25 results about "Vulnerability scanner" patented technology

The disclosed embodiments provide systems and methods for continuous exposure and attack surface management using a data fabric. Data from multiple heterogeneous cybersecurity sources, including vulnerability scanners, threat intelligence, cloud security tools, and endpoint monitoring systems, is ingested and integrated into a semantically harmonized representation, such as a security knowledge graph. This unified data model normalizes, correlates, and contextualizes diverse cybersecurity information, enabling comprehensive and real-time assessment of an organization's cybersecurity risk posture. Automated workflows trigger proactive remediation actions based on dynamically calculated exposure metrics. Additional embodiments leverage the same data fabric architecture to support specialized cybersecurity use cases, including unified vulnerability management (UVM), cyber asset attack surface management (CAASM), continuous threat exposure management (CTEM), and asset exposure management (AEM).

A system and method for determining device attributes using a classifier hierarchy. The method includes determining exploitation conditions for a manufacturing device based on a first set of device attributes of the manufacturing device and a second set of device attributes indicated in a vulnerabilities database; analyzing behavior and configuration of the manufacturing device to detect an exploitable vulnerability for the manufacturing device, wherein the exploitable vulnerability is a behavior or configuration of the manufacturing device which meets the exploitation conditions; and performing mitigation actions based on the exploitable vulnerability. The vulnerabilities database further indicates known exploits for the second set of device attributes. Analyzing the behavior and configuration of the manufacturing device includes identifying that a port is open and querying a vulnerability scanner for identifying information of the open port, wherein the currently exploitable vulnerability is detected based further on the identifying information of the open port.

The invention provides an intranet asset vulnerability scanning method, electronic equipment, a storage medium and a program product. The method comprises the steps of receiving a vulnerability scanning request; the vulnerability scanning request comprises to-be-scanned asset information, and assets corresponding to the to-be-scanned asset information are intranet assets; determining an access terminal based on the to-be-scanned asset information; the access terminal is used for realizing communication connection between the cloud service platform and the intranet; determining a vulnerability scanner on the cloud service platform according to the access terminal; the vulnerability scanning flow is sent to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning flow to assets corresponding to the to-be-scanned asset information, and vulnerability scanning of the assets is achieved. According to the embodiment of the invention, a communication channel between the cloud service platform and the intranet assets is opened through the access terminal, so that the purpose of performing vulnerability scanning on the intranet assets by using the vulnerability scanner on the cloud service platform is achieved.

The invention provides an LLM-based vulnerability risk repairing method, device and equipment and a storage medium, the method comprises the steps that scanning data scanned by a vulnerability scanner is processed by a first cue word generator and then input into an LLM language large model, a repairing suggestion is generated, and the scanning data comprises a request packet sent by the vulnerability scanner and a response packet received by the vulnerability scanner; finding a code snippet with the vulnerability according to a code path where the vulnerability is located, processing the code snippet through a second cue word generator, inputting the processed code snippet into the LLM language large model, and generating a repair code; and formatting the repair suggestion and the repair code to generate a vulnerability repair scheme. According to the method, multi-dimensional features of vulnerability codes are deeply analyzed by using an LLM language large model, vulnerability risk points in the codes are accurately positioned, more targeted repair suggestions and repair codes are provided, it is ensured that a generated repair scheme is matched with an actual code scene, the vulnerability risk repair cost is reduced, and the repair efficiency is improved. And a more efficient and reliable vulnerability risk management solution is provided.

The invention relates to a webpage API (Application Program Interface) depth discovery method, which comprises the following steps of: injecting a self-defined JS (JavaScript) code into a chromium browser which is started in a headless mode, triggering a webpage event and realizing request interception and hijack monitoring, and gradually triggering and completely traversing a functional process aiming at DOM0 and DOM2 events in the webpage code, meanwhile, a specific execution result is returned through a special DOM event of a HOOK part, the webpage is locked to avoid jumping in the triggering process, the DOM event on the webpage is triggered as completely as possible with the assistance of a field automatic filling function, and meanwhile, URL requests of webpage event functions are recorded and summarized. Compared with the prior art, the method has higher API discovery capability; according to the model, a browser event triggering and function HOOK technology method is adopted, the problems that a vulnerability scanner discovers and captures webpage URL paths and APIs are missing and incomplete are well solved, and the capacity of discovering the APIs and the vulnerabilities in the field of automatic vulnerability discovering is improved.

The invention discloses a vulnerability defense method, device and system, equipment, a medium and a product. The method comprises the following steps: acquiring request log data of a plurality of data sources, wherein the plurality of data sources at least comprise a network flow data source, an application firewall log data source and a domain name system log data source; capturing first out-of-band request data in the request log data, wherein the first out-of-band request data represents that an out-of-band scanning behavior for vulnerabilities exists; constructing second out-of-band request data based on malicious request information of the first out-of-band request data transmitted by the message queue; in a hybrid cloud environment, playing back the second out-of-band request data; wherein the hybrid cloud environment comprises a public cloud environment and a private cloud environment. In this way, automatic capture of the first out-of-band request data is achieved, meanwhile, the second out-of-band request data is constructed, the second out-of-band request data is played back in the mixed cloud environment, noise flow is formed to interfere with the vulnerability scanner, and the effect of active defense is achieved.

The application provides a mandatory vulnerability updating method, a mandatory vulnerability scanning method and related equipment, and relates to the technical field of network vulnerability scanning. The application obtains a plurality of vulnerability matching rules of a plurality of to-be-identified network vulnerabilities, calls a content distribution network platform to obtain historical network traffic data in a target time period, then performs vulnerability matching on the plurality of vulnerability matching rules and the historical network traffic data respectively, screens a plurality of target mandatory vulnerabilities with a higher probability of being exploited from the plurality of to-be-identified network vulnerabilities according to the vulnerability matching results of the plurality of vulnerability matching rules in the historical network traffic data, and finally automatically updates the vulnerability information of the screened plurality of target mandatory vulnerabilities to a target vulnerability scanner, so that an operation and maintenance personnel can directly use the target vulnerability scanner to effectively identify mandatory vulnerabilities existing in an information system, thereby effectively improving system security operation and maintenance efficiency and realizing accurate positioning of mandatory vulnerabilities.

The application provides a network security risk intelligent evaluation system and relates to the technical field of network security, which comprises a leak scanning capability evaluator, a leak scanning capability scheduler, a vulnerability scanner, a capability verification server and a target network. The leak scanning capability evaluator acquires network information of the target network and informs the leak scanning capability scheduler to create a projection environment according to the network information. The vulnerability scanner is called to perform vulnerability scanning on the projection environment and submit a first leak scanning report of the projection environment. The capability of each vulnerability scanner is evaluated according to the first leak scanning report. The leak scanning capability scheduler calls corresponding vulnerability scanners to scan the target network according to a vulnerability scanning combination scheme and submits a second leak scanning report to the leak scanning capability evaluator. Through the evaluation of the vulnerability detection efficiency and quality, the method for improving the vulnerability detection efficiency and quality by formulating the arrangement and calling strategy of various available leak scanning systems is realized, and the leak scanning quality and efficiency are effectively improved.

An automated network security risk quantitative assessment method for a power distribution network cyber-physical system includes: using the Nessus vulnerability scanner to perform a vulnerability scan on a target network; using the MulVAL tool to generate an attack graph using the vulnerability scan results and input network topology and security policies; searching a vulnerability library for corresponding vulnerability descriptions based on the vulnerability scan results, and outputting the vulnerability's CVSS metric classification using a CVSS metric classification prediction model; performing a quantitative system risk assessment based on the attack graph, CVSS metrics, and input physical consequences, and calculating the risk value of each node in the target network. The present invention utilizes open source tools to address the problem of automatic attack graph generation, and uses a CVSS metric classification prediction model to address the problem of CVSS information dependency. Furthermore, by designing multiple classifiers that share a multi-layer network, synchronous classification prediction and classification feature sharing of each CVSS metric are achieved.

The invention discloses an automatic network security risk quantitative evaluation method for a power distribution network information physical system. The method comprises the following steps: carrying out vulnerability scanning on a target network by utilizing a Nessus vulnerability scanner; the Mu lVAL tool generates an attack graph by using the vulnerability scanning result and the input network topology and security policy; searching corresponding vulnerability description in a vulnerability library according to a vulnerability scanning result, and outputting CVSS measurement classification of vulnerabilities through a CVSS measurement classification prediction model; and carrying out system risk quantitative evaluation according to the attack graph, the CVSS measurement and an input physical result, and calculating a risk value of each node in the target network. According to the method, the problem of automatic generation of the attack graph is solved by using an open source tool, and the problem of CVSS information dependence is solved through a CVSS measurement classification prediction model; by designing a plurality of classifiers sharing a multi-layer network, synchronous classification prediction and classification feature sharing of each CVSS metric are realized.

The invention relates to a vulnerability scanning effect evaluation method and device and electronic equipment, and belongs to the technical field of vulnerability scanning. According to the method, the vulnerability data generated when vulnerability scanning is carried out on each target network environment is preprocessed through the vulnerability scanning program, the index value of the basic index of each target network environment is obtained, and then the vulnerability scanning effect evaluation value of the scanning program on each target network environment is calculated; and finally, based on the vulnerability scanning effect evaluation value corresponding to each target network environment, determining the vulnerability scanning effect. Therefore, by integrating the scanning effects of the vulnerability scanning program on the system vulnerability, the service vulnerability and the Web vulnerability of each target network environment, the comprehensive assessment on the vulnerability scanning threat is realized at one time, so that the assessment result is more comprehensive and more accurate; therefore, a set of reasonable vulnerability scanning and vulnerability threat evaluation scheme can be provided for vulnerability utilization researchers or security defense developers.

A method of qualifying a vulnerability detection for remediation comprising: obtaining a vulnerability detection from a vulnerability scanner for a target system; determining qualification data qualifying the vulnerability detection, wherein the qualification data is based on a configuration of the target system excluded in the vulnerability detection from the vulnerability scanner; and associating the qualification data with the vulnerability detection.

The invention relates to the technical field of network security, and discloses a heterogeneous vulnerability scanner scheduling method and system based on an intelligent scheduling strategy, and the method comprises the steps: connecting different vulnerability scanners, carrying out the service registration and state monitoring through a unified API gateway, and collecting the operation indexes of all scanners in real time; setting a scanning scheduling strategy to allocate scanning tasks to scanners for execution, and obtaining task execution results; and obtaining scanning result data of each scanner, and generating a vulnerability scanning report. According to the invention, centralized scheduling management can be carried out uniformly, the utilization rate of the vulnerability scanner is improved, the scanning missing channel monitoring capability is provided, and when the content of our unit cannot be processed due to overtime unprocessed tasks or channel blockage, early warning is carried out in advance and related personnel of our unit are notified to process, so that the queuing waiting condition of users is relieved, and the user experience is improved. Different types of report data fusing heterogeneous scanning tasks are supported, a standardized scanning report is provided, and self-definition of a report format is supported.

The embodiment of the invention relates to the technical field of information, and discloses an interface security test method and device, a storage medium and a product, the interface security test method comprises the steps that a plurality of vulnerability detection plug-ins are constructed, the vulnerability detection plug-ins correspond to different interface security test categories, and the vulnerability detection plug-ins comprise basic principles of vulnerability types; obtaining interface information of the target interface and an interface associated with the target interface through the first intelligent agent; constructing a vulnerability scanning process through the first agent according to the interface information and the vulnerability arrangement information; performing vulnerability scanning on the target interface through the second agent according to the vulnerability scanning process to obtain a scanning result; therefore, by means of the endogenous ability of multiple agents, the workflow of a human penetration test engineer is simulated, through multi-step Web API calling, fine and meticulous vulnerability verification conforming to human thinking is achieved, the accuracy rate far higher than that of a traditional vulnerability scanner is achieved, and multiple vulnerability types difficult to cover by the traditional scanner can be covered.

The application provides an internal network asset vulnerability scanning method, an electronic device, a storage medium and a program product. The method comprises the following steps: receiving a vulnerability scanning request; the vulnerability scanning request comprises to-be-scanned asset information, and the asset corresponding to the to-be-scanned asset information is an internal network asset; determining an access terminal based on the to-be-scanned asset information; the access terminal is used to realize the communication connection between a cloud service platform and the internal network; determining a vulnerability scanner on the cloud service platform according to the access terminal; sending vulnerability scanning traffic to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the to-be-scanned asset information, to realize the vulnerability scanning of the asset. Through the access terminal, the communication channel between the cloud service platform and the internal network asset is opened, so that the purpose of using the vulnerability scanner on the cloud service platform to perform the vulnerability scanning on the internal network asset is realized.

The invention discloses a model training method and device and a vulnerability scanning flow identification method and device, and the method comprises the steps: scanning preset target network equipment through employing a plurality of vulnerability scanners, and capturing all network messages with the target network equipment as a destination address in a target time period; original network traffic is divided into scanning traffic and normal traffic, and corresponding scanner labels and normal labels are marked; extracting a network flow feature and a data load of each sample, and extracting a target character string which can best represent the content of the current sample from the data load of the sample to obtain a load feature; and taking the network flow feature and the load feature of each sample as training data, taking the scanner tag or the normal tag of the sample as tag data, and performing iterative training on a preset initial model to obtain a target model for identifying the abnormal network flow. According to the scheme, consumption of computing resources is reduced, deviation caused by a single point can be reduced, misinformation and missing report are reduced, and the recognition accuracy is improved.

An embodiment of the present application discloses a Web vulnerability scanning method, device, electronic device and medium based on Kubernetes. The method includes: if a vulnerability scanning trigger event is detected, sending a vulnerability scanning task creation request to the vulnerability detection software control center; after the vulnerability scanning task is successfully created, controlling the vulnerability scanner to register with the vulnerability detection software control center to obtain scanning parameters; according to the scanning parameters, controlling the vulnerability scanner to perform vulnerability scanning on the Web application. In the embodiment of the present application, by embedding "sidecar containers" such as vulnerability scanners and detection coordinators in the running unit Pod, the containers in the Pod can use the shared NetworkNamespace mechanism, so that the traffic detected by the vulnerability scanner can directly access the Web application locally to perform vulnerability detection on the Web application, without occupying the Kubernetes cluster entry bandwidth and without affecting the stability of other business operation units (Kubernetes Pods).

The embodiment of the invention discloses a vulnerability scanning method, device and system, a vulnerability scanner and electronic equipment, and relates to the field of cloud technology and computer technology. The method comprises the following steps: before sending a vulnerability scanning request to a scanned object, determining a response result of the scanned object to a historical scanning request; wherein the response result indicates whether a historical scanning request which is not responded by the scanned object exists or not; the historical scanning request comprises a historical vulnerability scanning request or a historical detection scanning request; and according to the response result, determining whether to send a vulnerability scanning request to the scanned object. By adopting the embodiment of the invention, whether the vulnerability scanning request is continuously sent to the scanned object or not can be determined according to the service performance of the scanned object, so that the scanned object is subjected to security check while stable operation of the scanned object is ensured, the scanned object is prevented from processing more vulnerability scanning requests under the condition of high load, and the security of the scanned object is improved. The scanning and hanging risk is reduced, and the applicability is high.

This disclosure provides a method, device, and medium for vulnerability rule generation and verification based on an intermediate component, relating to the field of computer technology, particularly artificial intelligence and network security. The specific implementation scheme includes: running the simulation environment constructed through the intermediate component; converting a vulnerability scanner tool template into an executable vulnerability detection service within the simulation environment, wherein the vulnerability detection service is a simulated service executed by a vulnerable web server; generating vulnerability detection rules in the simulation environment based on the vulnerability scanner tool template; and verifying the validity of the rules in the simulation environment based on the vulnerability detection rules and the vulnerability detection service.

An exploit assessment and pentesting program tests assets of a network being protected by an ASM cloud platform against known CVE. The vulnerability scanner performs pentesting by selecting CVE test templates from the database of CVE test templates and running the CVE test templates to conduct one or more common vulnerabilities and exposures tests on an asset to see whether the asset is actually vulnerable or not. The vulnerability scanner can cooperate with at least one of a user interface, a display, and a report generator to both i) report a results of the augmented pentesting on the assets of the network as well as ii) present an attack surface of the assets of the network being protected by the ASM cloud platform detected by the exploit assessment and pentesting program in order to show actual CVE risks present in the assets in the network.

Techniques for deploying and using offense-type network vulnerability scanners are disclosed herein. Network vulnerability scanners can be deployed at multiple locations in a network. The network vulnerability scanners can cause equipment with external connections to the network, such as user equipment which is configured for testing purposes, or other device(s) with or without external network connections to perform network vulnerability test operations. The network vulnerability test operations can expose network vulnerability information associated with external connections of the user equipment to the network.

1. The name of the product of this design: Vulnerability Scanner (unis X1000). 2. Purpose of this design product: used for vulnerability management in network equipment, and for early warning, scanning, and repair of vulnerability issues. 3. The design key point of this appearance design product lies in the shape. 4. The picture or photo that best illustrates the design points: Stereoscopic diagram 1.

The present application relates to the technical field of traffic extraction. Disclosed are a traffic extraction method and apparatus for a vulnerability scanner, and an electronic device and a storage medium. The method comprises: triggering a vulnerability scanner to send request traffic; determining whether the request traffic is redundant traffic, wherein the redundant traffic comprises universal traffic and / or repeated traffic, the repeated traffic being traffic identical to the previously received request traffic, and the universal traffic being request traffic for the vulnerability scanner to verify the survival of a site; and if the request traffic is non-redundant traffic, storing the request traffic. In this way, in the present application, whether request traffic is redundant traffic is determined, i.e., whether the request traffic is invalid traffic is determined, such that the request traffic that is not invalid traffic is stored, thereby reducing invalid traffic among stored request traffic.

The application relates to a novel power system APT attack graph generation method based on a GD-DQN algorithm, first, based on a novel power system network topology structure, network vulnerability scanners are used for scanning detection to generate vulnerability information of the novel power system; second, an intelligent agent in the GD-DQN algorithm is used for carrying out vulnerability state scanning on the vulnerability information to form network perception T of the novel power system environment; and then, the intelligent agent constructs an attack graph through a training process according to the network perception T. In the application, the intelligent agent in the GD-DQN algorithm is used to improve the efficiency and scale of attack graph generation, and the attack graph can be dynamically and real-timely generated; the Dueling DQN algorithm is introduced, each learning process of the intelligent agent does not necessarily depend on other learning scenes; the GRU model is introduced, the intelligent agent achieves better training effect, and a better attack path can be obtained.

Systems, computer program products, and methods are described herein for tracking virtual machine image vulnerabilities in a distributed network. The present disclosure is configured to identify a virtual machine (VM) image; apply the identified VM image to a VM vulnerability scanner; determine, by the VM vulnerability scanner, the VM image is safe from a list of known vulnerabilities; update, based on the VM vulnerability scanner, an approved repository with the VM image that is determined as safe from known vulnerabilities; generate, by a VM provisioning engine, at least one VM from the approved repository; identify at least one address identifier associated with the generated VM; and update the approved repository with the identified at least one address identifier and link the at least one address identifier to the associated VM image the generated VM is based on.