WO2021003982A1 - Service system vulnerability processing method and apparatus, computer device, and storage medium - Google Patents

Abstract

A service system vulnerability processing method, comprising: obtaining a vulnerability scanning plug-in according to a vulnerability scanning instruction sent by a terminal, the vulnerability scanning plug-in comprising multiple vulnerability types of vulnerability feature codes; obtaining module list data of a service system, scanning the module list data by means of the vulnerability scanning plug-in, and performing matching analysis on the module list data and the vulnerability feature codes to obtain a scanning result; if a vulnerability to be repaired exists in the scanning result, obtaining a vulnerability repair analysis model, and analyzing the scanning result by means of the vulnerability analysis model to obtain a target repair scheme of said vulnerability; pushing the target repair scheme to the corresponding terminal to receive a vulnerability repair instruction and a repair packet sent by the terminal according to the target repair scheme; and obtaining a vulnerability repair plug-in according to the vulnerability repair instruction, and repairing said vulnerability according to the repair packet by means of the vulnerability repair plug-in.

Description

Business system vulnerability processing method, device, computer equipment and storage medium

Cross-references to related applications:

This application claims the priority of the Chinese patent application filed to the Chinese Patent Office on July 5, 2019, with the application number 2019106034589, and the application titled "Business System Vulnerability Handling Methods, Devices, Computer Equipment, and Storage Media", and its entire contents Incorporated in this application by reference.

Technical field

This application relates to a method, device, computer equipment and storage medium for processing loopholes in a business system.

Background technique

With the continuous development of Internet technology, computers are also susceptible to many factors, which lead to certain security loopholes in the Internet. Vulnerability scanning is usually through the vulnerability scanner according to the operating system platform of the target system and the network services provided, calling various known vulnerabilities in the vulnerability database to detect one by one, and judging whether there are vulnerabilities by analyzing the detection response data packet.

However, existing network vulnerability scanners mainly use the principle of feature matching to identify various known vulnerabilities. The scanner sends a data packet containing a vulnerability feature detection code, and determines whether there is a vulnerability based on whether the returned data packet contains the response feature code of the vulnerability. Most of the vulnerabilities use database technology, and the vulnerability tools rely on more data. Using a larger database for vulnerability management has a large resource occupancy rate and low vulnerability scanning efficiency and repair efficiency.

Summary of the invention

According to various embodiments disclosed in the present application, a method, device, computer equipment, and storage medium for handling business system vulnerabilities are provided.

A method for processing loopholes in a business system, the method comprising:

Acquiring a vulnerability scanning plug-in according to a vulnerability scanning instruction sent by the terminal, the vulnerability scanning plug-in including vulnerability signature codes of multiple vulnerability types;

Acquiring module list data of the business system, scanning the module list data through the vulnerability scanning plug-in, and performing matching analysis on the module list data and the vulnerability feature code to obtain a scanning result;

When there are vulnerabilities to be repaired in the scanning result, obtain a vulnerability repair analysis model, and analyze the scanning result through the vulnerability analysis model to obtain a target repair plan for the vulnerability to be repaired;

Push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

A vulnerability repair plug-in is obtained according to the vulnerability repair instruction, and the vulnerability to be repaired is repaired by the vulnerability repair plug-in according to the repair package.

A device for processing loopholes in a business system, the device comprising:

The vulnerability scanning module is used to obtain the vulnerability scanning plug-in according to the vulnerability scanning instruction sent by the terminal. The vulnerability scanning plug-in includes vulnerability feature codes of multiple vulnerability types; to obtain the module list data of the business system, and the vulnerability scanning plug-in Scan the module list data, and perform matching analysis on the module list data and the vulnerability signature to obtain the scanning result;

The vulnerability analysis module is used to obtain a vulnerability repair analysis model when there is a vulnerability to be repaired in the scan result, analyze the scan result through the vulnerability analysis model, and obtain a target repair plan for the vulnerability to be repaired;

A data push module, configured to push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

The vulnerability repair module is used to obtain the vulnerability repair plug-in according to the vulnerability repair instruction, and repair the vulnerability to be repaired according to the repair package through the vulnerability repair plug-in.

A computer device, including a memory and one or more processors, the memory stores computer readable instructions, when the computer readable instructions are executed by the processor, the one or more processors execute The following steps:

Acquiring a vulnerability scanning plug-in according to a vulnerability scanning instruction sent by the terminal, the vulnerability scanning plug-in including vulnerability signature codes of multiple vulnerability types;

Acquiring module list data of the business system, scanning the module list data through the vulnerability scanning plug-in, and performing matching analysis on the module list data with the vulnerability feature code to obtain the scanning result;

When there are vulnerabilities to be repaired in the scanning result, obtain a vulnerability repair analysis model, and analyze the scanning result through the vulnerability analysis model to obtain a target repair plan for the vulnerability to be repaired;

Push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

A vulnerability repair plug-in is obtained according to the vulnerability repair instruction, and the vulnerability to be repaired is repaired by the vulnerability repair plug-in according to the repair package.

A non-volatile computer-readable storage medium, the storage medium stores at least one instruction, the computer-readable storage medium stores at least one computer-readable instruction, and the computer-readable instruction is executed by a processor Load and perform the following steps:

Acquiring a vulnerability scanning plug-in according to a vulnerability scanning instruction sent by the terminal, the vulnerability scanning plug-in including vulnerability signature codes of multiple vulnerability types;

Acquiring module list data of the business system, scanning the module list data through the vulnerability scanning plug-in, and performing matching analysis on the module list data and the vulnerability feature code to obtain a scanning result;

When there are vulnerabilities to be repaired in the scanning result, obtain a vulnerability repair analysis model, and analyze the scanning result through the vulnerability analysis model to obtain a target repair plan for the vulnerability to be repaired;

Push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

A vulnerability repair plug-in is obtained according to the vulnerability repair instruction, and the vulnerability to be repaired is repaired by the vulnerability repair plug-in according to the repair package.

The details of one or more embodiments of the application are set forth in the following drawings and description. Other features and advantages of this application will become apparent from the description, drawings and claims.

Description of the drawings

Fig. 1 is an application scenario diagram of a method for processing a business system vulnerability according to one or more embodiments.

Fig. 2 is a schematic flowchart of a method for processing a business system vulnerability according to one or more embodiments.

Fig. 3 is a schematic diagram of a process of scanning a vulnerability according to one or more embodiments.

Fig. 4 is a schematic diagram of a process of repairing a vulnerability to be repaired according to one or more embodiments.

Fig. 5 is a block diagram of a business system vulnerability processing device according to one or more embodiments.

Figure 6 is a block diagram of a computer device according to one or more embodiments.

Detailed ways

In order to make the technical solutions and advantages of the present application clearer, the following further describes the present application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the application, and not used to limit the application.

The business system vulnerability processing method provided in this application can be applied to the application environment as shown in FIG. 1. The terminal 102 communicates with the server 104 through the network through the network. The terminal 102 may be a terminal corresponding to operation and maintenance personnel. The terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices. The server 104 may be a server corresponding to a business system. 104 can be implemented by an independent server or a server cluster composed of multiple servers.

In one of the embodiments, as shown in FIG. 2, a method for processing vulnerabilities in a business system is provided. Taking the method applied to the server in FIG. 1 as an example for description, the method includes the following steps:

Step 202: Obtain a vulnerability scanning plug-in according to the vulnerability scanning instruction sent by the terminal. The vulnerability scanning plug-in includes vulnerability feature codes of multiple vulnerability types.

A business system can be a business processing system, or an information system that provides targeted support for business processing, and can provide powerful tool support for the completion of a certain task. The business system may include multiple business modules, each module includes a corresponding module list, and the module list includes status information of the business module. The status information may include the running status information of the service module, and the description information of the module.

During the operation of the business system, anomalies or vulnerabilities may occur. Therefore, the business system needs to be scanned and repaired for vulnerabilities.

Vulnerabilities can refer to weaknesses or defects in the business system, and the possibility of threats or dangerous incidents to the business system. Vulnerabilities can include, but are not limited to, defects or errors arising from system design or coding, design defects or unreasonable logical processes during the interactive processing of the business, and defects or errors arising from external attacks. Vulnerability scanning refers to the detection of the security of the business system through scanning and other means to detect the vulnerabilities in the business system. The vulnerability scanning plug-in may be a pre-configured plug-in program for detecting vulnerabilities according to the operating logic of the business system.

Step 204: Obtain the module list data of the business system, scan the module list data through the vulnerability scanning plug-in, and perform matching analysis on the module list data and the vulnerability feature code to obtain the scanning result.

After receiving the specified vulnerability scanning instruction, the server obtains the module list data of the business system according to the vulnerability scanning instruction, and the module list data includes operation status information of multiple business modules. The server then obtains the preset vulnerability scanning plug-in, scans the module list data through the vulnerability scanning plug-in, scans the operating status information in the multiple module list data in the business system, and compares the operating status information with the vulnerability features preset in the vulnerability plugin The vulnerability description information corresponding to the code is matched and analyzed.

When it is detected that there is running status information that is the same as the vulnerability signature, the vulnerability signature corresponding to the running status information is obtained, and the corresponding scanning result is generated according to the vulnerability signature. By using the vulnerability scanning plug-in to scan the business system for vulnerabilities, the security risks of the business system infrastructure can be detected timely and accurately to ensure the smooth development of the business, thereby effectively ensuring the security of the information assets in the business system.

Step 206: When there are vulnerabilities to be repaired in the scanning results, a vulnerability repair analysis model is obtained, and the scanning results are analyzed through the vulnerability analysis model to obtain a target repair plan for the vulnerabilities to be repaired.

Step 208: Push the target repair plan to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair plan.

When there are vulnerabilities to be fixed in the scan results, it means that there are vulnerabilities in the business system and need to be fixed. Vulnerabilities to be fixed include corresponding vulnerability status information. Specifically, the server obtains a preset vulnerability repair analysis model, where the vulnerability repair analysis model may be a neural network model based on a decision tree, and the vulnerability repair analysis model may include multiple preset vulnerability decision nodes. The vulnerability status information is analyzed through the vulnerability repair analysis model, and the vulnerability characteristics of the vulnerability to be repaired are obtained. According to the vulnerability characteristics of the vulnerability to be repaired, multiple vulnerability decision nodes are traversed until the target node is traversed, and then the target repair plan corresponding to the vulnerability to be repaired is obtained according to the target node.

After the server obtains the target repair plan through the vulnerability repair analysis model, it pushes the target repair plan to the terminal so that the operation and maintenance personnel can use the target repair plan to develop a corresponding repair package through the corresponding terminal.

Step 210: Obtain a vulnerability repair plug-in according to the vulnerability repair instruction, and repair the vulnerability to be repaired according to the repair package through the vulnerability repair plug-in.

After the operation and maintenance personnel obtain the repair package through the corresponding terminal, they can send a vulnerability repair instruction to the server to repair the vulnerability to be repaired. Specifically, after receiving the vulnerability repair instruction and repair package sent by the terminal, the server obtains the preset vulnerability repair plug-in according to the vulnerability repair instruction, and repairs the vulnerability to be repaired according to the repair package through the vulnerability repair plug-in.

Specifically, the server parses the repair package through the vulnerability repair plug-in, and obtains the repair script code and function interface in the repair package. Obtain the code identifier corresponding to the vulnerability to be repaired, obtain the function call interface according to the code identifier, reset the right corresponding to the vulnerability to be repaired to zero, and modify the function call interface of the vulnerability to be repaired to the function interface of the repair package. The server stores the repair script code in the local location corresponding to the vulnerability to be repaired, and deletes the original script code of the vulnerability to be repaired, thereby updating and repairing the vulnerability to be repaired. Scanning multiple module list data in the business system through the vulnerability scanning plug-in can quickly and effectively scan for vulnerabilities in the business system. After the vulnerability is scanned, the vulnerability repair analysis model is used to analyze the target repair plan for the vulnerability, so that the operation and maintenance personnel can develop the corresponding repair package according to the target repair plan, and use the repair package to repair the vulnerability through the vulnerability repair plug-in. Can effectively repair vulnerabilities.

In the vulnerability repair method of the business system, the server obtains the preset vulnerability scanning plug-in sent by the terminal, and obtains the module list data of the business system, scans the module list data through the vulnerability scanning plug-in, and compares the module list data with the vulnerability characteristics The code is matched and analyzed to obtain the scanning result, and the vulnerability scanning and analysis are performed through the vulnerability scanning plug-in, so that the vulnerabilities existing in the business system can be scanned effectively in time. When there are vulnerabilities to be repaired in the scan results, the server obtains the preset vulnerability repair analysis model, analyzes the scan results through the vulnerability analysis model, and obtains the target repair plan for the vulnerability to be repaired; pushes the target repair plan to the corresponding terminal and passes After the vulnerability repair analysis model analyzes and obtains the target repair plan of the vulnerability, it can effectively enable relevant staff to develop a corresponding repair package according to the target repair plan through the terminal. The server can thus send vulnerability repair instructions and repair packages according to the terminal through the vulnerability repair plug-in, and effectively repair the vulnerabilities to be repaired, so that the vulnerabilities existing in the business system can be repaired in a timely and effective manner.

In one of the embodiments, as shown in FIG. 3, the step of scanning the module list data through the vulnerability scanning plug-in specifically includes the following content:

Step 302: traverse the running status information of multiple module lists, and match the running status information with the vulnerability signature.

Step 304: When it is detected that there is running status information matching the vulnerability feature code, acquire a vulnerability feature code corresponding to the running status information.

Step 306, locate the vulnerability to be repaired with the vulnerability feature code, and obtain the location identifier corresponding to the vulnerability to be repaired.

Step 308: Generate a corresponding scan result according to the vulnerability feature code and location identifier of the vulnerability to be repaired.

The vulnerability scanning plug-in includes multiple scanning categories and preset components, and the vulnerability scanning plug-in also includes vulnerability signature codes corresponding to multiple business systems. After receiving the specified vulnerability scanning instruction, the server performs vulnerability scanning on the module list data in the business system through the vulnerability scanning plug-in, where the module list data includes operation status information of multiple business modules. The server then obtains the preset vulnerability scanning plug-in, scans the module list data through the vulnerability scanning plug-in, scans the operating status information in the multiple module list data in the business system, and compares the operating status information with the vulnerability features preset in the vulnerability plugin The vulnerability description information corresponding to the code is matched and analyzed.

Specifically, the server traverses the running status information of multiple module lists, and matches the running status information with the vulnerability signature. When it is detected that the running status information that is the same as the vulnerability signature, the vulnerability signature corresponding to the running status information is obtained. The vulnerability to be repaired with the vulnerability signature is located, and the corresponding location identifier is obtained. The server generates the corresponding scanning result according to the vulnerability signature and the location identifier. By using the vulnerability scanning plug-in to scan the business system for vulnerabilities, the security risks of the business system infrastructure can be detected timely and accurately to ensure the smooth development of the business, thereby effectively ensuring the security of the information assets in the business system.

In one of the embodiments, before obtaining the vulnerability repair analysis model, the method further includes: obtaining a plurality of sample vulnerability data, the sample vulnerability data includes the marked vulnerability data; performing feature extraction on the sample vulnerability data, and extracting the corresponding feature variable; Perform cluster analysis of feature variables to obtain multiple clustering results after multiple clustering; extract multiple feature variables and corresponding attribute information that reach a preset threshold according to the clustering results; use multiple feature variables and corresponding attribute information according to the clustering results The neural network model constructs a vulnerability repair analysis model.

Before the server receives the vulnerability scanning instruction sent by the terminal, it can also construct a vulnerability repair analysis model in advance. For example, the server can obtain a large amount of sample vulnerability data and perform big data analysis on a large amount of vulnerability data. Vulnerability data may include marked vulnerabilities and corresponding solution information. For example, the server performs feature extraction on a large amount of vulnerability data, extracts the corresponding feature variables, and then uses a clustering algorithm to perform cluster analysis on the feature variables. The server obtains multiple clustering results after clustering the feature variables multiple times. Then, the feature variable and the corresponding attribute information reaching the preset threshold are extracted. The server can obtain a preset neural network model, and then use the extracted feature variables and corresponding attribute information to construct a vulnerability repair analysis model in a preset manner.

In one of the embodiments, the scanning results are analyzed through the vulnerability analysis model to obtain the target repair plan for the vulnerability to be repaired. The steps include: analyzing the operating status information corresponding to the vulnerability to be repaired through the vulnerability repair analysis model to obtain the vulnerability to be repaired Vulnerability characteristics: traverse multiple decision nodes in the vulnerability repair analysis model according to the vulnerability characteristics; when traversing to the target decision node, obtain the target repair plan corresponding to the vulnerability to be repaired according to the target decision node.

After receiving the vulnerability scanning instruction sent by the terminal, the server obtains a preset vulnerability scanning plug-in according to the vulnerability scanning instruction, and the vulnerability scanning plug-in includes vulnerability signatures of multiple vulnerability types. The server obtains the module list data of the business system, scans the module list data through the vulnerability scanning plug-in, and performs matching analysis on the module list data with the vulnerability signature to obtain the scanning results. The vulnerability scanning plug-in can effectively detect the existence of the business system Scan for vulnerabilities.

When there are vulnerabilities to be fixed in the scan results, it means that there are vulnerabilities in the business system and need to be fixed. Vulnerabilities to be fixed include corresponding vulnerability status information. Specifically, the server obtains a preset vulnerability repair analysis model, where the vulnerability repair analysis model may be a neural network model based on a decision tree, and the vulnerability repair analysis model may include multiple preset vulnerability decision nodes. The vulnerability status information is analyzed through the vulnerability repair analysis model, and the vulnerability characteristics of the vulnerability to be repaired are obtained. According to the vulnerability characteristics of the vulnerability to be repaired, multiple vulnerability decision nodes are traversed until the target node is traversed, and then the target repair plan corresponding to the vulnerability to be repaired is obtained according to the target node. By analyzing the vulnerability to be repaired through the vulnerability repair analysis model, the target repair plan for the vulnerability to be repaired can be effectively obtained, and the efficiency of repairing the vulnerability can be effectively improved.

After the server obtains the target repair plan through the vulnerability repair analysis model, it pushes the target repair plan to the terminal, so that the operation and maintenance personnel can use the target repair plan to develop a corresponding repair package through the corresponding terminal.

In one of the embodiments, as shown in FIG. 4, the steps of repairing the vulnerability to be repaired by the vulnerability repair plug-in according to the repair package specifically include the following:

Step 402: Analyze the repair package through the vulnerability repair plug-in to obtain the repair script code and function interface in the repair package.

Step 404: Obtain the code identifier corresponding to the vulnerability to be fixed, and obtain the function call interface according to the code identifier.

Step 406: Reset the right corresponding to the vulnerability to be repaired to zero, and modify the function call interface of the vulnerability to be repaired to the function interface of the repair package.

Step 408: Store the repair script code in the local location corresponding to the vulnerability to be repaired, and delete the original script code of the vulnerability to be repaired.

After receiving the vulnerability scanning instruction sent by the terminal, the server obtains a preset vulnerability scanning plug-in according to the vulnerability scanning instruction, and the vulnerability scanning plug-in includes vulnerability signatures of multiple vulnerability types. The server obtains the module list data of the business system, scans the module list data through the vulnerability scanning plug-in, and performs matching analysis on the module list data with the vulnerability signature to obtain the scanning result. When there are vulnerabilities to be repaired in the scan results, the server obtains the preset vulnerability repair analysis model, analyzes the scan results through the vulnerability analysis model, and obtains the target repair plan for the vulnerability to be repaired; pushes the target repair plan to the corresponding terminal, so that The operation and maintenance personnel develop the corresponding repair package according to the target repair plan through the terminal. After the operation and maintenance personnel obtain the repair package through the corresponding terminal, they can send a vulnerability repair instruction to the server to repair the vulnerability to be repaired.

After receiving the vulnerability repair instruction and repair package sent by the terminal, the server obtains the preset vulnerability repair plug-in according to the vulnerability repair instruction, and repairs the vulnerability to be repaired according to the repair package through the vulnerability repair plug-in. Specifically, the server obtains a preset vulnerability repair plug-in, parses the repair package through the vulnerability repair plug-in, references related class libraries, and uses the parsing engine to parse the repair script code and function interface in the repair package. Obtain the code identifier corresponding to the vulnerability to be repaired, obtain the function call interface according to the code identifier, reset the right corresponding to the vulnerability to be repaired to zero, and modify the function call interface of the vulnerability to be repaired to the function interface of the repair package to be repaired Replace the vulnerable function interface. The server stores the repair script code to the location corresponding to the local vulnerability to be repaired, and deletes the original script code of the vulnerability to be repaired. After the server replaces the call interface, it replaces the original part of the code to be repaired by running the script in the repair package. Repair the loopholes in the business system. Scanning multiple module list data in the business system through the vulnerability scanning plug-in can quickly and effectively scan for vulnerabilities in the business system. After the vulnerability is scanned, the vulnerability repair analysis model is used to analyze the target repair plan for the vulnerability, so that the operation and maintenance personnel can develop the corresponding repair package according to the target repair plan, and use the repair package to repair the vulnerability through the vulnerability repair plug-in. It can effectively repair vulnerabilities and effectively improve the efficiency of vulnerabilities repair of business systems.

Further, the server may also call a load balancer, allocate a new process for the repair package and bind a new listening port, and at the same time reset the weight of the original part to be repaired corresponding to the repair package to zero. When the connections corresponding to the part to be repaired are disconnected, the old process is shut down, thereby realizing the update of the repair package. By replacing the part of the code to be repaired, the new and old code will not coexist when the application is running, thereby effectively improving the efficiency of vulnerability repair.

In one of the embodiments, the method further includes: when the vulnerability to be fixed fails to be repaired, obtaining corresponding repair process information; obtaining a vulnerability repair detection model, and detecting and analyzing the repair process information through the vulnerability repair detection model to obtain an analysis result; Push the analysis results to the terminal so that the operation and maintenance personnel can adjust the repair package through the terminal.

After receiving the vulnerability scanning instruction sent by the terminal, the server obtains the preset vulnerability scanning plug-in according to the vulnerability scanning instruction, and obtains the module list data of the business system, scans the module list data through the vulnerability scanning plug-in, and compares the module list data with the vulnerability characteristics The code is matched and analyzed to obtain the scanning result. When there are vulnerabilities to be fixed in the scan results, the server obtains the preset vulnerability repair analysis model, analyzes the scan results through the vulnerability analysis model, and obtains the target repair plan for the vulnerability to be repaired, and pushes the target repair plan to the corresponding terminal. It enables the operation and maintenance personnel to develop the corresponding repair package according to the target repair plan through the terminal. The server receives the vulnerability repair instruction and repair package sent by the terminal, and repairs the vulnerability to be repaired according to the repair package through a preset vulnerability repair plug-in.

In the process of repairing the vulnerability to be repaired by the server, when it is detected that the repair of the vulnerability to be repaired fails, the server obtains the repair process information of the vulnerability to be repaired, and analyzes the reason for the failure to repair the vulnerability. Specifically, the server may obtain a preset vulnerability repair detection model, where the vulnerability repair detection model may be a model based on a decision tree, and the repair process information is analyzed through the vulnerability repair detection model. Specifically, the repair process information may include repair nodes and corresponding status information. The server can analyze each repair node and corresponding status information in the repair process information through the vulnerability repair detection model, determine the reason for the repair failure, and generate The corresponding analysis results.

After the server obtains the corresponding analysis result through the vulnerability analysis detection model, it pushes the analysis result to the corresponding terminal of the operation and maintenance personnel. Make the corresponding operation and maintenance terminal improve and adjust the repair package according to the analysis result to repair the vulnerability to be repaired again. Further, after the operation and maintenance personnel adjust and improve the repair package through the terminal, the update repair package is obtained, the update repair package is sent to the server, and the vulnerability repair instruction is sent. After the server receives the vulnerability repair instruction and the update repair package sent by the operation and maintenance terminal, the vulnerability repair plug-in uses the update repair package to repair the vulnerabilities to be repaired again, thereby ensuring that the vulnerabilities are effectively repaired. By using the vulnerability repair detection model to analyze the repair process information, the reason for the repair failure can be effectively analyzed, which can help to further repair the vulnerability, thereby effectively improving the efficiency of the vulnerability repair.

It should be understood that although the various steps in the flowcharts of FIGS. 2-4 are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless specifically stated in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least some of the steps in Figures 2-4 may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. These sub-steps or stages The execution order of is not necessarily performed sequentially, but may be performed alternately or alternately with at least a part of other steps or sub-steps or stages of other steps.

In one of the embodiments, as shown in FIG. 5, a business system vulnerability processing device is provided, including: a vulnerability scanning module 502, a vulnerability analysis module 504, a data push module 506, and a vulnerability repair module 508, wherein:

The vulnerability scanning module 502 is used to obtain vulnerability scanning plugins according to the vulnerability scanning instructions sent by the terminal. The vulnerability scanning plugins include vulnerability signature codes of multiple vulnerability types; to obtain module list data of the business system, and to scan the module list data through the vulnerability scanning plugin , Perform matching analysis between the module list data and the vulnerability signature to obtain the scan result;

The vulnerability analysis module 504 is used to obtain a vulnerability repair analysis model when there is a vulnerability to be repaired in the scan result, analyze the scan result through the vulnerability analysis model, and obtain a target repair plan for the vulnerability to be repaired;

The data push module 506 is used to push the target repair plan to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair plan; and

The vulnerability repair module 508 is used to obtain preset vulnerability repair plugins according to the vulnerability repair instructions, and repair the vulnerabilities to be repaired according to the repair package through the vulnerability repair plugins.

In one of the embodiments, the module list data includes operating status information of multiple business modules, and the vulnerability scanning module 502 is also used to traverse the operating status information of multiple business modules and match the operating status information with the vulnerability signature; When detecting the existence of operating status information matching the vulnerability signature, obtain the vulnerability signature corresponding to the operating status information; locate the vulnerability to be repaired with the vulnerability signature, and obtain the location identifier corresponding to the vulnerability to be repaired; and Generate corresponding scan results according to the vulnerability signature and location identification.

In one of the embodiments, the device further includes a model building module for obtaining a plurality of sample vulnerability data, the sample vulnerability data includes the marked vulnerability data; feature extraction is performed on the sample vulnerability data, and the corresponding feature variable is extracted; Perform cluster analysis of feature variables to obtain multiple clustering results after multiple clustering; extract multiple feature variables and corresponding attribute information that reach a preset threshold according to the clustering results; and according to multiple feature variables and corresponding attribute information Use the neural network model to build a vulnerability repair analysis model.

In one of the embodiments, the vulnerability analysis module 504 is also used to analyze the operating status information corresponding to the vulnerability to be repaired through the vulnerability repair analysis model to obtain the vulnerability characteristics of the vulnerability to be repaired; according to the vulnerability characteristics, multiple vulnerability repair analysis models The decision node is traversed; and when the target decision node is traversed, the target repair plan corresponding to the vulnerability to be repaired is obtained according to the target decision node.

In one of the embodiments, the vulnerability repair module 508 is also used to parse the repair package through the vulnerability repair plug-in to obtain the repair script code and function interface in the repair package; obtain the code identifier corresponding to the vulnerability to be repaired, and obtain the function according to the code identifier Call interface; reset the right corresponding to the vulnerability to be repaired to zero, modify the function call interface of the vulnerability to be repaired to the function interface of the repair package; and store the repair script code to the location corresponding to the local vulnerability to be repaired, and delete the vulnerability to be repaired The original script code of the vulnerability.

In one of the embodiments, the device further includes a vulnerability repair detection module, which is used to obtain corresponding repair process information when the vulnerability to be repaired fails to be repaired; obtain a preset vulnerability repair detection model, and use the vulnerability repair detection model to check the repair process Information is detected and analyzed to obtain analysis results; and the analysis results are pushed to the terminal, so that the operation and maintenance personnel can adjust the repair package through the terminal.

For the specific limitation of the business system vulnerability processing device, please refer to the above limitation on the business system vulnerability processing method, which will not be repeated here. Each module in the above-mentioned business system vulnerability processing device can be implemented in whole or in part by software, hardware, and combinations thereof. The foregoing modules may be embedded in the form of hardware or independent of the processor in the computer device, or may be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the foregoing modules.

In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. 6. The computer equipment includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer readable instructions, and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the non-volatile storage medium. The database of the computer equipment is used to store data such as missing module list data, operating status information, hole scanning plug-ins, and vulnerability repair plug-ins. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer-readable instructions are executed by the processor, the steps of the business system vulnerability processing method provided in any embodiment of the present application are implemented.

Those skilled in the art can understand that the structure shown in FIG. 6 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may Including more or fewer parts than shown in the figure, or combining some parts, or having a different arrangement of parts.

A computer device, including a memory and one or more processors, in which computer-readable instructions are stored, and when the computer-readable instructions are executed by the processor, the steps of the business system vulnerability processing method provided in any one of the embodiments of the present application are implemented .

One or more non-volatile storage media storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors implement the services provided in any embodiment of the present application Steps of system vulnerability processing method.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through computer-readable instructions, which can be stored in a non-volatile computer. In a readable storage medium, when the computer-readable instructions are executed, they may include the processes of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Channel (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, they should It is considered as the range described in this specification.

The above-mentioned embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the scope of the invention patent. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can be made, and these all fall within the protection scope of this application. Therefore, the scope of protection of the patent of this application shall be subject to the appended claims.

Claims (20)

1. A method for processing loopholes in a business system, the method comprising:

   Acquiring a vulnerability scanning plug-in according to a vulnerability scanning instruction sent by the terminal, the vulnerability scanning plug-in including vulnerability signature codes of multiple vulnerability types;

   Acquiring module list data of the business system, scanning the module list data through the vulnerability scanning plug-in, and performing matching analysis on the module list data and the vulnerability feature code to obtain a scanning result;

   When there are vulnerabilities to be repaired in the scanning result, obtain a vulnerability repair analysis model, and analyze the scanning result through the vulnerability analysis model to obtain a target repair plan for the vulnerability to be repaired;

   Push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

   A vulnerability repair plug-in is obtained according to the vulnerability repair instruction, and the vulnerability to be repaired is repaired by the vulnerability repair plug-in according to the repair package.
2. The method according to claim 1, wherein the module list data includes operating status information of multiple business modules, and the step of scanning the module list data through the vulnerability scanning plug-in comprises:

   Traverse the operating status information of multiple service modules, and match the operating status information with the vulnerability feature code;

   When it is detected that there is running status information matching the vulnerability signature, acquiring the vulnerability signature corresponding to the running status information;

   Locate the vulnerability to be repaired with the vulnerability feature code, and obtain the location identifier corresponding to the vulnerability to be repaired; and

   A corresponding scan result is generated according to the vulnerability feature code and the location identifier.
3. The method according to claim 1, wherein before said obtaining the vulnerability repair analysis model, it further comprises:

   Acquiring multiple sample vulnerability data, where the sample vulnerability data includes the marked vulnerability data;

   Perform feature extraction on the sample vulnerability data, and extract corresponding feature variables;

   Performing cluster analysis on the characteristic variables to obtain multiple clustering results after multiple clustering;

   Extract multiple feature variables and corresponding attribute information that reach a preset threshold according to the clustering results; and

   The neural network model is used to construct a vulnerability repair analysis model according to the multiple feature variables and corresponding attribute information.
4. The method according to claim 1, wherein the step of analyzing the scanning result through the vulnerability analysis model to obtain the target repair plan of the vulnerability to be repaired comprises:

   Analyze the operating state information corresponding to the vulnerability to be repaired through the vulnerability repair analysis model to obtain the vulnerability characteristics of the vulnerability to be repaired;

   Traverse multiple decision nodes in the vulnerability repair analysis model according to the vulnerability characteristics; and

   When traversing to the target decision node, obtain the target repair plan corresponding to the vulnerability to be repaired according to the target decision node.
5. The method according to any one of claims 1 to 4, wherein the step of repairing the vulnerability to be repaired according to the repair package by the vulnerability repair plug-in comprises:

   Parse the repair package through the vulnerability repair plug-in to obtain the repair script code and function interface in the repair package;

   Obtain the code identifier corresponding to the vulnerability to be fixed, and obtain the function call interface according to the code identifier;

   Reset the right corresponding to the vulnerability to be repaired to zero, and modify the function call interface of the vulnerability to be repaired to the function interface of the repair package; and

   Store the repair script code in a local location corresponding to the vulnerability to be repaired, and delete the original script code of the vulnerability to be repaired.
6. The method of claim 1, wherein the method further comprises:

   When the repair of the vulnerability to be repaired fails, obtain the corresponding repair process information;

   Obtain a vulnerability repair detection model, detect and analyze the repair process information through the vulnerability repair detection model, and obtain an analysis result; and

   The analysis result is pushed to the terminal, so that the operation and maintenance personnel can adjust the repair package through the terminal.
7. A device for processing loopholes in a business system, the device comprising:

   The vulnerability scanning module is used to obtain the vulnerability scanning plug-in according to the vulnerability scanning instruction sent by the terminal. The vulnerability scanning plug-in includes vulnerability feature codes of multiple vulnerability types; to obtain the module list data of the business system, and the vulnerability scanning plug-in Scan the module list data, and perform matching analysis on the module list data and the vulnerability signature to obtain the scanning result;

   The vulnerability analysis module is used to obtain a vulnerability repair analysis model when there is a vulnerability to be repaired in the scan result, analyze the scan result through the vulnerability analysis model, and obtain a target repair plan for the vulnerability to be repaired;

   The data push module is used to push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

   The vulnerability repair module is used to obtain a preset vulnerability repair plug-in according to the vulnerability repair instruction, and repair the vulnerability to be repaired according to the repair package through the vulnerability repair plug-in.
8. 7. The device according to claim 7, wherein the module list data includes operation status information of multiple business modules, and the vulnerability scanning module is also used to traverse the operation status information of multiple business modules, and The operation status information is matched with the vulnerability signature; when the operation status information matching the vulnerability signature is detected, the vulnerability signature corresponding to the operation status information is obtained; if the vulnerability exists The vulnerability to be repaired of the signature is located, the location identifier corresponding to the vulnerability to be repaired is obtained; and the corresponding scan result is generated according to the vulnerability signature and the location identifier.
9. The device according to claim 7, wherein the vulnerability analysis module is further configured to analyze the operating state information corresponding to the vulnerability to be repaired through the vulnerability repair analysis model to obtain the vulnerability characteristics of the vulnerability to be repaired; The vulnerability feature traverses multiple decision nodes in the vulnerability repair analysis model; and when traversing to a target decision node, obtains a target repair plan corresponding to the vulnerability to be repaired according to the target decision node.
10. 8. The device according to claim 7, wherein the vulnerability repair module is further configured to parse the repair package through the vulnerability repair plug-in to obtain the repair script code and function interface in the repair package; The code identifier corresponding to the vulnerability to be repaired obtains a function call interface according to the code identifier; the right corresponding to the vulnerability to be repaired is reset to zero, and the function call interface of the vulnerability to be repaired is modified to the function of the repair package Interface; and store the repair script code to a location corresponding to the local vulnerability to be repaired, and delete the original script code of the vulnerability to be repaired.
11. A computer device includes a memory and one or more processors. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the one or more processors, the one or more Each processor performs the following steps:

    Acquiring a vulnerability scanning plug-in according to a vulnerability scanning instruction sent by the terminal, the vulnerability scanning plug-in including vulnerability signature codes of multiple vulnerability types;

    Acquiring module list data of the business system, scanning the module list data through the vulnerability scanning plug-in, and performing matching analysis on the module list data and the vulnerability feature code to obtain a scanning result;

    When there are vulnerabilities to be repaired in the scanning result, obtain a vulnerability repair analysis model, and analyze the scanning result through the vulnerability analysis model to obtain a target repair plan for the vulnerability to be repaired;

    Push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

    A vulnerability repair plug-in is obtained according to the vulnerability repair instruction, and the vulnerability to be repaired is repaired by the vulnerability repair plug-in according to the repair package.
12. The computer device according to claim 11, wherein the processor further executes the following steps when executing the computer-readable instructions: traversing the operating status information of multiple service modules, and combining the operating status information with The vulnerability feature code is matched; when it is detected that there is running status information matching the vulnerability feature code, the vulnerability feature code corresponding to the running status information is obtained; and the vulnerability feature code that has the vulnerability feature code to be repaired The vulnerability is located, the location identifier corresponding to the vulnerability to be repaired is obtained; and the corresponding scanning result is generated according to the vulnerability feature code and the location identifier.
13. The computer device according to claim 11, wherein the processor further executes the following steps when executing the computer-readable instructions: analyzing the operating state information corresponding to the vulnerability to be repaired through the vulnerability repair analysis model to obtain The vulnerability feature of the vulnerability to be repaired; traverse multiple decision nodes in the vulnerability repair analysis model according to the vulnerability feature; and when traversing to the target decision node, obtain the to be repaired according to the target decision node The target repair plan corresponding to the vulnerability.
14. The computer device according to claim 11, wherein the processor further executes the following step when executing the computer-readable instructions: analyzing the repair package through the vulnerability repair plug-in to obtain the repair package The repair script code and function interface in the vulnerabilities; obtain the code identifier corresponding to the vulnerability to be repaired, and obtain the function call interface according to the code identifier; reset the weight corresponding to the vulnerability to be repaired to zero, and reset the function of the vulnerability to be repaired The calling interface is modified to the functional interface of the repair package; and the repair script code is stored in a local location corresponding to the vulnerability to be repaired, and the original script code of the vulnerability to be repaired is deleted.
15. The computer device according to claim 11, wherein the processor further executes the following steps when executing the computer-readable instructions: when the repair of the vulnerability to be repaired fails, obtain the corresponding repair process information; obtain the vulnerability A repair detection model, which detects and analyzes the repair process information through the vulnerability repair detection model, and obtains an analysis result; and pushes the analysis result to the terminal, so that the operation and maintenance personnel can check the repair package through the terminal Make adjustments.
16. One or more non-volatile computer-readable storage media storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors perform the following steps:

    Acquiring a vulnerability scanning plug-in according to a vulnerability scanning instruction sent by the terminal, the vulnerability scanning plug-in including vulnerability signature codes of multiple vulnerability types;

    Acquiring module list data of the business system, scanning the module list data through the vulnerability scanning plug-in, and performing matching analysis on the module list data and the vulnerability feature code to obtain a scanning result;

    When there are vulnerabilities to be repaired in the scanning result, obtain a vulnerability repair analysis model, and analyze the scanning result through the vulnerability analysis model to obtain a target repair plan for the vulnerability to be repaired;

    Push the target repair solution to the corresponding terminal to receive the vulnerability repair instruction and repair package sent by the terminal according to the target repair solution; and

    A vulnerability repair plug-in is obtained according to the vulnerability repair instruction, and the vulnerability to be repaired is repaired by the vulnerability repair plug-in according to the repair package.
17. The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further executed: traversing the operating status information of multiple service modules, and converting the operating status information Match with the vulnerability signature; when it is detected that there is running status information matching the vulnerability signature, obtain the vulnerability signature corresponding to the running status information; for waiting for the existence of the vulnerability signature Repair the vulnerability to locate, obtain the location identifier corresponding to the vulnerability to be repaired; and generate the corresponding scanning result according to the vulnerability feature code and the location identifier.
18. The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further executed: analyzing the operating state information corresponding to the vulnerability to be repaired through the vulnerability repair analysis model, Obtain the vulnerability characteristics of the vulnerability to be repaired; traverse multiple decision nodes in the vulnerability repair analysis model according to the vulnerability characteristics; and when traversing to the target decision node, obtain the pending vulnerability according to the target decision node Fix the target repair plan corresponding to the vulnerability.
19. The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following step is further executed: the repair package is parsed by the vulnerability repair plug-in to obtain the repair The repair script code and function interface in the package; obtain the code identifier corresponding to the vulnerability to be repaired, and obtain the function call interface according to the code identifier; reset the right corresponding to the vulnerability to be repaired to zero, and reset the vulnerability to be repaired The function call interface is modified to the function interface of the repair package; and the repair script code is stored in a local location corresponding to the vulnerability to be repaired, and the original script code of the vulnerability to be repaired is deleted.
20. The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed: when the repair of the vulnerability to be repaired fails, obtaining corresponding repair process information; A vulnerability repair detection model, which detects and analyzes the repair process information through the vulnerability repair detection model to obtain an analysis result; and pushes the analysis result to the terminal, so that the operation and maintenance personnel can repair the repair through the terminal The package is adjusted.

Images