WO2016095591A1 - 漏洞扫描方法及装置 - Google Patents

漏洞扫描方法及装置 Download PDF

Info

Publication number
WO2016095591A1
WO2016095591A1 PCT/CN2015/091030 CN2015091030W WO2016095591A1 WO 2016095591 A1 WO2016095591 A1 WO 2016095591A1 CN 2015091030 W CN2015091030 W CN 2015091030W WO 2016095591 A1 WO2016095591 A1 WO 2016095591A1
Authority
WO
WIPO (PCT)
Prior art keywords
vulnerability
network
client
message
proxy module
Prior art date
Application number
PCT/CN2015/091030
Other languages
English (en)
French (fr)
Inventor
李瀛
Original Assignee
北京神州绿盟信息安全科技股份有限公司
北京神州绿盟科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京神州绿盟信息安全科技股份有限公司, 北京神州绿盟科技有限公司 filed Critical 北京神州绿盟信息安全科技股份有限公司
Priority to JP2017532916A priority Critical patent/JP6411661B2/ja
Publication of WO2016095591A1 publication Critical patent/WO2016095591A1/zh
Priority to US15/614,568 priority patent/US10642985B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0254—Stateful filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the embodiments of the present invention relate to the field of network security, and in particular, to a vulnerability scanning method and apparatus.
  • the prior art mainly uses a vulnerability scanner to remotely detect a vulnerability of a server to maintain network security. Specifically, the vulnerability scanner sends a connection request message to the server as a client, and the server responds to the connection request message and sends a response message to the vulnerability. The scanner, based on the response message analysis, determines whether the server has a vulnerability.
  • the entire network environment includes not only a server but also a client connected to the server, the prior art only remotely detects the security problem of the server, and thus cannot detect the security of the entire network environment.
  • Embodiments of the present invention provide a vulnerability scanning method and apparatus to detect security of an entire network environment.
  • An aspect of the embodiments of the present invention provides a vulnerability scanning method, including:
  • the reverse scanning proxy module obtains a client message
  • the reverse scan proxy module sends the client message to the vulnerability scanner, so that the vulnerability scanner identifies the vulnerability of the client according to the client message, or the reverse scan proxy module is based on The client message identifies the vulnerability of the client, and sends the vulnerability of the client to the vulnerability scanner;
  • the reverse scan proxy module receives the control command of the vulnerability scanner, and according to the The control instructions change the working mode and/or working mode, and update the vulnerability rules.
  • a reverse scan proxy module including:
  • a packet obtaining module configured to obtain a client packet
  • a sending module configured to send the client packet to the vulnerability scanner, so that the vulnerability scanner identifies the vulnerability of the client according to the client packet, or the packet identification and sending module, for The client message identifies the vulnerability of the client, and sends the vulnerability of the client to the vulnerability scanner;
  • the receiving control module is configured to receive a control instruction of the vulnerability scanner, and change a working mode and/or a working mode according to the control instruction, and update the vulnerability rule.
  • a vulnerability scanner including:
  • a receiving module configured to receive a client message sent by the reverse scanning proxy module, or to receive a vulnerability of the client sent by the reverse scanning proxy module
  • a message identification module configured to identify the vulnerability of the client according to the client message
  • an instruction sending module configured to send a control instruction to the reverse scan proxy module, so that the reverse scan proxy module changes a working mode and/or a working mode according to the control instruction, and updates a vulnerability rule.
  • Another aspect of an embodiment of the present invention is to provide a vulnerability scanning system including the reverse scanning proxy module and the vulnerability scanner.
  • the vulnerability scanning method and device obtained by the embodiment of the present invention obtains a client packet through a reverse scanning proxy module, and analyzes the client packet to identify a vulnerability existing in the client. On the basis of the security problem of the remote detection server, The analysis of client security issues has been added to achieve security testing of the entire network environment.
  • FIG. 1 is a flowchart of a vulnerability scanning method according to an embodiment of the present invention
  • FIG. 2 is a network topology diagram according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for obtaining network defect information according to an embodiment of the present invention.
  • FIG. 4 is a structural diagram of a reverse scanning proxy module according to an embodiment of the present invention.
  • FIG. 5 is a structural diagram of a reverse scanning proxy module according to another embodiment of the present invention.
  • FIG. 6 is a structural diagram of a reverse scanning proxy module according to another embodiment of the present invention.
  • FIG. 7 is a structural diagram of a vulnerability scanner according to an embodiment of the present invention.
  • FIG. 8 is a structural diagram of a vulnerability scanner according to another embodiment of the present invention.
  • FIG. 9 is a structural diagram of a vulnerability scanning system according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a vulnerability scanning method according to an embodiment of the present invention
  • FIG. 2 is a network topology diagram according to an embodiment of the present invention.
  • the specific steps of the vulnerability scanning method provided by the embodiment of the present invention are as follows:
  • Step S101 The reverse scanning proxy module acquires a client packet.
  • the reverse scan proxy module is installed on the server; the reverse scan proxy module acquiring the client packet includes: the reverse scan proxy module acquires the client sent during the interaction between the client and the server The service request message and the response message; or the reverse scan agent module sends a configuration test message to the client, and obtains a response message of the client to the configuration test message.
  • the reverse scanning proxy module 23 is installed in the server 22.
  • the working mode of the reverse scanning proxy module 23 includes a lossless mode and a reverse scanning mode, and the lossless mode refers to
  • the reverse scan proxy module 23 obtains the service request message and the response message sent by the client 24 in the process; the reverse scan mode means that the reverse scan proxy module 23 constructs the test report.
  • the configuration test packet is sent to the client 24, and the response message of the configuration test packet is obtained by the client 24.
  • Step S102 The reverse scan proxy module sends the client packet to the vulnerability scanner, so that the vulnerability scanner identifies the vulnerability of the client according to the client packet, or the reverse scan
  • the proxy module identifies the vulnerability of the client according to the client message, and sends the vulnerability of the client to the vulnerability scanner;
  • the reverse scan proxy module 23 also includes two working modes on the server 22: a proxy mode and a resident mode.
  • the proxy mode means that the reverse scan proxy module 23 sends the obtained packet sent by the client 24 directly to the vulnerability.
  • the scanner 21 analyzes the packet sent by the client 24 by the vulnerability scanner 21;
  • the resident mode means that the reverse scan proxy module 23 analyzes the obtained packet sent by the client 24 to obtain an intermediate processing result, and then The intermediate processing result is sent to the vulnerability scanner 21.
  • Step S103 The reverse scan proxy module receives a control instruction of the vulnerability scanner, and changes a working mode and/or a working mode according to the control instruction, and updates a vulnerability rule.
  • the vulnerability scanner 21 implements control of the reverse scan proxy module 23 by transmitting a control command to the reverse scan proxy module 23, specifically, the reverse scan proxy module 23 changes the working mode and/or working mode according to the control command, and updates the vulnerability rule. .
  • the client packet is obtained by the reverse scanning proxy module, and the client packet is analyzed to identify a vulnerability existing in the client, and the security problem of the client is added based on the security problem of the remote detection server. Analysis, thus achieving security testing of the entire network environment.
  • the identifying, by the client packet, the vulnerability of the client includes: identifying, according to the feature field of the service request packet, the response packet, and/or the response packet Vulnerability of the client; or identifying the client by matching the service request message, the response message, and/or the response message with a preset interaction message, a preset message sequence, or a vulnerability feature rule End of the loophole.
  • the embodiment of the present invention can obtain the packet sent by the client 24 by using any one of the working modes of the reverse scanning proxy module 23 and the working mode of the reverse scanning proxy module 23, and analyze and process the packet.
  • the execution entity that identifies the vulnerability of the client according to the packet sent by the client may be the server 22 or the vulnerability scanner 21, and the specific identification method includes: 1) according to the service request message, the response message, and The feature field of the response message identifies the vulnerability of the client; 2) the service request message, the response message, and/or the response message and the preset interaction message and the preset report A sequence of text or vulnerability feature rules are matched to identify vulnerabilities in the client.
  • Method 1) If the content of the User-Agent field of the service request message sent by the client 24 is:
  • the field of the browser used by the client 24, the model of the browser, and the operating system type of the client 24 can be analyzed through the field, and the vulnerability feature information in the vulnerability database and the User-Agent field are analyzed. The corresponding information is matched to determine whether the client 24 has a vulnerability.
  • the number of vulnerabilities, as a priority order, data retrieval, such as first through the browser version retrieval, to determine the client may have the following vulnerabilities :
  • the client may have the following vulnerabilities:
  • the embodiment of the present invention does not limit the detection of the User-Agent field, and may also detect other fields of the message sent by the client 24.
  • a typical message format and an interaction sequence of its specific request may be pre-stored, for example, multiple malformed HTML parsing denial of service vulnerabilities for the Opera Web browser, and the reverse scan proxy module may pre-save the vulnerability.
  • a typical message or sequence is specifically a malformed request packet, and the obtained client packet is matched with the malformed request packet; or the reverse scan proxy module sends a configuration test packet to the client by using a reverse scan mode to detect the client. Whether the terminal will return the malformed request message.
  • multiple hits can be used to determine that the client browser has such a vulnerability.
  • Typical message or sequence characteristics of different vulnerabilities can be specifically defined.
  • Embodiments of the present invention provide two ways to identify client vulnerabilities.
  • FIG. 3 is a flowchart of a method for obtaining network defect information according to an embodiment of the present invention. Based on the foregoing embodiment, the method further includes: the reverse scan proxy module or the vulnerability scanner acquiring a vulnerability of the server; and the reverse scan proxy module or the vulnerability scanner according to the vulnerability of the server And the client's vulnerability obtained network defect information.
  • the network defect information includes a network defect density and a network security level; and the obtaining network defect information according to the vulnerability of the server and the vulnerability of the client includes the following steps:
  • Step S301 dividing a vulnerability of the server and a vulnerability of the client according to at least one first dividing rule to obtain a network defect type set, where the network defect type set includes at least one type of network defect;
  • Deriving the vulnerability of the server and the vulnerability of the client according to the at least one first dividing rule to obtain a network defect type set includes: according to the mth first dividing rule in the at least one first dividing rule Divide the vulnerability of the server and the vulnerability of the client into a first set consisting of n types of network defects M ⁇ 1, n ⁇ 1, Denoting the i+1th network defect obtained after dividing the vulnerability according to the mth first partitioning rule, for i, j ⁇ [0, n-1] and i ⁇ j, satisfying Determining, in the first dividing rule, that the vulnerability is divided into a first target dividing rule that is less than or equal to a N-type network defect, and the first set obtained by dividing the vulnerability by the first target dividing rule constitutes the network defect Type collection
  • F(n) is a mapping function of n, indicating that the vulnerability is divided into a first target partitioning rule of n ⁇ N network defects, Indicates that the vulnerability is divided into a set of n ⁇ N-
  • the vulnerability in this step refers to a collection of vulnerabilities of server 22 and client 24.
  • the vulnerability is divided according to the first division rule, and the first division rule has multiple, and it is assumed that the vulnerability is classified into n types according to the mth first division rule in the first division rule.
  • the first set of network defects M ⁇ 1, n ⁇ 1, Denoting the i+1th network defect obtained after dividing the vulnerability according to the mth first partitioning rule, for i, j ⁇ [0, n-1] and i ⁇ j, satisfying Not every first partitioning rule divides the vulnerability to obtain a class n network defect, and n is a variable value.
  • other first partitioning rules are obtained after dividing the vulnerability.
  • the network defect may be greater than n, may be less than n, or may be equal to n; use N as the threshold of the number of network defect types, and select the first target in the first partitioning rule to divide the vulnerability into less than or equal to the N-type network defect.
  • a dividing rule the first set obtained by dividing the vulnerability by the first target dividing rule constitutes the network defect type set
  • F(n) is a mapping function of n, indicating that the vulnerability is divided into a first target partitioning rule of n ⁇ N-type network defects, Indicates that the vulnerability is divided into a set of n ⁇ N-type network defects.
  • Step S302 dividing a network area formed by the server and the client according to at least one second dividing rule to obtain a network sub-area set, where the network sub-area set includes at least one network sub-area;
  • Deriving the network area formed by the server and the client according to the at least one second dividing rule to obtain the network sub-area set includes: according to the t-th second partition in the at least one second dividing rule Rules divide the network area into a second set T ⁇ 1, S ⁇ 1, The s+1th network sub-region obtained after dividing the network region according to the t-th second division rule is satisfied for i, j ⁇ [0, S-1] and i ⁇ j
  • the second set obtained by dividing the network area by the T second dividing rules respectively constitutes the network sub-area set G(t) represents the number of the network sub-areas obtained after dividing the network area according to the t-th second division rule.
  • the network area in this step refers to a network area composed of a server and a client, and the network area is divided according to the second division rule, and the t-th second division rule in the second division rule is the network.
  • the area is divided into the second set T ⁇ 1, S ⁇ 1,
  • the s+1th network sub-region obtained after dividing the network region according to the t-th second division rule is satisfied for i, j ⁇ [0, S-1] and i ⁇ j
  • the second division rule of the tth is the browser type of the client, then Indicates that the client's browser type is the network sub-area of Internet Explorer. Indicates that the client's browser type is Firefox's network sub-area.
  • the second set constitutes the network sub-region set G(t) represents the number of the network sub-areas obtained after dividing the network area according to the t-th second division rule.
  • Step S303 Obtain a network defect density according to the network defect type set and the network sub-area set.
  • the network defect density includes network defect density in the network sub-area and network sub-area setting Defect density
  • the network defect density in the network sub-area indicates the density of a certain type of network defect in a specific network sub-area.
  • the device defect density in the network sub-area indicates the number of clients in a certain network sub-area where a certain type of network defect exists, that is, the network sub-area.
  • the intra-network defect density and the device defect density in the network sub-area are the quantities that measure the network defect density from two angles.
  • the obtaining the network defect density according to the network defect type set and the network sub-region set includes: according to the network defect type set And the network sub-region set Obtaining network defect density in the network sub-area among them, Used in Range screening For calculation quantity;
  • the network defect type set And the network sub-region set Obtaining device defect density in the network sub-area among them, Used in Range screening For calculation quantity.
  • Step S304 Obtain a network security level according to the network defect density.
  • the network security level includes a first network security level and a second network security level
  • the corresponding network security level corresponds to two types: the first network security level and the second network security level.
  • the first network security level corresponds to the network defect density in the network sub-area
  • the second network security The level corresponds to the device defect density in the network sub-area
  • the first network security level and the second network security level are also measures of the network security level from two angles.
  • the obtaining a network security level according to the network defect density includes:
  • Y 1 is Monotonically decreasing function
  • Y 2 is Monotonically decreasing function.
  • the embodiment of the present invention divides the vulnerability of the server and the client according to different first partitioning rules to obtain a network defect type set, and divides the network area formed by the server and the client according to different second dividing rules to obtain a network sub-area set, according to The network defect type set and the network sub-area set obtain network defect density, obtain a network security level according to the network defect density, and implement a quantitative description of the network security level.
  • ⁇ 1 , ⁇ 1 , ⁇ 2 , and ⁇ 2 are constants.
  • the relationship between the network security level and the network defect density is embodied by the monotonically decreasing functions Y 1 and Y 2 , and is preferably used in the embodiment of the present invention. with To reflect the monotonically decreasing functions Y 1 and Y 2 , where ⁇ 1 , ⁇ 1 , ⁇ 2 , ⁇ 2 are constants.
  • the network defect information further includes a network defect density distribution and a network security level distribution, the network defect density distribution including a distribution function of a network defect density in the network sub-area and a distribution function of a device defect density in the network sub-area,
  • the network security level distribution includes a distribution of the first network security level and a distribution of the second network security level; wherein a distribution function of network defect density in the network sub-area Distribution function of device defect density in the network sub-area Distribution of the first network security level Distribution of the second network security level
  • the foregoing embodiment embodies the security of the network by using the first network security level and the second network security level.
  • the embodiment of the present invention reflects the security of the network by the distribution of the first network security level and the distribution of the second network security level.
  • the embodiment of the present invention specifically defines the relationship between the network security level and the network defect density, and at the same time increases the manner of judging the network security through the distribution of the network security level.
  • FIG. 4 is a structural diagram of a reverse scanning proxy module according to an embodiment of the present invention
  • FIG. 5 is a structural diagram of a reverse scanning proxy module according to another embodiment of the present invention
  • the reverse scanning proxy module provided by the embodiment of the present invention can execute the processing flow provided by the vulnerability scanning method embodiment.
  • the reverse scanning proxy module 23 includes a packet acquiring module 231, a sending module 232, or a packet.
  • the identification and sending module 233, and the receiving control module 235 wherein the message obtaining module 231 is configured to obtain a client message; the sending module 232 is configured to send the client message to the vulnerability scanner to make the vulnerability
  • the scanner identifies the vulnerability of the client according to the client packet; the packet identification and sending module 233 is configured to identify the vulnerability of the client according to the client packet, and send the vulnerability of the client to the vulnerability scanning.
  • the receiving control module 235 is configured to receive a control instruction of the vulnerability scanner, and change a working mode and/or a working mode according to the control instruction, and update a vulnerability rule.
  • the reverse scan proxy module 23 is installed on the server; the packet obtaining module 231 is specifically configured to obtain a service request packet and a response packet sent by the client during the interaction between the client and the server; Or the sending module 232 is further configured to send a configuration test packet to the client, where the packet obtaining module 231 is configured to obtain a response packet of the client to the configuration test packet.
  • the packet identification and sending module 233 is specifically configured to identify a vulnerability of the client according to the service request packet, the response packet, and/or the feature field of the response packet, or report the service request.
  • the file, the response message, and/or the response message are matched with the preset interaction message, the preset message sequence, or the vulnerability feature rule to identify the vulnerability of the client.
  • the packet obtaining module 231 is further configured to acquire a vulnerability of the server; as shown in FIG. 6, the reverse scan proxy module 23 further includes a first network defect analysis module 234, configured to use the vulnerability of the server and the The client's vulnerability obtained network defect information.
  • the client packet is obtained by the reverse scanning proxy module, and the client packet is analyzed to identify a vulnerability existing in the client, and the security problem of the client is added based on the security problem of the remote detection server. Analysis, thus achieving security testing of the entire network environment.
  • FIG. 7 is a structural diagram of a vulnerability scanner according to an embodiment of the present invention
  • FIG. 8 is a structural diagram of a vulnerability scanner according to another embodiment of the present invention.
  • the vulnerability scanner provided by the embodiment of the invention may In the process flow of the implementation of the vulnerability scanning method embodiment, as shown in FIG. 7, the vulnerability scanner 21 includes a receiving module 211, a message identifying module 212, and an instruction sending module 214, wherein the receiving module 211 is configured to receive a reverse scanning proxy.
  • the message identification module 212 is configured to identify the vulnerability of the client according to the client message
  • the command sending module 214 is configured to: Sending a control instruction to the reverse scan proxy module to cause the reverse scan proxy module to change a working mode and/or a working mode according to the control command, and to update a vulnerability rule.
  • the packet identification module 212 is configured to identify a vulnerability of the client according to the service request packet, the response packet, and/or the feature field of the response packet, or by using the service request packet, The response message and/or the response message are matched with the preset interaction message, the preset message sequence, or the vulnerability feature rule to identify the vulnerability of the client.
  • the receiving module 211 is further configured to acquire a vulnerability of the server.
  • the vulnerability scanner 21 further includes a second network defect analysis module 213, configured to obtain a network defect according to the vulnerability of the server and the vulnerability of the client. information.
  • the client packet is obtained by the reverse scanning proxy module, and the client packet is analyzed to identify a vulnerability existing in the client, and the security problem of the client is added based on the security problem of the remote detection server. Analysis, thus achieving security testing of the entire network environment.
  • FIG. 9 is a structural diagram of a vulnerability scanning system according to an embodiment of the present invention.
  • the vulnerability scanning system provided by the embodiment of the present invention can perform a processing flow provided by the vulnerability scanning method embodiment.
  • the vulnerability scanning system 90 includes a reverse The proxy module 23 and the vulnerability scanner 21 are scanned.
  • the vulnerability scanning system provided by the embodiment of the present invention can execute the processing flow provided by the vulnerability scanning method embodiment.
  • the embodiment of the present invention obtains a client packet by using a reverse scan proxy module, and analyzes the client packet to identify a vulnerability existing in the client, and adds a pair on the basis of the security problem of the remote detection server. Analysis of client security issues, thus achieving security detection of the entire network environment; in addition, according to different first partitioning rules, the server and client vulnerabilities are divided to obtain a network defect type set, according to different second partitioning rules.
  • the network area formed by the server and the client is divided to obtain a network sub-area set, and the network defect density is obtained according to the network defect type set and the network sub-area set, According to the network defect density, the network security level is obtained, and the quantitative description of the network security level is realized; the relationship between the network security level and the network defect density is specifically defined, and the network security is determined by the distribution of the network security level. The way.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium.
  • the above software functional unit is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform the methods of the various embodiments of the present invention. Part of the steps.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Business, Economics & Management (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供一种漏洞扫描方法及装置。该方法包括：反向扫描代理模块获取客户端报文；所述反向扫描代理模块将所述客户端报文发送给漏洞扫描器，以使所述漏洞扫描器依据所述客户端报文识别所述客户端的漏洞；或者所述反向扫描代理模块依据所述客户端报文识别所述客户端的漏洞，并将所述客户端的漏洞发送给漏洞扫描器；反向扫描代理模块接收所述漏洞扫描器的控制指令，并依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。本发明实施例通过反向扫描代理模块获取客户端报文，并对客户端报文进行分析以识别客户端存在的漏洞，在远程检测服务器的安全问题基础上，增加了对客户端安全问题的分析，从而实现了对整个网络环境的安全性检测。

Description

漏洞扫描方法及装置 技术领域
本发明实施例涉及网络安全领域，尤其涉及一种漏洞扫描方法及装置。
背景技术
随着计算机网络技术的发展，网络安全技术也在不断发展，若服务器存在重大的漏洞，黑客将通过该漏洞窃取服务器或客户端的重要性信息，造成严重后果，因此，网络安全的重要性日益凸显。
现有技术主要通过漏洞扫描器远程检测服务器的漏洞来维护网络安全，具体为漏洞扫描器作为客户端向服务器发送连接请求消息，服务器对该连接请求消息做出应答，并将应答消息发送给漏洞扫描器，漏洞扫描器依据该应答消息分析判断服务器是否存在漏洞。
由于整个网络环境不仅包括服务器，还包括与服务器相连接的客户端，而现有技术只远程检测服务器的安全问题，因此不能检测整个网络环境的安全性。
发明内容
本发明实施例提供一种漏洞扫描方法及装置，以检测整个网络环境的安全性。
本发明实施例的一个方面是提供一种漏洞扫描方法，包括：
反向扫描代理模块获取客户端报文；
所述反向扫描代理模块将所述客户端报文发送给漏洞扫描器，以使所述漏洞扫描器依据所述客户端报文识别所述客户端的漏洞，或者所述反向扫描代理模块依据所述客户端报文识别所述客户端的漏洞，并将所述客户端的漏洞发送给漏洞扫描器；
所述反向扫描代理模块接收所述漏洞扫描器的控制指令，并依据所 述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
本发明实施例的另一个方面是提供一种反向扫描代理模块，包括：
报文获取模块，用于获取客户端报文；
发送模块，用于将所述客户端报文发送给漏洞扫描器，以使所述漏洞扫描器依据所述客户端报文识别所述客户端的漏洞，或者报文识别与发送模块，用于依据所述客户端报文识别所述客户端的漏洞，并将所述客户端的漏洞发送给漏洞扫描器；
接收控制模块，用于接收所述漏洞扫描器的控制指令，并依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
本发明实施例的另一个方面是提供一种漏洞扫描器，包括：
接收模块，用于接收反向扫描代理模块发送的客户端报文；或者用于接收反向扫描代理模块发送的客户端的漏洞；
报文识别模块，用于依据所述客户端报文识别所述客户端的漏洞；
指令发送模块，用于向所述反向扫描代理模块发送控制指令，以使所述反向扫描代理模块依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
本发明实施例的另一个方面是提供一种漏洞扫描系统，包括所述的反向扫描代理模块和所述的漏洞扫描器。
本发明实施例提供的漏洞扫描方法及装置，通过反向扫描代理模块获取客户端报文，并对客户端报文进行分析以识别客户端存在的漏洞，在远程检测服务器的安全问题基础上，增加了对客户端安全问题的分析，从而实现了对整个网络环境的安全性检测。
附图说明
图1为本发明实施例提供的漏洞扫描方法流程图；
图2为本发明实施例提供的网络拓扑图；
图3是本发明实施例提供的获得网络缺陷信息方法流程图；
图4为本发明实施例提供的反向扫描代理模块的结构图；
图5为本发明另一实施例提供的反向扫描代理模块的结构图；
图6为本发明另一实施例提供的反向扫描代理模块的结构图；
图7为本发明实施例提供的漏洞扫描器的结构图；
图8为本发明另一实施例提供的漏洞扫描器的结构图；
图9为本发明实施例提供的漏洞扫描系统的结构图。
具体实施方式
图1为本发明实施例提供的漏洞扫描方法流程图；图2为本发明实施例提供的网络拓扑图。本发明实施例提供的漏洞扫描方法具体步骤如下：
步骤S101、反向扫描代理模块获取客户端报文；
所述反向扫描代理模块安装在服务器上；所述反向扫描代理模块获取客户端报文包括：所述反向扫描代理模块获取所述客户端与所述服务器交互过程中所述客户端发出的业务请求报文和应答报文；或者所述反向扫描代理模块向所述客户端发送构造测试报文，获取所述客户端对所述构造测试报文的响应报文。
如图2所示，在获取到服务器管理方的同意后，在服务器22中安装反向扫描代理模块23，反向扫描代理模块23的工作方式包括无损方式和反向扫描方式，无损方式是指在服务器22客户端24交互的过程中，反向扫描代理模块23获取该过程中客户端24发出的业务请求报文和应答报文；反向扫描方式是指反向扫描代理模块23构造测试报文，向客户端24发送该构造测试报文，并获取客户端24对该构造测试报文的响应报文。
步骤S102、所述反向扫描代理模块将所述客户端报文发送给漏洞扫描器，以使所述漏洞扫描器依据所述客户端报文识别所述客户端的漏洞，或者所述反向扫描代理模块依据所述客户端报文识别所述客户端的漏洞，并将所述客户端的漏洞发送给漏洞扫描器；
反向扫描代理模块23在服务器22上的还包括两种工作模式：代理模式和驻留模式，代理模式是指反向扫描代理模块23将获取到的客户端24发出的报文直接发送到漏洞扫描器21，由漏洞扫描器21对客户端24发出的报文进行分析；驻留模式是指反向扫描代理模块23对获取到的客户端24发出的报文进行分析获得中间处理结果，再将该中间处理结果发送给漏洞扫描器21。
步骤S103、所述反向扫描代理模块接收所述漏洞扫描器的控制指令，并依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
漏洞扫描器21通过向反向扫描代理模块23发送控制指令实现对反向扫描代理模块23的控制，具体为反向扫描代理模块23依据控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
本发明实施例通过反向扫描代理模块获取客户端报文，并对客户端报文进行分析以识别客户端存在的漏洞，在远程检测服务器的安全问题基础上，增加了对客户端安全问题的分析，从而实现了对整个网络环境的安全性检测。
在上述实施例的基础上，所述依据所述客户端报文识别所述客户端的漏洞包括：依据所述业务请求报文、所述应答报文和/或所述响应报文的特征字段识别所述客户端的漏洞；或者通过所述业务请求报文、所述应答报文和/或所述响应报文与预设交互报文、预设报文序列或漏洞特征规则进行匹配识别所述客户端的漏洞。
本发明实施例可以通过上述反向扫描代理模块23的任一种工作方式和任一种工作模式相配合的方式获取客户端24发出的报文，并对该报文进行分析处理。依据所述客户端发出的报文识别所述客户端的漏洞的执行主体可以是服务器22或漏洞扫描器21，具体的识别方法包括：1)依据所述业务请求报文、所述应答报文和/或所述响应报文的特征字段识别所述客户端的漏洞；2)通过所述业务请求报文、所述应答报文和/或所述响应报文与预设交互报文、预设报文序列或漏洞特征规则进行匹配识别所述客户端的漏洞。
方法1)，若客户端24发出的业务请求报文的User-Agent字段内容为：
Mozilla/5.0(X11；Ubuntu；Linux x86_64；rv:24.0)Gecko/20100101Firefox/24.0；或
Mozilla/5.0(Windows NT 6.0；WOW64；rv:24.0)Gecko/20100101Firefox/24.0；或
Opera/9.80(Windows NT 6.1；U；es-ES)Presto/2.9.181 Version/12.00；
则通过该字段可以分析出客户端24所用浏览器的版本、浏览器的型号、客户端24的操作系统类型等信息，通过业界公知漏洞库中的漏洞特征信息与该User-Agent字段中分析出的相应信息进行匹配，判断该客户端24是否存在漏洞。
在现有的漏洞库中，基于获取不同信息所关联漏洞的紧密程度，漏洞数量的多少，作为优先级顺序，做数据检索，比如先通过浏览器的版本检索，判断客户端可能存在如下的漏洞：
Mozilla Firefox/Thunderbird/SeaMonkey浏览器引擎内存安全漏洞(CVE-2013-5609)；
Mozilla Firefox/Thunderbird/SeaMonkey浏览器引擎内存安全漏洞(CVE-2013-5610)；
再通过OS版本检索，客户端可能存在如下漏洞：
windows内核信息泄露漏洞(MS13-048)、Microsoft windows LPC和LPC端口拒绝服务漏洞。
另外，本发明实施例不限制检测User-Agent字段，还可以检测客户端24发出的报文的其他字段。
方法2)对于已知的漏洞类型，可预先存储其特定请求的典型消息格式及交互序列，例如针对Opera Web浏览器多个畸形HTML解析拒绝服务漏洞，反向扫描代理模块可以预先保存该漏洞的典型消息或序列，具体为畸形请求报文，将获取的客户端报文与该畸形请求报文进行匹配；或者反向扫描代理模块通过反向扫描方式向客户端发送构造测试报文，检测客户端是否会返回该畸形请求报文。为保障准确率，多次匹配命中后即可判定客户端浏览器具有此类漏洞。不同漏洞的典型消息或序列特征可具体定义。
本发明实施例提供了两种用于识别客户端漏洞的方式。
图3是本发明实施例提供的获得网络缺陷信息方法流程图。在上述实施例的基础上，还包括：所述反向扫描代理模块或所述漏洞扫描器获取所述服务器的漏洞；所述反向扫描代理模块或所述漏洞扫描器依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息。
所述网络缺陷信息包括网络缺陷密度和网络安全等级；所述依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息包括如下步骤：
步骤S301、依据至少一种第一划分规则对所述服务器的漏洞和所述客户端的漏洞进行划分获得网络缺陷类型集合，所述网络缺陷类型集合至少包括一类网络缺陷；
所述依据至少一种第一划分规则对所述服务器的漏洞和所述客户端的漏洞进行划分获得网络缺陷类型集合包括：依据所述至少一种第一划分规则中的第m种第一划分规则将所述服务器的漏洞和所述客户端的漏洞划分为由n类网络缺陷组成的第一集合
Figure PCTCN2015091030-appb-000001
m≥1，n≥1，
Figure PCTCN2015091030-appb-000002
表示依据所述第m种第一划分规则划分所述漏洞后获得的第i+1类网络缺陷，对于i、j∈[0,n-1]且i≠j，满足
Figure PCTCN2015091030-appb-000003
Figure PCTCN2015091030-appb-000004
确定所述第一划分规则中将所述漏洞划分为小于或者等于N类网络缺陷的第一目标划分规则，由所述第一目标划分规则划分所述漏洞获得的第一集合构成所述网络缺陷类型集合
Figure PCTCN2015091030-appb-000005
其中，F(n)是n的映射函数，表示将所述漏洞划分为n≤N类网络缺陷的第一目标划分规则，
Figure PCTCN2015091030-appb-000006
表示将所述漏洞划分为n≤N类网络缺陷的集合。
该步骤中的所述漏洞指的是服务器22和客户端24的漏洞的集合。对所述漏洞进行划分，依据的划分规则为第一划分规则，且第一划分规则有多个，假设依据该第一划分规则中第m种第一划分规则将所述漏洞划分为由n类网络缺陷组成的第一集合
Figure PCTCN2015091030-appb-000007
m≥1，n≥1，
Figure PCTCN2015091030-appb-000008
表示依据所述第m种第一划分规则划分所述漏洞后获得的第i+1类网络缺陷，对于i、j∈[0,n-1]且i≠j，满足
Figure PCTCN2015091030-appb-000009
Figure PCTCN2015091030-appb-000010
并不是每一种第一划分规则划分所述漏洞后都获得n类网络缺陷，n是一个变值，除第m种第一划分规则之外，其他的第一划分规则划分所述漏洞后获得的网络缺陷可能大于n，可能小于n，也可能等于n；将N作为网络缺陷类型数的阈值，选出第一划分规则中将所述漏洞划分为小于或者等于N类网络缺陷的第一目标划分规则，由所述第一目标划分规则划分所述漏洞获得的第一集合构成所述网络缺陷类型集合
Figure PCTCN2015091030-appb-000011
其中，F(n)是n的映射函数，表示将所述漏洞划分 为n≤N类网络缺陷的第一目标划分规则，
Figure PCTCN2015091030-appb-000012
表示将所述漏洞划分为n≤N类网络缺陷的集合。
步骤S302、依据至少一种第二划分规则对所述服务器和所述客户端构成的网络区域进行划分获得网络子区域集合，所述网络子区域集合至少包括一个网络子区域；
所述依据至少一种第二划分规则对所述服务器和所述客户端构成的网络区域进行划分获得网络子区域集合包括：依据所述至少一种第二划分规则中的第t种第二划分规则将所述网络区域划分为第二集合
Figure PCTCN2015091030-appb-000013
t≥1，S≥1,
Figure PCTCN2015091030-appb-000014
表示依据所述第t种第二划分规则划分所述网络区域后获得的第s+1个网络子区域，对于i、j∈[0,S-1]且i≠j，满足
Figure PCTCN2015091030-appb-000015
由T个所述第二划分规则分别对所述网络区域划分后获得的第二集合构成所述网络子区域集合
Figure PCTCN2015091030-appb-000016
G(t)表示依据所述第t种第二划分规则划分所述网络区域后获得的所述网络子区域的个数。
该步骤中的网络区域是指由服务器和客户端组成的网络区域，对网络区域进行划分，划分的依据是第二划分规则，第二划分规则中的第t种第二划分规则将所述网络区域划分为第二集合
Figure PCTCN2015091030-appb-000017
t≥1，S≥1,
Figure PCTCN2015091030-appb-000018
表示依据所述第t种第二划分规则划分所述网络区域后获得的第s+1个网络子区域，对于i、j∈[0,S-1]且i≠j，满足
Figure PCTCN2015091030-appb-000019
Figure PCTCN2015091030-appb-000020
假设第t种第二划分规则是客户端的浏览器类型，则
Figure PCTCN2015091030-appb-000021
表示客户端的浏览器类型为IE浏览器的网络子区域，
Figure PCTCN2015091030-appb-000022
表示客户端的浏览器类型为Fire Fox的网络子区域，
Figure PCTCN2015091030-appb-000023
表示客户端的浏览器类型为Opera的网络子区域…直到
Figure PCTCN2015091030-appb-000024
表示客户端的浏览器类型为搜狗浏览器的网络子区域；不同的第二划分规则划分网络区域后获得的第二集合并不相同，本发明实施例将各个第二划分规则划分网络区域后获得的第二集合构成所述网络子区域集合
Figure PCTCN2015091030-appb-000025
G(t)表示依据所述第t种第二划分规则划分所述网络区域后获得的所述网络子区域的个数。
步骤S303、依据所述网络缺陷类型集合和所述网络子区域集合获得网络缺陷密度；
所述网络缺陷密度包括网络子区域内网络缺陷密度和网络子区域内设 备缺陷密度；
网络子区域内网络缺陷密度表示特定网络子区域内某一类网络缺陷的密度，网络子区域内设备缺陷密度表示特定网络子区域内存在某一类网络缺陷的客户端的个数，即网络子区域内网络缺陷密度和网络子区域内设备缺陷密度是从两个角度衡量网络缺陷密度的量。
所述依据所述网络缺陷类型集合和所述网络子区域集合获得网络缺陷密度包括：依据所述网络缺陷类型集合
Figure PCTCN2015091030-appb-000026
和所述网络子区域集合
Figure PCTCN2015091030-appb-000027
获得所述网络子区域内网络缺陷密度
Figure PCTCN2015091030-appb-000028
其中，
Figure PCTCN2015091030-appb-000029
Figure PCTCN2015091030-appb-000030
用于在
Figure PCTCN2015091030-appb-000031
范围内筛选
Figure PCTCN2015091030-appb-000032
用于计算
Figure PCTCN2015091030-appb-000033
的数量；
依据所述网络缺陷类型集合
Figure PCTCN2015091030-appb-000034
和所述网络子区域集合
Figure PCTCN2015091030-appb-000035
获得所述网络子区域内设备缺陷密度
Figure PCTCN2015091030-appb-000036
其中，
Figure PCTCN2015091030-appb-000037
Figure PCTCN2015091030-appb-000038
用于在
Figure PCTCN2015091030-appb-000039
范围内筛选
Figure PCTCN2015091030-appb-000040
用于计算
Figure PCTCN2015091030-appb-000041
的数量。
步骤S304、依据所述网络缺陷密度获得网络安全等级。
所述网络安全等级包括第一网络安全等级和第二网络安全等级；
若网络缺陷密度越大，则该网络子区域的网络安全等级越低，若网络缺陷密度越小，则该网络子区域的网络安全等级越高；由于步骤S303中包括了用来衡量网络缺陷密度的两种方式，相应的网络安全等级对应的也有两种：第一网络安全等级和第二网络安全等级，具体的，第一网络安全等级与网络子区域内网络缺陷密度对应，第二网络安全等级与网络子区域内设备缺陷密度对应，第一网络安全等级和第二网络安全等级也是从两个角度衡量网络安全等级的量。
所述依据所述网络缺陷密度获得网络安全等级包括：
依据所述网络子区域内网络缺陷密度
Figure PCTCN2015091030-appb-000042
获得所述第一网络安全等级
Figure PCTCN2015091030-appb-000043
其中，
Figure PCTCN2015091030-appb-000044
Y1是
Figure PCTCN2015091030-appb-000045
的单调递减函数；
依据所述网络子区域内设备缺陷密度
Figure PCTCN2015091030-appb-000046
获得所述第二网络安全等级
Figure PCTCN2015091030-appb-000047
其中，
Figure PCTCN2015091030-appb-000048
Y2是
Figure PCTCN2015091030-appb-000049
的单调递减函数。
本发明实施例依据不同的第一划分规则对服务器和客户端的漏洞进行划分获得网络缺陷类型集合，依据不同的第二划分规则对服务器和客户端构成的网络区域进行划分获得网络子区域集合，依据所述网络缺陷类型集合和所述网络子区域集合获得网络缺陷密度，依据所述网络缺陷密度获得网络安全等级，实现了对网络安全等级的定量描述。
在上述实施例的基础上，所述
Figure PCTCN2015091030-appb-000050
为
Figure PCTCN2015091030-appb-000051
所述
Figure PCTCN2015091030-appb-000052
为
Figure PCTCN2015091030-appb-000053
其中，α1、β1、α2、β2是常数。
由于网络缺陷密度越大，网络子区域的网络安全等级越低，网络缺陷密度越小，网络子区域的网络安全等级越高，即网络安全等级与网络缺陷密度成反比，在上述实施例中，通过单调递减函数Y1和Y2体现网络安全等级与网络缺陷密度之间的关系，本发明实施例优选用
Figure PCTCN2015091030-appb-000054
和
Figure PCTCN2015091030-appb-000055
来体现单调递减函数Y1和Y2，其中，α1、β1、α2、β2是常数。
所述网络缺陷信息还包括网络缺陷密度分布和网络安全等级分布,所述网络缺陷密度分布包括所述网络子区域内网络缺陷密度的分布函数和所述网络子区域内设备缺陷密度的分布函数，所述网络安全等级分布包括所述第一网络安全等级的分布和所述第二网络安全等级的分布；其中，所述网络子区域内网络缺陷密度的分布函数
Figure PCTCN2015091030-appb-000056
所述网络子区域内设备缺陷密度的分布函数
Figure PCTCN2015091030-appb-000057
所述第一网络安全等级的分布
Figure PCTCN2015091030-appb-000058
所述第二网络安全等级的分布
Figure PCTCN2015091030-appb-000059
上述实施例通过第一网络安全等级和第二网络安全等级体现网络的安全性，本发明实施例通过第一网络安全等级的分布和第二网络安全等级的分布来体现网络的安全性。
本发明实施例具体限定了网络安全等级与网络缺陷密度之间的关系，同时增加了通过网络安全等级的分布来判断网络安全性的方式。
图4为本发明实施例提供的反向扫描代理模块的结构图；图5为本发明另一实施例提供的反向扫描代理模块的结构图；图6为本发明另一实施例提供的反向扫描代理模块的结构图。本发明实施例提供的反向扫描代理模块可以执行漏洞扫描方法实施例提供的处理流程，如图4、5所示，反向扫描代理模块23包括报文获取模块231、发送模块232或者报文识别与发送模块233，以及接收控制模块235，其中，报文获取模块231用于获取客户端报文；发送模块232用于将所述客户端报文发送给漏洞扫描器，以使所述漏洞扫描器依据所述客户端报文识别所述客户端的漏洞；报文识别与发送模块233用于依据所述客户端报文识别所述客户端的漏洞，并将所述客户端的漏洞发送给漏洞扫描器；接收控制模块235用于接收所述漏洞扫描器的控制指令，并依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
所述反向扫描代理模块23安装在服务器上；所述报文获取模块231具体用于获取所述客户端与所述服务器交互过程中所述客户端发出的业务请求报文和应答报文；或者所述发送模块232还用于向所述客户端发送构造测试报文；所述报文获取模块231具体用于获取所述客户端对所述构造测试报文的响应报文。
所述报文识别与发送模块233具体用于依据所述业务请求报文、所述应答报文和/或所述响应报文的特征字段识别所述客户端的漏洞；或者通过所述业务请求报文、所述应答报文和/或所述响应报文与预设交互报文、预设报文序列或漏洞特征规则进行匹配识别所述客户端的漏洞。
所述报文获取模块231还用于获取所述服务器的漏洞；如图6所示，反向扫描代理模块23还包括第一网络缺陷分析模块234，用于依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息。
本发明实施例通过反向扫描代理模块获取客户端报文，并对客户端报文进行分析以识别客户端存在的漏洞，在远程检测服务器的安全问题基础上，增加了对客户端安全问题的分析，从而实现了对整个网络环境的安全性检测。
图7为本发明实施例提供的漏洞扫描器的结构图；图8为本发明另一实施例提供的漏洞扫描器的结构图。本发明实施例提供的漏洞扫描器可 以执行漏洞扫描方法实施例提供的处理流程，如图7所示，漏洞扫描器21包括接收模块211、报文识别模块212和指令发送模块214，其中，接收模块211用于接收反向扫描代理模块发送的客户端报文；或者用于接收反向扫描代理模块发送的客户端的漏洞；报文识别模块212用于依据所述客户端报文识别所述客户端的漏洞；指令发送模块214用于向所述反向扫描代理模块发送控制指令，以使所述反向扫描代理模块依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
所述报文识别模块212具体用于依据所述业务请求报文、所述应答报文和/或所述响应报文的特征字段识别所述客户端的漏洞；或者通过所述业务请求报文、所述应答报文和/或所述响应报文与预设交互报文、预设报文序列或漏洞特征规则进行匹配识别所述客户端的漏洞。
所述接收模块211还用于获取服务器的漏洞；如图8所示，漏洞扫描器21还包括第二网络缺陷分析模块213，用于依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息。
本发明实施例通过反向扫描代理模块获取客户端报文，并对客户端报文进行分析以识别客户端存在的漏洞，在远程检测服务器的安全问题基础上，增加了对客户端安全问题的分析，从而实现了对整个网络环境的安全性检测。
图9为本发明实施例提供的漏洞扫描系统的结构图；本发明实施例提供的漏洞扫描系统可以执行漏洞扫描方法实施例提供的处理流程，如图9所示，漏洞扫描系统90包括反向扫描代理模块23和漏洞扫描器21。
本发明实施例提供的漏洞扫描系统可以执行漏洞扫描方法实施例提供的处理流程。
综上所述，本发明实施例通过反向扫描代理模块获取客户端报文，并对客户端报文进行分析以识别客户端存在的漏洞，在远程检测服务器的安全问题基础上，增加了对客户端安全问题的分析，从而实现了对整个网络环境的安全性检测；另外，依据不同的第一划分规则对服务器和客户端的漏洞进行划分获得网络缺陷类型集合，依据不同的第二划分规则对服务器和客户端构成的网络区域进行划分获得网络子区域集合，依据所述网络缺陷类型集合和所述网络子区域集合获得网络缺陷密度，依 据所述网络缺陷密度获得网络安全等级，实现了对网络安全等级的定量描述；具体限定了网络安全等级与网络缺陷密度之间的关系，同时增加了通过网络安全等级的分布来判断网络安全性的方式。
在本发明所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
上述以软件功能单元的形式实现的集成的单元，可以存储在一个计算机可读取存储介质中。上述软件功能单元存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本发明各个实施例所述方法的部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的装置的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (19)

  1. 一种漏洞扫描方法，其特征在于，包括：
    反向扫描代理模块获取客户端报文；
    所述反向扫描代理模块将所述客户端报文发送给漏洞扫描器，以使所述漏洞扫描器依据所述客户端报文识别所述客户端的漏洞，或者所述反向扫描代理模块依据所述客户端报文识别所述客户端的漏洞，并将所述客户端的漏洞发送给漏洞扫描器；
    所述反向扫描代理模块接收所述漏洞扫描器的控制指令，并依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
  2. 根据权利要求1所述的方法，其特征在于，所述反向扫描代理模块安装在服务器上；
    所述反向扫描代理模块获取客户端报文包括：
    所述反向扫描代理模块获取所述客户端与所述服务器交互过程中所述客户端发出的业务请求报文和应答报文；或者
    所述反向扫描代理模块向所述客户端发送构造测试报文，获取所述客户端对所述构造测试报文的响应报文。
  3. 根据权利要求2所述的方法，其特征在于，所述依据所述客户端报文识别所述客户端的漏洞包括：
    依据所述业务请求报文、所述应答报文和/或所述响应报文的特征字段识别所述客户端的漏洞；或者
    通过所述业务请求报文、所述应答报文和/或所述响应报文与预设交互报文、预设报文序列或漏洞特征规则进行匹配识别所述客户端的漏洞。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，还包括：
    所述反向扫描代理模块或所述漏洞扫描器获取所述服务器的漏洞；
    所述反向扫描代理模块或所述漏洞扫描器依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息。
  5. 根据权利要求4所述的方法，其特征在于，所述网络缺陷信息包括网络缺陷密度和网络安全等级；
    所述依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息 包括：
    依据至少一种第一划分规则对所述服务器的漏洞和所述客户端的漏洞进行划分获得网络缺陷类型集合，所述网络缺陷类型集合至少包括一类网络缺陷；
    依据至少一种第二划分规则对所述服务器和所述客户端构成的网络区域进行划分获得网络子区域集合，所述网络子区域集合至少包括一个网络子区域；
    依据所述网络缺陷类型集合和所述网络子区域集合获得网络缺陷密度；
    依据所述网络缺陷密度获得网络安全等级。
  6. 根据权利要求5所述的方法，其特征在于，所述依据至少一种第一划分规则对所述服务器的漏洞和所述客户端的漏洞进行划分获得网络缺陷类型集合包括：
    依据所述至少一种第一划分规则中的第m种第一划分规则将所述服务器的漏洞和所述客户端的漏洞划分为由n类网络缺陷组成的第一集合
    Figure PCTCN2015091030-appb-100001
    m≥1，n≥1，
    Figure PCTCN2015091030-appb-100002
    表示依据所述第m种第一划分规则划分所述漏洞后获得的第i+1类网络缺陷，对于i、j∈[0,n-1]且i≠j，满足
    Figure PCTCN2015091030-appb-100003
    Figure PCTCN2015091030-appb-100004
    确定所述第一划分规则中将所述漏洞划分为小于或者等于N类网络缺陷的第一目标划分规则，由所述第一目标划分规则划分所述漏洞获得的第一集合构成所述网络缺陷类型集合
    Figure PCTCN2015091030-appb-100005
    其中，F(n)是n的映射函数，表示将所述漏洞划分为n≤N类网络缺陷的第一目标划分规则，
    Figure PCTCN2015091030-appb-100006
    表示将所述漏洞划分为n≤N类网络缺陷的集合。
  7. 根据权利要求5所述的方法，其特征在于，所述依据至少一种第二划分规则对所述服务器和所述客户端构成的网络区域进行划分获得网络子区域集合包括：
    依据所述至少一种第二划分规则中的第t种第二划分规则将所述网络区域划分为第二集合
    Figure PCTCN2015091030-appb-100007
    t≥1，S≥1,
    Figure PCTCN2015091030-appb-100008
    表示依据所述第t种第二划分规则划分所述网络区域后获得的第s+1个网络子区域，对于i、j∈[0,S-1]且i≠j，满足
    Figure PCTCN2015091030-appb-100009
    Figure PCTCN2015091030-appb-100010
    由T个所述第二划分规则分别对所述网络区域划分后获得的第二集合构成所述网络子区域集合
    Figure PCTCN2015091030-appb-100011
    G(t)表示依据所述第t种第二划分规则划分所述网络区域后获得的所述网络子区域的个数。
  8. 根据权利要求6或7所述的方法，其特征在于，所述网络缺陷密度包括网络子区域内网络缺陷密度和网络子区域内设备缺陷密度；
    所述依据所述网络缺陷类型集合和所述网络子区域集合获得网络缺陷密度包括：
    依据所述网络缺陷类型集合
    Figure PCTCN2015091030-appb-100012
    和所述网络子区域集合
    Figure PCTCN2015091030-appb-100013
    获得所述网络子区域内网络缺陷密度
    Figure PCTCN2015091030-appb-100014
    其中，
    Figure PCTCN2015091030-appb-100015
    Figure PCTCN2015091030-appb-100016
    用于在
    Figure PCTCN2015091030-appb-100017
    范围内筛选
    Figure PCTCN2015091030-appb-100018
    Figure PCTCN2015091030-appb-100019
    用于计算
    Figure PCTCN2015091030-appb-100020
    的数量；
    依据所述网络缺陷类型集合
    Figure PCTCN2015091030-appb-100021
    和所述网络子区域集合
    Figure PCTCN2015091030-appb-100022
    获得所述网络子区域内设备缺陷密度
    Figure PCTCN2015091030-appb-100023
    其中，
    Figure PCTCN2015091030-appb-100024
    Figure PCTCN2015091030-appb-100025
    用于在
    Figure PCTCN2015091030-appb-100026
    范围内筛选
    Figure PCTCN2015091030-appb-100027
    Figure PCTCN2015091030-appb-100028
    用于计算
    Figure PCTCN2015091030-appb-100029
    的数量。
  9. 根据权利要求8所述的方法，其特征在于，所述网络安全等级包括第一网络安全等级和第二网络安全等级；
    所述依据所述网络缺陷密度获得网络安全等级包括：
    依据所述网络子区域内网络缺陷密度
    Figure PCTCN2015091030-appb-100030
    获得所述第一网络安全等级
    Figure PCTCN2015091030-appb-100031
    其中，
    Figure PCTCN2015091030-appb-100032
    Y1是
    Figure PCTCN2015091030-appb-100033
    的单调递减函数；
    依据所述网络子区域内设备缺陷密度
    Figure PCTCN2015091030-appb-100034
    获得所述第二网 络安全等级
    Figure PCTCN2015091030-appb-100035
    其中，
    Figure PCTCN2015091030-appb-100036
    Y2是
    Figure PCTCN2015091030-appb-100037
    的单调递减函数。
  10. 根据权利要求9所述的方法，其特征在于，所述
    Figure PCTCN2015091030-appb-100038
    为
    Figure PCTCN2015091030-appb-100039
    所述
    Figure PCTCN2015091030-appb-100040
    为其中，α1、β1、α2、β2是常数。
  11. 根据权利要求9或10所述的方法，其特征在于，所述网络缺陷信息还包括网络缺陷密度分布和网络安全等级分布,所述网络缺陷密度分布包括所述网络子区域内网络缺陷密度的分布函数和所述网络子区域内设备缺陷密度的分布函数，所述网络安全等级分布包括所述第一网络安全等级的分布和所述第二网络安全等级的分布；
    其中，所述网络子区域内网络缺陷密度的分布函数
    Figure PCTCN2015091030-appb-100042
    所述网络子区域内设备缺陷密度的分布函数
    Figure PCTCN2015091030-appb-100043
    所述第一网络安全等级的分布
    Figure PCTCN2015091030-appb-100044
    所述第二网络安全等级的分布
    Figure PCTCN2015091030-appb-100045
  12. 一种反向扫描代理模块，其特征在于，包括：
    报文获取模块，用于获取客户端报文；
    发送模块，用于将所述客户端报文发送给漏洞扫描器，以使所述漏洞扫描器依据所述客户端报文识别所述客户端的漏洞，或者报文识别与发送模块，用于依据所述客户端报文识别所述客户端的漏洞，并将所述客户端的漏洞发送给漏洞扫描器；
    接收控制模块，用于接收所述漏洞扫描器的控制指令，并依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
  13. 根据权利要求12所述的反向扫描代理模块，其特征在于，所述反向扫描代理模块安装在服务器上；
    所述报文获取模块具体用于获取所述客户端与所述服务器交互过程中所述客户端发出的业务请求报文和应答报文；或者
    所述发送模块还用于向所述客户端发送构造测试报文；所述报文获取模块具体用于获取所述客户端对所述构造测试报文的响应报文。
  14. 根据权利要求13所述的反向扫描代理模块，其特征在于，所述报文识别与发送模块具体用于依据所述业务请求报文、所述应答报文和/或所述响应报文的特征字段识别所述客户端的漏洞；或者通过所述业务请求报文、所述应答报文和/或所述响应报文与预设交互报文、预设报文序列或漏洞特征规则进行匹配识别所述客户端的漏洞。
  15. 根据权利要求14所述的反向扫描代理模块，其特征在于，所述报文获取模块还用于获取所述服务器的漏洞；
    所述反向扫描代理模块还包括第一网络缺陷分析模块，用于依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息。
  16. 一种漏洞扫描器，其特征在于，包括：
    接收模块，用于接收反向扫描代理模块发送的客户端报文；或者用于接收反向扫描代理模块发送的客户端的漏洞；
    报文识别模块，用于依据所述客户端报文识别所述客户端的漏洞；
    指令发送模块，用于向所述反向扫描代理模块发送控制指令，以使所述反向扫描代理模块依据所述控制指令改变工作方式和/或工作模式，以及更新漏洞规则。
  17. 根据权利要求16所述的漏洞扫描器，其特征在于，所述报文识别模块具体用于依据所述业务请求报文、所述应答报文和/或所述响应报文的特征字段识别所述客户端的漏洞；或者通过所述业务请求报文、所述应答报文和/或所述响应报文与预设交互报文、预设报文序列或漏洞特征规则进行匹配识别所述客户端的漏洞。
  18. 根据权利要求17所述的漏洞扫描器，其特征在于，所述接收模块还用于获取服务器的漏洞；
    所述漏洞扫描器还包括第二网络缺陷分析模块，用于依据所述服务器的漏洞和所述客户端的漏洞获得网络缺陷信息。
  19. 一种漏洞扫描系统，其特征在于，包括如权利要求12-15任一项所述的反向扫描代理模块，以及如权利要求16-18任一项所述的漏洞扫描器。
PCT/CN2015/091030 2014-12-19 2015-09-29 漏洞扫描方法及装置 WO2016095591A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2017532916A JP6411661B2 (ja) 2014-12-19 2015-09-29 脆弱性走査方法及び装置
US15/614,568 US10642985B2 (en) 2014-12-19 2017-06-05 Method and device for vulnerability scanning

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410802136.4 2014-12-19
CN201410802136.4A CN104506522B (zh) 2014-12-19 2014-12-19 漏洞扫描方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/614,568 Continuation US10642985B2 (en) 2014-12-19 2017-06-05 Method and device for vulnerability scanning

Publications (1)

Publication Number Publication Date
WO2016095591A1 true WO2016095591A1 (zh) 2016-06-23

Family

ID=52948237

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/091030 WO2016095591A1 (zh) 2014-12-19 2015-09-29 漏洞扫描方法及装置

Country Status (4)

Country Link
US (1) US10642985B2 (zh)
JP (1) JP6411661B2 (zh)
CN (1) CN104506522B (zh)
WO (1) WO2016095591A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115795484A (zh) * 2023-02-06 2023-03-14 北京长亭未来科技有限公司 一种物联网设备的漏洞检测方法、装置和设备

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104506522B (zh) * 2014-12-19 2017-12-26 北京神州绿盟信息安全科技股份有限公司 漏洞扫描方法及装置
CN105516131B (zh) * 2015-12-04 2019-03-26 珠海豹趣科技有限公司 一种扫描漏洞的方法、装置及电子设备
CN106534172A (zh) * 2016-12-07 2017-03-22 北京数字观星科技有限公司 一种内网远程扫描系统及其扫描内网的方法
CN107395593B (zh) * 2017-07-19 2020-12-04 深信服科技股份有限公司 一种漏洞自动化防护方法、防火墙及存储介质
US10033756B1 (en) * 2017-10-26 2018-07-24 Hytrust, Inc. Methods and systems for holistically attesting the trust of heterogeneous compute resources
CN108121552B (zh) * 2017-11-06 2021-01-12 广东睿江云计算股份有限公司 一种基于XenServer的自动化补丁方法
US10778713B2 (en) * 2018-02-26 2020-09-15 International Business Machines Corporation Method and system to manage risk of vulnerabilities and corresponding change actions to address malware threats
JP7040992B2 (ja) * 2018-04-27 2022-03-23 矢崎総業株式会社 脆弱性情報生成装置および脆弱性評価装置
US11374959B2 (en) * 2018-11-26 2022-06-28 International Business Machines Corporation Identifying and circumventing security scanners
CN109768973A (zh) * 2018-12-28 2019-05-17 易票联支付有限公司 一种安全公告的发布监控方法、系统及装置
CN109740355A (zh) * 2019-01-03 2019-05-10 深圳前海微众银行股份有限公司 漏洞扫描方法、服务器、系统及代理服务器
CN110059007B (zh) * 2019-04-03 2020-12-22 奇安信科技集团股份有限公司 系统漏洞扫描方法、装置、计算机设备及存储介质
CN110086806B (zh) * 2019-04-26 2020-04-14 中国南方电网有限责任公司 一种厂站设备系统漏洞的扫描系统
CN110971599A (zh) * 2019-11-29 2020-04-07 杭州迪普科技股份有限公司 漏洞扫描方法和装置
CN111859375B (zh) * 2020-07-20 2023-08-29 百度在线网络技术（北京）有限公司 漏洞检测方法、装置、电子设备及存储介质
CN112906011B (zh) * 2021-05-07 2021-08-03 北京安普诺信息技术有限公司 漏洞发现方法、测试方法、安全测试方法及相关装置、平台
CN112906010B (zh) * 2021-05-07 2021-07-20 北京安普诺信息技术有限公司 一种自动化攻击测试方法及基于此的自动化安全测试方法
CN114880675B (zh) * 2022-05-23 2023-05-05 浙江微铭汇信息技术有限公司 一种基于智慧云计算的业务漏洞分析方法及服务器
CN116545769B (zh) * 2023-06-30 2023-09-12 北京华云安信息技术有限公司 基于组合模块的远程加载式扫描方法、装置及设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101064736A (zh) * 2006-04-30 2007-10-31 飞塔信息科技（北京）有限公司 一种计算机网络风险评估的装置及其方法
CN102664876A (zh) * 2012-04-10 2012-09-12 星云融创（北京）科技有限公司 网络安全检测方法及系统
CN103679026A (zh) * 2013-12-03 2014-03-26 西安电子科技大学 一种云计算环境下的恶意程序智能防御系统及防御方法
US20140137180A1 (en) * 2012-11-13 2014-05-15 Bitdefender IPR Management Ltd. Hypervisor-Based Enterprise Endpoint Protection
CN104506522A (zh) * 2014-12-19 2015-04-08 北京神州绿盟信息安全科技股份有限公司 漏洞扫描方法及装置

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030051163A1 (en) * 2001-09-13 2003-03-13 Olivier Bidaud Distributed network architecture security system
JP2003271469A (ja) * 2002-03-13 2003-09-26 Lac Co Ltd クライアント検査方法、クライアント検査装置、およびプログラム
JP2007325293A (ja) * 2002-08-20 2007-12-13 Nec Corp 攻撃検知システムおよび攻撃検知方法
US20040193918A1 (en) * 2003-03-28 2004-09-30 Kenneth Green Apparatus and method for network vulnerability detection and compliance assessment
JP4074266B2 (ja) * 2004-05-26 2008-04-09 株式会社東芝 パケットフィルタリング装置、及びパケットフィルタリングプログラム
US20070101432A1 (en) * 2005-10-28 2007-05-03 Microsoft Corporation Risk driven compliance management
JP2007272396A (ja) * 2006-03-30 2007-10-18 Nec Personal Products Co Ltd セキュリティ管理システム、中継装置、プログラム
CN101340434B (zh) * 2008-05-15 2011-09-07 王瑞 网站恶意内容检测与认证方法及系统
KR20090121579A (ko) * 2008-05-22 2009-11-26 주식회사 이베이지마켓 서버의 취약점을 점검하기 위한 시스템 및 그 방법
WO2010019918A1 (en) * 2008-08-15 2010-02-18 Qualys, Inc. System and method for performing remote security assessment of firewalled computer
US8955107B2 (en) * 2008-09-12 2015-02-10 Juniper Networks, Inc. Hierarchical application of security services within a computer network
CN102082659B (zh) * 2009-12-01 2014-07-23 厦门市美亚柏科信息股份有限公司 一种面向网络安全评估的漏洞扫描系统及其处理方法
KR101745758B1 (ko) * 2011-05-31 2017-06-09 휴렛 팩커드 엔터프라이즈 디벨롭먼트 엘피 애플리케이션 보안 검사
US20130096980A1 (en) * 2011-10-18 2013-04-18 Mcafee, Inc. User-defined countermeasures
CN102945340B (zh) * 2012-10-23 2016-04-20 北京神州绿盟信息安全科技股份有限公司 信息对象检测方法及系统
CN103929323A (zh) * 2013-12-16 2014-07-16 汉柏科技有限公司 一种云网络设备的健康度监控方法
US9203851B1 (en) * 2014-05-13 2015-12-01 Trend Micro Incorporated Redirection of data from an on-premise computer to a cloud scanning service

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101064736A (zh) * 2006-04-30 2007-10-31 飞塔信息科技（北京）有限公司 一种计算机网络风险评估的装置及其方法
CN102664876A (zh) * 2012-04-10 2012-09-12 星云融创（北京）科技有限公司 网络安全检测方法及系统
US20140137180A1 (en) * 2012-11-13 2014-05-15 Bitdefender IPR Management Ltd. Hypervisor-Based Enterprise Endpoint Protection
CN103679026A (zh) * 2013-12-03 2014-03-26 西安电子科技大学 一种云计算环境下的恶意程序智能防御系统及防御方法
CN104506522A (zh) * 2014-12-19 2015-04-08 北京神州绿盟信息安全科技股份有限公司 漏洞扫描方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115795484A (zh) * 2023-02-06 2023-03-14 北京长亭未来科技有限公司 一种物联网设备的漏洞检测方法、装置和设备

Also Published As

Publication number Publication date
US20170270304A1 (en) 2017-09-21
JP6411661B2 (ja) 2018-10-24
US10642985B2 (en) 2020-05-05
JP2018503900A (ja) 2018-02-08
CN104506522B (zh) 2017-12-26
CN104506522A (zh) 2015-04-08

Similar Documents

Publication Publication Date Title
WO2016095591A1 (zh) 漏洞扫描方法及装置
US11038917B2 (en) System and methods for building statistical models of malicious elements of web pages
Dumitraş et al. Toward a standard benchmark for computer security research: The Worldwide Intelligence Network Environment (WINE)
CN103279710B (zh) Internet信息系统恶意代码的检测方法和系统
JP6606050B2 (ja) 検知装置、検知方法および検知プログラム
WO2015188743A1 (en) Web page vulnerability detection method and apparatus
CN112703496B (zh) 关于恶意浏览器插件对应用用户的基于内容策略的通知
US8813229B2 (en) Apparatus, system, and method for preventing infection by malicious code
CN110086836B (zh) 获取元数据的方法和装置
US20180196861A1 (en) Method for generating graph database of incident resources and apparatus thereof
US9817866B1 (en) Lossless compression of client read data
US9774508B1 (en) Communication generation using sparse indicators and sensor data
CN110532779A (zh) 一种漏洞检测的方法、装置、终端及存储介质
CN111953665B (zh) 服务器攻击访问识别方法及系统、计算机设备、存储介质
US20220311793A1 (en) Worm Detection Method and Network Device
CN110135326B (zh) 一种身份认证方法、电子设备及计算机可读存储介质
US9813467B1 (en) Real-time alignment and processing of incomplete stream of data
US20190370476A1 (en) Determination apparatus, determination method, and determination program
KR102042045B1 (ko) 악성코드 진단장치, 진단방법 및 진단시스템
CN115098151A (zh) 一种细粒度的内网设备固件版本探测方法
US9811439B1 (en) Functional testing of code modifications for read processing systems
JP2020502703A (ja) ネットワーク・マッピングのためのフィンガープリントの決定
US20180020012A1 (en) Malware analysis system, malware analysis method, and malware analysis program
KR101907037B1 (ko) 악성 코드 진단 서버, 시스템 및 방법
CN114666136A (zh) 一种网络攻击行为的检测方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15869102

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017532916

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15869102

Country of ref document: EP

Kind code of ref document: A1