WO2010105516A1

WO2010105516A1 - Method and device for patching of vulnerability

Info

Publication number: WO2010105516A1
Application number: PCT/CN2010/070497
Authority: WO
Inventors: 陈起儒
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2009-03-16
Filing date: 2010-02-03
Publication date: 2010-09-23
Also published as: CN101526984B; CN101526984A

Abstract

The present invention discloses a method and a device for patching of vulnerability, which belong to the computer security field. The method includes: the vulnerability patching device detects whether vulnerability exists in a computer; the existent vulnerability is analyzed in order to obtain the level of the vulnerability, and the corresponding patching of the existent vulnerability is implemented according to the level of the vulnerability. The device includes: detecting module, analyzing module, and patching module. The present invention enables patching of vulnerability automatically when the vulnerability of the computer is detected, and manual operation is avoided through the whole patching process; so as to improve the user experience, help the user to patch the vulnerability of the computer instantly, and most adequately decrease the venture of the computer from being attacked by hacker while the user visits a network.

Description

Method and device for repairing vulnerabilities

TECHNICAL FIELD The present invention relates to the field of computer security, and in particular, to a method and apparatus for repairing a vulnerability. Background of the invention

With the popularity of the network, the application of computers has become more and more widespread, and the security of computer systems has gradually become a concern of people. Due to defects in the logic design of the application software or operating system software, or errors in the writing of the program, the system system has a system vulnerability, which may cause the defect or error to be exploited by the scam or computer hacker by implanting a Trojan, a virus. Other ways to attack or control the entire computer, thereby stealing important information and information from the computer, and even destroying the computer system. Therefore, fixing vulnerabilities has become a must-have for people to protect their computers.

There are many existing bug fix products that provide the ability to fix vulnerabilities. Users need to periodically start the software program to repair the vulnerability, and when detecting the system vulnerability, select the system vulnerability that needs to be repaired, and fix the system vulnerability by downloading and installing the patch corresponding to the system vulnerability.

In the process of implementing the present invention, the inventors have found that the prior art has at least the following disadvantages:

Users need to periodically start software programs to detect system vulnerabilities in computer systems, in order to discover system vulnerabilities, and to select system vulnerabilities that need to be repaired, in order to repair system vulnerabilities in computer systems. Therefore, remediation of vulnerabilities requires manual participation; For beginners, the process of fixing vulnerabilities is cumbersome and complicated. It is difficult for beginners to choose which system vulnerabilities need to be repaired immediately. Which system vulnerabilities can be ignored and not repaired. Sometimes, because users do not fix system vulnerabilities in time, the computer is When users access the network Hacked. Summary of the invention

In order to help the user automatically fix the vulnerabilities of the computer in the first time, the risk of hacking the user when the user accesses the network is minimized, and the user experience is increased, the embodiment of the present invention provides a method and device for repairing the vulnerability. The technical solution is as follows: On the one hand, a method for repairing a vulnerability is provided, and the method includes:

The device that fixes the vulnerability detects whether the computer has a vulnerability;

Analyze the existing vulnerability, obtain the level of the vulnerability, and repair the existing vulnerability according to the level of the vulnerability.

In another aspect, an embodiment of the present invention provides an apparatus for repairing a vulnerability, and the apparatus includes:

a detecting module, configured to detect whether a computer has a vulnerability;

An analysis module, configured to analyze a vulnerability detected by the detection module, and obtain a level of the vulnerability;

The repair module is configured to repair the existing vulnerability according to the level of the vulnerability analyzed by the analysis module.

The beneficial effects of the technical solutions provided by the embodiments of the present invention are:

By detecting if a computer has a vulnerability and automatically detecting a vulnerability in the computer, it automatically repairs it based on the level of the vulnerability; it not only helps users automatically fix computer vulnerabilities in the first place, but also minimizes the computer's access to the network when users access the network. The risk of hacking. BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solution in the embodiment of the present invention, the following describes the embodiment. The drawings used in the description are to be taken in a single manner. It is obvious that the drawings in the following description are only some embodiments of the present invention, and those skilled in the art, without any creative work, Other drawings can also be obtained from these figures.

1 is a flowchart of a method for repairing a vulnerability provided by Embodiment 1 of the present invention;

2 is a flowchart of a method for repairing a vulnerability according to Embodiment 2 of the present invention;

3 is a schematic structural diagram of an apparatus for repairing a vulnerability according to Embodiment 3 of the present invention; FIG. 4 is a schematic structural diagram of another apparatus for repairing a vulnerability provided by Embodiment 3 of the present invention; FIG. Schematic diagram of the structure of the device to fix the vulnerability. Mode for carrying out the invention

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

Example 1

The method for repairing a vulnerability provided by the present invention includes: detecting a vulnerability of the device to detect whether the computer has a vulnerability; analyzing the existing vulnerability, obtaining a level of the vulnerability, and correspondingly repairing the existing vulnerability according to the level of the vulnerability.

Preferably, referring to FIG. 1 , a method for repairing a vulnerability provided by this embodiment is as follows:

101: The device for repairing the vulnerability detects whether the computer has a vulnerability, and if so, executes 102, otherwise, executes 103;

102: Analyze the existing vulnerability, obtain the level of the vulnerability, and repair the existing vulnerability according to the level of the vulnerability;

103: Automatically stop fixing the vulnerability.

The device that fixes the vulnerability detects the vulnerability of the computer, and automatically detects the existing vulnerability when detecting the vulnerability of the computer. It not only helps the user to automatically repair the vulnerability of the computer in the first time, but also minimizes the computer. User access network The risk of being attacked by hackers.

Example 2

This embodiment provides a method for repairing a vulnerability, which can implement a real-time repair of a computer vulnerability in any software that automatically runs with a computer startup. The vulnerability may be a vulnerability in the computer hardware or a computer software. The vulnerability in this embodiment is exemplified by a device having a function of supporting detection and repairing a vulnerability, and a method for repairing a vulnerability provided in this embodiment is described in detail. Referring to Figure 2, the method is as follows:

201: After the device has the function of supporting detection and repairing vulnerabilities, the device automatically runs to support the detection and repair of vulnerabilities;

As a preferred solution, in order to realize the real-time nature of the repair vulnerability, the support detection and repair vulnerability function is turned on by the user, and the device automatically runs the support detection and repair vulnerability function when the computer is started.

In the actual application, after the detection and repair vulnerability function is enabled, the system tray taskbar in the computer will set an icon for displaying the support detection and repair vulnerability has been started.

202: Supporting the detection and repair of the vulnerability function After the predetermined period of time is run, the device automatically accesses the server end in the network;

For this step, after the device supports the detection and repair of the vulnerability function for a period of time, it then accesses the server in the network to ensure that the network is connected.

Specifically, the server side in the network stores the latest vulnerability profile, and according to the vulnerability profile, the device can detect whether the computer has a vulnerability in the computer.

203: Update a vulnerability feature file existing in the computer according to the vulnerability feature file stored on the server side;

Among them, when the software or hardware in the computer is found in the logic design or the error generated during the writing, the vulnerability caused by the defect or the error is also discovered, therefore, The server will update the discovered vulnerability profile at any time. Correspondingly, the vulnerability profile in the computer should be updated at any time to ensure timely detection of vulnerabilities in the computer.

204: After the vulnerability profile update is completed, the trigger immediately detects whether the computer has a vulnerability in the background, and if so, executes 205, otherwise, executes 206;

In order to detect the loopholes in the computer in time, you need to set a period for updating the vulnerability profile. For example: After the detection and repair of the vulnerability function is run, the device automatically accesses the server every 10 minutes to update the vulnerability profile. This implementation The case does not specifically limit the cycle of updating the vulnerability profile.

Preferably, after detecting the new vulnerability profile, it is triggered to detect whether the computer has a vulnerability; if there is no new vulnerability profile, the computer may not be detected whether there is a hole; thereby saving resources occupied by each detection.

205: Automatically stop repairing the vulnerability;

206: Perform a level analysis on the existing vulnerabilities and fix them according to the results of the level analysis.

Specifically, some vulnerabilities can seriously threaten the security of computers. Some vulnerabilities do not pose a threat to the security of computers. According to the characteristics of vulnerabilities and the threat to the security of computers, vulnerabilities are classified into different levels:

High-risk level: It may cause damage to the computer, which means that the computer's administrative rights are owned by the hacker, for example: Causes the popular Trojan to invade the computer system.

Normal level: It will not cause the computer to be damaged, that is, it will not cause the computer's management rights to be owned by the hacker. For example: Generally, it will not cause the popular Trojan to invade the computer system.

For vulnerabilities, the server on the network will issue a patch to fix the vulnerability, or release a new version of the system after the improvement. Therefore, by downloading the latest version of the patch or the new version of the system to the server on the network, The vulnerability is fixed, and the entire repair process does not require manual intervention, which improves the user experience. The specific repair method based on the level of the vulnerability is:

First, for high-risk vulnerabilities, or vulnerabilities that have never been fixed:

In time for the repair, at this point, the user is prompted to "discover the vulnerability, is repairing", start downloading and installing the vulnerability patch.

For example: When a computer's operating system provides a service, there are serious vulnerabilities that allow an attacker to illegally access the system, attack the computer, and control multiple computers to attack other computers. Therefore, the operating system The existing vulnerability needs to be repaired in time. In addition to prohibiting the application of the service with the vulnerability when using the computer, the most effective measure is to download and install the corresponding patch in time.

Second, for common level vulnerabilities, or vulnerabilities that have been fixed successfully, or vulnerabilities that cannot be fixed:

You can leave it unfixed and choose Ignore. At this point, the user is prompted to "ignore the discovered vulnerability." For example: There may be some vulnerabilities in the version of the operating system of the computer, which may cause some defects in the current version of the operating system, but the defect will not pose a threat to the security of the computer, even if the server has released a new version of the system after the improvement defect, Choose to ignore the current vulnerability of the computer operating system, or you can choose to download the new version of the system. At this point, the version of the computer operating system can be upgraded to the new version to prevent system vulnerabilities from being exploited by criminals, but with the computer operating system updated to the new version. The computer operating system will be reinstalled and the previous patches will be cleared.

In summary, for the method for repairing a vulnerability provided by the embodiment, the level of the vulnerability, the scope of the selected repair, and the prompt performance may be differently defined according to the strategy for repairing the vulnerability product.

Further, after the vulnerability is successfully repaired, the repair result can be prompted in the system tray area task bar of the computer, for example, "7 vulnerabilities have been successfully repaired." If the repairing vulnerability fails due to problems such as network connection, you can prompt the user to fix the failure information, and support the user to view the details. Love.

Among them, there are many reasons for the failure to fix the vulnerability. For example: Because the network cannot be connected, the patch to fix the vulnerability cannot be downloaded, or there is no patch to fix the vulnerability, and so on.

In summary, in the embodiment, the software automatically running after being started by the computer is used to periodically detect the vulnerability of the computer by periodically updating the vulnerability feature file after running for a period of time, and timely repairing the existing vulnerability. This helps users automatically fix vulnerabilities in the computer at the first time, minimizing the risk of hacking when the user accesses the network, and the entire repair process does not require manual participation, which improves the user experience.

Example 3

The present invention also provides an apparatus for repairing a vulnerability, including:

A detection module that detects whether a computer has a vulnerability.

An analysis module is configured to analyze the vulnerability detected by the detection module to obtain a level of the vulnerability.

Preferably, referring to FIG. 3, the apparatus for repairing a vulnerability provided by the embodiment may include: a detecting module 301, configured to detect whether a computer has a vulnerability;

The analyzing module 302 is configured to analyze the existing vulnerability when the detecting module 301 detects that the computer has a vulnerability, and obtain a level of the vulnerability;

The repair module 303 is configured to repair the existing vulnerability according to the level of the vulnerability analyzed by the analysis module 302.

The stopping module 304 is configured to automatically stop the repairing of the vulnerability when the detecting module detects that the computer does not have a vulnerability. Referring to Figure 4, the apparatus further includes:

The access update module 305 is configured to automatically access the server end after the device for repairing the vulnerability is started, and update the vulnerability feature file, and the trigger detection module 301 detects whether the computer has a vulnerability according to the updated vulnerability feature file. In order to detect whether there is a vulnerability in the computer in real time, the access update module automatically accesses the server at regular intervals and updates the vulnerability profile. After detecting the new vulnerability profile, the trigger detection module 301 starts to detect whether the computer has a vulnerability; if there is no new vulnerability profile, the detection module 301 may not be triggered to detect whether the computer has a vulnerability; thereby avoiding occupation by each detection. Resources.

Specifically, the foregoing analyzing module 302 is specifically configured to determine, according to the vulnerability feature, whether the vulnerability may cause the computer to be damaged; if possible, the vulnerability is regarded as a high-risk vulnerability; if not, the vulnerability is regarded as a common level vulnerability.

The above repair module 303 is specifically used for timely repairing a high-risk vulnerability or an unrepaired vulnerability; for a common level vulnerability or an unrecoverable vulnerability, the selection is ignored, and no repair is temporarily made.

Further, referring to FIG. 5, the device further includes:

The first prompt module 306 is configured to prompt to repair the vulnerability when the vulnerability is successfully repaired. The second prompt module 307 is configured to prompt the repair of the vulnerability when the vulnerability is failed, and support the user to view the details.

The device for repairing a vulnerability provided in this embodiment triggers detection of whether a vulnerability exists in the computer by updating the vulnerability feature file. When a vulnerability is detected in the computer, the vulnerability is automatically repaired according to the level of the vulnerability, and the entire repair process does not require manual participation, thereby improving the user. Experience; not only helps users automatically fix vulnerabilities in their computers in the first place, but also minimizes the risk of computers being hacked when users access the network.

The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

Part of the steps in the embodiment of the present invention can be implemented by using software, and the corresponding software program It can be stored in a readable storage medium such as a compact disc or a hard disk.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are within the spirit and scope of the present invention, should be included in the protection of the present invention. Within the scope.

Claims

Claim

A method for repairing a vulnerability, the method comprising:

2. The method according to claim 1, wherein before the detecting the vulnerability device detects whether the computer has a vulnerability, the method further includes:

After the device that fixes the vulnerability starts, it automatically accesses the server and updates the vulnerability profile. The detection of the vulnerability of the computer includes:

Detects a vulnerability in the computer based on the updated vulnerability signature file.

The method according to claim 2, wherein after the device for repairing the vulnerability is started, the server is automatically accessed at regular intervals to update the vulnerability profile.

The method according to claim 1, wherein the analyzing the existing vulnerability to obtain the level of the vulnerability includes:

According to the characteristics of the vulnerability, determine whether the vulnerability can cause damage to the computer;

If possible, identify the vulnerability as a high-risk vulnerability;

If no, the vulnerability is identified as a common level vulnerability;

The repairing the existing vulnerability according to the level of the vulnerability, specifically including:

Fixes for high-risk vulnerabilities, or vulnerabilities that have never been fixed, and fix them for common-level vulnerabilities, or unrepairable vulnerabilities.

5. The method of claim 1 wherein:

If it detects that there is no vulnerability in the computer, it will automatically stop fixing the vulnerability.

6. A device for repairing a vulnerability, the device comprising:

a detecting module, configured to detect whether a computer has a vulnerability; An analysis module, configured to analyze a vulnerability detected by the detection module, and obtain a level of the vulnerability;

The device according to claim 6, wherein the device further comprises: an access update module, configured to automatically access the server after the device is started, and update the vulnerability profile to trigger the detection module Detects a vulnerability in the computer based on the updated vulnerability signature file.

8. Apparatus according to claim 6 wherein:

The analyzing module is specifically configured to determine, according to the vulnerability feature, whether the vulnerability may cause the computer to be damaged; if yes, the vulnerability is determined to be a high-risk vulnerability; if not, the vulnerability is determined to be a common level vulnerability. ;

The repair module is specifically used to repair a high-risk vulnerability or an unrepaired vulnerability in time; for a common level vulnerability or an unrecoverable vulnerability, no repair is performed.

The device according to claim 6, wherein the device further comprises: a first prompting module, configured to prompt a result of repairing the vulnerability when the repairing vulnerability is successful; and a second prompting module, configured to repair When the vulnerability fails, the prompt to fix the vulnerability fails.

The device according to claim 6, wherein the device further comprises a stopping module, configured to automatically stop the repairing vulnerability when the detecting module detects that the computer does not have a vulnerability.