection method when the program is executed by a processor.

[0130] Based on the same inventive concept, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the network device detection method when executing the program.

[0131] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the particular order shown or sequential sequence to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0132] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A method for detecting a network device, characterized in that: The method comprises: Obtaining port status information of the network device to be detected, and determining a port scanning strategy based on the port status information; Scan the network device according to the port scanning strategy to determine the open port information and port service information in the network device; According to the open port information and port service information in the network device, port detection is performed on the network device to determine whether there is a risk in the network device.

2. The method according to claim 1, characterized in that The obtaining of the port status information of the network device to be detected and determining the port scanning strategy according to the port status information includes: Detecting the online status of the network device; If the online status of the network device indicates that the network device is online, performing port identification on the network device to be detected to determine port status information of the network device, wherein the port status information includes at least a port type and a port number; The port scanning strategy is determined according to the port status information of the network device.

3. The method according to claim 2, characterized in that The method further comprises: If the online status of the network device indicates that the network device is offline, an offline prompt message is output.

4. The method according to claim 1, wherein The performing port detection on the network device according to the open port information and port service information in the network device to determine whether there is a risk in the network device includes: Obtaining preset verification information, wherein the verification information includes port information and service information; If the open port information matches the port information in the verification information, and the port service information matches the service information in the verification information, determining a first detection script corresponding to the open port information and / or the port service information in a preset script library; Detecting the network device by running the first detection script to obtain a first detection result; Detecting the network device by running a second detection script in the preset script library to obtain a second detection result; Determine whether the network device has a risk based on the first detection result and the second detection result.

5. The method according to claim 4, characterized in that The method further comprises: If the open port information does not match the port information in the verification information, and / or the port service information does not match the service information in the verification information, detecting the network device by running a second detection script in a preset script library to obtain a third detection result; Determine whether the network device has a risk based on the third detection result.

6. The method according to claim 4, characterized in that The method further comprises: If the open port information in the network device does not match the port information in the verification information, and / or the port service information in the network device does not match the service information in the verification information, then a prompt message is output based on the open port information and / or the port service information, wherein the prompt message is used to prompt the security configuration rules of the network device.

7. A detection device for a network device, characterized in that: The device comprises: An acquiring unit, configured to acquire port status information of a network device to be detected and determine a port scanning strategy according to the port status information; A scanning unit, configured to scan the network device according to the port scanning strategy, and determine the open port information and port service information in the network device; The first detection unit is configured to perform port detection on the network device according to the open port information and port service information in the network device, and determine whether there is a risk in the network device.

8. A computer program product, characterized in that When the computer program product is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented.

Images