WO2019127869A1 - 漏洞信息收集方法、装置、设备及可读存储介质 - Google Patents

漏洞信息收集方法、装置、设备及可读存储介质 Download PDF

Info

Publication number
WO2019127869A1
WO2019127869A1 PCT/CN2018/076396 CN2018076396W WO2019127869A1 WO 2019127869 A1 WO2019127869 A1 WO 2019127869A1 CN 2018076396 W CN2018076396 W CN 2018076396W WO 2019127869 A1 WO2019127869 A1 WO 2019127869A1
Authority
WO
WIPO (PCT)
Prior art keywords
vulnerability
information
website
current
proxy
Prior art date
Application number
PCT/CN2018/076396
Other languages
English (en)
French (fr)
Inventor
荣夫弟
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019127869A1 publication Critical patent/WO2019127869A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present application relates to the technical field of financial risk control systems, and in particular to a method, device, device and readable storage medium for collecting vulnerability information.
  • the main purpose of the present application is to provide a method, an apparatus, a device, and a readable storage medium for collecting vulnerability information, which are intended to solve the problem that the vulnerability information cannot be collected in time in the prior art, and the collection operation is easily prohibited.
  • the present application provides a vulnerability information collection method, and the vulnerability information collection method includes the following steps:
  • the current proxy IP access vulnerability database website is controlled, and the vulnerability information of each current collection node is extracted and collected.
  • the step of determining the current collection node of the vulnerability library website according to the speed at which the vulnerability library website issues the vulnerability includes:
  • the step of controlling the current proxy IP access vulnerability database website includes:
  • the step of determining whether the current proxy IP is invalid includes:
  • the feedback information carries the identifier of the access failure, it is determined that the current proxy IP is invalid.
  • the step of extracting and collecting the vulnerability information of each current collection node includes:
  • the vulnerability information is parsed into vulnerability reference information, and the vulnerability reference information is inserted into each data source of the preset system to monitor each data source.
  • the step of monitoring each data source comprises:
  • the prompt information is sent to the user who uses the data source.
  • the present application further provides a vulnerability information collecting apparatus, where the vulnerability information collecting apparatus includes:
  • a first determining module configured to determine a current collection node of the vulnerability library website according to a change speed of the vulnerability disclosed by the vulnerability library website;
  • a second determining module configured to determine an HTML extraction rule and a URL extraction rule of the vulnerability library website according to a writing rule of the vulnerability library website;
  • the collecting module is configured to control the current proxy IP access vulnerability database website according to the HTML extraction rule and the URL extraction rule when the preset time interval is reached, and extract and collect the vulnerability information of each current collecting node.
  • the first determining module comprises:
  • a determining unit configured to determine a speed of change of a vulnerability reported by the vulnerability library website according to a preset time interval and a number of vulnerabilities collected at the preset time interval;
  • the reduction unit is used to reduce the current collection node of the vulnerability library website when the vulnerability database website releases the vulnerability.
  • the present application further provides a vulnerability information collecting device, where the vulnerability information collecting device includes: a memory, a processor, a communication bus, and a vulnerability information collecting program stored on the memory;
  • the communication bus is used to implement connection communication between a processor and a memory
  • the processor is configured to execute the vulnerability information collecting program to implement the following steps:
  • the current proxy IP access vulnerability database website is controlled, and the vulnerability information of each current collection node is extracted and collected.
  • the present application also provides a readable storage medium storing one or more programs, the one or more programs being executable by one or more processors Used for:
  • the current proxy IP access vulnerability database website is controlled, and the vulnerability information of each current collection node is extracted and collected.
  • the vulnerability information collection method, device, device and readable storage medium of the embodiment determine the current collection node of the vulnerability library website according to the change speed of the vulnerability database website, and also determine the vulnerability library according to the writing rules of the vulnerability library website.
  • the HTML extraction rule and the URL extraction rule of the website are implemented; thereby, at a preset time interval, according to the HTML extraction rule and the URL extraction rule, the current proxy IP access vulnerability database website is controlled, and the vulnerability information of each current collection node is extracted and collected.
  • the speed of change of the vulnerabilities in the vulnerability database of the solution can reflect the update speed of the vulnerabilities of the vulnerabilities library website.
  • the current collection node is determined according to the update speed of the embodiment, which ensures timely collection of the latest vulnerability information and improves collection efficiency.
  • the current proxy IP is used.
  • the access is extracted and collected according to the HTML extraction rule and the URL extraction rule of the vulnerability database website, and the extraction is highly targeted, and when the current proxy IP is prohibited, other proxy IPs can be exchanged for access to ensure the collection of vulnerability information.
  • FIG. 1 is a schematic flowchart of a first embodiment of a vulnerability information collection method of the present application
  • FIG. 2 is a schematic flowchart of a second embodiment of a vulnerability information collection method according to the present application.
  • FIG. 3 is a schematic flowchart of a third embodiment of a vulnerability information collection method of the present application.
  • FIG. 4 is a schematic diagram of functional modules of a first embodiment of a vulnerability information collecting apparatus of the present application
  • FIG. 5 is a schematic structural diagram of a device in a hardware operating environment involved in a method according to an embodiment of the present application.
  • the application provides a method for collecting vulnerability information.
  • FIG. 1 is a schematic flowchart diagram of a first embodiment of a method for collecting vulnerability information according to the present application.
  • the vulnerability information collection method includes:
  • Step S10 determining the current collection node of the vulnerability library website according to the change speed of the vulnerability published by the vulnerability library website;
  • the vulnerability information collection in this embodiment collects the vulnerability information of the collection node by arranging the collection node on the vulnerability database website, and the vulnerability database website publishes the vulnerability on its website, and the number of vulnerabilities released at different times may be different.
  • the number of vulnerabilities released during a certain period of time is large, and the number of vulnerabilities released at the next time is reduced.
  • the number of collection nodes is set to be constant, when the number of vulnerabilities increases, there may be cases where collection is not possible; and when the number of vulnerabilities decreases, there may be cases where nodes are not fully utilized. Therefore, in this embodiment, according to the change speed of the vulnerability published by the vulnerability library website, the current collection node currently used to collect the vulnerability database website vulnerability is determined.
  • the specific steps include:
  • Step S11 Determine, according to the preset time interval and the number of vulnerabilities collected at the preset time interval, the rate of change of the vulnerabilities in the vulnerability database website;
  • the interval collection policy is set, and the preset time interval is set.
  • the preset time interval can be pre-set according to requirements. For example, this preset time interval is set according to the vulnerability update time interval of the vulnerability library website to ensure that the updated vulnerability can be collected at the first time when the vulnerability is released.
  • this preset time interval is set according to the vulnerability update time interval of the vulnerability library website to ensure that the updated vulnerability can be collected at the first time when the vulnerability is released.
  • the preset time interval is reached, the vulnerability of the vulnerability library website is collected once, and the number of vulnerabilities collected is counted. Once the preset time interval is reached again, the vulnerability of the vulnerability library website is collected again, and the number of vulnerabilities collected again is counted.
  • the relationship between the two can reflect the speed of the release vulnerability.
  • the number of vulnerabilities collected becomes larger, indicating that the speed of the vulnerability is increased.
  • Step S12 when the vulnerability database website releases the vulnerability, the current collection node of the vulnerability library website is increased;
  • the current collection node of the vulnerability library is increased, and more collection nodes are added as the current collection node to ensure comprehensive collection of the added vulnerabilities.
  • Determine the location of the vulnerability added by the vulnerability library publishing site arrange the collection node at this location, and use the collected collection node as the added current collection node to collect the added vulnerabilities.
  • the added current collection node exists in the form of distributed nodes, and multiple nodes are collected at the same time to improve collection efficiency.
  • step S13 when the vulnerability database website releases the vulnerability, the current collection node of the vulnerability library website is reduced.
  • the current collection node of the vulnerability library is reduced, and the reduced collection node is used as the current collection node to prevent occupation of more system resources.
  • the corresponding reduced current collection nodes also exist in the form of distributed nodes, and vulnerabilities are collected for multiple nodes at the same time to improve collection efficiency.
  • Step S20 determining an HTML extraction rule and a URL extraction rule of the vulnerability library website according to a writing rule of the vulnerability library website;
  • the vulnerability library website is written in program code, including multiple HTML (HyperText Markup Language, Hypertext Markup Language) Web pages, different HTML web content, there are differences in how to write, such as some content using HTTP transport format, and others using XML format.
  • the web page may include multiple web address URLs (Uniform) Resource Locator, Uniform Resource Locator), can be linked to other web pages through the web address URL.
  • URLs Uniform Resource Locator
  • the rules written by the code are different, the rules for extraction are different, so according to the writing rules of the vulnerability library website, the HTML extraction rules and URL extraction rules are determined. Read the contents of the HTML and the URL by writing the program code to determine the rules for writing, and then determine the corresponding extraction rules according to the writing rules.
  • Step S30 when the preset time interval is reached, according to the HTML extraction rule and the URL extraction rule, the current proxy IP access vulnerability database website is controlled, and the vulnerability information of each current collection node is extracted and collected.
  • the current proxy IP access vulnerability database website is controlled according to the HTML extraction rule and the URL extraction rule, and the vulnerability information of each current collection node is extracted and collected.
  • the proxy IP obtains the network information through the proxy network user, and the client first creates a connection with the proxy server, and then requests to create a connection to the target server or obtain the specified resource of the target server according to the proxy protocol used by the proxy server.
  • the vulnerability information of each collection node disposed on the vulnerability database website is obtained through the current proxy IP access vulnerability database website, that is, the vulnerability information published by the vulnerability collection website at each current collection node is extracted and collected.
  • the vulnerability information collection method of the embodiment determines the current collection node of the vulnerability database website according to the change speed of the vulnerability database website, and also determines the HTML extraction rule and the URL extraction rule of the vulnerability library website according to the writing rules of the vulnerability library website. Therefore, at a preset time interval, according to the HTML extraction rule and the URL extraction rule, the current proxy IP access vulnerability database website is controlled, and the vulnerability information of each current collection node is extracted and collected.
  • the speed of change of the vulnerabilities in the vulnerability database of the solution can reflect the update speed of the vulnerabilities of the vulnerabilities library website.
  • the current collection node is determined according to the update speed of the embodiment, which ensures timely collection of the latest vulnerability information and improves collection efficiency.
  • the current proxy IP is used. The access is extracted and collected according to the HTML extraction rule and the URL extraction rule of the vulnerability database website, and the extraction is highly targeted, and when the current proxy IP is prohibited, other proxy IPs can be exchanged for access to ensure the collection of vulnerability information.
  • a second embodiment of the vulnerability information collection method of the present application is proposed.
  • the steps to control the current proxy IP access vulnerability library website include:
  • step S40 it is determined whether the current proxy IP is invalid. If the current proxy IP is invalid, the other proxy IPs are randomly selected from the proxy IP library as the current proxy IP.
  • the same proxy IP address when used to access the vulnerability database website, it may be restricted by the anti-collection policy of the vulnerability library, and the website of the vulnerability library is disabled, so that the current proxy IP access vulnerability library website is controlled in this embodiment.
  • the current proxy IP is still used to access the vulnerability library website.
  • the other proxy IPs are randomly selected from the proxy IP library as the current proxy IP.
  • the proxy IP library contains multiple proxy IPs. If the currently used proxy IP is disabled, the proxy IP is randomly selected from the proxy IP library to access as the new current proxy IP, and the selection is still made considering the random selection. The proxy IP, so that when the new current proxy IP is still invalid, then the proxy IP is replaced again, that is, the mechanism of dynamic proxy IP is adopted.
  • the dynamic proxy IP mode of the proxy IP is selected multiple times to prevent the proxy IP from being banned and to ensure the validity of accessing the vulnerability database website.
  • the steps for determining whether the current proxy IP is invalid include:
  • Step S41 controlling the current proxy IP access vulnerability database website, and receiving feedback information returned by the access vulnerability database website;
  • step S42 when the feedback information carries the identifier of the access failure, it is determined that the current proxy IP is invalid.
  • the received feedback information When the received feedback information carries the identifier of the successful access, it indicates that the current proxy IP can access the vulnerability database website, and the current proxy IP is valid and does not need to be replaced.
  • the received feedback information carries the identifier of the access failure, the current proxy IP is forbidden, the vulnerability database cannot be accessed, the current proxy IP is invalid, and no other proxy IP is randomly selected from the proxy IP library for replacement.
  • the current collection node is The steps of extracting and collecting vulnerability information.
  • step S50 the vulnerability information is parsed into vulnerability reference information, and the vulnerability reference information is inserted into each data source of the preset system to monitor each data source.
  • the vulnerability information needs to be parsed to obtain the vulnerability reference information.
  • the corresponding HTML is used for parsing;
  • the URL is used for parsing.
  • the URL address may exist in the form of a list or may be in the form of a detail.
  • the preset system is a local system or a third-party system that needs to perform vulnerability monitoring.
  • the data source is a source for constructing each data of the preset system webpage, and may exist in the form of a text file, a database or a message queue, for multiple types of data. The source can be prioritized according to the degree of importance, that is, the vulnerability reference information is preferentially inserted into a highly important data source for monitoring. Specifically, the steps of monitoring each data source include:
  • Step S51 comparing the data in each data source with the vulnerability reference information to determine whether there is data consistent with any vulnerability reference information in the data source;
  • Various types of data sources include various data used to build a preset system web page. Therefore, the data in each data source is compared with each vulnerability reference information one by one to determine whether there is data in the data source that is consistent with any one of the vulnerability reference information.
  • Step S52 When there is data consistent with any one of the vulnerability reference information in the data source, the prompt information is sent to the user who uses the data source.
  • the prompt information is sent to the user who uses the data source, because the data source has data carrying the vulnerability reference information, and if the user uses the data source, there is a risk, and the prompt information is sent to the data, and the prompt information may include the presence information.
  • Vulnerability data such as the vulnerability's data name, vulnerability name, vulnerability details, vulnerability severity level, etc., to prompt them to fix the vulnerability as soon as possible based on this vulnerability reference information to avoid loss.
  • the application provides a vulnerability information collecting apparatus.
  • the vulnerability information collecting apparatus includes:
  • the first determining module 10 is configured to determine a current collecting node of the vulnerability library website according to a change speed of the vulnerability of the vulnerability library website;
  • the vulnerability information collection in this embodiment collects the vulnerability information of the collection node by arranging the collection node on the vulnerability database website, and the vulnerability database website publishes the vulnerability on its website, and the number of vulnerabilities released at different times may be different.
  • the number of vulnerabilities released during a certain period of time is large, and the number of vulnerabilities released at the next time is reduced.
  • the number of collection nodes is set to be constant, when the number of vulnerabilities increases, there may be cases where collection is not possible; and when the number of vulnerabilities decreases, there may be cases where nodes are not fully utilized. Therefore, according to the speed of change of the vulnerability of the vulnerability database website, the first determining module 10 determines the current collecting node currently used to collect the vulnerability database website vulnerability.
  • the first determining module 10 includes:
  • the determining unit 11 is configured to determine, according to the preset time interval and the number of vulnerabilities collected at the preset time interval, the rate of change of the vulnerabilities database website publishing vulnerability;
  • the interval collection policy is set, and the preset time interval is set.
  • the preset time interval can be pre-set according to requirements. For example, this preset time interval is set according to the vulnerability update time interval of the vulnerability library website to ensure that the updated vulnerability can be collected at the first time when the vulnerability is released.
  • this preset time interval is set according to the vulnerability update time interval of the vulnerability library website to ensure that the updated vulnerability can be collected at the first time when the vulnerability is released.
  • the preset time interval is reached, the vulnerability of the vulnerability library website is collected once, and the number of vulnerabilities collected is counted. Once the preset time interval is reached again, the vulnerability of the vulnerability library website is collected again, and the number of vulnerabilities collected again is counted.
  • the determining unit 11 determines the size relationship between the two, and the relationship between the two can reflect the speed of the release vulnerability; wherein the number of vulnerabilities collected becomes larger, indicating that the speed of issuing the vulnerability becomes larger; When the number of collected roofs becomes smaller, the speed at which the vulnerability is released becomes smaller.
  • the adding unit 12 is configured to increase the current collection node of the vulnerability library website when the vulnerability of the vulnerability library website is increased;
  • the adding unit 12 increases the current collection node of the vulnerability library, and adds more collection nodes as the current collection node to ensure the added vulnerability. Conduct a comprehensive collection to prevent omissions. Determine the location of the vulnerability added by the vulnerability library publishing site, arrange the collection node at this location, and use the collected collection node as the added current collection node to collect the added vulnerabilities.
  • the added current collection node exists in the form of distributed nodes, and multiple nodes are collected at the same time to improve collection efficiency.
  • the reduction unit 13 is configured to reduce the current collection node of the vulnerability library website when the vulnerability database website releases the vulnerability.
  • the reducing unit 13 reduces the current collecting node of the vulnerability library, and reduces the collected collecting node as the current collecting node to prevent occupation of the number of vulnerabilities.
  • system resource Determine the location of the vulnerabilities that are reduced by the vulnerability library publishing website, reduce the collection nodes arranged at this location, and reduce the collection nodes after the collection nodes as the current collection nodes to collect the reduced vulnerabilities.
  • the corresponding reduced current collection nodes also exist in the form of distributed nodes, and vulnerabilities are collected for multiple nodes at the same time to improve collection efficiency.
  • the second determining module 20 is configured to determine an HTML extraction rule and a URL extraction rule of the vulnerability library website according to a writing rule of the vulnerability library website;
  • the vulnerability library website is written in program code, including multiple HTML (HyperText Markup Language, Hypertext Markup Language) Web pages, different HTML web content, there are differences in how to write, such as some content using HTTP transport format, and others using XML format.
  • the web page may include multiple web address URLs (Uniform) Resource Locator, Uniform Resource Locator), can be linked to other web pages through the web address URL.
  • Uniform Resource Locator Uniform Resource Locator
  • the second determining module 20 determines its HTML extraction rules and URL extraction rules according to the writing rules of the vulnerability library website. Read the contents of the HTML and the URL by writing the program code to determine the rules for writing, and then determine the corresponding extraction rules according to the writing rules.
  • the collecting module 30 is configured to control the current proxy IP access vulnerability database website according to the HTML extraction rule and the URL extraction rule when the preset time interval is reached, and extract and collect the vulnerability information of each current collecting node.
  • the collection module 30 controls the current proxy IP access vulnerability database website to extract and collect the vulnerability information of each current collection node.
  • the proxy IP obtains the network information through the proxy network user, and the client first creates a connection with the proxy server, and then requests to create a connection to the target server or obtain the specified resource of the target server according to the proxy protocol used by the proxy server.
  • the vulnerability information of each collection node disposed on the vulnerability database website is obtained through the current proxy IP access vulnerability database website, that is, the vulnerability information published by the vulnerability collection website at each current collection node is extracted and collected.
  • the first determining module 10 determines the current collecting node of the vulnerability database website according to the change speed of the vulnerability of the vulnerability database website
  • the second determining module 20 determines the vulnerability database according to the writing rules of the vulnerability database website.
  • the HTML extraction rule and the URL extraction rule of the website thereby implementing, at a preset time interval, the collection module 30 controls the current proxy IP access vulnerability database website according to the HTML extraction rule and the URL extraction rule, and extracts and collects the vulnerability information of each current collection node.
  • the speed of change of the vulnerabilities in the vulnerability database of the solution can reflect the update speed of the vulnerabilities of the vulnerabilities library website.
  • the current collection node is determined according to the update speed of the embodiment, which ensures timely collection of the latest vulnerability information and improves collection efficiency.
  • the current proxy IP is used.
  • the access is extracted and collected according to the HTML extraction rule and the URL extraction rule of the vulnerability database website, and the extraction is highly targeted, and when the current proxy IP is prohibited, other proxy IPs can be exchanged for access to ensure the collection of vulnerability information.
  • the above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • FIG. 5 is a schematic structural diagram of a device in a hardware operating environment involved in a method according to an embodiment of the present application.
  • the vulnerability information collection device in the embodiment of the present application may be a PC, or may be a terminal device such as a smart phone, a tablet computer, an e-book reader, or a portable computer.
  • the vulnerability information collecting device may include a processor 1001, such as a CPU, a memory 1005, and a communication bus 1002.
  • the communication bus 1002 is used to implement connection communication between the processor 1001 and the memory 1005.
  • the memory 1005 may be a high speed RAM memory or a stable memory (non-volatile) Memory), such as disk storage.
  • the memory 1005 can also optionally be a storage device independent of the aforementioned processor 1001.
  • the vulnerability information collection device may further include a user interface, a network interface, a camera, and an RF (Radio). Frequency, RF) circuits, sensors, audio circuits, WiFi modules, and more.
  • the user interface may include a display, an input unit such as a keyboard, and the optional user interface may also include a standard wired interface, a wireless interface.
  • the network interface can optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).
  • the vulnerability information collecting device structure shown in FIG. 5 does not constitute a limitation of the vulnerability information collecting device, and may include more or less components than those illustrated, or combine some components, or different. Parts layout.
  • an operating system may be included in the memory 1005 as a computer storage medium.
  • the operating system is a program that manages and controls the vulnerability information collection device hardware and software resources, and supports the operation of vulnerability information collection programs and other software and/or programs.
  • the network communication module is used to implement communication between components within the memory 1005 and with other hardware and software in the vulnerability information collection device.
  • the processor 1001 is configured to execute the vulnerability information collecting program stored in the memory 1005 to implement the steps in the vulnerability information collecting method.
  • the specific implementation manner of the vulnerability information collection device of the present application is basically the same as the foregoing embodiments of the vulnerability information collection method, and details are not described herein again.
  • the present application provides a readable storage medium storing one or more programs, the one or more programs being further executable by one or more processors for implementing the above vulnerability information Collect the steps in the method.
  • the specific embodiment of the readable storage medium of the present application is substantially the same as the embodiment of the foregoing vulnerability information collection method, and details are not described herein again.
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM as described above). , a disk, an optical disk, including a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in the various embodiments of the present application.
  • a terminal device which may be a mobile phone, a computer, a server, or a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请公开一种漏洞信息收集方法、装置、设备及可读存储介质，所述方法包括：根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。本方案根据漏洞库网站的漏洞更新速度确定当前收集节点，可确保及时收集最新的漏洞信息，提高收集效率；并根据漏洞库网站的HTML提取规则和URL提取规则进行提取收集，提取的针对性强，且在当前代理IP被禁止时，可更换其它代理IP进行访问，确保实现漏洞信息的收集。

Description

漏洞信息收集方法、装置、设备及可读存储介质
本申请要求于2017年12月28日提交中国专利局、申请号为201711468775.1、发明名称为“漏洞信息收集方法、装置、设备及可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在申请中。
技术领域
本申请主要涉及金融风控系统技术领域，具体地说，涉及一种漏洞信息收集方法、装置、设备及可读存储介质。
背景技术
目前，随着网络的普及，网络上面各种漏洞铺天盖地，各种漏洞如果不能及时发现修补，被恶意利用，会造成严重损失。现有的漏洞都是靠单机漏洞扫描工具扫描或者人工来发现，对于一些新的漏洞缺少及时发现和处理。另外现有漏洞平台的信息大多防收集策略比较严格，简单的单机收集系统很容易被漏洞平台所禁止，而无法实现漏洞信息的收集。
发明内容
本申请的主要目的是提供一种漏洞信息收集方法、装置、设备及可读存储介质，旨在解决现有技术中不能及时收集更新的漏洞信息，收集操作容易被禁止的问题。
为实现上述目的，本申请提供一种漏洞信息收集方法，所述漏洞信息收集方法包括以下步骤：
根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
优选地，所述根据漏洞库网站发布漏洞的速度，确定漏洞库网站的当前收集节点的步骤包括：
根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
优选地，所述当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站的步骤之前包括：
判断当前代理IP是否无效，若当前代理IP无效，则从代理IP库中随机选择其他代理IP作为当前代理IP。
优选地，所述判断当前代理IP是否无效的步骤包括：
控制当前代理IP访问漏洞库网站，并接收访问漏洞库网站所返回的反馈信息；
当反馈信息中携带访问失败的标识符，则判定当前代理IP无效。
优选地，所述对各当前收集节点的漏洞信息进行提取收集的步骤之后包括：
将漏洞信息解析为漏洞参考信息，并将所述漏洞参考信息插入到预设系统的各个数据源，以对各个数据源进行监测。
优选地，所述对各个数据源进行监测的步骤包括：
将各个数据源中的数据和漏洞参考信息对比，以判断数据源中是否存在与任意一项漏洞参考信息一致的数据；
当数据源中存在与任意一项漏洞参考信息一致的数据时，向使用所述数据源的使用方发送提示信息。
此外，为实现上述目的，本申请还提出一种漏洞信息收集装置，所述漏洞信息收集装置包括：
第一确定模块，用于根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
第二确定模块，用于根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
收集模块，用于当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
优选地，所述第一确定模块包括：
确定单元，用于根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
增加单元，用于当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
减少单元，用于当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
此外，为实现上述目的，本申请还提出一种漏洞信息收集设备，所述漏洞信息收集设备包括：存储器、处理器、通信总线以及存储在所述存储器上的漏洞信息收集程序；
所述通信总线用于实现处理器和存储器之间的连接通信；
所述处理器用于执行所述漏洞信息收集程序，以实现以下步骤：
根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
此外，为实现上述目的，本申请还提供一种可读存储介质，所述可读存储介质存储有一个或者一个以上程序，所述一个或者一个以上程序可被一个或者一个以上的处理器执行以用于：
根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
本实施例的漏洞信息收集方法、装置、设备及可读存储介质，根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点，同时还根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；从而实现在预设时间间隔，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。本方案的漏洞库网站发布漏洞的变化速度可体现漏洞库网站漏洞的更新速度，根据此体现的更新速度确定当前收集节点，可确保及时收集最新的漏洞信息，提高收集效率；此外使用当前代理IP进行访问，根据漏洞库网站的HTML提取规则和URL提取规则进行提取收集，提取的针对性强，且在当前代理IP被禁止时，可更换其它代理IP进行访问，确保实现漏洞信息的收集。
附图说明
图1是本申请的漏洞信息收集方法第一实施例的流程示意图；
图2是本申请的漏洞信息收集方法第二实施例的流程示意图；
图3是本申请的漏洞信息收集方法第三实施例的流程示意图；
图4是本申请的漏洞信息收集装置第一实施例的功能模块示意图；
图5是本申请实施例方法涉及的硬件运行环境的设备结构示意图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供一种漏洞信息收集方法。
请参照图1，图1为本申请漏洞信息收集方法第一实施例的流程示意图。在本实施例中，所述漏洞信息收集方法包括：
步骤S10，根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
本实施例的漏洞信息收集通过在漏洞库网站上布置收集节点，对收集节点的漏洞信息进行收集，漏洞库网站将漏洞发布在其网站上，不同的时间所发布的漏洞数量可能不一样，在某一段时间所发布的漏洞数量多，而在下一时间所发布的漏洞数量减少。当数量多时，各收集节点所需要收集的漏洞量大；当数据量少时，各收集节点所需要收集的漏洞量小。从而如果将收集节点的数量设定为不变，当漏洞数量增加时，可能出现收集不过来的情况；而当漏洞数量减少时，可能出现节点没有被充分利用的情况。从而本实施例根据漏洞库网站发布漏洞的变化速度，确定当前用于收集漏洞库网站漏洞的当前收集节点。其具体步骤包括：
步骤S11，根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
可理解地，因漏洞库网站不会实时发布更新，在对漏洞进行收集时，如果采用实时收集的策略，可能浪费较多系统资源。从而设定间隔收集策略，设定预设时间间隔，当到达预设时间间隔时，则进行漏洞收集。此预设时间间隔可根据需求预先设定，如根据漏洞库网站的漏洞更新时间间隔设定此预设时间间隔，以确保在漏洞发布更新的第一时间即可收集到更新的漏洞。当到达预设时间间隔时，即对漏洞库网站的漏洞进行一次收集，统计此次收集的漏洞数量。后续再次到达预设时间间隔时，再一次对漏洞库网站的漏洞进行收集，并统计此再一次收集的漏洞数量。将两次的收集数量做比较，确定两者的大小关系，两者的大小关系即可体现发布漏洞的变化速度；其中收集的漏洞数量变大，则说明发布漏洞的速度变大；当收集的楼顶数量变小，则说明发布漏洞的速度变小。
步骤S12，当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
当漏洞库网站发布漏洞的速度变大，即发布的漏洞数量增加时，则对漏洞库的当前收集节点进行增加，增加更多的收集节点作为当前收集节点，以确保对增加的漏洞进行全面收集，防止遗漏。判断漏洞库发布网站增加的漏洞所出现的位置，在此位置上布置收集节点，将布置的收集节点作为增加的当前收集节点，对增加的漏洞进行收集。此外增加后的当前收集节点以分布式节点的形式存在，在同一时间对多个节点进行漏洞收集，提高收集效率。
步骤S13，当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
相应的，当发布漏洞的变化速度变小，即发布的漏洞数量减少时，则对漏洞库的当前收集节点进行减少，将减少后的收集节点作为当前收集节点，以防止占用较多系统资源。判断漏洞库发布网站减少的漏洞所出现的位置，将此位置上布置的收集节点进行减少，将减少收集节点后的收集节点作为当前收集节点，对减少的漏洞进行收集。相应的减少后的当前收集节点也以分布式节点的形式存在，在同一时间对多个节点进行漏洞收集，提高收集效率。
步骤S20，根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
可理解地，漏洞库网站由程序代码编写而成，包括多个HTML（HyperText Markup Language，超级文本标记语言）网页，不同的HTML网页内容，在编写方式上存在差异，如某些内容采用HTTP传输格式、另一些内容采用XML格式。此外网页中可能包括多个网页地址URL（Uniform Resource Locator，统一资源定位符），通过网页地址URL可以链接到其他网页。在对漏洞库网站进行漏洞收集时，实质过程是对漏洞库的网页和网页地址进行提取的过程。因代码编写的规则不同，会导致提取的规则不同，从而根据漏洞库网站的编写规则，确定其HTML提取规则和URL提取规则。通过编写程序代码读取HTML和URL的内容，以确定其编写规则，进而根据编写规则确定对应的提取规则。
步骤S30，当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
当到达预设的时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。代理IP通过代理网络用户去取得网络信息，客户端先与代理服务器创建连接，接着根据代理服务器所使用的代理协议，请求对目标服务器创建连接、或者获得目标服务器的指定资源。本实施例即为通过当前代理IP访问漏洞库网站，获取布置在漏洞库网站上各收集节点的漏洞信息，即对漏洞库网站在各当前收集节点发布的漏洞信息进行提取收集。
本实施例的漏洞信息收集方法，根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点，同时还根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；从而实现在预设时间间隔，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。本方案的漏洞库网站发布漏洞的变化速度可体现漏洞库网站漏洞的更新速度，根据此体现的更新速度确定当前收集节点，可确保及时收集最新的漏洞信息，提高收集效率；此外使用当前代理IP进行访问，根据漏洞库网站的HTML提取规则和URL提取规则进行提取收集，提取的针对性强，且在当前代理IP被禁止时，可更换其它代理IP进行访问，确保实现漏洞信息的收集。
进一步地，请参照图2，在本申请漏洞信息收集方法第一实施例的基础上，提出本申请漏洞信息收集方法第二实施例，在第二实施例中，所述当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站的步骤之前包括：
步骤S40，判断当前代理IP是否无效，若当前代理IP无效，则从代理IP库中随机选择其他代理IP作为当前代理IP。
进一步地，当持续使用同一个代理IP地址访问漏洞库网站时，可能会被漏洞库的反收集策略限制，出现被漏洞库网站禁用的情况，从而本实施例在控制当前代理IP访问漏洞库网站之前，设置每隔一定间隔时间对当前代理IP是否被禁止无效进行判断的机制，以确保控制访问漏洞库网站的当前代理IP的有效性。此间隔时间可根据需求设定，如设置在达到预设时间间隔的前五分钟。当判断出当前代理IP没有被禁止、仍然有效时，则仍然使用当前代理IP进行漏洞库网站的访问。而当判出当前代理IP被禁止无效时，则从代理IP库中随机选择其他代理IP作为当前代理IP。代理IP库中包含多个代理IP，若当前使用的代理IP被禁止，即从代理IP库中随机选择其他代理IP来作为新的当前代理IP进行访问，且考虑到随机选择时仍然选择到原来的代理IP，从而当新的当前代理IP仍然无效时，则再次选择更换代理IP，即采用动态代理IP的机制。采用多次选择更换代理IP的动态代理IP方式，防止代理IP被禁止，确保访问漏洞库网站的有效性。其中判断当前代理IP是否无效的步骤包括：
步骤S41，控制当前代理IP访问漏洞库网站，并接收访问漏洞库网站所返回的反馈信息；
在进行当前代理IP的无效性判断时，控制当前代理IP访问漏洞库网站，并判断是否访问成功，当访问成功时生成访问成功标识符，当访问识别时则生成访问失败的标识符，将此成功标识符或失败标识符添加到反馈信息进行返回，接收此访问漏洞库网站所返回的反馈信息，以根据此反馈信息判断当前代理IP是否无效。
步骤S42，当反馈信息中携带访问失败的标识符，则判定当前代理IP无效。
当接收的反馈信息中携带有访问成功的标识符时，则说明当前代理IP可以访问漏洞库网站，当前代理IP有效，不需要进行更换。而当接收的反馈信息中携带有访问失败的标识符时，则说明当前代理IP被禁止，不能访问漏洞库网站，当前代理IP无效，不需要从代理IP库随机选择其他代理IP进行更换。
进一步地，请参照图3，在本申请漏洞信息收集方法第二实施例的基础上，提出本申请漏洞信息收集方法第三实施例，在第三实施例中，所述对各当前收集节点的漏洞信息进行提取收集的步骤之后包括：
步骤S50，将漏洞信息解析为漏洞参考信息，并将所述漏洞参考信息插入到预设系统的各个数据源，以对各个数据源进行监测。
在根据HTML提取规则和URL提取规则，对漏洞信息进行提取收集后，需要对此漏洞信息进行解析，得到漏洞参考信息。对于通过HTML提取规则提取的漏洞信息，相应的使用HTML方式进行解析；对于通过URL提取规则提取的漏洞信息，则使用URL方式进行解析。因URL地址可以以列表的形式存在也可以以详情的形式存在，先将根据URL提取规则提取的漏洞信息和URL列表规则匹配，如果匹配成功，则说明提取的漏洞信息为列表式，对于列表式的漏洞信息不需要进行解析，可将其直接作为漏洞参考信息进行使用。如果匹配不成功，则说明提取的漏洞信息为详情式，对于详情式的漏洞信息则需要经过解析后才能使用。解析得到漏洞名称、漏洞详情、漏洞严重级别、漏洞发布时间及浏览量等漏洞参考信息。将此漏洞参考信息插入到预设系统的各个数据源，对数据源进行监控，查看其中是否携带有漏洞信息中的任意一项。预设系统为需要进行漏洞监控的本地系统或者第三方系统，数据源为用于构建预设系统网页各个数据的来源，可以以文本文件、数据库或者消息队列的形式存在，对于多种类型的数据源，可根据重要程度设置优先级，即优先将漏洞参考信息插入到重要程度高的数据源中进行监测。具体地，对各个数据源进行监测的步骤包括：
步骤S51，将各个数据源中的数据和漏洞参考信息对比，以判断数据源中是否存在与任意一项漏洞参考信息一致的数据；
因漏洞参考信息存在多项，而数据源也存在多种类型，多种类型的数据源包括各种用于构建预设系统网页的数据。从而监测时将各个数据源中的数据逐个和各个漏洞参考信息一一对比，以判断数据源中是否存在与漏洞参考信息中的任意一项一致的数据。
步骤S52，当数据源中存在与任意一项漏洞参考信息一致的数据时，向使用所述数据源的使用方发送提示信息。
当判断出某一数据源中存在与任意一项漏洞参考信息一致的数据时，则说明此数据源存在具有漏洞的数据，使用此数据源的数据进行网页构建，会使网页出现漏洞，导致网页使用的用户出现损失。从而向使用该数据源的使用方发送提示信息，因该数据源存在携带有漏洞参考信息的数据，此使用方如果使用此数据源，会存在风险，向其发送提示信息，提示信息可包括存在漏洞的数据名称、漏洞名称、漏洞详情、漏洞严重级别等漏洞参考信息，以提示其根据此漏洞参考信息尽快修复漏洞，避免损失。
此外，请参照图4，本申请提供一种漏洞信息收集装置，在本申请漏洞信息收集装置第一实施例中，所述漏洞信息收集装置包括：
第一确定模块10，用于根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
本实施例的漏洞信息收集通过在漏洞库网站上布置收集节点，对收集节点的漏洞信息进行收集，漏洞库网站将漏洞发布在其网站上，不同的时间所发布的漏洞数量可能不一样，在某一段时间所发布的漏洞数量多，而在下一时间所发布的漏洞数量减少。当数量多时，各收集节点所需要收集的漏洞量大；当数据量少时，各收集节点所需要收集的漏洞量小。从而如果将收集节点的数量设定为不变，当漏洞数量增加时，可能出现收集不过来的情况；而当漏洞数量减少时，可能出现节点没有被充分利用的情况。从而本实施例根据漏洞库网站发布漏洞的变化速度，第一确定模块10确定当前用于收集漏洞库网站漏洞的当前收集节点。此第一确定模块10包括：
确定单元11，用于根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
可理解地，因漏洞库网站不会实时发布更新，在对漏洞进行收集时，如果采用实时收集的策略，可能浪费较多系统资源。从而设定间隔收集策略，设定预设时间间隔，当到达预设时间间隔时，则进行漏洞收集。此预设时间间隔可根据需求预先设定，如根据漏洞库网站的漏洞更新时间间隔设定此预设时间间隔，以确保在漏洞发布更新的第一时间即可收集到更新的漏洞。当到达预设时间间隔时，即对漏洞库网站的漏洞进行一次收集，统计此次收集的漏洞数量。后续再次到达预设时间间隔时，再一次对漏洞库网站的漏洞进行收集，并统计此再一次收集的漏洞数量。将两次的收集数量做比较，确定单元11确定两者的大小关系，两者的大小关系即可体现发布漏洞的变化速度；其中收集的漏洞数量变大，则说明发布漏洞的速度变大；当收集的楼顶数量变小，则说明发布漏洞的速度变小。
增加单元12，用于当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
当漏洞库网站发布漏洞的速度变大，即发布的漏洞数量增加时，增加单元12则对漏洞库的当前收集节点进行增加，增加更多的收集节点作为当前收集节点，以确保对增加的漏洞进行全面收集，防止遗漏。判断漏洞库发布网站增加的漏洞所出现的位置，在此位置上布置收集节点，将布置的收集节点作为增加的当前收集节点，对增加的漏洞进行收集。此外增加后的当前收集节点以分布式节点的形式存在，在同一时间对多个节点进行漏洞收集，提高收集效率。
减少单元13，用于当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
相应的，当发布漏洞的变化速度变小，即发布的漏洞数量减少时，减少单元13则对漏洞库的当前收集节点进行减少，将减少后的收集节点作为当前收集节点，以防止占用较多系统资源。判断漏洞库发布网站减少的漏洞所出现的位置，将此位置上布置的收集节点进行减少，将减少收集节点后的收集节点作为当前收集节点，对减少的漏洞进行收集。相应的减少后的当前收集节点也以分布式节点的形式存在，在同一时间对多个节点进行漏洞收集，提高收集效率。
第二确定模块20，用于根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
可理解地，漏洞库网站由程序代码编写而成，包括多个HTML（HyperText Markup Language，超级文本标记语言）网页，不同的HTML网页内容，在编写方式上存在差异，如某些内容采用HTTP传输格式、另一些内容采用XML格式。此外网页中可能包括多个网页地址URL（Uniform Resource Locator，统一资源定位符），通过网页地址URL可以链接到其他网页。在对漏洞库网站进行漏洞收集时，实质过程是对漏洞库的网页和网页地址进行提取的过程。因代码编写的规则不同，会导致提取的规则不同，从而根据漏洞库网站的编写规则，第二确定模块20确定其HTML提取规则和URL提取规则。通过编写程序代码读取HTML和URL的内容，以确定其编写规则，进而根据编写规则确定对应的提取规则。
收集模块30，用于当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
当到达预设的时间间隔时，根据HTML提取规则和URL提取规则，收集模块30控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。代理IP通过代理网络用户去取得网络信息，客户端先与代理服务器创建连接，接着根据代理服务器所使用的代理协议，请求对目标服务器创建连接、或者获得目标服务器的指定资源。本实施例即为通过当前代理IP访问漏洞库网站，获取布置在漏洞库网站上各收集节点的漏洞信息，即对漏洞库网站在各当前收集节点发布的漏洞信息进行提取收集。
本实施例的漏洞信息收集装置，第一确定模块10根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点，同时第二确定模块20根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；从而实现在预设时间间隔，收集模块30根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。本方案的漏洞库网站发布漏洞的变化速度可体现漏洞库网站漏洞的更新速度，根据此体现的更新速度确定当前收集节点，可确保及时收集最新的漏洞信息，提高收集效率；此外使用当前代理IP进行访问，根据漏洞库网站的HTML提取规则和URL提取规则进行提取收集，提取的针对性强，且在当前代理IP被禁止时，可更换其它代理IP进行访问，确保实现漏洞信息的收集。
需要说明的是，本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
参照图5，图5是本申请实施例方法涉及的硬件运行环境的设备结构示意图。
本申请实施例漏洞信息收集设备可以是PC，也可以是智能手机、平板电脑、电子书阅读器、便携计算机等终端设备。
如图5所示，该漏洞信息收集设备可以包括：处理器1001，例如CPU，存储器1005，通信总线1002。其中，通信总线1002用于实现处理器1001和存储器1005之间的连接通信。存储器1005可以是高速RAM存储器，也可以是稳定的存储器（non-volatile memory），例如磁盘存储器。存储器1005可选的还可以是独立于前述处理器1001的存储装置。
可选地，该漏洞信息收集设备还可以包括用户接口、网络接口、摄像头、RF（Radio Frequency，射频）电路，传感器、音频电路、WiFi模块等等。用户接口可以包括显示屏（Display）、输入单元比如键盘（Keyboard），可选用户接口还可以包括标准的有线接口、无线接口。网络接口可选的可以包括标准的有线接口、无线接口（如WI-FI接口）。
本领域技术人员可以理解，图5中示出的漏洞信息收集设备结构并不构成对漏洞信息收集设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图5所示，作为一种计算机存储介质的存储器1005中可以包括操作系统、网络通信模块以及漏洞信息收集程序。操作系统是管理和控制漏洞信息收集设备硬件和软件资源的程序，支持漏洞信息收集程序以及其它软件和/或程序的运行。网络通信模块用于实现存储器1005内部各组件之间的通信，以及与漏洞信息收集设备中其它硬件和软件之间通信。
在图5所示的漏洞信息收集设备中，处理器1001用于执行存储器1005中存储的漏洞信息收集程序，以实现上述漏洞信息收集方法中的步骤。本申请漏洞信息收集设备具体实施方式与上述漏洞信息收集方法各实施例基本相同，在此不再赘述。
本申请提供了一种可读存储介质，所述可读存储介质存储有一个或者一个以上程序，所述一个或者一个以上程序还可被一个或者一个以上的处理器执行以用于实现上述漏洞信息收集方法中的步骤。本申请可读存储介质具体实施方式与上述漏洞信息收集方法各实施例基本相同，在此不再赘述。
还需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在如上所述的一个存储介质（如ROM/RAM、磁碟、光盘）中，包括若干指令用以使得一台终端设备（可以是手机，计算机，服务器，或者网络设备等）执行本申请各个实施例所述的方法。
以上所述仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是在本申请的构思下，利用本申请说明书及附图内容所作的等效结构变换，或直接/间接运用在其他相关的技术领域均包括在本申请的专利保护范围内。

Claims (20)

  1. 一种漏洞信息收集方法，其特征在于，所述漏洞信息收集方法包括以下步骤：
    根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
    根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
    当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
  2. 如权利要求1所述的漏洞信息收集方法，其特征在于，所述根据漏洞库网站发布漏洞的速度，确定漏洞库网站的当前收集节点的步骤包括：
    根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
    当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
    当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
  3. 如权利要求1所述的漏洞信息收集方法，其特征在于，所述当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站的步骤之前包括：
    判断当前代理IP是否无效，若当前代理IP无效，则从代理IP库中随机选择其他代理IP作为当前代理IP。
  4. 如权利要求3所述的漏洞信息收集方法，其特征在于，所述判断当前代理IP是否无效的步骤包括：
    控制当前代理IP访问漏洞库网站，并接收访问漏洞库网站所返回的反馈信息；
    当反馈信息中携带访问失败的标识符，则判定当前代理IP无效。
  5. 如权利要求1所述的漏洞信息收集方法，其特征在于，所述对各当前收集节点的漏洞信息进行提取收集的步骤之后包括：
    将漏洞信息解析为漏洞参考信息，并将所述漏洞参考信息插入到预设系统的各个数据源，以对各个数据源进行监测。
  6. 如权利要求5所述的漏洞信息收集方法，其特征在于，所述对各个数据源进行监测的步骤包括：
    将各个数据源中的数据和漏洞参考信息对比，以判断数据源中是否存在与任意一项漏洞参考信息一致的数据；
    当数据源中存在与任意一项漏洞参考信息一致的数据时，向使用所述数据源的使用方发送提示信息。
  7. 一种漏洞信息收集装置，其特征在于，所述漏洞信息收集装置包括：
    第一确定模块，用于根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
    第二确定模块，用于根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
    收集模块，用于当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
  8. 如权利要求7所述的漏洞信息收集装置，其特征在于，所述第一确定模块包括：
    确定单元，用于根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
    增加单元，用于当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
    减少单元，用于当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
  9. 一种漏洞信息收集设备，其特征在于，所述漏洞信息收集设备包括：存储器、处理器、通信总线以及存储在所述存储器上的漏洞信息收集程序；
    所述通信总线用于实现处理器和存储器之间的连接通信；
    所述处理器用于执行所述漏洞信息收集程序，以实现以下步骤：
    根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
    根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
    当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
  10. 如权利要求9所述的漏洞信息收集设备，其特征在于，所述根据漏洞库网站发布漏洞的速度，确定漏洞库网站的当前收集节点的步骤包括：
    根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
    当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
    当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
  11. 如权利要求9所述的漏洞信息收集设备，其特征在于，所述当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站的步骤之前，所述处理器用于执行所述漏洞信息收集程序，以实现以下步骤：
    判断当前代理IP是否无效，若当前代理IP无效，则从代理IP库中随机选择其他代理IP作为当前代理IP。
  12. 如权利要求11所述的漏洞信息收集设备，其特征在于，所述判断当前代理IP是否无效的步骤包括：
    控制当前代理IP访问漏洞库网站，并接收访问漏洞库网站所返回的反馈信息；
    当反馈信息中携带访问失败的标识符，则判定当前代理IP无效。
  13. 如权利要求9所述的漏洞信息收集设备，其特征在于，所述对各当前收集节点的漏洞信息进行提取收集的步骤之后，所述处理器用于执行所述漏洞信息收集程序，以实现以下步骤：
    将漏洞信息解析为漏洞参考信息，并将所述漏洞参考信息插入到预设系统的各个数据源，以对各个数据源进行监测。
  14. 如权利要求13所述的漏洞信息收集设备，其特征在于，所述对各个数据源进行监测的步骤包括：
    将各个数据源中的数据和漏洞参考信息对比，以判断数据源中是否存在与任意一项漏洞参考信息一致的数据；
    当数据源中存在与任意一项漏洞参考信息一致的数据时，向使用所述数据源的使用方发送提示信息。
  15. 一种可读存储介质，其特征在于，所述计算机课读存储介质上存储有漏洞信息收集程序，所述漏洞信息收集程序被处理器执行，以实现以下步骤：
    根据漏洞库网站发布漏洞的变化速度，确定漏洞库网站的当前收集节点；
    根据漏洞库网站的编写规则，确定漏洞库网站的HTML提取规则和URL提取规则；
    当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站，对各当前收集节点的漏洞信息进行提取收集。
  16. 如权利要求15所述的可读存储介质，其特征在于，所述根据漏洞库网站发布漏洞的速度，确定漏洞库网站的当前收集节点的步骤包括：
    根据预设时间间隔以及在预设时间间隔所收集的漏洞数量，确定漏洞库网站发布漏洞的变化速度；
    当漏洞库网站发布漏洞的速度变大时，增加漏洞库网站的当前收集节点；
    当漏洞库网站发布漏洞的速度变小时，减少漏洞库网站的当前收集节点。
  17. 如权利要求15所述的可读存储介质，其特征在于，所述当到达预设时间间隔时，根据HTML提取规则和URL提取规则，控制当前代理IP访问漏洞库网站的步骤之前，所述漏洞信息收集程序被处理器执行，以实现以下步骤：
    判断当前代理IP是否无效，若当前代理IP无效，则从代理IP库中随机选择其他代理IP作为当前代理IP。
  18. 如权利要求17所述的可读存储介质，其特征在于，所述判断当前代理IP是否无效的步骤包括：
    控制当前代理IP访问漏洞库网站，并接收访问漏洞库网站所返回的反馈信息；
    当反馈信息中携带访问失败的标识符，则判定当前代理IP无效。
  19. 如权利要求15所述的可读存储介质，其特征在于，所述对各当前收集节点的漏洞信息进行提取收集的步骤之后，所述漏洞信息收集程序被处理器执行，以实现以下步骤：
    将漏洞信息解析为漏洞参考信息，并将所述漏洞参考信息插入到预设系统的各个数据源，以对各个数据源进行监测。
  20. 如权利要求19所述的可读存储介质，其特征在于，所述对各个数据源进行监测的步骤包括：
    将各个数据源中的数据和漏洞参考信息对比，以判断数据源中是否存在与任意一项漏洞参考信息一致的数据；
    当数据源中存在与任意一项漏洞参考信息一致的数据时，向使用所述数据源的使用方发送提示信息。
PCT/CN2018/076396 2017-12-28 2018-02-12 漏洞信息收集方法、装置、设备及可读存储介质 WO2019127869A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711468775.1A CN109977677A (zh) 2017-12-28 2017-12-28 漏洞信息收集方法、装置、设备及可读存储介质
CN201711468775.1 2017-12-28

Publications (1)

Publication Number Publication Date
WO2019127869A1 true WO2019127869A1 (zh) 2019-07-04

Family

ID=67064976

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/076396 WO2019127869A1 (zh) 2017-12-28 2018-02-12 漏洞信息收集方法、装置、设备及可读存储介质

Country Status (2)

Country Link
CN (1) CN109977677A (zh)
WO (1) WO2019127869A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110958243A (zh) * 2019-11-28 2020-04-03 米哈游科技（上海）有限公司 一种网络漏洞提交方法、装置、存储介质及电子设备
TWI728637B (zh) * 2020-01-02 2021-05-21 中華電信股份有限公司 資訊安全防護方法及電腦可讀媒介
CN114996718A (zh) * 2022-06-30 2022-09-02 浙江网商银行股份有限公司 数据处理方法以及装置
US11570196B2 (en) * 2019-03-28 2023-01-31 Naver Cloud Corporation Method for determining duplication of security vulnerability and analysis apparatus using same

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101808093A (zh) * 2010-03-15 2010-08-18 北京安天电子设备有限公司 一种对web安全进行自动化检测的系统和方法
CN105678170A (zh) * 2016-01-05 2016-06-15 广东工业大学 一种动态检测xss漏洞的方法

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5135389B2 (ja) * 2010-06-30 2013-02-06 株式会社日立情報システムズ 情報漏えいファイル検知装置、及びその方法とプログラム
CN103124223B (zh) * 2011-12-21 2016-01-27 中国科学院软件研究所 一种it系统安全态势自动实时判定方法
CN104125197B (zh) * 2013-04-24 2017-08-08 阿里巴巴集团控股有限公司 一种安全基线系统及其实现安全检查的方法
CN104065645A (zh) * 2014-05-28 2014-09-24 北京知道创宇信息技术有限公司 用于防护web漏洞的方法和设备
CN105991554B (zh) * 2015-02-04 2019-06-11 阿里巴巴集团控股有限公司 漏洞检测方法和设备
CN106656924A (zh) * 2015-10-30 2017-05-10 北京神州泰岳软件股份有限公司 一种设备安全漏洞的处理方法和装置
CN106096406B (zh) * 2016-05-30 2019-01-25 北京启明星辰信息安全技术有限公司 一种安全漏洞回溯分析方法及装置
CN106357635A (zh) * 2016-09-09 2017-01-25 浪潮软件集团有限公司 一种基于同源框架的漏洞对比分析方法
CN106911694B (zh) * 2017-02-28 2020-08-25 广东电网有限责任公司信息中心 一种基于android漏洞知识库自动更新的方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101808093A (zh) * 2010-03-15 2010-08-18 北京安天电子设备有限公司 一种对web安全进行自动化检测的系统和方法
CN105678170A (zh) * 2016-01-05 2016-06-15 广东工业大学 一种动态检测xss漏洞的方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11570196B2 (en) * 2019-03-28 2023-01-31 Naver Cloud Corporation Method for determining duplication of security vulnerability and analysis apparatus using same
CN110958243A (zh) * 2019-11-28 2020-04-03 米哈游科技（上海）有限公司 一种网络漏洞提交方法、装置、存储介质及电子设备
TWI728637B (zh) * 2020-01-02 2021-05-21 中華電信股份有限公司 資訊安全防護方法及電腦可讀媒介
CN114996718A (zh) * 2022-06-30 2022-09-02 浙江网商银行股份有限公司 数据处理方法以及装置

Also Published As

Publication number Publication date
CN109977677A (zh) 2019-07-05

Similar Documents

Publication Publication Date Title
WO2019127869A1 (zh) 漏洞信息收集方法、装置、设备及可读存储介质
WO2019165691A1 (zh) 自动生成测试案例的方法、装置、设备及可读存储介质
WO2018107610A1 (zh) 业务数据处理方法、系统、设备及计算机可读存储介质
WO2019104877A1 (zh) 通过网站对接购买保险的方法、装置、设备及介质
WO2019174375A1 (zh) 接口测试方法、装置、设备及计算机可读存储介质
WO2019037396A1 (zh) 账户清结算方法、装置、设备及存储介质
WO2018205545A1 (zh) 数据生成方法、装置、终端及计算机可读存储介质
WO2019127837A1 (zh) 建表脚本生成方法、装置、设备及计算机可读存储介质
WO2019192085A1 (zh) 银企直联通信方法、装置、设备及计算机可读存储介质
WO2019119771A1 (zh) 语音交互方法、装置及计算机可读存储介质
WO2017041538A1 (zh) 终端用户界面的受控显示方法及装置
WO2019227557A1 (zh) 密钥管理方法、设备、存储介质及装置
WO2017028601A1 (zh) 智能终端的语音控制方法、装置及电视机系统
WO2019041832A1 (zh) 修改源数据库表结构的方法、服务器、系统及存储介质
WO2019061613A1 (zh) 贷款资质筛选方法、装置及计算机可读存储介质
WO2018098880A1 (zh) 网站信息下载方法及装置
WO2018227880A1 (zh) 数据比对方法、装置、设备及可读存储介质
WO2019161615A1 (zh) 账单录入方法、系统、光学字符识别服务器和存储介质
WO2020224247A1 (zh) 基于区块链的数据溯源方法、装置、设备及可读存储介质
WO2015144089A1 (en) Application recommending method and apparatus
WO2019104876A1 (zh) 保险产品的推送方法、系统、终端、客户终端及存储介质
WO2018233301A1 (zh) 产品推荐方法、装置、设备以及计算机可读存储介质
WO2019075944A1 (zh) 基于用户行为的信息屏蔽方法、装置、终端和存储介质
WO2014000635A1 (zh) 阅读器提供服务的方法、阅读器、终端及计算机存储介质
WO2019037454A1 (zh) 保费缴纳方法、装置、设备及可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18895677

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 06.10.2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18895677

Country of ref document: EP

Kind code of ref document: A1