A website scanning method, system and electronic device

Abstract

The present disclosure provides a website scanning method, system and electronic device, belonging to the technical field of network security, which comprises the following steps: obtaining operation information on an interactive interface, the operation information comprising a scanning address and scanning parameters; generating scanning instructions corresponding to the scanning parameters based on a preset dictionary library, the dictionary library comprising a mapping relationship between scanning parameters and scanning instructions; and executing the scanning instructions to scan network resources corresponding to the scanning address by using a scanning tool to obtain original scanning results. The method of the present disclosure can generate corresponding scanning instructions according to the scanning parameters and the scanning address, thereby reducing the operation difficulty and reducing invalid scanning tasks.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity technology, and in particular to a website scanning method, system, and electronic device. Background Technology

[0002] Website scanning is a fundamental step in network security maintenance. It is used to detect open ports, directory structure, service versions, and known vulnerabilities of website servers, providing data support for security hardening. The Linux operating system is the mainstream operating environment for website scanning tools.

[0003] Currently, website scanning in Linux environments is performed via command-line mode. Users need to manually enter complete scanning commands and parameters through the terminal to initiate a scan task. However, different scanning tools have different command syntax and parameter naming rules, requiring users to memorize the commands and parameters corresponding to different scanning tools, which raises the operational threshold. Furthermore, scanning parameters need to be manually entered character by character, which is prone to spelling errors, parameter omissions, or formatting errors, leading to scan task failure or the generation of invalid scan results. Summary of the Invention

[0004] This disclosure provides a website scanning method, system, and electronic device; it can generate corresponding scanning instructions based on the parameters to be scanned and the address to be scanned, reducing the difficulty of operation and reducing invalid scanning tasks.

[0005] The technical solution disclosed herein is implemented as follows: In a first aspect, this disclosure provides a website scanning method, which includes: acquiring operation information on an interactive interface, the operation information including a address to be scanned and parameters to be scanned; generating a scanning instruction corresponding to the parameters to be scanned based on a preset dictionary, the dictionary including a mapping relationship between scanning parameters and scanning instructions; executing the scanning instruction to scan the network resources corresponding to the address to be scanned using a scanning tool, and obtaining the original scanning result.

[0006] Secondly, this disclosure provides a website scanning device, which includes: an acquisition module, a generation module, and an execution module; the acquisition module is configured to acquire operation information on an interactive interface, the operation information including the address to be scanned and the parameters to be scanned; the generation module is configured to generate a scanning instruction corresponding to the parameters to be scanned based on a preset dictionary, the dictionary including the mapping relationship between the scanning parameters and the scanning instruction; the execution module is configured to execute the scanning instruction to scan the network resources corresponding to the address to be scanned using a scanning tool to obtain the original scanning results.

[0007] Thirdly, this disclosure provides an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the website scanning method as described in the first aspect.

[0008] Fourthly, this disclosure provides a computer-readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the website scanning method as described in the first aspect.

[0009] Fifthly, this disclosure provides a computer program product, wherein the computer program product includes a computer program or instructions, which, when run on a processor, cause the processor to execute the computer program or instructions to implement the steps of the website scanning method as described in the first aspect.

[0010] Sixthly, this disclosure provides a website scanning system, including a client and a server; the client is used to generate operation information based on interactive operations on an interactive interface and send it to the server, the operation information including the address to be scanned and the parameters to be scanned; the server is used to obtain the operation information; and to generate a scan instruction corresponding to the parameters to be scanned based on a preset dictionary, and execute the scan instruction to scan the network resources corresponding to the address to be scanned by a scanning tool to obtain the original scan result, wherein the dictionary includes the mapping relationship between the scan parameters and the scan instruction.

[0011] This disclosure provides a website scanning method, system, and electronic device. The website scanning method receives the URL to be scanned and the parameters to be scanned as visualized on an interactive interface. Based on a pre-built dictionary, it maps the scan parameters to scan commands and concatenates the commands to obtain the scan commands. Finally, a scanning tool executes the scan commands to obtain the raw scan results. Compared to the traditional method of manually memorizing commands and typing into a terminal, this embodiment abstracts the highly technical Linux security scanning operation into an interactive interface that is easy for users to use. While ensuring scanning accuracy, it greatly improves the efficiency of scan task configuration and execution. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the structure of a website scanning system provided in this disclosure.

[0013] Figure 2 This is a flowchart illustrating a website scanning method provided in this disclosure.

[0014] Figure 3 This is a schematic diagram of an interactive interface provided in this disclosure.

[0015] Figure 4 A schematic diagram of the initial interactive interface provided in this disclosure.

[0016] Figure 5 A schematic diagram of the first interactive interface provided in this disclosure.

[0017] Figure 6 This is a schematic diagram of the second interactive interface provided in this disclosure.

[0018] Figure 7 This is a schematic diagram illustrating the display of scanning progress on an interactive interface provided in this disclosure.

[0019] Figure 8 This is a schematic diagram illustrating the interaction between the client, server, and cloud server provided in this disclosure.

[0020] Figure 9 This is a structural block diagram of a website scanning device provided in this disclosure.

[0021] Figure 10 This is a schematic diagram of the hardware structure of an electronic device provided in this disclosure. Detailed Implementation

[0022] The technical solutions in the embodiments of this disclosure will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure are within the scope of protection of this disclosure.

[0023] The terms “first,” “second,” etc., used in this disclosure are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that this disclosure can be implemented in orders other than those illustrated or described herein, and the objects distinguished by “first,” “second,” etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more.

[0024] Before describing the technical solutions claimed in the claims in detail, the application environment and system architecture of the embodiments of this disclosure will first be introduced with reference to the accompanying drawings.

[0025] Please see Figure 1 , Figure 1 This is a schematic diagram of the structure of a website scanning system provided in an embodiment of this disclosure. Figure 1 As shown, the website scanning system may include a client 101 and a server 102. The client 101 and the server 102 can establish a communication connection through a wired network or a wireless network.

[0026] Specifically, client 101 can be a terminal device that provides a front-end interactive interface for the World Wide Web (Web), such as a personal computer (PC), tablet computer, smartphone, or laptop computer. Client 101 provides a visual interactive interface, i.e., a Web page, to the user, receives interactive operations such as clicking and inputting on the interface, and converts these operations into operation information, which is then sent to server 102. This operation information includes the address to be scanned and the parameters to be scanned. For example, client 101 sends the Internet Protocol (IP) address to be scanned, the Uniform Resource Locator (URL) address, and the selected parameters to be scanned to server 102.

[0027] Server 102 can be a standalone physical server, a server cluster consisting of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, and cloud computing. In this embodiment, server 102 performs backend scheduling control and Linux automated scanning engine functions. After receiving operation information, server 102 uses an internally preset dictionary to translate and synthesize the parameters to be scanned passed from client 101 into low-level command-line instructions recognizable by the underlying Linux operating system, i.e., the scanning instructions. Subsequently, it calls the system's underlying scanning tools (such as nmap, gobuster, nuclei, etc.) to scan the network resources corresponding to the addresses to be scanned included in the operation information, obtaining the raw scan results. The dictionary includes the mapping relationship between scan parameters and scan instructions. In addition, server 102 also includes a data storage module (such as a relational database MySQL or a non-relational database MongoDB) for storing scan tasks and raw scan results.

[0028] In some embodiments, the website scanning system may also include a cloud server. The client 101, the server 102, and the cloud server can establish a communication connection via a wired or wireless network.

[0029] The cloud server can be a computing node deployed with an artificial intelligence (AI) model. After obtaining the raw scan results, server 102 can send the raw scan results to the cloud server through the application programming interface (API). The cloud server runs a pre-trained AI model, such as a natural language processing (NLP) model, to perform semantic understanding, threat extraction, and risk rating on the raw scan results, generate a structured scan report, and return it to server 102. Server 102 then pushes the report to client 101 for visualization.

[0030] It should be noted that although the server 102 and the cloud server are described as two independent network entities in this embodiment, in other embodiments, if the server 102 has computing power resources to carry the AI ​​model (such as carrying a neural network processor or a graphics processor), the AI ​​model carried by the cloud server can also be directly integrated and run locally on the server 102, i.e., local large model mode. This disclosure does not make specific limitations on this.

[0031] The website scanning method provided in this disclosure will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0032] Please see Figure 2 , Figure 2 This is a flowchart illustrating a website scanning method provided in an embodiment of this disclosure. The method can be performed by... Figure 1 The execution is carried out by the server 102, or by the control chip or processor integrated in the server 102. For example... Figure 2 As shown, the website scanning method may include the following steps S201 to S203.

[0033] In step S201, operation information on the interactive interface is obtained, including the address to be scanned and the parameters to be scanned.

[0034] The user interface (UI) refers to the front-end page deployed in the client's web browser, used to receive scan-related information input by the user and display the scan status and results. The UI presents configurable items through standardized form elements, such as text input boxes, drop-down menus, radio buttons, and checkboxes. Users no longer need to memorize and type complex command lines in the Linux terminal; instead, they enter the address to be scanned in a visual web page. The address to be scanned refers to the target network address that needs to be security tested, and can be at least one of an IP address or a URL.

[0035] Simultaneously, users can select specific scanning parameters from a preset visual option by clicking or touching the interface. After the user confirms the input on the interface, the client serializes the user's operation data into a standard data exchange format (e.g., a JSON payload), i.e., operation information. This operation information consists of all data related to the scanning task entered or selected by the user on the interface, including at least the address to be scanned and the scanning parameters. The scanning parameters refer to configuration items used to control the scanning behavior, which may include scan type and / or scan conditions. Scan conditions may include scan depth, timeout, concurrency, and file templates; scan depth may include fast scan, standard scan, and deep scan. Scan type may include at least one of port scan, directory scan, service fingerprint scan, and vulnerability scan. Finally, the client sends the data to the server's backend interface via Hypertext Transfer Protocol (HTTP). The server parses and extracts the address to be scanned and the scanning parameters from the operation information.

[0036] For example, such as Figure 3 The diagram shown is a simplified representation of the interactive interface and is not intended to limit the actual form of the interface disclosed herein. On this interface, the user enters the IP address 192.168.1.100 in the IP address input field and https: / / www.example.com in the URL address input field. The user selects "Port Scan" for the scan type; for the scan conditions, the first condition is "Timeout," and the user selects "10s" from the timeout dropdown menu; the second condition is "Scan Depth," and the user selects "Fast Scan" from the scan depth dropdown menu; the third condition is "Concurrency," and the user selects "100" from the concurrency dropdown menu. Clicking the down arrow icon displays a selectable menu; clicking the "+" icon adds a scan type or scan condition, and clicking the "-" icon deletes the corresponding scan type or scan condition. When the user clicks the submit button, the client generates operation information based on all the operation data entered on the interactive interface.

[0037] In step S202, a scan instruction corresponding to the parameters to be scanned is generated based on a preset dictionary.

[0038] The dictionary refers to a structured database pre-stored in the server-side data storage module, used to establish a one-to-one correspondence between the parameters to be scanned and the scan commands. This dictionary can be a multi-dimensional hash table or a collection of key-value pairs. The dictionary includes: a scan type dictionary and a scan condition dictionary. Optionally, it may also include a parsing configuration dictionary. The scan type dictionary may include: port scan, directory scan, service fingerprint scan, and vulnerability scan, along with corresponding scan commands. The scan condition dictionary may include scan depth, timeout, concurrency, and file templates, along with corresponding scan commands. The parsing configuration dictionary includes AI parsing switches, parsing styles (such as concise, detailed, and custom versions), and corresponding scan commands.

[0039] For example, the mapping relationships in the dictionary are as follows: if the parameters to be scanned include "scan type: port scan", then the scan command is "nmap"; if the parameters to be scanned include "scan depth: all ports", then the scan command is "-p 1-65535"; if the parameters to be scanned include "concurrency: high", then the scan command is "-T4 --min-parallelism 100"; if the parameters to be scanned include "service version detection: enabled", then the scan command is "-sV".

[0040] When the server synthesizes the scan command, it iterates through all the scan parameters contained in the operation information, searches for the corresponding scan command for each parameter in the dictionary, and then concatenates all the scan commands into strings according to the syntax order required by the specific scanning tool using a command concatenation algorithm. For example, for the scan parameters in the example above, the final scan command synthesized by the server might be a complete Linux command: "nmap -p 1-65535 -T4 --min-parallelism 100 -sV 192.168.1.100".

[0041] In step S203, the scan command is executed to scan the network resources corresponding to the address to be scanned using the scanning tool, and the original scan results are obtained.

[0042] In this context, network resources refer to all hardware and software entities and data sets existing in a computer network that can be accessed through standard network protocols, and are the scanning objects of the scanning tool in this embodiment. For example, for port scanning, the corresponding network resources may include Transmission Control Protocol (TCP) ports and User Datagram Protocol (UDP) ports; for vulnerability scanning, the corresponding network resources may include system vulnerabilities, application vulnerabilities, and configuration defects; and for directory scanning, the corresponding network resources may include website directories and file resources.

[0043] Specifically, different scan types included in the parameters to be scanned correspond to different scanning tools. The server, within its own Linux operating system environment, invokes the system kernel's process creation mechanism, such as using the `subprocess.Popen()` method in Python or the `os / exec` package in Go, to submit the scan command to the Linux operating system as a child process, causing it to initiate a network probe against the target address.

[0044] Throughout the entire lifecycle of the scan command, the server continuously monitors the standard output and standard error streams of the child process. While probing network resources at the scanned address, the scanning tool continuously outputs log information. The server uses operating system-level pipelining or log redirection techniques to capture these output stream bytes in real time and buffers them in memory, avoiding frequent disk reads and writes by the main process. When the scan process exits, the server determines the execution result based on the status code returned by the child process (a status code of 0 indicates success, while a non-zero code indicates failure, requiring error recording and a return to the interactive interface). If successful, the server aggregates and encodes all captured output stream data to obtain the original scan results.

[0045] In the above process, since the scanning behavior may take a long time, in order to prevent the server main process from being blocked, the server can adopt an asynchronous non-blocking concurrency control model when triggering the scan command. This model can avoid the server's thread pool being quickly exhausted when faced with a large number of concurrent scan tasks, thereby ensuring that subsequent user operation requests can be responded to in a timely manner.

[0046] The website scanning method provided in this disclosure receives the address to be scanned and the parameters to be scanned as visualized on an interactive interface. Based on a pre-built dictionary, it maps the scanning parameters to scanning instructions and concatenates the instructions to obtain the scanning instructions. Finally, the scanning tool executes the scanning instructions to obtain the raw scan results. Compared to the traditional method of manually memorizing instructions and typing in the terminal, this embodiment abstracts the highly technical Linux security scanning operation into an interactive interface operation that is easy for users to use. While ensuring scanning accuracy, it greatly improves the efficiency of scanning task configuration and execution.

[0047] This embodiment integrates the traditional, fragmented manual input process of scanning commands in a Linux environment into a standardized operation flow based on a unified interactive interface. Users no longer need to memorize the command syntax and parameter rules of different scanning tools; they only need to select the corresponding parameters to be scanned in the interactive interface to initiate a scanning task, significantly lowering the professional threshold for website scanning operations. The one-to-one mapping relationship between scanning parameters and scanning commands established through a preset dictionary avoids spelling errors, parameter omissions, and formatting errors that are prone to occur during manual command input, effectively reducing the failure rate of scanning tasks.

[0048] In real-world business scenarios, scanning tools often include numerous scanning parameter options. Displaying all these parameters on the user interface would increase the user's selection burden, potentially leading to conflicting and invalid parameter combinations. Therefore, in this embodiment, obtaining the operation information from the user interface in step S201 includes: Obtain the first target parameter; according to the preset linkage rules, select the second target parameter set that matches the first target parameter from the preset parameter set; obtain the second target parameter selected from the second target parameter set; integrate the first target parameter and the second target parameter to obtain the parameter to be scanned in the operation information.

[0049] Here, the first target parameter refers to the trigger condition that initiates the parameter linkage logic, and its value determines the range of subsequent selectable parameters. The second target parameter refers to the secondary configuration parameter attached to the first target parameter, and it is only displayed when the corresponding first target parameter is selected. The linkage rule refers to the parameter association table pre-stored on the server, used to define the range of second target parameters corresponding to each first target parameter.

[0050] Specifically, the client-side page loads preset linkage rules during rendering. When the user first selects a first target parameter on the interactive interface, the client's front-end control script (such as an onChange event triggered by JavaScript) captures this action and dynamically searches for a set of second target parameters associated with the first target parameter according to the linkage rules. Then, the client hides input boxes unrelated to the first target parameter in the interactive interface and loads and displays the set of second target parameters. Finally, based on at least one second target parameter selected by the user, the first and second target parameters are integrated to obtain the parameter to be scanned.

[0051] For example, such as Figure 4As shown, the initial interactive interface displays: an IP address input field, a URL address input field, a scan type dropdown menu, and an AI parsing switch selection box. The AI ​​parsing switch is off by default. When the user selects vulnerability scanning as the scan type and enables the AI ​​parsing switch in the initial interactive interface, the updated initial interactive interface will look like this. Figure 5 The first interactive interface shown only displays the second target parameters associated with vulnerability scanning and enabling the AI ​​parsing switch, hiding other irrelevant display parameters. Specifically, the first target parameters corresponding to vulnerability scanning and enabling the AI ​​parsing switch are determined according to the linkage rules. The set of second target parameters corresponding to vulnerability scanning includes: timeout, concurrency, and scan depth. The set of second target parameters corresponding to enabling the AI ​​parsing switch includes: parsing style. Among them, the default value of the timeout is 1 second, the default value of the concurrency is 50, and the default value of the parsing style is the simplified version.

[0052] When the user selects depth scan as the scan depth in the first interactive interface, such as Figure 6 As shown, the first interactive interface is updated to the second interactive interface. At this time, depth scan becomes the first target parameter. The second target parameter associated with depth scan, determined according to the linkage rules, is the depth scan file template. The set of second target parameters includes: timeout, concurrency, scan depth, parsing style, and depth scan file template. The user selects template A from the depth scan file template drop-down menu. Through the above linkage rules, interference from irrelevant scan parameters is shielded, configuration time is shortened, and scan failure rates caused by mismatched scan parameters are avoided.

[0053] After receiving operation information containing the parameters to be scanned and the address to be scanned, the server performs a legality check on the operation information in some embodiments before generating the scanning command to ensure its validity. If the legality check passes, the server then generates the scanning command corresponding to the parameters to be scanned based on a preset dictionary. The legality check refers to the server performing multi-dimensional verification on the acquired operation information to determine whether it conforms to preset rules. This process is used to identify and block invalid operation information. The legality check includes at least one of format verification, connectivity verification, and integrity verification.

[0054] Format validation verifies whether the character format of the address to be scanned conforms to the standard specifications of IP addresses or URLs. The server can use regular expressions to perform static text matching on the incoming URL or IP address. For example, it can determine whether all four subnets of the IP address are between 0 and 255, or whether the URL contains a valid protocol header. If the format validation fails, the server can generate an error message indicating an incorrect address format and return it to the client's interactive interface, terminating the subsequent process.

[0055] Connectivity verification refers to verifying whether the server corresponding to the address to be scanned is accessible through network probing. The server runs a lightweight network probe in the background. For example, it can use the system's built-in ICMP protocol to send Ping packets, or use the Telnet protocol to perform a TCP three-way handshake half-open scan of the address to be scanned (such as 80 or 443) to determine connectivity. If the connectivity verification fails, the server can generate a message indicating that the address to be scanned is unreachable and return it to the client's interactive interface, terminating the subsequent process.

[0056] Integrity verification verifies whether the operation information includes all necessary scanning parameters. The server checks whether any scanning parameters in the operation information are missing or out of bounds. For example, if the obtained scanning parameters include a vulnerability scan type, a standard scan depth, and a timeout of 10 seconds, but lack concurrency, the integrity verification fails. If the integrity verification fails, the server can generate a message indicating the lack of necessary scanning parameters and return it to the client, terminating the subsequent process.

[0057] This embodiment performs a validity check before generating the scan command, which can identify problems such as format errors, unreachable addresses, and missing scan parameters in advance. The scan command is only generated if the operation information passes the validity check, which can avoid the server generating and executing invalid scan commands and reduce the waste of server computing resources.

[0058] In practical applications, the raw scan results of existing Linux website scanning technologies are mostly stored in local logs or text format. The scan task information, raw scan results, and subsequent analysis content are separated, making unified management and traceability impossible. Therefore, in this embodiment, after obtaining the raw scan results, a task identifier corresponding to the operation information is generated. Then, the operation information and the raw scan results are associated with the task identifier and stored in the database of the server's storage module.

[0059] Specifically, the operation information undergoes a validity check, indicating that the operation information corresponds to a legitimate and executable scanning task. At this point, the server uses a globally unique identifier generation algorithm (such as the UUID v4 algorithm or the Snowflake algorithm) to generate a unique task identifier for a scanning task, such as the string "task_9f8b2a1c_20231024_153000".

[0060] The task identifier serves as the primary key throughout the entire scanning lifecycle. The server inserts a new task record into the background database, associates the task identifier with operation information (who initiated it, what address is being scanned, what parameters were configured, creation time, etc.) and stores it persistently. The server can also initialize the task's status to pending execution or queued.

[0061] Furthermore, during the execution of the scan command on the server side, since website scanning is a time-consuming task, to avoid users mistakenly believing the system is frozen or the browser has crashed due to prolonged periods of unresponsive webpages, thus negatively impacting user experience, this embodiment obtains the scan progress during the execution of the scan command and displays it on the interactive interface, allowing users to perceive the scan task's progress in real time.

[0062] Specifically, the server-side monitoring module periodically (e.g., every 2 seconds) parses the standard output logs of the underlying scanning tool or sends system process status query requests. It uses preset progress extraction rules, such as capturing specific "progress percentage" keywords in the output logs, or calculating the progress percentage based on the ratio of the number of ports detected to the total expected number of probes, to calculate the current scanning progress value.

[0063] Subsequently, the server proactively pushes a data frame carrying the task identifier and progress percentage to the client. Upon receiving the data, the client smoothly moves the progress bar forward on the interactive interface, or refreshes the scanned temporary results in real time. For example, ... Figure 7 As shown, during the execution of scan task 1, the current scan progress is displayed as 32% on the interactive interface using a progress bar. In this way, the user can perceive the scan progress of the scan task in real time.

[0064] Once the scanning subprocess finishes execution and exits normally, the scanning task is complete, and the server obtains the raw scan results. At this point, the server does not store these results in the local disk log. Instead, it triggers a database insertion operation, using the task identifier as a query condition to locate the corresponding task record in the database. The server then updates the task status of that record to "completed" and stores the raw scan results in the database or associates them with a file storage path pointer. Furthermore, to allow users to directly view the raw scan results on the interactive interface, the raw scan results can also be fed back to the client and displayed on the client's interactive interface.

[0065] This task-identifier-based storage architecture ensures that historical original scan results are not lost during server restarts or failover, facilitating subsequent data auditing, multi-task comparison queries, and long-term result traceability.

[0066] Since raw scan results are typically difficult-to-read machine logs and hexadecimal data packets, in this embodiment, the parameters to be scanned may also include: AI parsing style, such as: brief version, standard version, detailed version, and custom. When the server detects the raw scan results stored in the database, it reads the raw scan results from the database and constructs corresponding parsing prompts based on the parsing style selected by the user in the operation information (e.g., detailed version). These prompts include the raw scan results and parsing requirements, and are sent to the AI ​​model. The AI ​​model, based on its expertise in website security, analyzes the raw scan results and outputs a scan report. Furthermore, the parsing style can also be customized according to user needs; the user can choose the content included in the final output scan report as needed.

[0067] The scan report converts the raw scan results, which are not easy to read, into natural language. Depending on the parsing style, the content may include at least one of the following: task identifier, address to be scanned, scan type, scan time, parsing style, scanning tool information, result summary, risk level assessment, professional interpretation of ports or services, vulnerability hazard analysis, remediation suggestions, and security hardening plan.

[0068] The scanning tool information records the basic information, version number, and actual scanning commands executed by all scanning tools used in this scanning task; the results summary is a high-level summary of all findings in this scan, using concise language to summarize core security issues, risk levels, and overall security posture; the risk level determination is based on a unified quantitative assessment standard (such as a general vulnerability scoring system), classifying the severity of individual vulnerabilities and the overall security level; the port or service professional interpretation analyzes all open ports, running services, and their version information found in the scan, explaining their business purpose, security status, and potential attack risks; the vulnerability hazard analysis explains the technical principles, scope of impact, exploitable methods, and possible specific consequences for each discovered vulnerability; the remediation recommendations provide specific, directly implementable remediation steps for all discovered vulnerabilities and security configuration defects, categorized by urgency; and the security hardening plan refers to a security protection plan proposed from multiple dimensions, including basic configuration, protection equipment, management systems, and data security, based on vulnerability remediation.

[0069] After generating the scan report, the server uses the same task identifier to locate the corresponding task record in the database and appends the generated scan report to that record. Furthermore, to allow users to view the scan report directly on the user interface, the scan report can also be sent to the client for display on their interface.

[0070] The final task record corresponding to a scanning task is stored in the database, and the specific contents may include those shown in Table 1.

[0071] Table 1. One task record corresponding to one scanning task

[0072] The field names in Table 1 are used to uniquely identify the name of each row of data; the data type refers to the type of value stored. Among them, VARCHAR(n) is used to store short text, identifiers, status and other fixed-length or short variable-length content, where n is the maximum number of characters; TEXT is used to store long text content, with a maximum support of 65535 characters; JSON is used to store structured data, such as lists and objects; DATETIME is used to store time information; and the value refers to the actual value taken.

[0073] In this embodiment of the disclosure, the data generated during the execution of each scanning task is stored in the database. When the user switches to the historical task management panel on the front-end interactive interface, they can initiate a task query request based on various filtering conditions (such as by scanning address, by scanning completion time period, by scanning status, etc.).

[0074] The client sends a task query request to the server, which translates the request into a database query statement (such as an SQL SELECT statement), retrieves the corresponding query results from the database, and returns them to the client. The client then renders and displays these results on the interactive interface. This allows users to easily view historical scan task records on the interactive interface, avoiding manual database queries.

[0075] like Figure 8 The diagram shown illustrates the interaction between client 101, server 102, and cloud server 103. The complete interaction process is as follows: When the client 101's interactive interface initializes and loads, it sends a standardized option dictionary retrieval request to the server 102 to obtain all configurable scan options pre-configured by the server 102. Upon receiving the dictionary retrieval request, the server 102 reads the pre-stored standardized option dictionary from the storage module and returns it to the client 101. After receiving the dictionary returned by the server 102, the client 101 converts it into corresponding visual form elements and renders them in the interactive interface. For example, the scan type dictionary included in the dictionary is rendered as a dropdown selection box, displaying "Please select scan type" by default; the scan condition dictionary included in the dictionary is initially hidden according to parameter linkage rules, and dynamically rendered only after the user selects the corresponding scan type; the parsing configuration dictionary included in the dictionary renders the AI ​​parsing switch as a checkbox and the parsing style as a radio button group, with the parsing style option initially hidden and only displayed after the AI ​​parsing switch is turned on.

[0076] The user enters and submits operation information in the interactive interface of client 101. The operation information includes the address to be scanned and the parameters to be scanned. After the server 102 obtains the operation information, it first performs a validity check on it. If the check passes, it generates a scan instruction based on the dictionary database pre-stored in the storage module.

[0077] Based on the scan type in the scan parameters, server 102 determines the corresponding local pre-integrated scanning tool through the predefined mapping relationship between scan type and scanning tool, executes the scan command, scans the network resources corresponding to the scan address, and obtains the raw scan results.

[0078] During the scanning task execution, the monitoring module of server 102 continuously monitors the output stream of the scanning process, parses the current scanning progress in real time, and feeds back the scanning progress to client 101, which is then displayed in real time in the interactive interface.

[0079] After the scanning task is completed, the server 102 sends the complete raw scan results back to the client 101 and displays them in the interactive interface; at the same time, it generates a unique task identifier corresponding to the operation information, associates the operation information and the raw scan results with the task identifier, and stores them in the database of the storage module.

[0080] If the AI ​​analysis switch in the operation information is turned on, server 102 sends the raw scan results to cloud server 103. Cloud server 103 analyzes the raw scan results using the deployed AI model, generates a scan report, and returns it to server 102. After receiving the scan report, server 102 associates it with the corresponding task identifier and updates the database. At the same time, it sends the scan report back to client 101 for display in the interactive interface.

[0081] Corresponding to the website scanning method described above, this disclosure also provides a website scanning device, such as... Figure 9 The diagram shows the structural block diagram of the website scanning device, which may include: an acquisition module 901, a generation module 902, and an execution module 903. The acquisition module 901 is configured to acquire operation information from the interactive interface, including the address to be scanned and the parameters to be scanned. The generation module 902 is configured to generate a scanning instruction corresponding to the parameters to be scanned based on a preset dictionary, which includes a mapping relationship between scanning parameters and scanning instructions. The execution module 903 is configured to execute the scanning instruction to scan the network resources corresponding to the address to be scanned using a scanning tool, obtaining the original scan results.

[0082] In some embodiments, the acquisition module 901 is configured to acquire a first target parameter; according to a preset linkage rule, select a second target parameter set that matches the first target parameter from a preset parameter set; acquire the second target parameter selected from the second target parameter set; and integrate the first target parameter and the second target parameter to obtain the parameter to be scanned in the operation information.

[0083] In some embodiments, the device further includes: a verification module configured to perform a validity verification on the operation information before generating a scan instruction corresponding to the scan parameters based on a preset dictionary, the validity verification including at least one of format verification, connectivity verification and integrity verification; and a generation module 902 configured to generate a scan instruction corresponding to the scan parameters based on a preset dictionary when the validity verification passes.

[0084] In some embodiments, the device further includes: an association and storage module; a verification module, wherein the generation module 902 is configured to generate a task identifier corresponding to the operation information after obtaining the original scan result; and the association and storage module is configured to associate the operation information and the original scan result with the task identifier and store them in a database.

[0085] In some embodiments, the device further includes: an output module configured to analyze the original scan results based on an artificial intelligence model and output a scan report; and an association and storage module configured to associate the original scan results and scan report with task identifiers and update them in a database.

[0086] In some embodiments, the device further includes a feedback module configured to feed back the raw scan results and scan report to the interactive interface for display.

[0087] In some embodiments, the feedback module is configured to retrieve the corresponding query results from the database and display them on the interactive interface in response to a task query request on the interactive interface.

[0088] In some embodiments, the acquisition module 901 is configured to acquire the scanning progress during the execution of the scan instruction; the feedback module is configured to feed back the scanning progress to the interactive interface for display.

[0089] Each functional module in the website scanning device in this embodiment performs the steps described in the above method embodiments. The specific implementation principles and achievable technical effects have been discussed in detail in the foregoing method section, and will not be repeated here to maintain the conciseness of the specification.

[0090] like Figure 10 The diagram illustrates a hardware structure of an electronic device provided in an exemplary embodiment of this disclosure. In some examples, the electronic device may be a high-performance rack server, blade server, or elastic computing cloud server deployed in a data center. This electronic device performs the computation, scheduling, and processing tasks required by the technical solutions of this disclosure.

[0091] The electronic device of this disclosure may include one or more components such as a processor 1010 and a memory 1020. The processor 1010 and the memory 1020 can communicate internally at high speed via a system bus.

[0092] The processor 1010 connects various parts of the electronic device using various interfaces and lines. By running or executing instructions, programs, code sets, or instruction sets stored in the memory 1020, and by calling data stored in the memory 1020, the processor 1010 is able to perform various functions of the electronic device and process data.

[0093] Optionally, the processor 1010 can be implemented using at least one of the following hardware forms: Digital Signal Processing (DSP), Field Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). In industrial-grade server configurations, the processor 1010 typically employs a multi-core architecture Central Processing Unit (CPU) to handle the creation and destruction of multiple concurrent scanning subprocesses. If the system deploys a large local model for AI parsing, the processor 1010 can also integrate a Neural-network Processing Unit (NPU) or be independently mounted with a high-performance Graphics Processing Unit (GPU). The GPU is primarily used to accelerate tensor operations and inference speed of the artificial intelligence model using highly parallel matrix multiplication, thereby shortening the parsing wait time from the raw scan results to the generation of the scan report.

[0094] The memory 1020 may include random access memory (RAM) or read-only memory (ROM). To meet the requirement of large-capacity persistent storage of scan results, the memory 1020 typically also includes non-transitory computer-readable media.

[0095] The memory 1020 can be used to store operating system kernel instructions, various network communication stack drivers, application layer code, and dictionary library mapping files. The stored program area of ​​the memory 1020 stores computer program code for implementing the various steps of the website scanning method described above; the stored data area is used to persistently save task identifiers generated during operation, table data of relational and non-relational databases, raw scan result text, and scan reports generated by AI models.

[0096] In addition, it will be understood by those skilled in the art that Figure 10 The structure of the electronic device shown does not constitute a limitation on the device. For example, the electronic device must also include a network communication interface for establishing a persistent connection with the client and receiving operational information from the front end, while simultaneously initiating network probe data packets to the address to be scanned from the back end. The electronic device may also include auxiliary components such as a power management module and a cooling fan control array to ensure that the system maintains a stable thermal design power during high-load concurrent scanning and AI inference, which will not be elaborated further here.

[0097] This disclosure also provides a computer-readable storage medium (such as a USB flash drive, portable hard drive, ROM, RAM, magnetic disk, or optical disk) that stores a computer program or instructions. When the computer program or instructions are read and executed by a computer, the website scanning method described in the above-described method embodiments can be implemented, achieving the same technical effect.

[0098] This disclosure also provides a computer program product including computer instructions that, when read and executed by a processor of an electronic device, cause the electronic device to perform the website scanning method described in the various embodiments above.

[0099] In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, apparatuses, servers, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0100] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0101] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0102] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0103] Those skilled in the art will recognize that the functions described in this disclosure in one or more of the examples above can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0104] It should be noted that the technical solutions described in this disclosure can be combined arbitrarily as long as they do not conflict.

[0105] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A website scanning method, characterized in that, The method includes: Obtain operation information from the interactive interface, the operation information including the address to be scanned and the parameters to be scanned; Based on a preset dictionary, a scanning instruction corresponding to the parameters to be scanned is generated. The dictionary includes a mapping relationship between scanning parameters and scanning instructions. The scan command is executed to scan the network resources corresponding to the address to be scanned using a scanning tool, and the original scan results are obtained.

2. The method according to claim 1, characterized in that, The acquisition of operation information on the interactive interface includes: Obtain the first target parameter; According to the preset linkage rules, a second set of target parameters that matches the first target parameter is selected from the preset parameter set; Obtain the second target parameter selected from the second target parameter set; The first target parameter and the second target parameter are integrated to obtain the parameter to be scanned in the operation information.

3. The method according to claim 1, characterized in that, Before generating the scanning instruction corresponding to the parameters to be scanned based on a preset dictionary, the method further includes: The operation information is validated for legality, and the validity validation includes at least one of format validation, connectivity validation, and integrity validation. The step of generating a scan instruction corresponding to the scan parameters based on a preset dictionary includes: When the validity check passes, a scanning instruction corresponding to the parameters to be scanned is generated based on a preset dictionary.

4. The method according to claim 1, characterized in that, After obtaining the original scan results, the method further includes: Generate a task identifier corresponding to the operation information; The operation information is associated with the original scan result and then stored in the database.

5. The method according to claim 4, characterized in that, The method further includes: The original scan results are analyzed based on an artificial intelligence model, and a scan report is output. The scan report is associated with the task identifier and updated in the database.

6. The method according to claim 5, characterized in that, The method further includes: The original scan results and the scan report are displayed on the interactive interface.

7. The method according to claim 4, characterized in that, The method further includes: In response to a task query request on the interactive interface, the corresponding query results are retrieved from the database and displayed on the interactive interface.

8. The method according to claim 1, characterized in that, The method further includes: The scanning progress during the execution of the command to be scanned is obtained and displayed on the interactive interface.

9. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to implement the website scanning method as described in any one of claims 1 to 8.

10. A website scanning system, characterized in that, Including both client and server sides; The client is used to generate operation information based on interactive operations on the interactive interface and send it to the server. The operation information includes the address to be scanned and the parameters to be scanned. The server is used to obtain the operation information; as well as, Based on a preset dictionary, a scan command corresponding to the scan parameters is generated and executed to scan the network resources corresponding to the scan address using a scanning tool, thereby obtaining the original scan results. The dictionary includes a mapping relationship between scan parameters and scan commands.

11. The website scanning system according to claim 10, characterized in that, The system also includes a cloud server; The server is also used to send the original scan results to the cloud server; The cloud server is used to analyze the original scan results based on an artificial intelligence model and output a scan report to the server.

Images