WO2019127890A1

WO2019127890A1 - Vulnerability scanning method, device, computer apparatus, and storage medium

Info

Publication number: WO2019127890A1
Application number: PCT/CN2018/077372
Authority: WO
Inventors: 周圣龙
Original assignee: 平安科技（深圳）有限公司
Priority date: 2017-12-30
Filing date: 2018-02-27
Publication date: 2019-07-04
Also published as: CN108206830A; CN108206830B

Abstract

A vulnerability scanning method, a system, a computer apparatus, and a storage medium. The method comprises: intercepting traffic data to be scanned; determining whether the intercepted traffic data to be scanned is dynamic data; if so, performing a search to determine whether there is a parameter for the traffic data to be scanned; if so, acquiring the type of the traffic data to be scanned; acquiring a vulnerability scanning rule corresponding to the type of the traffic data to be scanned; and performing a vulnerability scan on the traffic data to be scanned by means of the vulnerability scanning rule.

Description

Vulnerability scanning method, device, computer device and storage medium

This application claims the priority of the Chinese Patent Application entitled "Vulnerability Scanning Methods, Devices, Computer Equipment, and Storage Media" on December 30, 2017, filed on Dec. 30, 2017, the entire contents of which are incorporated by reference. In this application.

Technical field

The present application relates to the field of computer technologies, and in particular, to a vulnerability scanning method, apparatus, computer device, and storage medium.

Background technique

With the development of computer technology, a vulnerability scanning technology has emerged. The traditional vulnerability scanning technology refers to detecting the security vulnerability of a specified remote or local computer system based on a vulnerability database by scanning and other means, and discovering one of the exploitable vulnerabilities. A security detection (penetration attack) behavior.

However, the traditional vulnerability scanning technology is that the scanning server actively crawls the data to be scanned in the server through the crawling technology, and then judges whether the crawled data has a vulnerability through all the vulnerability matching rules in the vulnerability database, and the scanning efficiency is relatively high. low.

Summary of the invention

According to various embodiments disclosed herein, a vulnerability scanning method, apparatus, computer device, and storage medium are provided.

A vulnerability scanning method, the method comprising:

Intercepting traffic data to be scanned;

Determining whether the intercepted traffic data to be scanned is dynamic data;

When the intercepted traffic data to be scanned is dynamic data, query whether the traffic data to be scanned has parameters;

Obtaining a type of the to-be-scanned traffic data when the scanning traffic data has a parameter;

Obtaining a vulnerability scanning rule corresponding to the type of the traffic data to be scanned; and

The vulnerability scanning data is subjected to vulnerability scanning by the vulnerability scanning rule.

A vulnerability scanning device, the device comprising:

a traffic intercepting module, configured to intercept traffic data to be scanned;

a data judging module, configured to determine whether the intercepted traffic data to be scanned is dynamic data;

a querying module, configured to query whether the flow data to be scanned has a parameter when the intercepted traffic data to be scanned is dynamic data;

a traffic type obtaining module, configured to acquire a type of the to-be-scanned traffic data when the traffic data to be scanned has a parameter;

a rule obtaining module, configured to acquire a vulnerability scanning rule corresponding to the type of the traffic data to be scanned; and

And a scanning module, configured to perform vulnerability scanning on the to-be-scanned traffic data by using the vulnerability scanning rule.

A computer device comprising a memory, a processor, and a computer readable instruction stored thereon, the processor executing the computer readable instructions to implement the following steps:

Intercepting traffic data to be scanned;

Determining whether the intercepted traffic data to be scanned is dynamic data;

One or more computer readable non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of:

Intercepting traffic data to be scanned;

Determining whether the intercepted traffic data to be scanned is dynamic data;

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the present invention will be apparent from the description, drawings and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some embodiments of the present application, Those skilled in the art can also obtain other drawings based on these drawings without any creative work.

1 is an application scenario diagram of a vulnerability scanning method in an embodiment;

2 is a block diagram of a scan server in an embodiment;

3 is a schematic flow chart of a vulnerability scanning method in an embodiment;

4 is a structural block diagram of a vulnerability scanning apparatus in an embodiment;

Figure 5 is a diagram showing the internal structure of a computer device in one embodiment.

Detailed ways

In order to make the objects, technical solutions, and advantages of the present application more comprehensible, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

The vulnerability scanning method provided by the present application can be applied to an application environment as shown in FIG. 1. The terminal can access resources on the network through a core switch or a router, and the scan server can intercept the traffic data of the terminal through the core switch or the router, or the scan server can intercept the traffic data of the terminal by setting a proxy server, thereby scanning The server can passively scan the traffic data when intercepting the traffic data to determine whether the traffic data is vulnerability data, thereby implementing vulnerability detection. The terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices. The scanning server can be implemented by a separate server or a server cluster composed of multiple servers.

Referring to FIG. 2, FIG. 2 is an architectural diagram of a scan server in an embodiment, including a system foundation, a transfer engine, and a web application service. The scheduling engine is mainly for a passive scan service, and the web application service is mainly for querying a record server, and a UI. The interface is ready for display. Specifically, the scheduling engine may adopt a distributed multi-threaded deployment, where a machine learning model, a scan engine, and a system upgrade program are set. The machine learning model may be a decision tree model, and the scan engine mainly stores vulnerability scanning rules and system upgrades. The program is mainly for the upgrade of the system. The web application service mainly includes a report model, a log module, and a configuration module. The web application service is mainly for querying the record service, that is, after each vulnerability scan is completed, a log storage to the log module can be generated, and a corresponding report is generated according to the scan result, for example, A vulnerability report or a vulnerability report is displayed on the corresponding UI interface.

In an embodiment, as shown in FIG. 3, a vulnerability scanning method is provided, which is applied to the scanning server in FIG. 1 as an example, and includes the following steps:

S302: Intercept the traffic data to be scanned.

Specifically, the traffic data refers to data generated when the terminal accesses resources on the network, and includes a message for accessing the request. The terminal used by the user can access the resources on the Internet. When the terminal used by the user accesses, the traffic data can be intercepted in the backbone node or the link node, and the intercepted traffic is stored in the scan server, thereby determining according to the traffic data. Is there a vulnerability?

S304: Determine whether the intercepted traffic data to be scanned is dynamic data.

Specifically, dynamic data is only data that can be seen and interacted, and has a good experience. Users are no longer passive to browse. For example, message boards, forums, user registrations, etc. are dynamic and can be used by users. Interact with the website, while static data is for viewing only. Specifically, the traffic that does not need vulnerability detection in the intercepted traffic data that is intercepted may be deleted by a machine learning manner, for example, by a decision tree algorithm, and when the traffic data to be scanned is intercepted, the machine learning model is input. First, it is determined whether the traffic data to be scanned is dynamic data. If it is dynamic data, it indicates that the intercepted traffic data to be scanned needs to continue scanning, and if it is static data, it can be culled, so that the scanning to be scanned needs to be scanned. The amount of flow data is reduced to improve scanning efficiency. The machine learning model may be pre-configured, for example, by generating a training set and a test set by historically-scanned data to generate a model of the machine learning, wherein the training set is used to train to form an initial model, and the test set is used to perform an initial model. Corrected to ensure the correctness of the model.

S306: When the intercepted traffic data to be scanned is dynamic data, query whether the traffic data to be scanned has a parameter.

Specifically, when the first machine learns to determine the dynamic data when the traffic data to be scanned is determined, the second step machine learning may determine whether the traffic data has parameters, and only the traffic to be scanned with the parameter will perform the vulnerability scanning. The traffic to be scanned without parameters does not need to acquire the resources of the server on the network, and therefore does not perform vulnerability scanning. In other embodiments, the two-step machine learning can be integrated into a machine learning model, that is, when the flow data to be scanned is input into the integrated model, static data and parameterless data to be scanned can be proposed.

S308: When there is a parameter of the traffic data to be scanned, obtain the type of the traffic data to be scanned.

Specifically, when the traffic data to be scanned is dynamic data, and the parameter exists, the traffic data to be scanned needs to be scanned for vulnerability. Therefore, the type of the traffic data to be scanned is obtained first, so that different types can be obtained according to different types. Vulnerability scanning rules, which in turn reduce the execution of vulnerability scanning rules.

S310: Obtain a vulnerability scanning rule corresponding to the type of the traffic data to be scanned.

Specifically, the type of the traffic data to be scanned may include web traffic or network traffic, etc., according to the type, the corresponding vulnerability detection rule may be obtained, thereby reducing the execution rate of the vulnerability detection rule. For example, when the traffic data to be scanned is web traffic, the vulnerability detection rule for the web traffic is directly obtained, and the entire vulnerability detection rule is not needed to improve the execution efficiency of the vulnerability detection rule.

S312: Vulnerability scanning is performed on the scanned traffic data through the vulnerability scanning rule.

Specifically, the vulnerability scanning rule refers to a rule pre-stored in the scanning server. By comparing the traffic data to be scanned with the vulnerability scanning rule, whether the traffic data to be scanned is the result of the vulnerability data can be obtained, thereby implementing the scanning of the vulnerability. For example, when the traffic data to be scanned complies with the vulnerability scanning rule, it indicates that the traffic data to be scanned is vulnerability data, so subsequent interception or the like is needed to prevent normal access. When the traffic data to be scanned does not meet the vulnerability scanning rule, it indicates that The traffic data to be scanned is not vulnerability data, and it can be accessed normally without subsequent interception and the like.

The above vulnerability scanning method first intercepts the traffic data to be scanned, that is, when the client has data access, the traffic data is intercepted, so that the coverage of the traffic data to be scanned becomes larger; secondly, before the vulnerability scanning, the unnecessary The scanned traffic data to be scanned is eliminated, the scanning volume of the traffic data to be scanned is reduced, and the vulnerability scanning efficiency is improved. Finally, the corresponding vulnerability scanning rule is obtained according to the type of the traffic data to be scanned, without requiring all the databases in the database. Vulnerability scanning rules are executed once, which can greatly reduce the number of executions of vulnerability scanning rules, thereby improving the efficiency of vulnerability scanning.

In one embodiment, the step of intercepting the traffic data to be scanned, that is, after the step S302, may further include: acquiring the current resource occupancy rate; if the current resource occupancy rate exceeds the threshold, acquiring the resource occupancy rate of the standby scanning server; The standby scanning server with the lowest resource usage of the standby scanning server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.

Specifically, in this embodiment, the scan server exists in the form of a cluster, and a main scan server is set. When the main scan server intercepts the traffic data to be scanned, first determines the resource occupancy rate of the main scan server, when the main scan server If the current resource usage rate exceeds the threshold, the current scan server has a higher current resource usage rate. Therefore, the resource usage rate of the standby scan server is continuously obtained, and the standby scan server with the lowest resource occupancy rate is obtained to perform the vulnerability scan. That is, it is judged whether the intercepted traffic data to be scanned is dynamic data or the like. When the resource usage of the standby scanning server is obtained, the resource usage of the standby scanning server may be sorted, which is more convenient to select. The threshold of the current resource occupancy rate may be determined according to experience, or determined according to the test peak value during the system stress test, for example, determining different thresholds according to the amount of the intercepted traffic data to be scanned. The resource occupancy rate may refer to the occupancy rate of the CPU of the scan server.

In the above embodiment, after the traffic data to be scanned is intercepted, the resource occupancy rate of the primary scanning server is first determined. When the resource occupancy rate of the primary scanning server does not exceed the threshold, the vulnerability scanning is performed by the primary scanning server, when the primary scanning server When the resource usage exceeds the threshold, the standby scan server is started, and the standby scan server performs vulnerability scanning to ensure consistent and normal operation of the system.

In one of the embodiments, the step of obtaining the current resource occupancy rate may further include: determining whether the current scan server is faulty; if the current scan server does not fail, continuing to perform the step of acquiring the current resource occupancy rate; if the current scan server If the fault occurs, the resource usage of the standby scan server is obtained. The standby scan server with the lowest resource usage of the standby scan server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.

Specifically, before the step of acquiring the current resource occupancy rate, first determining whether the current scan server is faulty. If no fault occurs, the current resource occupancy rate may be further determined, and whether the current scan server is used to determine whether the current scan server is used by the current scan server. Perform vulnerability detection. If the current scan server is faulty, the standby scan server with the lowest resource usage of the standby scan server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data, without first determining the current resource occupancy rate, which may be reduced. The step of performing the process, wherein the resource usage rate is lower than the default value of the resource usage rate and the lowest resource usage rate; for example, three standby scan servers: standby scan server A, standby scan server B, and standby scan Server C, wherein the resource occupancy rate of the standby scan server A is a, the resource occupancy rate of the standby scan server B is b, the resource occupancy rate of the standby scan server C is c, and a is greater than the preset value of the resource occupancy rate m, b, and c. If the value of the to-be-scanned traffic is less than c, the backup scan server corresponding to the resource occupancy b needs to continue to perform the step of determining whether the intercepted traffic data is dynamic data, and in this embodiment. The resource occupancy preset value is not specifically limited, and it may be set according to experience.

In actual use, the scan server uses a distributed architecture, multi-threaded queue form for plug-in scanning or rule matching. For example, you can set up one main scanning server and multiple standby scanning servers. When receiving the intercepted traffic, first determine whether the primary scanning server is faulty. If the primary scanning server is faulty, scan it through the standby scanning server. If the scan server is faulty, for example, it can be judged one by one according to the order of the standby scan server. When the current standby scan server fails, the next set is judged in order until there is a standby scan server without failure. If the primary scan server does not fail, the current resource usage rate of the primary scan server is obtained. When the resource usage exceeds the threshold, the scan server scans the current scan server. For example, the current resource usage of the standby scan server can be obtained first. Sort and select a standby scan server with low resource occupancy for scanning.

In the above embodiment, after the traffic data to be scanned is intercepted, it is first determined whether the current scan server is faulty. If a fault occurs, the standby scan server is directly selected for vulnerability scanning. If no fault occurs, the current scan server resources are first determined. Rate: When the current scan server's resource usage does not exceed the threshold, the current scan server scans the vulnerability. When the current scan server's resource usage exceeds the threshold, other scan servers are started, and other scan servers scan for vulnerabilities. , can ensure the system is consistent and normal operation.

In one embodiment, the step of intercepting the traffic data to be scanned, that is, after step S302, further includes: counting the number of interception of the traffic data to be scanned; starting a corresponding number of scan servers according to the number of intercepts; and distributing the traffic data to be scanned to The step of starting the scan server to continue to determine whether the intercepted traffic data to be scanned is dynamic data.

Specifically, the number of times the intercepted traffic is scanned refers to the number of times the scan server receives the vulnerability scan request, that is, after the core switch or the router or the proxy server intercepts the traffic to be scanned, the core switch or the router or the proxy server scans. The server sends a vulnerability scan request, which carries traffic data to be scanned. The scan server control system starts a corresponding number of scan servers according to the number of intercepts, and distributes the to-be-scanned traffic data to the scan server that is started, so that the plurality of scan servers scan the scan traffic data together.

The number of times the intercepted traffic data is intercepted is obtained, that is, the number of requests for scanning the traffic data to be scanned is acquired, and the corresponding scanning server is started according to the number of the requests, and then received according to the load balancing policy. The request is assigned to the corresponding scan server. For example, when there are 3000 requests to be processed, the number of scanning servers that are turned on is three. According to the load balancing policy, the 3000 requests are sequentially allocated to the three scanning servers, and the three scanning servers will simultaneously request the same. Processing improves scanning efficiency. Each scanning server can use multi-thread scanning when scanning, that is, each scanning server receives 50 requests, and starts 50 threads, and each thread scans the to-be-scanned traffic data in 20 requests, so that The efficiency can be further improved. The processing peak of each scanning server may be preset, and the processing level is preset for each scanning server, and the processing level is selected according to the number of received requests, for example, when the received request is the first quantity, the processing level is Level 1, when the received request is the second quantity, the processing level is two, the processing request amount of the scanning server is A at the first level, and the processing request amount of the scanning server at the second level is B; according to the received The number of requests is selected as the processing level. If the selected processing level is one level, the number of scanning servers that need to be started is determined according to the number N of received requests and the processing request amount of the primary scanning server. /A; Then, according to the quantity A, the number of threads that each scanning server needs to be started is determined, thereby implementing parallel processing of requests and improving processing efficiency.

In the above embodiment, according to the number of intercepted traffic, that is, the number of requests for scanning for traffic, the corresponding scanning server is started according to the number of the requests, and then the received request is allocated according to the load balancing policy. The scanning server improves processing efficiency.

In one embodiment, after the step of performing vulnerability scanning on the scanned traffic data by using the vulnerability scanning rule, the method further includes: receiving a vulnerability scanning rule adjustment instruction for the traffic data to be scanned; and adjusting the instruction to obtain the vulnerability scanning supplementary rule according to the vulnerability scanning rule adjustment instruction Vulnerability scanning of scanned traffic data through vulnerability scanning supplemental rules.

Specifically, in general, different types of traffic data to be scanned need to be scanned by the corresponding vulnerability scanning rule, but in special cases, the scanning result of the to-be-scanned traffic data may be problematic, in order to avoid the problem. When the problem occurs, the scan result of the traffic data to be scanned can be displayed on the UI interface, and the vulnerability scan rule adjustment instruction for the traffic data to be scanned can be received through the UI interface. For example, for web traffic, the scan server may first pass the web. After the traffic vulnerability scanning rule scans, the scan result is output, but the tester may think that the scan is not perfect enough, and then the network traffic scan rule may be invoked to scan the web traffic again, that is, according to the vulnerability scan rule adjustment instruction to obtain the vulnerability scan supplement. Rules; vulnerability scanning is performed by vulnerability scanning supplemental rules to scan scanned traffic data to improve the accuracy of vulnerability scanning rules.

In the foregoing embodiment, the vulnerability scanning rule adjustment instruction may be further received, and the vulnerability scanning rule adjustment instruction is used to obtain another type of vulnerability scanning rule to further scan the traffic. That is, the system is configured through the web application service. In this embodiment, not only the dynamic scanning of the traffic is supported, but also the manual intervention is supported, so that the key traffic can be scanned in an all-round manner, and the accuracy of the vulnerability scanning is improved.

In one of the embodiments, the step of intercepting the traffic data to be scanned may include intercepting the traffic data to be scanned by an agent set in advance at the client. Or the step of intercepting the traffic data to be scanned may include: receiving the mirrored traffic data generated by the core switch according to the intercepted traffic data to be scanned as the traffic data to be scanned.

Specifically, the traffic interception may be performed in the trunk or the primary link node, so that the proxy may be set in the client in advance, and when the client installed by the terminal has the traffic data sent, the agent intercepted by the client is preset. Traffic data to be scanned. Or, when the core switch or the router receives the traffic data sent by the client, the core switch or the router mirrors the traffic data, and sends the mirroring of the traffic data to the server to be scanned to implement interception of the traffic data to be scanned.

In the foregoing embodiment, by performing traffic interception in the trunk or the primary link node, and sending the intercepted traffic data to be scanned to the scan server, the scan server performs passive scanning of the scanned traffic data, instead of the traditional Crawl traffic data to ensure the integrity of the traffic data to be scanned.

It should be understood that although the various steps in the flowchart of FIG. 3 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other sequences. Moreover, at least some of the steps in FIG. 3 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be performed at different times, and the execution of these sub-steps or stages The order is also not necessarily sequential, but may be performed alternately or alternately with other steps or at least a portion of the sub-steps or stages of the other steps.

In an embodiment, as shown in FIG. 4, a vulnerability scanning apparatus is provided, including: a traffic interception module, a data determination module, a query module, a traffic type acquisition module, a rule acquisition module, and a scanning module, where:

The traffic intercepting module 100 is configured to intercept traffic data to be scanned.

The data judging module 200 is configured to determine whether the intercepted traffic data to be scanned is dynamic data.

The query module 300 is configured to query whether the flow data to be scanned has a parameter when the intercepted traffic data to be scanned is dynamic data.

The traffic type obtaining module 400 is configured to acquire the type of the traffic data to be scanned when there is a parameter of the traffic data to be scanned.

The rule obtaining module 500 is configured to acquire a vulnerability scanning rule corresponding to the type of the traffic data to be scanned.

The scanning module 600 is configured to perform vulnerability scanning on the scanned traffic data by using a vulnerability scanning rule.

In one embodiment, the apparatus may further include:

The resource occupancy obtaining module is configured to obtain the current resource occupancy rate after the traffic data to be scanned is intercepted. If the current resource usage rate exceeds the threshold, the resource usage rate of the standby scanning server is obtained.

The scanning module is further configured to select whether the standby scanning server with the lowest resource occupancy rate of the standby scanning server continues to determine whether the intercepted traffic data to be scanned is a dynamic number.

In one embodiment, the apparatus may further include:

The fault judging module is configured to determine whether the current scan server is faulty before acquiring the current resource occupancy rate.

The resource occupancy acquisition module is further configured to: if the current scan server fails, obtain the current resource occupancy rate; if the current scan server fails, obtain the resource occupancy rate of the standby scan server.

The scanning module is further configured to select the standby scanning server with the lowest resource occupancy rate of the standby scanning server to continue to determine whether the intercepted traffic data to be scanned is dynamic data.

In one embodiment, the apparatus may further include:

The statistics module is configured to count the number of interception of the traffic data to be scanned before intercepting the traffic data to be scanned.

The startup module is configured to start a corresponding number of scan servers according to the number of interceptions.

The data judging module is further configured to allocate the to-be-scanned traffic data to the activated scan server to continue to determine whether the intercepted traffic data to be scanned is dynamic data.

In one embodiment, the apparatus may further include:

The receiving module is configured to receive a vulnerability scanning rule adjustment instruction for the traffic data to be scanned after the vulnerability scanning rule scans the traffic data through the vulnerability scanning rule.

A supplemental rule acquisition module is configured to obtain a vulnerability scan supplemental rule according to the vulnerability scan rule adjustment instruction.

A supplemental scanning module for vulnerability scanning of scanned traffic data through vulnerability scanning supplemental rules.

In one of the embodiments, the intercepting module may be further configured to intercept the traffic data to be scanned by an agent preset in the client.

In one embodiment, the intercepting module is further configured to receive the mirrored traffic data generated by the core switch according to the intercepted traffic data to be scanned as the traffic data to be scanned.

For specific definitions of the vulnerability scanning device, reference may be made to the limitation of the vulnerability scanning method in the above, and details are not described herein again. Each of the above-described vulnerability scanning devices may be implemented in whole or in part by software, hardware, and combinations thereof. Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in FIG. The computer device includes a processor, memory, network interface, and database connected by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The non-volatile storage medium stores an operating system, computer readable instructions, and a database. The internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium. The database of the computer device is used to store vulnerability scan rule data. The network interface of the computer device is used to communicate with an external terminal via a network connection. The computer readable instructions are executed by the processor to implement a vulnerability scanning method.

It will be understood by those skilled in the art that the structure shown in FIG. 5 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied. The specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.

In one embodiment, a computer device is provided, including a memory, a processor, and a computer readable instruction stored thereon, the processor executing the computer readable instructions to: intercept the traffic data to be scanned; and determine the intercepted Whether the traffic data to be scanned is dynamic data; when the intercepted traffic data to be scanned is dynamic data, query whether the traffic data to be scanned has a parameter; when the traffic data to be scanned has a parameter, obtain the type of the traffic data to be scanned; Vulnerability scanning rules corresponding to the type of traffic data to be scanned; vulnerability scanning is performed on the scanned traffic data through the vulnerability scanning rule.

After the step of intercepting the to-be-scanned traffic data, the processor may further include: acquiring the current resource occupancy rate; and acquiring the standby scan server if the current resource occupancy rate exceeds the threshold value. The resource usage rate of the standby scanning server with the lowest resource usage of the standby scanning server continues to be performed to determine whether the intercepted traffic data to be scanned is dynamic data.

Before the step of obtaining the current resource occupancy rate by the processor when the processor executes the computer readable instructions, the method may further include: determining whether the current scan server is faulty; if the current scan server does not fail, proceeding to perform the acquisition. The current resource usage rate is as follows: if the current scan server is faulty, the resource usage rate of the standby scan server is obtained; and the standby scan server with the lowest resource occupancy rate of the standby scan server continues to determine whether the intercepted traffic data to be scanned is dynamic. The steps of the data.

After the step of intercepting the to-be-scanned traffic data is implemented by the processor, the processor may further include: intercepting the interception times of the traffic data to be scanned; and starting a corresponding number of scan servers according to the number of intercepts; The traffic data to be scanned is allocated to the activated scan server to continue the step of determining whether the intercepted traffic data to be scanned is dynamic data.

After the step of performing the vulnerability scanning by the vulnerability scanning rule to scan the traffic data by the processor executing the computer readable instructions in one embodiment, the method may further include: receiving a vulnerability scanning rule adjustment instruction for the traffic data to be scanned; The vulnerability scan rule adjustment instruction acquires a vulnerability scan supplemental rule; the vulnerability scan supplemental rule scans the scanned traffic data for vulnerability.

The step of intercepting the to-be-scanned traffic data implemented by the processor when executing the computer readable instructions in one of the embodiments may include: intercepting the to-be-scanned traffic data by an agent preset in the client.

The step of intercepting the to-be-scanned traffic data implemented by the processor when executing the computer readable instructions in one embodiment may include: receiving the mirrored traffic data generated by the core switch according to the intercepted traffic data to be scanned as the traffic data to be scanned. .

In one embodiment, a computer readable storage medium is provided having stored thereon computer readable instructions that, when executed by a processor, perform the steps of: intercepting traffic data to be scanned; determining the intercepted to be scanned Whether the traffic data is dynamic data; when the intercepted traffic data to be scanned is dynamic data, query whether the traffic data to be scanned has a parameter; when the traffic data to be scanned has a parameter, obtain the type of the traffic data to be scanned; Scan the vulnerability scan rule corresponding to the type of traffic data; perform vulnerability scanning on the scanned traffic data through the vulnerability scan rule.

One of ordinary skill in the art can understand that all or part of the process of implementing the above embodiments can be completed by computer readable instructions, which can be stored in a non-volatile computer. The readable storage medium, which when executed, may include the flow of an embodiment of the methods as described above. Any reference to a memory, storage, database or other medium used in the various embodiments provided herein may include non-volatile and/or volatile memory. Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain. Synchlink DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

The technical features of the above embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, It is considered to be the range described in this specification.

The above-mentioned embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims

A vulnerability scanning method, the method comprising:

Intercepting traffic data to be scanned;

Determining whether the intercepted traffic data to be scanned is dynamic data;

When the intercepted traffic data to be scanned is dynamic data, query whether the traffic data to be scanned has parameters;

Obtaining a type of the to-be-scanned traffic data when the scanning traffic data has a parameter;

Obtaining a vulnerability scanning rule corresponding to the type of the traffic data to be scanned; and

The vulnerability scanning data is subjected to vulnerability scanning by the vulnerability scanning rule.
The method according to claim 1, wherein after the step of intercepting the traffic data to be scanned, the method further comprises:

Obtain the current resource occupancy rate;

If the current resource occupancy rate exceeds the threshold, the resource occupancy rate of the standby scanning server is obtained; and

The standby scanning server with the lowest resource usage of the standby scanning server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The method according to claim 2, wherein before the step of acquiring the current resource occupancy rate, the method further comprises:

Determine whether the current scan server is faulty;

If the current scan server does not fail, continue to perform the step of obtaining the current resource occupancy rate;

If the current scan server fails, the resource occupancy rate of the standby scan server is obtained;

The standby scanning server with the lowest resource usage of the standby scanning server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The method according to claim 1, wherein after the step of intercepting the traffic data to be scanned, the method further comprises:

Counting the number of intercepts of the traffic data to be scanned;

Starting a corresponding number of scan servers according to the number of intercepts; and

And distributing the to-be-scanned traffic data to the activated scan server to continue performing the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The method according to any one of claims 1 to 4, wherein after the step of performing vulnerability scanning on the to-be-scanned traffic data by the vulnerability scanning rule, the method further includes:

Receiving a vulnerability scan rule adjustment instruction for the traffic data to be scanned;

Obtaining a vulnerability scanning supplement rule according to the vulnerability scanning rule adjustment instruction; and

Vulnerability scanning is performed on the to-be-scanned traffic data by using the vulnerability scanning supplemental rule.
The method according to any one of claims 1 to 4, wherein the step of intercepting the traffic data to be scanned comprises:

The traffic data to be scanned is intercepted by a proxy readable instruction set in advance on the client.
The method according to any one of claims 1 to 4, wherein the step of intercepting the traffic data to be scanned comprises:

The receiving core switch uses the mirrored traffic data generated according to the intercepted traffic data to be scanned as the traffic data to be scanned.
A vulnerability scanning device, characterized in that the device comprises:

a traffic intercepting module, configured to intercept traffic data to be scanned;

a data judging module, configured to determine whether the intercepted traffic data to be scanned is dynamic data;

a querying module, configured to query whether the flow data to be scanned has a parameter when the intercepted traffic data to be scanned is dynamic data;

a traffic type obtaining module, configured to acquire a type of the to-be-scanned traffic data when the traffic data to be scanned has a parameter;

a rule obtaining module, configured to acquire a vulnerability scanning rule corresponding to the type of the traffic data to be scanned; and

And a scanning module, configured to perform vulnerability scanning on the to-be-scanned traffic data by using the vulnerability scanning rule.
The device according to claim 8, wherein the device further comprises:

The resource occupancy obtaining module is configured to obtain the current resource occupancy rate; if the current resource occupancy rate exceeds the threshold, the resource occupancy rate of the standby scanning server is obtained;

The scanning module is further configured to select the standby scanning server with the lowest resource occupancy rate of the standby scanning server to continue to determine whether the intercepted traffic data to be scanned is dynamic data.
A computer device comprising a memory, a processor, on which is stored computer readable instructions, wherein the processor, when executing the computer readable instructions, implements the following steps:

Intercepting traffic data to be scanned;

Determining whether the intercepted traffic data to be scanned is dynamic data;

When the intercepted traffic data to be scanned is dynamic data, query whether the traffic data to be scanned has parameters;

Obtaining a type of the to-be-scanned traffic data when the scanning traffic data has a parameter;

Obtaining a vulnerability scanning rule corresponding to the type of the traffic data to be scanned; and

The vulnerability scanning data is subjected to vulnerability scanning by the vulnerability scanning rule.
The computer device according to claim 10, wherein after the step of intercepting the to-be-scanned traffic data implemented by the processor when the processor is executed by the processor, the method further comprises:

Obtain the current resource occupancy rate;

If the current resource occupancy rate exceeds the threshold, the resource occupancy rate of the standby scanning server is obtained; and

The standby scanning server with the lowest resource usage of the standby scanning server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The computer device according to claim 11, wherein before the step of acquiring the current resource occupancy rate that is implemented when the processor executes the computer readable instructions, the method further includes:

Determine whether the current scan server is faulty;

If the current scan server does not fail, continue to perform the step of obtaining the current resource occupancy rate;

If the current scan server fails, the resource occupancy rate of the standby scan server is obtained;

The standby scanning server with the lowest resource usage of the standby scanning server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The computer device according to claim 10, wherein after the step of intercepting the to-be-scanned traffic data implemented by the processor when the processor is executed by the processor, the method further comprises:

Counting the number of intercepts of the traffic data to be scanned;

Starting a corresponding number of scan servers according to the number of intercepts; and

And distributing the to-be-scanned traffic data to the activated scan server to continue performing the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The computer device according to any one of claims 10 to 13, wherein the flow data to be scanned is performed by the vulnerability scanning rule implemented by the processor when the computer readable instructions are executed After the steps of vulnerability scanning, it also includes:

Receiving a vulnerability scan rule adjustment instruction for the traffic data to be scanned;

Obtaining a vulnerability scanning supplement rule according to the vulnerability scanning rule adjustment instruction; and

Vulnerability scanning is performed on the to-be-scanned traffic data by using the vulnerability scanning supplemental rule.
The computer device according to any one of claims 10 to 13, wherein the step of intercepting the to-be-scanned traffic data implemented by the processor when the processor is executed by the computer comprises:

The traffic data to be scanned is intercepted by a proxy readable instruction set in advance on the client.
The computer device according to any one of claims 10 to 13, wherein the step of intercepting the to-be-scanned traffic data implemented by the processor when the processor is executed by the computer comprises:

The receiving core switch uses the mirrored traffic data generated according to the intercepted traffic data to be scanned as the traffic data to be scanned.
One or more computer readable non-volatile storage media storing computer readable instructions, wherein when the computer readable instructions are executed by one or more processors, cause one or more processors to perform the following step:

Intercepting traffic data to be scanned;

Determining whether the intercepted traffic data to be scanned is dynamic data;

When the intercepted traffic data to be scanned is dynamic data, query whether the traffic data to be scanned has parameters;

Obtaining a type of the to-be-scanned traffic data when the scanning traffic data has a parameter; and

Obtaining a vulnerability scan rule corresponding to the type of the traffic data to be scanned;

The vulnerability scanning data is subjected to vulnerability scanning by the vulnerability scanning rule.
The storage medium of claim 17, wherein when the computer readable instructions are executed by one or more processors, causing the one or more processors to perform the step of intercepting the flow data to be scanned, Also includes:

Obtain the current resource occupancy rate;

If the current resource occupancy rate exceeds the threshold, the resource occupancy rate of the standby scanning server is obtained; and

The standby scanning server with the lowest resource usage of the standby scanning server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The storage medium of claim 18, wherein when the computer readable instructions are executed by one or more processors, causing the one or more processors to perform the step of obtaining a current resource occupancy, Also includes:

Determine whether the current scan server is faulty;

If the current scan server does not fail, continue to perform the step of obtaining the current resource occupancy rate;

If the current scan server fails, the resource occupancy rate of the standby scan server is obtained;

The standby scanning server with the lowest resource usage of the standby scanning server continues to perform the step of determining whether the intercepted traffic data to be scanned is dynamic data.
The storage medium of claim 17, wherein when the computer readable instructions are executed by one or more processors, causing the one or more processors to perform the step of intercepting the flow data to be scanned, Also includes:

Counting the number of intercepts of the traffic data to be scanned;

Starting a corresponding number of scan servers according to the number of intercepts; and

And distributing the to-be-scanned traffic data to the activated scan server to continue performing the step of determining whether the intercepted traffic data to be scanned is dynamic data.