WO2019153384A1 - 一种漏洞扫描方法、服务端及系统 - Google Patents

一种漏洞扫描方法、服务端及系统 Download PDF

Info

Publication number
WO2019153384A1
WO2019153384A1 PCT/CN2018/077557 CN2018077557W WO2019153384A1 WO 2019153384 A1 WO2019153384 A1 WO 2019153384A1 CN 2018077557 W CN2018077557 W CN 2018077557W WO 2019153384 A1 WO2019153384 A1 WO 2019153384A1
Authority
WO
WIPO (PCT)
Prior art keywords
scan
task
page
proxy node
host
Prior art date
Application number
PCT/CN2018/077557
Other languages
English (en)
French (fr)
Inventor
王海涵
许友南
钟启富
施纯毅
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to US16/099,815 priority Critical patent/US11070580B1/en
Priority to EP18871818.3A priority patent/EP3751811A4/en
Publication of WO2019153384A1 publication Critical patent/WO2019153384A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/563—Data redirection of data network streams
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H04L67/63—Routing a service request depending on the request content or context

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a vulnerability scanning method, a server, and a system.
  • the traditional vulnerability scanning tool scans the computer and the content is pre-customized.
  • the vulnerability scanning tool can perform pre-customized scanning content once at a time to detect possible vulnerabilities defined in the scanned content.
  • this vulnerability scanning method has a large limitation.
  • the content scanned for the computer can only be included in the pre-customized content. For different computers, these customized scanning contents may not be applicable, or the computer may not be fully applicable. Perform a vulnerability scan. Therefore, the accuracy of vulnerability scanning in the prior art is not high enough.
  • the purpose of the application is to provide a vulnerability scanning method, a server and a system, which can improve the accuracy of vulnerability scanning.
  • an application of the present invention provides a vulnerability scanning method, the method comprising: identifying a host service running in a target host, and establishing a scan task adapted to the identified host service; The scanning task is sent to the task scheduling center, so that the proxy node acquires at least one scan task from the task scheduling center; wherein the proxy node obtains the at least one scan task after the target host is obtained a scan result; receiving a scan result fed back by the proxy node, and determining whether the specified host service exists in the identified host service, where the specified host service is used to represent that the website resource is running in the target host; Executing, the scanning subtask corresponding to the specified host service is delivered to the task scheduling center; wherein the scanning subtask is obtained by the proxy node from the task scheduling center and executed for the target host, The scan result corresponding to the specified host service in the target host.
  • another aspect of the present application further provides a server, where the server includes a memory and a processor, where the computer stores a computer program, and when the computer program is executed by the processor, the following steps are implemented. Identifying a host service running in the target host, and establishing a scan task adapted to the identified host service; delivering the established scan task to the task scheduling center, so that the proxy node is scheduled from the task Acquiring at least one scan task at the center; wherein the proxy node obtains a scan result after performing the at least one scan task for the target host; receiving a scan result fed back by the proxy node, and determining the identified In the host service, whether there is a specified host service; the specified host service is used to indicate that the website resource is running in the target host; if yes, the scanner corresponding to the specified host service is delivered to the task scheduling center again. a task; wherein the scan subtask is obtained by the proxy node from the task dispatch center After execution for the target host, the destination host to obtain the specified
  • the present application further provides a vulnerability scanning system, where the system includes a server, a task scheduling center, and a proxy node, where: the server is configured to identify a host service running in a target host; Establishing a scan task that is compatible with the host service, and sending the created scan task to the task scheduling center; determining whether the specified host service exists in the identified host service, the designated host The service is used to indicate that a website resource is run in the target host; if yes, the scan subtask corresponding to the specified host service is delivered to the task scheduling center; and the scan result fed back by the proxy node is received; a task scheduling center, configured to receive a scan task or a scan sub-task delivered by the server, and place the scan task or scan sub-task in a task queue; the proxy node is configured to be used from the task dispatch center Obtaining at least one scan task or scanning a subtask, and performing the at least one scan on the target host Service subtasks or scanned, to obtain a scanning result; feedback obtained
  • the technical solution provided by the present application can perform a scan task multiple times when performing vulnerability scan on the target host, and each time the scan task is delivered based on the service, website or component in the host. Determined after identification. Specifically, when it is identified that the host service exists in the target host, the server may send a scan task corresponding to the host service to the task scheduling center. If the specified host service that represents the website resource exists in the identified host service, the server may deliver the scan subtask for the specified host service again. The scan subtask can more fully scan for possible vulnerabilities in the specified host service with respect to the last issued scan task.
  • the page address associated with the website resource may continue to be collected, and for the collected page address, the server may further send a page application scanning task, thereby further Scan for possible vulnerabilities in the website page. Further, the page fingerprint corresponding to the collected page address may be identified, and after the page fingerprint is matched with the preset fingerprint database, whether the specified page component exists in the website page may be determined. If it exists, the server can further deliver the page component scan task, so that the specified page component that may have a vulnerability can be scanned.
  • the technical solution provided by the present application generates a corresponding scanning task based on the recognition result of the host each time, and sends a scanning task multiple times, so as to perform a shallow scan to the target host in a targeted manner. process.
  • the technical solution provided by the present application can scan the website of the operation and maintenance on the host in addition to scanning the host, thereby enabling a more comprehensive scanning process.
  • the distributed scanning mode of the server and the proxy node can be used to improve the efficiency of vulnerability scanning by parallel scanning of multiple proxy nodes. Therefore, the technical solution provided by the present application can not only improve the accuracy of vulnerability scanning, but also improve the efficiency of vulnerability scanning.
  • FIG. 1 is a schematic structural diagram of a system in an embodiment of the present invention.
  • FIG. 2 is a flowchart of a vulnerability scanning method in an embodiment of the present invention
  • FIG. 3 is a flow chart of vulnerability scanning in an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a server in an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of interaction of each subject in an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a computer terminal according to an embodiment of the present invention.
  • the system architecture may include a server, a task scheduling center, and a proxy node.
  • the server may be configured to create a scan task for scanning a vulnerability
  • the task scheduling center may receive a scan task delivered by the server, where the proxy node may obtain a scan task from the task dispatch center, and The acquired scan task is performed for the corresponding host, thereby obtaining scan results related to the host.
  • the scan result can be reported by the proxy node to the server.
  • the above system architecture may adopt a distributed system deployment manner, and the number of proxy nodes may be multiple, and the multiple proxy nodes may be connected to the task scheduling center, and some of the proxy nodes may be directed to the same host. Get different scan tasks, and this part of the proxy nodes can perform the acquired scan tasks in parallel, thus improving the efficiency of vulnerability scanning.
  • the present application provides a vulnerability scanning method, which can be applied to the above system structure.
  • the method may include the following steps.
  • the execution body of the following steps S11 to S15 may be the server end.
  • S11 Identify a host service running in the target host, and establish a scan task that is adapted to the identified host service.
  • the target host may be a host to be scanned for a vulnerability.
  • the server may first identify the host service running in the target host. Specifically, the target host may be detected by an external service to detect the target host's Internet-facing assets, and the vulnerability may be scanned for the Internet-facing assets.
  • not all attacks come from external networks, and some attacks may also come from applications inside the target host. In this way, the server can also perform internal application detection on the target host, thereby detecting assets inside the target host.
  • the detected assets can be used as host services running in the target host.
  • the server can query and identify in the preset vulnerability database.
  • the significance of this processing is that the server does not blindly send scan tasks for all host services, but delivers corresponding scan tasks for host services that may have vulnerabilities.
  • the server can establish a scanning task for the type of the vulnerability.
  • the scanning task for the type of vulnerability can be used as a scanning task adapted to the host service.
  • S13 Deliver the established scan task to a task scheduling center, so that the proxy node acquires at least one scan task from the task scheduling center; wherein the proxy node performs the at least one for the target host After scanning the task, the scan results are obtained.
  • the server may send the scan task to the task scheduling center.
  • the task scheduling center may place the scan task in the task queue to wait for the proxy node to obtain the scan task.
  • the proxy node can selectively obtain the scan task from the task scheduling center based on its current load situation.
  • the proxy node may include a load balancing module, where the load balancing module may acquire a current load parameter of the proxy node when the proxy node is about to obtain a scan task from the task scheduling center.
  • the load parameter may include, for example, the current CPU usage of the proxy node, memory usage, the number of processed scan tasks, and the like.
  • the load balancing module may comprehensively calculate a current load value of the proxy node based on the load parameter. The higher the load value, the lower the ability of the proxy node to handle the scan task.
  • the load balancing module can determine the number of scan tasks expected to be acquired from the task scheduling center according to the current load value of the proxy node.
  • the load balancing module may pre-store a mapping relationship table between the load value and the number of tasks.
  • the mapping relationship table the interval of the load value may be divided, and the number of tasks that can be acquired corresponding to each interval. In this way, after determining the real-time load value of the proxy node, the mapping relationship table can be used to determine the number of scan tasks that can be currently acquired.
  • the obtained scan task can be executed through the scan interface provided by the target host in advance. During the execution of the scan task, it is possible to detect possible vulnerabilities in the target host in terms of host services.
  • the scan task When the scan task is completed, it can be summarized into scan results based on the vulnerability information obtained by the scan. The scan result can be fed back to the server by the proxy node.
  • S15 Receive a scan result fed back by the proxy node, and determine whether the specified host service exists in the identified host service, where the specified host service is used to indicate that a website resource is running in the target host; And sending, to the task scheduling center, the scanning subtask corresponding to the specified host service, where the scanning subtask is obtained by the proxy node from the task scheduling center and executed for the target host, The scan result corresponding to the specified host service in the target host.
  • the server may receive the scan result fed back by the proxy node.
  • the scan result is the result of a preliminary scan of the host service.
  • the scan task established above may be a shallow scan of a host service that may have a vulnerability, and a more elaborate scan for some key host services. Therefore, in the present embodiment, the scanning task can be issued multiple times in a layer-by-layer manner.
  • the server may determine whether the specified host service exists in the identified host service.
  • the designated host service can be used to characterize running a website resource in the target host. Since the website is usually accessed by a large number of users, the specified host service within the representation website resource can be a more important service in the target host, and can be a service that is vulnerable to attack.
  • the specified host service is an HTTP service.
  • the server may establish a scan subtask for the HTTP service again. This scanning subtask can be further scanned for website resources.
  • the server may collect a page address associated with the website resource when determining that an HTTP service exists in the target host.
  • the page address may be a page URL (Uniform Resource Locator) existing in the website.
  • the page application scan task corresponding to the page address may be established.
  • the page application scan task can scan for possible vulnerabilities in the website page, and the page application scan task can be more elaborately involved in the HTTP service than the above-mentioned scan task for the common host service in the target host.
  • the website page is scanned for vulnerabilities.
  • the scanning subtask established by the server may be the page application scanning task.
  • the server may send the page application scan task to the task scheduling center again.
  • the proxy node may continue to obtain at least one page application scan task from the task scheduling center, and may obtain the page address after the proxy node performs the at least one page application scan task for the target host.
  • the scan results can also be fed back to the server.
  • a plurality of page components may be included in a website page, and these page components may be identified by a page fingerprint (web fingerprint).
  • the page fingerprint of the page address may be further identified.
  • the page fingerprint corresponding to the page address may be identified by a keyword in a webpage, or an MD5 code of a specific file, or a keyword in a page address, or a TAG mode of a page address.
  • the server may match the identified page fingerprint with the preset fingerprint library. Therefore, it is determined whether the identified page fingerprint is a specified page fingerprint existing in the preset fingerprint database.
  • the page component of the specified page fingerprint is more likely to be vulnerable. Therefore, in the embodiment, when the identified page fingerprint is determined to be a specified page fingerprint existing in the preset fingerprint database, The page component corresponding to the page fingerprint performs further vulnerability scanning.
  • the server may establish a page component scan task, and the page component scan task may scan the page component included in the website page corresponding to the page address.
  • the server may also send the created page component scan task to the task scheduling center again, so that the proxy node obtains at least one page component scan task from the task scheduling center. .
  • the page component scan result corresponding to the target host may be obtained.
  • the scan task can be sent multiple times, and the scan task that is issued each time is determined based on the identification of the service, website or component in the host. Not only can the host be scanned for vulnerabilities, but also the vulnerabilities of the sites in the host can be scanned, as well as scanning for a web page component. As the scan task is issued multiple times, the scanning process for the target host will become more and more refined. Different from the scanning method using the customized template in the prior art, the technical solution of the present application can issue different scanning tasks for different hosts, and the scanning depth will be deepened as the number of scanning times increases, thereby achieving comprehensiveness. , accurate vulnerability scanning process.
  • a matching proxy node may be selectively employed to perform a scan task based on a network environment in which the target host is located. Specifically, when the target host needs to be scanned, the network environment in which the target host is located can be identified. For example, the operator corresponding to the network currently used by the target host may be determined, and the geographic location where the target host is currently located may also be determined. A target proxy node that is adapted to the identified network environment can then be determined.
  • the determined target proxy node may be in the same carrier's network as the target host, and the target proxy node is closer to the target host.
  • a target proxy node that is adapted to the target host can be selected by means of a content distribution network.
  • the scan task can be acquired from the task scheduling center by the target proxy node, and the acquired scan task can be executed by the target proxy node for the target host. Because it is in the same network environment, it can maintain a good communication connection, thus avoiding the problem of low scanning efficiency due to network environment differences.
  • the content distribution network may be included in the content distribution network.
  • the transmission path of the scan result backhaul is selected in a targeted manner.
  • the network environment in which the proxy nodes are located in the transmission path may be adapted to the network environment in which the target host is located. In this way, the server can identify the network environment in which the target host is located, and receive the scan result reported by the proxy node that is adapted to the identified network environment.
  • the designated port of the target host can be scanned in a specified cycle.
  • the designated port may be the above-mentioned port that needs to set access control measures.
  • the scan result indicates that the designated port does not have access control measures, it indicates that the designated port may cause data leakage.
  • the warning information for the designated port may be generated to remind the administrator of the target host to perform corresponding processing in time, or to add an appropriate access control measure according to the scan result.
  • the scanning task can also be flexibly configured on the server.
  • various scanning parameters when the scan task is executed can be customized at the server.
  • the scan parameters may be, for example, a defined scan depth, a number of scans, and the like.
  • the scan parameter can define a scan mode corresponding to the scan task.
  • the scan task can be executed according to the scan mode defined by the scan parameter.
  • the purpose of this processing is to flexibly configure the vulnerability scanning process according to the requirements of the user.
  • the application further provides a server, where the server includes a memory and a processor, where the computer stores a computer program, and when the computer program is executed by the processor, the following steps are implemented:
  • S11 Identify a host service running in the target host, and establish a scan task that is adapted to the identified host service.
  • S13 Deliver the established scan task to a task scheduling center, so that the proxy node acquires at least one scan task from the task scheduling center; wherein the proxy node performs the at least one for the target host After scanning the task, the scan results are obtained.
  • S15 Receive a scan result fed back by the proxy node, and determine whether the specified host service exists in the identified host service; the specified host service is used to indicate that a website resource is running in the target host; And sending, to the task scheduling center, the scanning subtask corresponding to the specified host service, where the scanning subtask is obtained by the proxy node from the task scheduling center and executed for the target host, The scan result corresponding to the specified host service in the target host.
  • the present application further provides a vulnerability scanning system, where the system includes a server, a task scheduling center, and a proxy node, where:
  • the server is configured to identify a host service running in the target host; establish a scan task that is adapted to the host service, and deliver the created scan task to the task scheduling center; Whether the specified host service exists in the host service, and the specified host service is used to indicate that the website resource is running in the target host; if yes, the task scheduling center sends the specified host service correspondingly to the task scheduling center. Scanning a subtask; receiving a scan result fed back by the proxy node;
  • the task scheduling center is configured to receive a scan task or a scan sub-task delivered by the server, and place the scan task or the scan sub-task in the task queue;
  • the proxy node is configured to acquire at least one scan task or scan a subtask from the task scheduling center, and execute the at least one scan task or scan a subtask for the target host to obtain a scan result; The scan result obtained by the server feedback.
  • the number of proxy nodes may be multiple, and the multiple proxy nodes may be connected to the task scheduling center, and some of the proxy nodes may acquire different scanning tasks for the same host, and the proxy nodes may The acquired scan tasks are executed in parallel to improve the efficiency of vulnerability scanning.
  • the server is further configured to collect a page address associated with the website resource, and establish a page application scan task corresponding to the page address; To the task scheduling center.
  • the server after collecting the page address associated with the website resource, is further configured to identify a page fingerprint of the page address, and match the page fingerprint with a preset fingerprint database. If the page fingerprint is a specified page fingerprint existing in the preset fingerprint database, the page component scan task is established; and the created page component scan task is sent to the task scheduling center again.
  • the server is further configured to identify a network environment where the target host is located, and determine a target proxy node that is adapted to the identified network environment to pass through the target proxy node.
  • the task scheduling center acquires a scan task or a scan subtask, and the target proxy node performs the acquired scan task or scan subtask for the target host.
  • the proxy node further includes an addressing module, where the addressing module is configured to determine a target proxy node that is adapted to a network environment in which the target host is located, and pass the determined target The proxy node reports the scan result to the server.
  • the proxy node further includes a load balancing module, where the load balancing module is configured to acquire a current load parameter of the proxy node, and determine, based on the load parameter, that the expected task is obtained from the task scheduling center.
  • the number of scan tasks or scan subtasks Specifically, the proxy node can selectively obtain a scan task from the task scheduling center based on its current load situation.
  • the load balancing module may acquire a current load parameter of the proxy node when the proxy node is about to obtain a scan task from the task scheduling center.
  • the load parameter may include, for example, the current CPU usage of the proxy node, memory usage, the number of processed scan tasks, and the like.
  • the load balancing module may comprehensively calculate a current load value of the proxy node based on the load parameter. The higher the load value, the lower the ability of the proxy node to handle the scan task. In this way, the load balancing module can determine the number of scan tasks expected to be acquired from the task scheduling center according to the current load value of the proxy node. Specifically, the load balancing module may pre-store a mapping relationship table between the load value and the number of tasks. In the mapping relationship table, the interval of the load value may be divided, and the number of tasks that can be acquired corresponding to each interval. In this way, after determining the real-time load value of the proxy node, the mapping relationship table can be used to determine the number of scan tasks that can be currently acquired.
  • Computer terminal 10 may include one or more (only one of which is shown) processor 102 (processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), for storing data.
  • processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), for storing data.
  • FIG. 6 is merely illustrative and does not limit the structure of the above electronic device.
  • computer terminal 10 may also include more or fewer components than shown in FIG. 6, or have a different configuration than that shown in FIG.
  • the memory 104 can be used to store software programs and modules of application software, and the processor 102 executes various functional applications and data processing by running software programs and modules stored in the memory 104.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may further include memory remotely located relative to processor 102, which may be coupled to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 is for receiving or transmitting data via a network.
  • the network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 10.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module for communicating wirelessly with the Internet.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • the technical solution provided by the present application can issue a scan task multiple times when performing vulnerability scan on the target host, and each time the scan task is delivered based on the host service, website or component in the host. Determined after identification. Specifically, when it is identified that the host service exists in the target host, the server may send a scan task corresponding to the host service to the task scheduling center. If the specified host service that represents the website resource exists in the identified host service, the server may deliver the scan subtask for the specified host service again. The scanning subtask can scan the vulnerability of the specified host service more comprehensively than the scanning task that was issued last time.
  • the page address associated with the website resource may continue to be collected, and for the collected page address, the server may further send a page application scanning task, thereby further Scan for possible vulnerabilities in the website page. Further, the page fingerprint corresponding to the collected page address may be identified, and after the page fingerprint is matched with the preset fingerprint database, whether the specified page component exists in the website page may be determined. If it exists, the server can further deliver the page component scan task, so that the specified page component that may have a vulnerability can be scanned.
  • the technical solution provided by the present application generates a corresponding scanning task based on the recognition result of the host each time, and sends a scanning task multiple times, so as to perform a shallow scan to the target host in a targeted manner. process.
  • the technical solution provided by the present application can scan the website of the operation and maintenance on the host in addition to scanning the host, thereby enabling a more comprehensive scanning process.
  • the distributed scanning mode of the server and the proxy node can be used to improve the efficiency of vulnerability scanning by parallel scanning of multiple proxy nodes. Therefore, the technical solution provided by the present application can not only improve the accuracy of vulnerability scanning, but also improve the efficiency of vulnerability scanning.

Abstract

本发明公开了一种漏洞扫描方法、服务端及系统，其中，所述方法包括：识别目标主机中运行的主机服务，并建立与识别出的所述主机服务相适配的扫描任务；将建立的所述扫描任务下发至任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个扫描任务后，得到扫描结果；接收所述代理节点反馈的扫描结果，并判断识别出的所述主机服务中，是否存在指定主机服务，所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务。本申请提供的技术方案，能够提高漏洞扫描的精度。

Description

一种漏洞扫描方法、服务端及系统 技术领域
本发明涉及互联网技术领域，特别涉及一种漏洞扫描方法、服务端及系统。
背景技术
随着互联网技术的不断发展，互联网中的信息安全问题也日益突出。当前，利用计算机漏洞和网络系统缺陷进行网络攻击已经成为不法分子谋取私利和犯罪的重要手段。为了及时对计算机漏洞进行修复，通常需要利用漏洞扫描工具对计算机进行扫描，从而发现计算机中已经存在的或者潜在的漏洞。
传统的漏洞扫描工具在对计算机进行扫描时，扫描内容都是预先定制好的。漏洞扫描工具可以一次性地将预先定制的扫描内容执行一遍，从而对扫描内容中限定的可能存在的漏洞进行检测。然而，这种漏洞扫描方法具备较大的局限性，针对计算机扫描的内容只能包含于预先定制的内容中，针对不同的计算机，这些定制的扫描内容可能并不适用，或者无法全面地对计算机进行漏洞扫描。因此，现有技术中漏洞扫描的精度不够高。
发明内容
本申请的目的在于提供一种漏洞扫描方法、服务端及系统，能够提高漏洞扫描的精度。
为实现上述目的，本申请一方面提供一种漏洞扫描方法，所述方法包括：识别目标主机中运行的主机服务，并建立与识别出的所述主机服务相适配的扫描任务；将建立的所述扫描任务下发至任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个扫描任务后，得到扫描结果；接收所述代理节点反馈的扫描结果，并判断识别出的所述主机服务中，是否存在指定主机服务，所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；其中，所述扫描子任 务被代理节点从所述任务调度中心处获取并针对所述目标主机执行之后，得到所述目标主机中所述指定主机服务对应的扫描结果。
为实现上述目的，本申请另一方面还提供一种服务端，所述服务端包括存储器和处理器，所述存储器中存储计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：识别目标主机中运行的主机服务，并建立与识别出的所述主机服务相适配的扫描任务；将建立的所述扫描任务下发至任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个扫描任务后，得到扫描结果；接收所述代理节点反馈的扫描结果，并判断识别出的所述主机服务中，是否存在指定主机服务；所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；其中，所述扫描子任务被代理节点从所述任务调度中心处获取并针对所述目标主机执行之后，得到所述目标主机中所述指定主机服务对应的扫描结果。
为实现上述目的，本申请另一方面还提供一种漏洞扫描系统，所述系统包括服务端、任务调度中心以及代理节点，其中：所述服务端，用于识别目标主机中运行的主机服务；建立与所述主机服务相适配的扫描任务，并将建立的所述扫描任务下发至所述任务调度中心；判断识别出的所述主机服务中，是否存在指定主机服务，所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；接收所述代理节点反馈的扫描结果；所述任务调度中心，用于接收所述服务端下发的扫描任务或者扫描子任务，并将所述扫描任务或者扫描子任务放置于任务队列中；所述代理节点，用于从所述任务调度中心处获取至少一个扫描任务或者扫描子任务，并针对所述目标主机执行所述至少一个扫描任务或者扫描子任务，以得到扫描结果；向所述服务端反馈得到的扫描结果。
由上可见，本申请提供的技术方案，在对目标主机进行漏洞扫描时，可以多次下发扫描任务，并且每次下发的扫描任务，都是基于对主机中的服务、网站或者组件进行识别后确定的。具体地，在识别到目标主机中存在主机服务时，服务端可以向任务调度中心下发主机服务对应的扫描任务。若识别出的主机服务中存在表征网站资源的指定主机服务时，服务端可以再次下发针对该指定主机服务的扫描子任务。该扫描子任务相对上一次下发的扫描任务而言，能够更 加全面地扫描所述指定主机服务中可能存在的漏洞。在针对表征网站资源的指定主机服务下发扫描子任务后，还可以继续收集该网站资源相关联的页面地址，并且针对收集的页面地址，服务端可以进一步地下发页面应用扫描任务，从而可以进一步地针对网站页面中可能存在的漏洞进行扫描。进一步地，可以识别出收集到的页面地址对应的页面指纹，通过将页面指纹与预设指纹库进行匹配后，可以确定网站页面中是否存在指定的页面组件。若存在，服务端可以进一步下发页面组件扫描任务，从而可以对可能存在漏洞的指定页面组件进行扫描。由上可见，本申请提供的技术方案，每次都是基于针对主机的识别结果来生成相应的扫描任务，并多次下发扫描任务，从而有针对性地对目标主机进行由浅入深的扫描过程。此外，本申请提供的技术方案，除了可以对主机进行扫描，还可以对主机上运维的网站进行扫描，从而能够实现更加全面的扫描过程。在系统结构方面，采用服务端与代理节点的分布式扫描模式，可以通过多个代理节点平行扫描的方式，提高漏洞扫描的效率。因此，本申请提供的技术方案，不仅能够提高漏洞扫描的精度，而且能够提高漏洞扫描的效率。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例中系统结构示意图；
图2是本发明实施例中漏洞扫描方法流程图；
图3是本发明实施例中漏洞扫描流程图；
图4是本发明实施例中服务端的结构示意图；
图5是本发明实施例中各主体交互示意图；
图6是本发明实施例中计算机终端的结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
实施例一
本申请提供的技术方案，可以应用于如图1所示的系统架构中。请参阅图1，所述系统架构可以包括服务端、任务调度中心以及代理节点。其中，所述服务端可以用于创建扫描漏洞的扫描任务，所述任务调度中心可以接收所述服务端下发的扫描任务，所述代理节点可以从所述任务调度中心处获取扫描任务，并针对相应的主机执行获取的扫描任务，从而得到与该主机相关的扫描结果。最终，扫描结果可以由代理节点上报至所述服务端。
在本申请中，上述的系统架构可以采用分布式系统的部署方式，代理节点的数量可以为多个，这多个代理节点均可以与任务调度中心相连，其中的部分代理节点可以针对同一个主机获取不同的扫描任务，并且这部分代理节点可以并行执行获取的扫描任务，从而提高漏洞扫描的效率。
本申请提供一种漏洞扫描方法，所述方法可以应用于上述的系统结构中。请参阅图2和图3，所述方法可以包括以下步骤，下述步骤S11至S15的执行主体可以是上述的服务端。
S11：识别目标主机中运行的主机服务，并建立与识别出的所述主机服务相适配的扫描任务。
在本实施方式中，所述目标主机可以是待扫描漏洞的主机，服务端在针对所述目标主机下发扫描任务时，首先可以识别所述目标主机中运行的主机服务。具体地，可以通过对所述目标主机进行外部服务探测，从而检测到所述目标主机面向互联网的资产，后续可以针对这些面向互联网的资产进行漏洞扫描。此外，并不是所有的攻击都来自于外部网络，有些攻击还可能来自于目标主机内部的应用。这样，服务端还可以对所述目标主机进行内部应用检测，从而检测到所述目标主机内部的资产。
在本实施方式中，上述检测到的资产均可以作为目标主机中运行的主机服务，在检测到所述目标主机中存在运行的主机服务后，服务端可以在预设漏洞数据库中查询与识别出的所述主机服务相适配的漏洞类型。这样处理的意义在于，服务端不会盲目地下发针对所有主机服务的扫描任务，而是针对可能存在漏洞的主机服务才下发对应的扫描任务。这样，在识别出主机服务适配的漏洞类型后，服务端可以建立针对所述漏洞类型的扫描任务。其中，针对所述漏洞 类型的扫描任务就可以作为与主机服务相适配的扫描任务。
S13：将建立的所述扫描任务下发至任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个扫描任务后，得到扫描结果。
在本实施方式中，服务端在建立了针对所述目标主机的扫描任务后，可以将所述扫描任务下发至所述任务调度中心。所述任务调度中心接收到扫描任务后，可以将扫描任务放置于任务列队中，以等待代理节点来获取扫描任务。
在本实施方式中，代理节点可以基于自身当前的负载情况，有选择地从任务调度中心处获取扫描任务。具体地，所述代理节点中可以包括负载均衡模块，所述负载均衡模块可以在代理节点即将从任务调度中心处获取扫描任务时，获取所述代理节点当前的负载参数。所述负载参数例如可以包括所述代理节点当前的CPU使用量、内存使用量、处理的扫描任务的数量等。负载均衡模块可以基于所述负载参数，综合算出所述代理节点当前的负载值。负载值越高，表示代理节点处理扫描任务的能力越低。这样，负载均衡模块可以根据所述代理节点当前的负载值，确定预计从所述任务调度中心获取的扫描任务的数量。具体地，负载均衡模块中可以预先存储负载值与任务数量之间的映射关系表，在该映射关系表中，可以划分负载值的区间，以及每个区间所对应的能够获取的任务数量。这样，在确定出代理节点实时的负载值之后，通过该映射关系表便可以确定当前能够获取的扫描任务的数量。
在本实施方式中，代理节点在获取了针对所述目标主机的扫描任务之后，便可以通过所述目标主机预先提供的扫描接口，执行获取的所述扫描任务。在扫描任务执行过程中，便可以检测目标主机中在主机服务方面可能存在的漏洞。当扫描任务执行完成时，便可以根据扫描得到的漏洞信息，汇总成扫描结果。该扫描结果可以由代理节点反馈至所述服务端。
S15：接收所述代理节点反馈的扫描结果，并判断识别出的所述主机服务中，是否存在指定主机服务，所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；其中，所述扫描子任务被代理节点从所述任务调度中心处获取并针对所述目标主机执行之后，得到所述目标主机中所述指定主机服务对应的扫描结果。
在本实施方式中，服务端可以接收代理节点反馈的扫描结果。该扫描结果是针对主机服务初步扫描后得到的结果。上述建立的扫描任务，可以是对可能存在漏洞的主机服务进行的浅层扫描，针对一些重点的主机服务，并不会进行更加精细的扫描。因此，在本实施方式中，可以通过逐层深入的方式，多次下发扫描任务。具体地，服务端可以判断识别出的所述主机服务中，是否存在指定主机服务。所述指定主机服务可以用于表征在所述目标主机中运行有网站资源。由于网站通常会被大量用户访问，因此表征网站资源内的指定主机服务可以是目标主机中比较重要的服务，并且可以是容易被攻击的服务。例如，所述指定主机服务为HTTP服务。在实际应用中，当确定所述目标主机中开启有HTTP服务时，服务端可以针对HTTP服务，再次建立扫描子任务。该扫描子任务可以针对网站资源进行进一步地扫描。
在一个实施方式中，服务端在确定所述目标主机中存在HTTP服务时，可以收集与所述网站资源相关联的页面地址。该页面地址可以是网站中存在的页面URL(Uniform Resource Locator，统一资源定位符)。在收集到与网站资源相关联的页面地址后，可以建立所述页面地址对应的页面应用扫描任务。该页面应用扫描任务可以针对网站页面中可能存在的漏洞进行扫描，相比于上述的针对目标主机中普通主机服务的扫描任务而言，所述页面应用扫描任务可以更加精细地对HTTP服务所涉及的网站页面进行漏洞扫描。这样，在本实施方式中，服务端建立的所述扫描子任务便可以是所述页面应用扫描任务。
在本实施方式中，服务端在建立了所述页面应用扫描任务后，可以再次向所述任务调度中心下发所述页面应用扫描任务。这样，代理节点可以继续从所述任务调度中心处获取至少一个页面应用扫描任务，并且在所述代理节点在针对所述目标主机执行所述至少一个页面应用扫描任务后，可以得到所述页面地址对应的扫描结果，该扫描结果同样可以被反馈至所述服务端中。
在一个实施方式中，网站页面中可以包括多个页面组件，这些页面组件可以通过页面指纹(web指纹)来识别。具体地，在收集到所述页面地址后，可以进一步地识别所述页面地址的页面指纹。在实际应用中，可以通过在网页中的关键字，或者特定文件的MD5码，或者页面地址中的关键字，又或者通过页面地址的TAG模式，来识别所述页面地址对应的页面指纹。在识别出所述页面指纹之后，服务端可以将识别出的页面指纹与预设指纹库进行匹配。从而判断识 别出的页面指纹是否为存在于所述预设指纹库中的指定页面指纹。所述指定页面指纹表征的页面组件存在漏洞的可能性较大，因此，在本实施方式中，在确定识别出的页面指纹为存在于所述预设指纹库中的指定页面指纹时，可以针对该页面指纹对应的页面组件进行进一步的漏洞扫描。
具体地，在本实施方式中，服务端可以建立页面组件扫描任务，该页面组件扫描任务可以针对页面地址对应的网站页面中包含的页面组件进行扫描。服务端在建立了页面组件扫描任务后，同样可以将建立的所述页面组件扫描任务再次下发至所述任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个页面组件扫描任务。这样，所述代理节点在针对所述目标主机执行所述至少一个页面组件扫描任务后，可以得到所述目标主机对应的页面组件扫描结果。
由上可见，在对目标主机进行漏洞扫描时，可以多次下发扫描任务，并且每次下发的扫描任务，都是基于对主机中的服务、网站或者组件进行识别后确定的。不仅可以对主机进行漏洞扫描，还可以对主机中的网站进行漏洞扫描，同时还能够针对某个网页组件进行扫描。随着扫描任务的多次下发，针对目标主机的扫描过程也会越来越精细。不同于现有技术中采用定制模板的扫描方式，本申请的技术方案，能够针对不同的主机，下发不同的扫描任务，并且扫描深度也会随着扫描次数的增加而不断加深，从而实现全面、精确的漏洞扫描过程。
在实际应用中，由于运营商不同，主机所处的网络环境也可能差异巨大。现有技术中在进行主机扫描时，很有可能由于网络原因，无法与待扫描的主机取得通信联系，或者通信缓慢。鉴于此，在本申请一个实施方式中，可以基于目标主机所处的网络环境，有选择地采用相适配的代理节点来执行扫描任务。具体地，在需要对目标主机进行扫描时，可以识别所述目标主机所处的网络环境。例如，可以确定所述目标主机当前采用的网络所对应的运营商，还可以确定所述目标主机当前所处的地理位置。然后，可以确定与识别出的所述网络环境相适配的目标代理节点。例如，确定出的所述目标代理节点可以与所述目标主机处于同一个运营商的网络中，并且所述目标代理节点与所述目标主机距离较近。在实际应用场景中，可以借助于内容分发网络，来选择与目标主机相适配的目标代理节点。这样，后续可以通过所述目标代理节点从所述任务调度中心获取扫描任务，并由所述目标代理节点针对所述目标主机执行获取的所述扫 描任务。由于处于同一个网络环境，便可以保持较好的通信连接，从而可以避免由于网络环境差异而带来的扫描效率低下的问题。
在一个实施方式中，在选用与所述目标主机所处的网络环境相适配的代理节点执行完扫描任务，并得到扫描结果之后，为了提高扫描结果的上传效率，可以在内容分发网络中有针对性地选择扫描结果回传的传输路径。在所述传输路径中各个代理节点所处的网络环境，可以与所述目标主机所处的网络环境相适配。这样，服务端可以识别所述目标主机所处的网络环境，并接收与识别出的所述网络环境相适配的代理节点上报的扫描结果。
在一个实施方式中，考虑到目标主机中，有些端口会产生比较严重的漏洞，如果这些端口没有设置访问控制措施，而直接开放的话，会导致目标主机的数据泄露。因此，在本实施方式中，可以按照指定周期对所述目标主机的指定端口进行扫描。所述指定端口可以是上述的需要设置访问控制措施的端口。当扫描结果表征所述指定端口不具备访问控制措施时，表明该指定端口可能造成数据泄露。此时，可以生成针对所述指定端口的预警信息，以提醒目标主机的管理者及时进行相应处理，也可以依据扫描结果，新增相适配的访问控制措施。
在一个实施方式中，在所述服务端还可以灵活配置扫描任务。具体地，在服务端可以自定义扫描任务被执行时的各种扫描参数。所述扫描参数例如可以是限定的扫描深度、扫描次数等。这样，所述扫描参数可以限定所述扫描任务对应的扫描方式。那么后续代理节点在执行所述扫描任务时，便可以按照所述扫描参数限定的扫描方式，执行所述扫描任务。这样处理的目的在于，可以根据用户的要求，灵活地配置漏洞扫描过程。
实施例二
请参阅图4，本申请还提供一种服务端，所述服务端包括存储器和处理器，所述存储器中存储计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：
S11：识别目标主机中运行的主机服务，并建立与识别出的所述主机服务相适配的扫描任务。
S13：将建立的所述扫描任务下发至任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个扫描任务；其中，所述代理节点在针对所述目标 主机执行所述至少一个扫描任务后，得到扫描结果。
S15：接收所述代理节点反馈的扫描结果，并判断识别出的所述主机服务中，是否存在指定主机服务；所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；其中，所述扫描子任务被代理节点从所述任务调度中心处获取并针对所述目标主机执行之后，得到所述目标主机中所述指定主机服务对应的扫描结果。
在一个实施方式中，所述计算机程序被所述处理器执行时，还实现以下步骤：
收集与所述网站资源相关联的页面地址，并建立所述页面地址对应的页面应用扫描任务；
将建立的所述页面应用扫描任务再次下发至所述任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个页面应用扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个页面应用扫描任务后，得到所述页面地址对应的扫描结果。
在一个实施方式中，所述计算机程序被所述处理器执行时，还实现以下步骤：
识别所述页面地址的页面指纹，并将所述页面指纹与预设指纹库进行匹配，若所述页面指纹为存在于所述预设指纹库中的指定页面指纹，建立页面组件扫描任务；
将建立的所述页面组件扫描任务再次下发至所述任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个页面组件扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个页面组件扫描任务后，得到所述目标主机对应的页面组件扫描结果。
实施例三
请参阅图1和图5，本申请还提供一种漏洞扫描系统，所述系统包括服务端、任务调度中心以及代理节点，其中：
所述服务端，用于识别目标主机中运行的主机服务；建立与所述主机服务相适配的扫描任务，并将建立的所述扫描任务下发至所述任务调度中心；判断 识别出的所述主机服务中，是否存在指定主机服务，所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；接收所述代理节点反馈的扫描结果；
所述任务调度中心，用于接收所述服务端下发的扫描任务或者扫描子任务，并将所述扫描任务或者扫描子任务放置于任务队列中；
所述代理节点，用于从所述任务调度中心处获取至少一个扫描任务或者扫描子任务，并针对所述目标主机执行所述至少一个扫描任务或者扫描子任务，以得到扫描结果；向所述服务端反馈得到的扫描结果。
在本实施方式中，代理节点的数量可以为多个，这多个代理节点均可以与任务调度中心相连，其中的部分代理节点可以针对同一个主机获取不同的扫描任务，并且这部分代理节点可以并行执行获取的扫描任务，从而提高漏洞扫描的效率。
在一个实施方式中，所述服务端还用于收集与所述网站资源相关联的页面地址，并建立所述页面地址对应的页面应用扫描任务；将建立的所述页面应用扫描任务再次下发至所述任务调度中心。
在一个实施方式中，所述服务端在收集与所述网站资源相关联的页面地址之后，还用于识别所述页面地址的页面指纹，并将所述页面指纹与预设指纹库进行匹配，若所述页面指纹为存在于所述预设指纹库中的指定页面指纹，建立页面组件扫描任务；将建立的所述页面组件扫描任务再次下发至所述任务调度中心。
在一个实施方式中，所述服务端还用于识别所述目标主机所处的网络环境，并确定与识别出的所述网络环境相适配的目标代理节点，以通过所述目标代理节点从所述任务调度中心获取扫描任务或者扫描子任务，并由所述目标代理节点针对所述目标主机执行获取的所述扫描任务或者扫描子任务。
在一个实施方式中，所述代理节点中还包括寻址模块，所述寻址模块用于确定与所述目标主机所处的网络环境相适配的目标代理节点，并通过确定的所述目标代理节点将扫描结果上报至所述服务端。
在一个实施方式中，所述代理节点中还包括负载均衡模块，所述负载均衡模块用于获取所述代理节点当前的负载参数，并基于所述负载参数，确定预计从所述任务调度中心获取的扫描任务或者扫描子任务的数量。具体地，所述代 理节点可以基于自身当前的负载情况，有选择地从任务调度中心处获取扫描任务。所述负载均衡模块可以在代理节点即将从任务调度中心处获取扫描任务时，获取所述代理节点当前的负载参数。所述负载参数例如可以包括所述代理节点当前的CPU使用量、内存使用量、处理的扫描任务的数量等。负载均衡模块可以基于所述负载参数，综合算出所述代理节点当前的负载值。负载值越高，表示代理节点处理扫描任务的能力越低。这样，负载均衡模块可以根据所述代理节点当前的负载值，确定预计从所述任务调度中心获取的扫描任务的数量。具体地，负载均衡模块中可以预先存储负载值与任务数量之间的映射关系表，在该映射关系表中，可以划分负载值的区间，以及每个区间所对应的能够获取的任务数量。这样，在确定出代理节点实时的负载值之后，通过该映射关系表便可以确定当前能够获取的扫描任务的数量。
请参阅图6，在本申请中，上述实施例中的技术方案可以应用于如图6所示的计算机终端10上。计算机终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器104、以及用于通信功能的传输模块106。本领域普通技术人员可以理解，图6所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图6中所示更多或者更少的组件，或者具有与图6所示不同的配置。
存储器104可用于存储应用软件的软件程序以及模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网 进行通讯。
由上可见，本申请提供的技术方案，在对目标主机进行漏洞扫描时，可以多次下发扫描任务，并且每次下发的扫描任务，都是基于对主机中的主机服务、网站或者组件进行识别后确定的。具体地，在识别到目标主机中存在主机服务时，服务端可以向任务调度中心下发主机服务对应的扫描任务。若识别出的主机服务中存在表征网站资源的指定主机服务时，服务端可以再次下发针对该指定主机服务的扫描子任务。该扫描子任务相对上一次下发的扫描任务而言，能够更加全面地扫描所述指定主机服务中可能存在的漏洞。在针对表征网站资源的指定主机服务下发扫描子任务后，还可以继续收集该网站资源相关联的页面地址，并且针对收集的页面地址，服务端可以进一步地下发页面应用扫描任务，从而可以进一步地针对网站页面中可能存在的漏洞进行扫描。进一步地，可以识别出收集到的页面地址对应的页面指纹，通过将页面指纹与预设指纹库进行匹配后，可以确定网站页面中是否存在指定的页面组件。若存在，服务端可以进一步下发页面组件扫描任务，从而可以对可能存在漏洞的指定页面组件进行扫描。由上可见，本申请提供的技术方案，每次都是基于针对主机的识别结果来生成相应的扫描任务，并多次下发扫描任务，从而有针对性地对目标主机进行由浅入深的扫描过程。此外，本申请提供的技术方案，除了可以对主机进行扫描，还可以对主机上运维的网站进行扫描，从而能够实现更加全面的扫描过程。在系统结构方面，采用服务端与代理节点的分布式扫描模式，可以通过多个代理节点平行扫描的方式，提高漏洞扫描的效率。因此，本申请提供的技术方案，不仅能够提高漏洞扫描的精度，而且能够提高漏洞扫描的效率。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件来实现。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的 保护范围之内。

Claims (17)

  1. 一种漏洞扫描方法，其特征在于，所述方法包括：
    识别目标主机中运行的主机服务，并建立与识别出的所述主机服务相适配的扫描任务；
    将建立的所述扫描任务下发至任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个扫描任务后，得到扫描结果；
    接收所述代理节点反馈的扫描结果，并判断识别出的所述主机服务中，是否存在指定主机服务，所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；其中，所述扫描子任务被代理节点从所述任务调度中心处获取并针对所述目标主机执行之后，得到所述目标主机中所述指定主机服务对应的扫描结果。
  2. 根据权利要求1所述的方法，其特征在于，建立与识别出的所述主机服务相适配的扫描任务包括：
    在预设漏洞数据库中查询与识别出的所述主机服务相适配的漏洞类型；
    建立针对所述漏洞类型的扫描任务，并将建立的所述扫描任务作为与识别出的所述主机服务相适配的扫描任务。
  3. 根据权利要求1所述的方法，其特征在于，所述扫描子任务包括页面应用扫描任务；相应地，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务包括：
    收集与所述网站资源相关联的页面地址，并建立所述页面地址对应的页面应用扫描任务；
    将建立的所述页面应用扫描任务再次下发至所述任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个页面应用扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个页面应用扫描任务后，得到所述页面地址对应的扫描结果。
  4. 根据权利要求3所述的方法，其特征在于，在收集与所述网站资源相关联的页面地址之后，所述方法还包括：
    识别所述页面地址的页面指纹，并将所述页面指纹与预设指纹库进行匹配，若所述页面指纹为存在于所述预设指纹库中的指定页面指纹，建立页面组件扫描任务；
    将建立的所述页面组件扫描任务再次下发至所述任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个页面组件扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个页面组件扫描任务后，得到所述目标主机对应的页面组件扫描结果。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    识别所述目标主机所处的网络环境，并确定与识别出的所述网络环境相适配的目标代理节点；
    通过所述目标代理节点从所述任务调度中心获取扫描任务，并由所述目标代理节点针对所述目标主机执行获取的所述扫描任务。
  6. 根据权利要求1所述的方法，其特征在于，接收所述代理节点反馈的扫描结果包括：
    识别所述目标主机所处的网络环境，并接收与识别出的所述网络环境相适配的代理节点上报的扫描结果。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    按照指定周期对所述目标主机的指定端口进行扫描，当扫描结果表征所述指定端口不具备访问控制措施时，生成针对所述指定端口的预警信息。
  8. 根据权利要求1所述的方法，其特征在于，所述扫描任务中携带扫描参数，所述扫描参数用于限定所述扫描任务对应的扫描方式；相应地，所述代理节点按照所述扫描参数限定的扫描方式，执行所述扫描任务。
  9. 一种服务端，其特征在于，所述服务端包括存储器和处理器，所述存储器中存储计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：
    识别目标主机中运行的主机服务，并建立与识别出的所述主机服务相适配的扫描任务；
    将建立的所述扫描任务下发至任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个扫描任务后，得到扫描结果；
    接收所述代理节点反馈的扫描结果，并判断识别出的所述主机服务中，是否存在指定主机服务；所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；其中，所述扫描子任务被代理节点从所述任务调度中心处获取并针对所述目标主机执行之后，得到所述目标主机中所述指定主机服务对应的扫描结果。
  10. 根据权利要求9所述的服务端，其特征在于，所述计算机程序被所述处理器执行时，还实现以下步骤：
    收集与所述网站资源相关联的页面地址，并建立所述页面地址对应的页面应用扫描任务；
    将建立的所述页面应用扫描任务再次下发至所述任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个页面应用扫描任务；其中，所述代理节点在针对所述目标主机执行所述至少一个页面应用扫描任务后，得到所述页面地址对应的扫描结果。
  11. 根据权利要求10所述的服务端，其特征在于，所述计算机程序被所述处理器执行时，还实现以下步骤：
    识别所述页面地址的页面指纹，并将所述页面指纹与预设指纹库进行匹配，若所述页面指纹为存在于所述预设指纹库中的指定页面指纹，建立页面组件扫描任务；
    将建立的所述页面组件扫描任务再次下发至所述任务调度中心，以使得代理节点从所述任务调度中心处获取至少一个页面组件扫描任务；其中，所述代 理节点在针对所述目标主机执行所述至少一个页面组件扫描任务后，得到所述目标主机对应的页面组件扫描结果。
  12. 一种漏洞扫描系统，其特征在于，所述系统包括服务端、任务调度中心以及代理节点，其中：
    所述服务端，用于识别目标主机中运行的主机服务；建立与所述主机服务相适配的扫描任务，并将建立的所述扫描任务下发至所述任务调度中心；判断识别出的所述主机服务中，是否存在指定主机服务，所述指定主机服务用于表征在所述目标主机中运行有网站资源；若存在，向所述任务调度中心再次下发所述指定主机服务对应的扫描子任务；接收所述代理节点反馈的扫描结果；
    所述任务调度中心，用于接收所述服务端下发的扫描任务或者扫描子任务，并将所述扫描任务或者扫描子任务放置于任务队列中；
    所述代理节点，用于从所述任务调度中心处获取至少一个扫描任务或者扫描子任务，并针对所述目标主机执行所述至少一个扫描任务或者扫描子任务，以得到扫描结果；向所述服务端反馈得到的扫描结果。
  13. 根据权利要求12所述的系统，其特征在于，所述服务端还用于收集与所述网站资源相关联的页面地址，并建立所述页面地址对应的页面应用扫描任务；将建立的所述页面应用扫描任务再次下发至所述任务调度中心。
  14. 根据权利要求13所述的系统，其特征在于，所述服务端在收集与所述网站资源相关联的页面地址之后，还用于识别所述页面地址的页面指纹，并将所述页面指纹与预设指纹库进行匹配，若所述页面指纹为存在于所述预设指纹库中的指定页面指纹，建立页面组件扫描任务；将建立的所述页面组件扫描任务再次下发至所述任务调度中心。
  15. 根据权利要求12所述的系统，其特征在于，所述服务端还用于识别所述目标主机所处的网络环境，并确定与识别出的所述网络环境相适配的目标代理节点，以通过所述目标代理节点从所述任务调度中心获取扫描任务或者扫描子任务，并由所述目标代理节点针对所述目标主机执行获取的所述扫描任务或 者扫描子任务。
  16. 根据权利要求12所述的系统，其特征在于，所述代理节点中还包括寻址模块，所述寻址模块用于确定与所述目标主机所处的网络环境相适配的目标代理节点，并通过确定的所述目标代理节点将扫描结果上报至所述服务端。
  17. 根据权利要求12所述的系统，其特征在于，所述代理节点中还包括负载均衡模块，所述负载均衡模块用于获取所述代理节点当前的负载参数，并基于所述负载参数，确定预计从所述任务调度中心获取的扫描任务或者扫描子任务的数量。
PCT/CN2018/077557 2018-02-07 2018-02-28 一种漏洞扫描方法、服务端及系统 WO2019153384A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US16/099,815 US11070580B1 (en) 2018-02-07 2018-02-28 Vulnerability scanning method, server and system
EP18871818.3A EP3751811A4 (en) 2018-02-07 2018-02-28 METHOD AND SYSTEM FOR SCANNING VULNERABILITIES AND SERVER

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810124877.XA CN108282489B (zh) 2018-02-07 2018-02-07 一种漏洞扫描方法、服务端及系统
CN201810124877.X 2018-02-07

Publications (1)

Publication Number Publication Date
WO2019153384A1 true WO2019153384A1 (zh) 2019-08-15

Family

ID=62807910

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077557 WO2019153384A1 (zh) 2018-02-07 2018-02-28 一种漏洞扫描方法、服务端及系统

Country Status (4)

Country Link
US (1) US11070580B1 (zh)
EP (1) EP3751811A4 (zh)
CN (1) CN108282489B (zh)
WO (1) WO2019153384A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112115457A (zh) * 2020-08-24 2020-12-22 国网福建省电力有限公司 一种电力终端接入方法及系统
US10958684B2 (en) 2018-01-17 2021-03-23 Group Ib, Ltd Method and computer device for identifying malicious web resources
US11005779B2 (en) 2018-02-13 2021-05-11 Trust Ltd. Method of and server for detecting associated web resources
NL2026468A (en) 2019-12-19 2021-08-11 Group Ib Tds Ltd Method and system for determining network vulnerabilities
CN114900341A (zh) * 2022-04-24 2022-08-12 京东科技信息技术有限公司 混合云环境下的扫描探测方法、装置、系统、设备和介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108810025A (zh) * 2018-07-19 2018-11-13 平安科技（深圳）有限公司 一种暗网的安全性评估方法、服务器及计算机可读介质
CN109347892B (zh) * 2018-08-03 2021-09-03 奇安信科技集团股份有限公司 一种互联网工业资产扫描处理方法及装置
CN109327471B (zh) * 2018-11-29 2021-07-13 广东电网有限责任公司信息中心 一种漏洞发现与应急验证实现方法
CN109981653B (zh) * 2019-03-28 2021-07-23 上海中通吉网络技术有限公司 一种web漏洞扫描方法
CN110309667B (zh) * 2019-04-16 2022-08-30 网宿科技股份有限公司 一种网站暗链检测方法和装置
CN111580946A (zh) * 2020-04-28 2020-08-25 北京达佳互联信息技术有限公司 端口扫描方法、装置、设备及存储介质
CN111786947B (zh) * 2020-05-18 2021-10-29 北京邮电大学 攻击图的生成方法、装置、电子设备及存储介质
CN112839047B (zh) * 2021-01-15 2023-03-21 杭州安恒信息技术股份有限公司 一种云平台上的资产漏洞扫描方法、装置、设备及介质
US11822672B1 (en) * 2021-02-04 2023-11-21 Cisco Technology, Inc. Systems and methods for scanning images for vulnerabilities
CN113672934A (zh) * 2021-08-09 2021-11-19 中汽创智科技有限公司 一种安全漏洞扫描系统及方法、终端、存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101605134A (zh) * 2009-06-30 2009-12-16 成都市华为赛门铁克科技有限公司 网络安全扫描方法、装置及系统
CN103065095A (zh) * 2013-01-29 2013-04-24 四川大学 一种基于指纹识别技术的web漏洞扫描方法和漏洞扫描器
CN103870334A (zh) * 2012-12-18 2014-06-18 中国移动通信集团公司 一种大规模漏洞扫描的任务分配方法及装置
US20160080410A1 (en) * 2010-07-19 2016-03-17 Sitelock, Llc Selective website vulnerability and infection testing
CN105429955A (zh) * 2015-10-30 2016-03-23 西安四叶草信息技术有限公司 一种远程漏洞的检测方法

Family Cites Families (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7243148B2 (en) * 2002-01-15 2007-07-10 Mcafee, Inc. System and method for network vulnerability detection and reporting
US7398399B2 (en) * 2003-12-12 2008-07-08 International Business Machines Corporation Apparatus, methods and computer programs for controlling performance of operations within a data processing system or network
CN1558605A (zh) * 2004-01-19 2004-12-29 上海交通大学 漏洞扫描的实现方法
CN1870493A (zh) * 2006-06-15 2006-11-29 北京华景中天信息技术有限公司 网站安全漏洞扫描方法
US7950056B1 (en) * 2006-06-30 2011-05-24 Symantec Corporation Behavior based processing of a new version or variant of a previously characterized program
US9239745B1 (en) * 2006-09-28 2016-01-19 Whitehat Security, Inc. Method and apparatus for managing security vulnerability lifecycles
US20100107257A1 (en) * 2008-10-29 2010-04-29 International Business Machines Corporation System, method and program product for detecting presence of malicious software running on a computer system
US8365290B2 (en) 2009-05-15 2013-01-29 Frederick Young Web application vulnerability scanner
WO2011126911A1 (en) * 2010-03-30 2011-10-13 Authentic8, Inc Disposable browsers and authentication techniques for a secure online user environment
US8671182B2 (en) * 2010-06-22 2014-03-11 Sourcefire, Inc. System and method for resolving operating system or service identity conflicts
CN102104601B (zh) * 2011-01-14 2013-06-12 无锡市同威科技有限公司 一种基于渗透技术的web漏洞扫描方法和漏洞扫描器
CN102523218B (zh) * 2011-12-16 2015-04-08 北京神州绿盟信息安全科技股份有限公司 一种网络安全防护方法、设备和系统
US9407653B2 (en) * 2012-04-10 2016-08-02 Mcafee, Inc. Unified scan management
WO2014151061A2 (en) * 2013-03-15 2014-09-25 Authentic8, Inc. Secure web container for a secure online user environment
EP3091465B1 (en) * 2014-03-13 2019-03-06 Nippon Telegraph and Telephone Corporation Monitoring device, monitoring method, and monitoring program
CN104980309B (zh) * 2014-04-11 2018-04-20 北京奇安信科技有限公司 网站安全检测方法及装置
CN104392175B (zh) * 2014-11-26 2018-05-29 华为技术有限公司 一种云计算系统中云应用攻击行为处理方法、装置及系统
US9606854B2 (en) * 2015-08-13 2017-03-28 At&T Intellectual Property I, L.P. Insider attack resistant system and method for cloud services integrity checking
US9977894B2 (en) * 2015-11-18 2018-05-22 Red Hat, Inc. Virtual machine malware scanning
EP3539043B1 (en) * 2016-11-09 2021-11-03 Dev/Con Detect, Inc. Digital auditing system and method for detecting unauthorized activities on websites
RU2638001C1 (ru) * 2017-02-08 2017-12-08 Акционерное общество "Лаборатория Касперского" Система и способ выделения части резерва производительности антивирусного сервера для выполнения антивирусной проверки веб-страницы
US10630724B2 (en) * 2017-09-12 2020-04-21 Zscaler, Inc. Systems and methods for network vulnerability assessment and protection of Wi-fi networks using a cloud-based security system
US20190222587A1 (en) * 2018-01-15 2019-07-18 GamaSec Ltd System and method for detection of attacks in a computer network using deception elements
US10944770B2 (en) * 2018-10-25 2021-03-09 EMC IP Holding Company LLC Protecting against and learning attack vectors on web artifacts

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101605134A (zh) * 2009-06-30 2009-12-16 成都市华为赛门铁克科技有限公司 网络安全扫描方法、装置及系统
US20160080410A1 (en) * 2010-07-19 2016-03-17 Sitelock, Llc Selective website vulnerability and infection testing
CN103870334A (zh) * 2012-12-18 2014-06-18 中国移动通信集团公司 一种大规模漏洞扫描的任务分配方法及装置
CN103065095A (zh) * 2013-01-29 2013-04-24 四川大学 一种基于指纹识别技术的web漏洞扫描方法和漏洞扫描器
CN105429955A (zh) * 2015-10-30 2016-03-23 西安四叶草信息技术有限公司 一种远程漏洞的检测方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3751811A4 *

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10958684B2 (en) 2018-01-17 2021-03-23 Group Ib, Ltd Method and computer device for identifying malicious web resources
US11005779B2 (en) 2018-02-13 2021-05-11 Trust Ltd. Method of and server for detecting associated web resources
NL2026468A (en) 2019-12-19 2021-08-11 Group Ib Tds Ltd Method and system for determining network vulnerabilities
US11356470B2 (en) 2019-12-19 2022-06-07 Group IB TDS, Ltd Method and system for determining network vulnerabilities
CN112115457A (zh) * 2020-08-24 2020-12-22 国网福建省电力有限公司 一种电力终端接入方法及系统
CN112115457B (zh) * 2020-08-24 2022-08-05 国网福建省电力有限公司 一种电力终端接入方法及系统
CN114900341A (zh) * 2022-04-24 2022-08-12 京东科技信息技术有限公司 混合云环境下的扫描探测方法、装置、系统、设备和介质
CN114900341B (zh) * 2022-04-24 2023-11-03 京东科技信息技术有限公司 混合云环境下的扫描探测方法、装置、系统、设备和介质

Also Published As

Publication number Publication date
US20210226979A1 (en) 2021-07-22
US11070580B1 (en) 2021-07-20
EP3751811A1 (en) 2020-12-16
CN108282489A (zh) 2018-07-13
EP3751811A4 (en) 2021-03-31
CN108282489B (zh) 2020-01-31

Similar Documents

Publication Publication Date Title
WO2019153384A1 (zh) 一种漏洞扫描方法、服务端及系统
US11811785B2 (en) Real-time scanning of IP addresses
US11675640B2 (en) External function invocation by a data system
CN109510846B (zh) Api调用系统、方法、装置、电子设备及存储介质
US9594912B1 (en) Return-oriented programming detection
US9667643B2 (en) Apparatus, system, and method for correlating security vulnerabilities from multiple independent vulnerability assessment methods
WO2018188558A1 (zh) 账号权限的识别方法及装置
US9158918B2 (en) Method and apparatus for determining malicious program
US20220279012A1 (en) Methods and apparatus to identify and report cloud-based security vulnerabilities
WO2014094151A1 (en) System and method for monitoring data in a client environment
US8984151B1 (en) Content developer abuse detection
US20150373026A1 (en) Permission management method, device and system for cloud platform service
US20150229652A1 (en) Method and apparatus for reporting a virus
CN112579997B (zh) 一种用户权限配置方法、装置、计算机设备及存储介质
CN109522202B (zh) 一种软件测试的方法和装置
CN112417454A (zh) 扫描任务的目标分发方法与漏洞扫描系统
US20150326577A1 (en) Accelerated application authentication and content delivery
CN110574018A (zh) 基于通信交换来管理异步分析操作
US10581916B2 (en) System and method for identifying cyber-attacks
KR101490227B1 (ko) 트래픽 제어 방법 및 장치
CN113032089B (zh) 一种基于api网关的分布式仿真服务构建方法
US11636198B1 (en) System and method for cybersecurity analyzer update and concurrent management system
US20230319547A1 (en) Device identification for newly connecting devices using mac randomization on a network
JP6900328B2 (ja) 攻撃種別判定装置、攻撃種別判定方法、及びプログラム
CN106792690B (zh) 基于net验证平台的公共wifi登录方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18871818

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018871818

Country of ref document: EP

Effective date: 20200907

ENP Entry into the national phase

Ref document number: 2018871818

Country of ref document: EP

Effective date: 20200907