WO2021232282A1 - 漏洞信息获取方法、装置、电子设备及存储介质 - Google Patents

漏洞信息获取方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2021232282A1
WO2021232282A1 PCT/CN2020/091272 CN2020091272W WO2021232282A1 WO 2021232282 A1 WO2021232282 A1 WO 2021232282A1 CN 2020091272 W CN2020091272 W CN 2020091272W WO 2021232282 A1 WO2021232282 A1 WO 2021232282A1
Authority
WO
WIPO (PCT)
Prior art keywords
vulnerability
information
vulnerability information
target object
obtaining
Prior art date
Application number
PCT/CN2020/091272
Other languages
English (en)
French (fr)
Inventor
吴逸民
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN202080099538.6A priority Critical patent/CN115380285A/zh
Priority to PCT/CN2020/091272 priority patent/WO2021232282A1/zh
Publication of WO2021232282A1 publication Critical patent/WO2021232282A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • This application relates to the field of information security technology, and more specifically, to a method, device, electronic device, and storage medium for obtaining vulnerability information.
  • This application proposes a method, device, electronic device, and storage medium for obtaining vulnerability information to solve the above-mentioned problems.
  • an embodiment of the present application provides a method for obtaining vulnerability information, which obtains first vulnerability information from a vulnerability disclosure platform, where the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform; Link content related to the target object, where the link content includes recorded vulnerability information related to the target object; analyzing the link content to obtain second vulnerability information, where the second vulnerability information is different from the first vulnerability information; Prompt the first vulnerability information and the second vulnerability information.
  • an embodiment of the present application provides a vulnerability information obtaining device, which includes: a first vulnerability information obtaining module, configured to obtain first vulnerability information from a vulnerability disclosure platform, where the first vulnerability information includes vulnerability disclosure The vulnerability information related to the target object disclosed by the platform; the link acquisition module is used to obtain the link content related to the target object, and the link content includes the recorded vulnerability information related to the target object; the second vulnerability acquisition module is used to The link content is analyzed to obtain second vulnerability information, where the second vulnerability information is different from the first vulnerability information; a prompt module is used to prompt the first vulnerability information and the second vulnerability information.
  • an embodiment of the present application provides an electronic device that includes one or more processors; a memory; one or more application programs, wherein the one or more application programs are stored in the memory And configured to be executed by the one or more processors, and the one or more programs are configured to execute the method applied to the electronic device as described above.
  • an embodiment of the present application provides a computer-readable storage medium in which a program code is stored, wherein the above-mentioned method is executed when the program code is running.
  • the vulnerability information acquisition method proposed in this application obtains the first vulnerability information from the vulnerability disclosure platform, which is convenient to grasp the published vulnerability information related to the target object; obtain the link content related to the target object, and The link content is analyzed to obtain the second vulnerability information, which is convenient for grasping the vulnerability information that has not yet been published; after obtaining the first vulnerability information and the second vulnerability information, the first vulnerability information and the second vulnerability information are prompted, thereby All vulnerability information related to the target object can be obtained in time, and prepared in advance to avoid illegal attacks on the target object, thereby improving information security.
  • Fig. 1 shows a flowchart of a method for obtaining vulnerability information provided by an embodiment of the present application.
  • Fig. 2 shows a flowchart of a method for obtaining vulnerability information provided by another embodiment of the present application.
  • Fig. 3 shows a flowchart of some steps in the method for obtaining vulnerability information provided on the basis of the embodiment provided in Fig. 2.
  • Fig. 4 shows a flowchart of a method for obtaining vulnerability information provided by still another embodiment of the present application.
  • Fig. 5 shows a flowchart of some steps in the method for obtaining vulnerability information provided on the basis of the embodiment provided in Fig. 4.
  • Fig. 6 shows a flowchart of a method for obtaining vulnerability information provided by another embodiment of the present application.
  • FIG. 7 shows a flowchart of some steps in the method for obtaining vulnerability information provided on the basis of the embodiment provided in FIG. 6.
  • Fig. 8 shows a functional module diagram of a vulnerability information acquiring device provided by an embodiment of the present application.
  • Fig. 9 shows a functional module diagram of a vulnerability information acquiring device provided by another embodiment of the present application.
  • Fig. 10 shows a structural block diagram of an electronic device proposed by an embodiment of the present application for executing the method for obtaining vulnerability information according to an embodiment of the present application.
  • Fig. 11 shows a storage medium provided by an embodiment of the present application for storing or carrying program code for implementing the method for obtaining vulnerability information according to the embodiment of the present application.
  • CVE Common Vulnerabilities & Exposures
  • CNVD China National Vulnerability Database
  • CCNNVD China National Vulnerability Database of Information Security
  • CVE is a database related to information security. It collects various information security weaknesses and vulnerabilities and gives them numbers for public inspection; CNVD is an important information system unit in the United Nations, basic telecommunications operators, and networks by the National Computer Network Emergency Technology Coordination Center.
  • CNNVD is the China Information Security Evaluation Center to effectively perform the functions of vulnerability analysis and risk assessment, and is responsible for building a national information security vulnerability database for operation and maintenance.
  • various vulnerability information that has been disclosed can be obtained.
  • These vulnerability information are information related to the vulnerability disclosed on the vulnerability platform, such as vulnerability number, vulnerability title, vulnerability details, etc.
  • Vulnerability information published on various vulnerability disclosure platforms are usually assigned corresponding numbers. The inventor found that there may be some vulnerability information. Before being assigned a number, attackers use these unnumbered vulnerabilities, which means that they are not on the vulnerability disclosure platform. The public vulnerabilities are attacked, which makes it difficult to ensure information security.
  • the inventor proposes the vulnerability information acquisition method of the present application to obtain first vulnerability information from the vulnerability disclosure platform.
  • the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform; and obtains information related to the target object.
  • Link content the link content includes the recorded vulnerability information related to the target object;
  • the second vulnerability information is obtained by analyzing the link content, and the second vulnerability information is different from the first vulnerability information;
  • a vulnerability information and the second vulnerability information are prompted. It is convenient to grasp the published vulnerability information related to the target object and the vulnerability information that has not yet been published, and prompt the first vulnerability information and the second vulnerability information, so that all vulnerability information related to the target object can be obtained in time , Precautions in advance to avoid illegal attacks on the target object, thereby improving information security.
  • an embodiment of the present application provides a method for obtaining vulnerability information, which can be applied to electronic devices and can be implemented based on Python code.
  • the specific method may include:
  • Step S110 Obtain first vulnerability information from the vulnerability disclosure platform, where the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform.
  • the vulnerability information obtained on the vulnerability disclosure platform is defined as the first vulnerability information.
  • the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform, and the target object refers to systems, applications, websites, etc. that need to ensure information security.
  • the vulnerability information disclosed on the vulnerability disclosure platform includes vulnerability information A, vulnerability information B, and vulnerability information C.
  • vulnerability information B is vulnerability information related to the target object
  • the vulnerability information disclosed on the vulnerability disclosure platform only Vulnerability information B is the first vulnerability information.
  • keyword information related to the target object may be obtained, and the first vulnerability information may be obtained from the vulnerability disclosure platform according to the keyword information.
  • the target object is inseparable from the support of various products, such as development languages, databases, components, operating systems, etc. Therefore, the keyword information can include various product information used by the target.
  • the first vulnerability information can be obtained comprehensively from the vulnerability disclosure platform.
  • Step S120 Obtain link content related to the target object, where the link content includes recorded vulnerability information related to the target object.
  • the link content related to the target object can also be obtained, and the link content includes the recorded and target object Related vulnerability information.
  • the link content includes the recorded vulnerability information of the various products used by the target object.
  • the products used by the target object include product AA
  • the official website of product AA records vulnerability information with product AA.
  • the content of the link may be the content of the official website. Therefore, the link content related to the target object can be obtained according to the target object for subsequent use.
  • Step S130 Analyze the link content to obtain second vulnerability information, where the second vulnerability information is different from the first vulnerability information.
  • the link content related to the target object since the link content may also include other information besides the vulnerability information, it is necessary to analyze the obtained link content to extract the link neutralization vulnerability Related information, and obtain vulnerability information other than the first vulnerability information from the extracted vulnerability-related information as the second vulnerability information.
  • the second vulnerability information is the vulnerability information that is related to the target object and is different from the first vulnerability information obtained by analyzing the content of the link.
  • the second vulnerability information and the first vulnerability information are both vulnerability information related to the target object, but the difference between the first vulnerability information and the second vulnerability information is that the first vulnerability information is the vulnerability information that has been published on the vulnerability disclosure platform, and The second vulnerability information has not yet been disclosed on the vulnerability disclosure platform, because if the vulnerability information needs to be disclosed on the vulnerability disclosure platform, it will take a certain period of review, so some vulnerability information has been discovered, but it was not timely in the review stage. It is disclosed on the vulnerability disclosure platform, therefore, the second vulnerability information cannot be obtained through each vulnerability disclosure platform.
  • the first vulnerability information and the second vulnerability information may include multiple pieces of different and non-repetitive vulnerability information.
  • the first vulnerability information includes vulnerability information A and vulnerability information B
  • the second vulnerability information includes vulnerability information C and vulnerability information D.
  • vulnerability information A, vulnerability information B, vulnerability information C, and vulnerability information D are all related to Different vulnerability information related to the target object
  • vulnerability information A and vulnerability information B are disclosed on the vulnerability disclosure platform
  • vulnerability information C and vulnerability information D are not disclosed on the vulnerability disclosure platform.
  • the first vulnerability information and the second vulnerability information may be zero-day vulnerability information, and the zero-day vulnerability information is information related to zero-day vulnerabilities.
  • the relevant information may include vulnerability title, vulnerability product, vulnerability level, vulnerability details and other information.
  • zero-day vulnerabilities are also called 0DAY vulnerabilities, which can be understood as vulnerabilities that have not been exploited by the outside world.
  • Step S140 Prompt the first vulnerability information and the second vulnerability information.
  • the first vulnerability information and the second vulnerability information can be saved in the vulnerability database, and The first vulnerability information and the second vulnerability information are prompted to facilitate the corresponding personnel to quickly understand the vulnerability information.
  • a target address may be preset, and when the first vulnerability information or the second vulnerability information is obtained, the first vulnerability information or the second vulnerability information is sent to the target address.
  • a preset prompt message is sent to the target address, and the recipient corresponding to the target address accesses the vulnerability according to the preset prompt information.
  • the database obtains the first vulnerability information or the second vulnerability information.
  • the first vulnerability information or the second vulnerability information may be encrypted and sent to improve the security of the first vulnerability information or the second vulnerability information.
  • a sending time period may be preset, and the first vulnerability information and the second vulnerability information are only sent within the sending time period. It may also be that as soon as the first vulnerability information or the second vulnerability information is obtained, the obtained first vulnerability information or the second vulnerability information is sent to the target address.
  • This application proposes a method for obtaining vulnerability information, obtaining the first vulnerability information from the vulnerability disclosure platform, which is convenient for grasping the published vulnerability information related to the target object; obtaining the link content related to the target object, and analyzing the link content to obtain the second Vulnerability information is easy to grasp the vulnerability information that has not yet been published; after obtaining the first vulnerability information and the second vulnerability information, prompt the first vulnerability information and the second vulnerability information, so that the target object can be obtained in time All related vulnerability information is prepared in advance to avoid illegal attacks on the target object, thereby improving information security.
  • FIG. 2 another embodiment of the present application provides a method for obtaining vulnerability information. Based on the foregoing embodiment, this embodiment focuses on the process of obtaining the first vulnerability information from the vulnerability disclosure platform.
  • This method can include:
  • Step S210 Acquire keyword information, where the keyword information includes product information used by the target object.
  • keyword information may be obtained first, and the keyword information includes product information used by the target object.
  • the target object uses a variety of products, which can be CPU processors, network devices, operating systems, virtualization, containers, databases, development languages, middleware, and components.
  • the product information can be the product name, product manufacturer and other information corresponding to the product. For example, if product information is the name corresponding to the product, the keyword information is the name of the product used by the target object.
  • the keyword information When the keyword information is obtained, the keyword information may be stored in a document. When the keyword information is needed later, the document can be directly called to obtain the keyword information.
  • Step S220 Obtain the first vulnerability information from the vulnerability disclosure platform according to the keyword information.
  • the first vulnerability information can be obtained from the vulnerability disclosure platform according to the keyword information.
  • the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform. Since there are various types of vulnerability information disclosed on the vulnerability disclosure platform, some of the vulnerability information may not be related to the target object. Therefore, the vulnerability information disclosed by the vulnerability disclosure platform can be filtered according to the keyword information. The first vulnerability information.
  • FIG. 3 shows the process of obtaining the first vulnerability information from the vulnerability disclosure platform according to the keyword information, which may specifically include the following steps.
  • Step S221 Search on the vulnerability disclosure platform according to the keyword information, and obtain corresponding search results.
  • the keyword information can be searched on the vulnerability disclosure platform.
  • Each vulnerability information disclosure platform provides a search function, and different vulnerability disclosure platforms use different search protocols. Therefore, the search protocol of the vulnerability disclosure platform can be obtained, the keyword information can be searched based on the search protocol, and the corresponding search result can be obtained.
  • the keyword information may be input into each vulnerability information disclosure platform to obtain search results corresponding to the keyword information.
  • different vulnerability disclosure platforms use different search protocols and obtain different search results. For example, if the keyword information is XX, the search result obtained on one vulnerability disclosure platform may be XXXX, and the search result obtained on another vulnerability disclosure platform may be XXXY.
  • search results When most vulnerability disclosure platforms perform keyword searches, they search by title and content. As long as the content contains keywords, the corresponding search results can be obtained. There is a problem that the search results correspond to the keyword information poorly. For example, if you search for NTP, the search result will get the content of currentPage. In order to obtain more accurate search results, the keyword information may be matched with the search results to obtain the first vulnerability information. That is to say, when searching for keyword information on the vulnerability disclosure platform, the search result that may be obtained is not the vulnerability information corresponding to the keyword information.
  • Step S222 Cut the first preset content of the search result to obtain a cut list corresponding to the search result.
  • the first preset content of the search results can be cut to obtain the corresponding information.
  • the search result is also vulnerability information, which may include vulnerability title, vulnerability product, vulnerability level, vulnerability details and other information.
  • the first preset content may be any of the vulnerability title, the vulnerability product, the vulnerability level, and the vulnerability details, which can be specifically set according to actual needs. For example, if the keyword information must be included in the vulnerability title of the vulnerability information, then the vulnerability title can be used as the first preset content.
  • the first preset content may be cut to obtain a cut list corresponding to the search result.
  • Jieba may be used to cut the first preset content.
  • Jieba is a Python component that can be used to segment sentences.
  • Jieba cutting has many different modes. When cutting the first preset content, the full mode can be used, that is, all possible words in the text are output. For example, “Hello World”, after using Jieba full mode cutting, the cut list will be “Hello”, “Ah”, and "World”.
  • Step S223 Determine whether the keyword information is included in the cutting list; if yes, execute step S224; if not, execute step S225.
  • the first preset content of the search result is cut to obtain the search result corresponding to the search result, that is, each search result can correspond to a cut list.
  • it can be determined whether the keyword information is included in the cutting list. If the keyword information is included, it indicates that the first preset content includes the keyword information, and the search result is accurate, so that step S224 can be executed.
  • step S225 may be executed.
  • Step S224 Perform regular matching on the search result to extract the first vulnerability information.
  • a preset regular expression may be stored in advance, and the first vulnerability information may be extracted by using the regular expression.
  • the preset regular expression may be multiple, and the preset regular expression may be determined according to the content to be obtained.
  • the search result includes information such as vulnerability title, vulnerability product, vulnerability level, vulnerability details, etc.
  • the preset regular expression may be an extraction search The vulnerability level and vulnerability details in the result obtain the first vulnerability information.
  • Step S225 Discard the search result.
  • the search result may be discarded.
  • the keyword is Kindeditor.
  • the search results obtained based on various vulnerability disclosure platforms there is a vulnerability titled "Y software has file upload vulnerability”. The description of "Y software features similar to Kindeditor” appears in the vulnerability details.
  • the vulnerability information is related to Y software, not Kindeditor. Assuming that the first preset content is the vulnerability title, after cutting the vulnerability title "Y software has file upload vulnerability", the cutting list is obtained as "Y” "software” "existing” "file” "up” "” “vulnerabilities” ", excluding Kindeditor, you can discard the search result.
  • Step S230 Obtain link content related to the target object, where the link content includes recorded vulnerability information related to the target object.
  • Step S240 Analyze the link content to obtain second vulnerability information, where the second vulnerability information is different from the first vulnerability information.
  • Step S250 Prompt the first vulnerability information and the second vulnerability information.
  • step S230 to step S250 refer to the corresponding part of the foregoing embodiment, which will not be repeated here.
  • This application proposes a method for obtaining vulnerability information, obtaining product information used by the target object as the keyword information, and searching on the vulnerability platform according to the keyword information to obtain the search results, and after obtaining the search results, perform cutting And regular matching to obtain the first vulnerability information improves the accuracy of obtaining the first vulnerability information.
  • Obtain the link content related to the target object and analyze the link content to obtain the second vulnerability letter, which is convenient for grasping the vulnerability information that has not yet been published; after obtaining the first vulnerability information and the second vulnerability information, check the first vulnerability information The vulnerability information and the second vulnerability information are prompted, so that all vulnerability information related to the target object can be obtained in time, and prepared in advance to avoid illegal attacks on the target object, thereby improving information security.
  • FIG. 4 another embodiment of the present application provides a method for obtaining vulnerability information. Based on the foregoing embodiment, this embodiment focuses on the process of obtaining second vulnerability information.
  • the method may include:
  • Step S310 Obtain first vulnerability information from the vulnerability disclosure platform, where the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform.
  • step S310 reference may be made to the corresponding part of the foregoing embodiment, which will not be repeated here.
  • Step S320 Obtain link content related to the target object, where the link content includes recorded vulnerability information related to the target object.
  • the key link may be obtained first, and the key link includes the related link of the product used by the target object.
  • the key link includes the related link of the product used by the target object.
  • product announcements on the official website github issue, github commit, github release, and links to personal security research blogs.
  • github issue is the function for other users to raise vulnerabilities in the product, which can record the vulnerabilities of the product discovered by other users
  • github commit is the function to view product update code details, and the product person in charge adds corresponding remarks after updating the code.
  • Corresponding vulnerability information can be obtained; github release is the place where the product is packaged and downloaded, and the person in charge of the product notes the corresponding update content, so that the corresponding vulnerability information can be obtained.
  • the key link When the key link is obtained, the key link can be crawled to obtain the link content.
  • a preset time interval may be preset, and the key link is crawled according to the preset time interval to obtain the link content.
  • the update status of the key link content can be monitored in real time, and when the content of the key link is detected to be updated, the key link is crawled to obtain the key content.
  • Step S330 Use a natural language processing model to analyze whether the link content includes information related to vulnerabilities; if so, perform step S340; if not, perform step S320.
  • the link content can be analyzed. It may be that a natural language processing model is used to analyze the link content to determine whether the link content includes information related to vulnerabilities.
  • step S340 If the link content includes information related to the vulnerability, it indicates that the vulnerability information can be extracted, so that step S340 can be executed. If the link content does not include the information related to the vulnerability, it indicates that the vulnerability information cannot be extracted, so that step S320 can be executed to continue to obtain the link content and perform analysis and judgment.
  • the natural language processing model used to analyze the link content may be based on the input link content, outputting the vulnerability-related information corresponding to the link content.
  • a training sample set may be obtained first; and the natural language processing model is trained based on the training sample set.
  • the corpus when acquiring the training sample set, the corpus may be acquired first; preprocessing the acquired corpus to obtain the processed corpus, and performing feature engineering and feature selection on the processed corpus to obtain the training sample set .
  • the corpus refers to language materials, which can be obtained from the Internet. After the corpus is obtained, a series of pre-processing needs to be performed on the corpus, such as word segmentation, tagging, etc. After the corpus is processed, the corpus needs to be expressed as a type that can be calculated by the computer, that is, feature engineering. Usually, the corpus can be processed into a feature vector for the calculator to calculate. After constructing the feature vector, it is necessary to select suitable and expressive features to obtain the training sample set.
  • a machine learning model may be trained based on the training sample set to obtain the natural language processing model. Therefore, the natural language processing model can be used to analyze the link content.
  • Step S340 Perform regular matching on the information related to the vulnerability to extract the second vulnerability information.
  • the link content includes information related to the vulnerability
  • FIG. 5 may include the following steps.
  • Step S341 Match the vulnerability-related information according to a preset regular expression to obtain a matching result.
  • the natural language processing model When analyzing the link content using the natural language processing model, if the link content includes information related to the vulnerability, the natural language processing model can output the information related to the vulnerability. Therefore, the information related to the vulnerability can be matched according to the preset regular expression to obtain the matching result.
  • step S224 of the foregoing embodiment.
  • the preset regular expression used here can be the same as that in step S224, or some expressions can be added to the preset regular expression in step S224.
  • Type to match. For example, usually in the link content, in addition to the vulnerability details, vulnerability title, etc., some vulnerability update content may also be included, and the vulnerability update content can also be extracted. Thereby, the information related to the vulnerability can be matched to obtain a matching result.
  • Step S342 Determine whether the matching result is the same as the first vulnerability information; if yes, execute step S343; if not, execute step S344.
  • the matching result is vulnerability information.
  • the first vulnerability information when the first vulnerability information is obtained, the first vulnerability information can be stored in a vulnerability database, and after the matching result is obtained, whether the matching result is compared with the vulnerability database
  • the first vulnerability information in is the same.
  • Step S343 Discard the matching result.
  • Step S344 Use the matching result as the second vulnerability information.
  • the matching result may be discarded; if it is determined that the matching result is not duplicated with the first vulnerability information, the matching result may be used as the first vulnerability information. 2. Vulnerability information.
  • This application proposes a method for obtaining vulnerability information, using a natural language processing model to analyze the link content, and can accurately extract the information related to the vulnerability in the link content, so that the vulnerability information that has not been disclosed can be obtained in time and accurately, and be prepared in advance , To avoid illegal attacks on the target object, thereby improving information security.
  • FIG. 6 Another embodiment of the present application provides a method for obtaining vulnerability information. Based on the foregoing embodiments, this embodiment focuses on the process of prompting the first vulnerability information and the second vulnerability information. Methods can include:
  • Step S410 Obtain first vulnerability information from the vulnerability disclosure platform, where the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform.
  • Step S420 Obtain link content related to the target object, where the link content includes recorded vulnerability information related to the target object.
  • Step S430 Analyze the link content to obtain second vulnerability information, where the second vulnerability information is different from the first vulnerability information.
  • step S410 to step S430 reference may be made to the corresponding part of the foregoing embodiment, which will not be repeated here.
  • Step S440 Obtain the risk levels of the first vulnerability information and the second vulnerability information.
  • the risk levels of the first vulnerability information and the second vulnerability information can be obtained, and a selective prompt is made according to the risk level.
  • the risk level may be a parameter, and the higher the parameter value, the higher the threat of the vulnerability.
  • Step S441 Obtain the first vulnerability information and the second vulnerability information.
  • Step S442 Determine whether the first vulnerability information or the second vulnerability information includes a vulnerability level; if yes, perform step S444; if not, perform step S443.
  • the vulnerability information disclosed on the vulnerability disclosure platform usually has a number and a vulnerability level. Therefore, the first vulnerability information usually includes the vulnerability level.
  • the second vulnerability information is usually the vulnerability information that has not been disclosed on the vulnerability disclosure platform, and there is usually no vulnerability level.
  • step S444 After the first vulnerability information and the second vulnerability information are obtained, it can be determined whether the vulnerability level is included, if it is included, step S444 is executed; if it is not included, step S443 is executed.
  • Step S443 Determine the risk level according to the vulnerability level.
  • the risk level can be determined according to the vulnerability level. Generally, the content of the vulnerability level is low, low, high, high, etc.
  • the vulnerability level can be converted into a risk level.
  • a conversion table may be preset, and the conversion table includes the corresponding relationship between the vulnerability level and the risk level. Usually, by querying the conversion table, the risk level corresponding to the vulnerability level can be obtained.
  • Step S444 Determine whether the first vulnerability information or the second vulnerability information includes the second preset content; if yes, perform step S445; if not, perform step S441.
  • the second preset content may be key information of some relatively threatening vulnerabilities, which may be specifically set according to actual use. For example, it can be to determine whether the vulnerability details include keywords such as command execution or sql injection. If the second preset content is included, step S445 is performed, and if the second preset content is not included, step S441 is performed to continue to obtain the first vulnerability information and the second vulnerability information, and determine the risk level.
  • Step S445 Determine that the risk level of the first vulnerability information and the second vulnerability information including the second preset content is greater than the preset level.
  • the risk level may be a preset level. If the risk level of the vulnerability information is greater than the preset level, it can be considered that the threat of the vulnerability is greater, and once it is exploited by an attacker, a greater loss will be caused.
  • Step S450 Send the first vulnerability information and the second vulnerability information that the risk level is greater than the preset level to the preset personnel.
  • the vulnerability level After the risk level is determined according to the vulnerability level, it is also necessary to determine whether the vulnerability level is greater than a preset level, and obtain the vulnerability information greater than the preset level. In order to notify the corresponding personnel, the vulnerability information greater than the preset level may be sent to the preset personnel.
  • a target address may be preset, and when the first vulnerability information or the second vulnerability information is obtained, the first vulnerability information or the second vulnerability information is sent to the target address, and the target address may It is all kinds of correspondence addresses.
  • a preset prompt message is sent to the target address, and the recipient corresponding to the target address accesses the vulnerability according to the preset prompt information.
  • the database obtains the first vulnerability information or the second vulnerability information.
  • the first vulnerability information or the second vulnerability information may be encrypted and sent to improve the security of the first vulnerability information or the second vulnerability information.
  • a sending time period may be preset, and the first vulnerability information and the second vulnerability information are only sent within the sending time period. It may also be that as soon as the first vulnerability information or the second vulnerability information is obtained, the obtained first vulnerability information or the second vulnerability information is sent to the target address.
  • all the acquired first vulnerability information and second vulnerability information can also be prompted.
  • This application proposes a method for obtaining vulnerability information, obtaining first vulnerability information from a vulnerability disclosure platform; obtaining link content related to the target object; analyzing the link content to obtain second vulnerability information; obtaining the first vulnerability information and the first vulnerability information Second, the risk level of the vulnerability information, and send the first vulnerability information and the second vulnerability information with a risk level greater than the preset level to the preset personnel, prompting in time, so that all vulnerability information related to the target object can be obtained in time, in advance Take precautions to avoid illegal attacks on the target object, thereby improving information security.
  • FIG. 8 shows a vulnerability information obtaining apparatus 500 provided by an embodiment of the present application, which is applied to electronic equipment.
  • the apparatus 500 includes a first vulnerability information obtaining module 510, a link content obtaining module 520, and a second vulnerability information obtaining module 510.
  • the first vulnerability information obtaining module 510 is configured to obtain first vulnerability information from the vulnerability disclosure platform, where the first vulnerability information includes vulnerability information related to the target object disclosed by the vulnerability disclosure platform; the link obtaining module 520, Used to obtain the link content related to the target object, the link content includes the recorded vulnerability information related to the target object; the second vulnerability obtaining module 530 is used to analyze the link content to obtain the second vulnerability information, The second vulnerability information is different from the first vulnerability information; the prompt module 540 is configured to prompt the first vulnerability information and the second vulnerability information.
  • the first vulnerability information obtaining module 510 further includes a keyword information obtaining unit 511 and a searching unit 512:
  • the keyword information obtaining unit 511 is used to obtain keyword information, and the keyword information includes product information used by the target object; the searching unit 512 is used to obtain the first information from the vulnerability disclosure platform according to the keyword information. Vulnerability information.
  • search unit 512 is further configured to search on the vulnerability disclosure platform according to the keyword information to obtain corresponding search results; match the keyword information with the search results to obtain the first 1. Vulnerability information.
  • the searching unit 512 is also configured to obtain a search protocol of the vulnerability disclosure platform; and search the keyword information based on the search protocol.
  • the search unit 512 is further configured to cut the first preset content of the search result to obtain a cut list corresponding to the search result; determine whether the keyword information is included in the cut list; if If not included, discard the search result; if included, perform regular matching on the search result to extract the first vulnerability information.
  • the searching unit 512 is further configured to match the search result according to a preset regular expression to obtain the first vulnerability information.
  • the link content obtaining module 520 is also configured to obtain key links, the key links including related links of products used by the target object; crawling the key links to obtain the link content.
  • the link content obtaining module 520 is further configured to crawl the key links according to a preset time interval to obtain the link content.
  • the second vulnerability information acquisition module 530 is also configured to use a natural language processing model to analyze whether the link content includes vulnerability-related information, and the natural language processing model is used to output and The information related to the vulnerability corresponding to the content of the link; if it is, the second vulnerability information is extracted by regular matching on the information related to the vulnerability.
  • the second vulnerability information obtaining module 530 is also used to obtain a training sample set; The natural language processing model is trained.
  • the second vulnerability information acquisition module 530 is also used to preprocess the acquired corpus to obtain a processed corpus.
  • the preprocessing includes word segmentation and labeling; perform feature engineering and feature on the processed corpus. Select to get the training sample set.
  • the second vulnerability information obtaining module 530 is further configured to match the vulnerability-related information according to a preset regular expression to obtain a matching result; determine whether the matching result is the same as the first vulnerability information; if so , Discard the matching result; if not, use the matching result as the second vulnerability information.
  • the prompt module 540 is also used to obtain the risk level of the first vulnerability information and the second vulnerability information; and send the first vulnerability information and the second vulnerability information to the preset personnel with the risk level greater than the preset level .
  • the prompt module 540 is also used to determine whether the first vulnerability information or the second vulnerability information includes a vulnerability level; if so, determine the risk level according to the vulnerability level; if not, determine the first vulnerability information Or whether the second vulnerability information includes the second preset content; if the second preset content is included, it is determined that the risk level of the first vulnerability information and the second vulnerability information including the second preset content is greater than the preset level .
  • the prompt module 540 is further configured to store the obtained first vulnerability information or the second vulnerability information in the vulnerability database after obtaining the first vulnerability information or after obtaining the second vulnerability information.
  • first vulnerability information and the second vulnerability information are zero-day vulnerability information.
  • the vulnerability information acquisition method acquires the target task created by the user on the management platform.
  • the target task includes the source computer room, the target computer room, and the synchronization theme.
  • the synchronization in the source computer room is obtained according to the target task.
  • the data of the subject the data is sent to the same synchronized subject in the target computer room.
  • Provides a management platform to create synchronization tasks which simplifies the creation of synchronization tasks and the process of data synchronization. Users only need to establish corresponding synchronization tasks on the management platform to synchronize data in the source computer room to the target computer room, reducing the realization of data The difficulty of synchronization.
  • the coupling or direct coupling or communication connection between the displayed or discussed modules may be through some interfaces, and the indirect coupling or communication connection between the devices or modules may be electrical, Mechanical or other forms.
  • the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.
  • FIG. 9 shows a structural block diagram of a server provided by an embodiment of the present application.
  • the electronic device 600 in this application may include one or more of the following components: a processor 610, a memory 620, and one or more application programs, where one or more application programs may be stored in the memory 620 and configured to be configured by One or more processors 610 execute, and one or more programs are configured to execute the methods described in the foregoing method embodiments.
  • the processor 610 may include one or more processing cores.
  • the processor 610 uses various interfaces and lines to connect various parts of the entire electronic device 600, and executes by running or executing instructions, programs, code sets, or instruction sets stored in the memory 620, and calling data stored in the memory 620.
  • the processor 610 may use at least one of digital signal processing (Digital Signal Processing, DSP), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), and Programmable Logic Array (Programmable Logic Array, PLA).
  • DSP Digital Signal Processing
  • FPGA Field-Programmable Gate Array
  • PLA Programmable Logic Array
  • the processor 610 may be integrated with one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a modem, and the like.
  • the CPU mainly processes the operating system, user interface, and application programs;
  • the GPU is used for rendering and drawing of display content;
  • the modem is used for processing wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 610, but may be implemented by a communication chip alone.
  • the memory 620 may include random access memory (RAM) or read-only memory (Read-Only Memory).
  • the memory 620 may be used to store instructions, programs, codes, code sets, or instruction sets.
  • the memory 620 may include a storage program area and a storage data area, where the storage program area may store instructions for implementing the operating system and instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.) , Instructions used to implement the following various method embodiments, etc.
  • the storage data area can also store data created by the electronic device 600 during use (such as phone book, audio and video data, chat record data), and the like.
  • FIG. 11 shows a structural block diagram of a computer-readable storage medium provided by an embodiment of the present application.
  • the computer-readable storage medium 700 stores program code, and the program code can be invoked by a processor to execute the method described in the foregoing method embodiment.
  • the computer-readable storage medium 700 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • the computer-readable storage medium 700 includes a non-transitory computer-readable storage medium.
  • the computer-readable storage medium 700 has a storage space for the program code 710 for executing any method steps in the above-mentioned methods. These program codes can be read from or written into one or more computer program products.
  • the program code 710 may be compressed in a suitable form, for example.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请公开了一种漏洞信息获取方法、装置、电子设备及存储介质。所述方法包括：从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息；获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息；对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息；对所述第一漏洞信息和所述第二漏洞信息进行提示。从而及时获取到与目标对象相关的所有漏洞信息，提前防备，避免目标对象遭受非法攻击，从而提升了信息安全性。

Description

漏洞信息获取方法、装置、电子设备及存储介质 技术领域
本申请涉及信息安全技术领域，更具体地，涉及一种漏洞信息获取方法、装置、电子设备及存储介质。
背景技术
随着科技的发展，网络服务日益普及，随着网络服务的普及也出现了一系列的信息安全问题。网络服务的实现基于各类软件和协议。这些硬件，软件，协议中可能出现各类漏洞，漏洞是指在软件和协议上可能出现的逻辑缺陷或代码错误等，这些漏洞可以被攻击者利用，对网络服务造成影响，甚至可以非法获取各类网络数据，造成信息泄露。
因此，需要及时掌握各类漏洞信息，以维护正常的网络服务。然而，目前获取漏洞信息的途径较少，且获取到的漏洞信息的时效性较差，从而难以提前防备攻击者利用漏洞攻击，难以保障信息安全。
发明内容
本申请提出了一种漏洞信息获取方法、装置、电子设备及存储介质，以解决上述问题。
第一方面，本申请实施例提供了一种漏洞信息获取方法，从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息；获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息；对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息；对所述第一漏洞信息和所述第二漏洞信息进行提示。
第二方面，本申请实施例提供了一种漏洞信息获取装置，该装置包括：第一漏洞信息获取模块，用于从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息；链接获取模块，用于获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息；第二漏洞获取模块，用于对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息；提示模块，用于对所述第一漏洞信息和所述第二漏洞信息进行提示。
第三方面，本申请实施例提供了一种电子设备，该电子设备包括一个或多个处理器；存储器；一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个 程序配置用于执行如上述应用于电子设备的方法。
第四方面，本申请实施列提供一种计算机可读存储介质，所述计算机可读存储介质中存储有程序代码，其中，在所述程序代码运行时执行上述的方法。
相对于现有技术，本申请提出的漏洞信息获取方法，从漏洞公开平台上获取第一漏洞信息，便于掌握与目标对象相关的已经被公布漏洞信息；获取与目标对象相关的链接内容，并对链接内容进行分析获取第二漏洞信，便于掌握还没有被公布的漏洞信息；在获取到第一漏洞信息和第二漏洞信息后，对所述第一漏洞信息和第二漏洞信息进行提示，从而可以及时获取到与目标对象相关的所有漏洞信息，提前防备，避免目标对象遭受非法攻击，从而提升了信息安全性。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了本申请一个实施例提供的漏洞信息获取方法的流程图。
图2示出了本申请另一个实施例提供的漏洞信息获取方法的流程图。
图3示出了在图2所提供的实施例的基础上提供的漏洞信息获取方法中部分步骤的流程图。
图4示出了本申请再一个实施例提供的漏洞信息获取方法的流程图。
图5示出了在图4所提供的实施例的基础上提供的漏洞信息获取方法中部分步骤的流程图。
图6示出了本申请又一个实施例提供的漏洞信息获取方法的流程图。
图7示出了在图6所提供的实施例的基础上提供的漏洞信息获取方法中部分步骤的流程图。
图8示出了本申请一个实施例提供的漏洞信息获取装置的功能模块图。
图9示出了本申请另一个实施例提供的漏洞信息获取装置的功能模块图。
图10示出了本申请实施例提出的用于执行根据本申请实施例的漏洞信息获取方法的电子设备的结构框图。
图11示出了本申请实施例提供的用于保存或者携带实现根据本申请实施例的漏洞信息获取方法的程序代码的存储介质。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
随着科技的发展，网络服务日益普及，随着网络服务的普及也出现了一系列的信息安全问题。网络服务的实现基于各类的软件和协议。这些硬件，软件，协议中可能出现各类漏洞，漏洞是指在软件和协议上可能出现的逻辑缺陷或代码错误等，这些漏洞可以被攻击者利用，对网络服务造成影响，甚至可以非法获取各类网络数据，造成信息泄露。
因此，需要及时掌握各类漏洞信息，以维护正常的网络服务避免被攻击者攻击。在对漏洞信息进行收集时，通常依赖于各大漏洞公开平台。其中，漏洞公开平台可以是通用漏洞披露(Common Vulnerabilities&Exposures，CVE)，国家信息安全漏洞共享平台(China National Vulnerability Database，CNVD)，中国国家信息安全漏洞库(China National Vulnerability Database of Information Security，CNNVD)等。CVE是一个与资讯安全有关的数据库，收集各种资讯安全弱点及漏洞并给予编号以便于公众查阅；CNVD是由国家计算机网络应急技术处理协调中心联合国内重要信息系统单位、基础电信运营商、网络安全厂商、软件厂商和互联网企业建立的信息安全漏洞信息共享知识库；CNNVD是中国信息安全测评中心为切实履行漏洞分析和风险评估的职能，负责建设运维的国家信息安全漏洞库。通过这些漏洞公开平台，可以获取到各类已经被公开的漏洞信息，这些漏洞信息则为公开在漏洞平台上与该漏洞相关的信息，例如，漏洞编号，漏洞标题，漏洞详情等。
在各类漏洞公开平台上公开漏洞信息通常都分配有对应编号，发明人发现，可能会存在一些漏洞信息在没有被分配编号之前，攻击者利用这些没有被编号的漏洞即没有在漏洞公开平台上公开的漏洞进行攻击情况，从而难以保障信息安全。
发明人在研究中发现，若是可以获取与目标对象相关的链接内容，对这些链接内容进行分析，搜寻与漏洞相关的信息，则可以获取到一些没有编号的漏洞信息，再结合各类漏洞公开平台上已经公开的漏洞信息，则可以较为全面的获取到和目标对象相关的所有漏洞信息，从而可以提升信息安全。
因此，发明人提出本申请的漏洞信息获取方法，从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息；获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息；对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息；对所述第一漏洞信息和所述第二漏洞信息进行提示。便于掌握与目标对象相关的已经被公布漏洞信息以及还没有被公布的漏洞信息，并对所述第一漏洞信息和第二漏洞信息进行提示，从而可以及时获取到与目标对象相关的所有漏洞信息，提前防备，避免目标对象遭受非法攻击，从而提升了信息安全性。
下面将对本申请实施例进行详细的说明。
请参阅图1，本申请实施例提供了一种漏洞信息获取方法，可应用于电子 设备，可以基于Python代码变成实现，具体的该方法可以包括：
步骤S110：从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息。
目前存在多个漏洞公开平台，如CVE，CNVD,CNNVD等平台。从而可以从这些漏洞公开平台上获取漏洞信息。在本申请实施例中，为便于描述，定义在漏洞公开平台获取的漏洞信息为第一漏洞信息。
其中，第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息，目标对象是指需要保障信息安全的系统，应用程序，网站等。例如，漏洞公开平台上公开漏洞信息有漏洞信息A，漏洞信息B，以及漏洞信息C，然而，只有漏洞信息B为与目标对象相关的漏洞信息，那么，漏洞公开平台所公开的漏洞信息中只有漏洞信息B为第一漏洞信息。
在一些实施方式中，可以是获取与目标对象相关的关键字信息，根据所述关键字信息从所述漏洞公开平台上获取第一漏洞信息。目标对象离不开各类产品的支持，如开发语言，数据库，组件，操作系统等，因此，关键字信息可以包括目标对应所使用的各类产品信息。从而可以全面地从漏洞公开平台上获取到第一漏洞信息。
步骤S120：获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息。
在从漏洞公开平台上获取到第一漏洞信息后，为了确保全面地获取到与目标对应的相关的漏洞信息，还可以获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息。也就是说，链接内容中包括记录的目标对象所使用各类产品的漏洞信息。例如，目标对象所使用产品中包括产品AA，产品AA的官方网站中记录有与产品AA的漏洞信息。那么，链接内容可以是官方网站的内容。从而，可以根据目标对象获取到与目标对象相关的链接内容，以供后续使用。
步骤S130：对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息。
在获取到与目标对象相关的链接内容后，由于所述链接内容中还可以包括了除了漏洞信息之外的其他信息，因为，需要对获取到的链接内容进行分析，提取所述链接中和漏洞相关的信息，并从提取到的漏洞相关信息中获取除第一漏洞信息以外的漏洞信息，作为所述第二漏洞信息。其中，第二漏洞信息为对链接内容进行分析获得与目标对象相关的、且不同于第一漏洞信息的漏洞信息。第二漏洞信息和第一漏洞信息均为与目标对象相关的漏洞信息，但是第一漏洞信息和第二漏洞信息不同的是，第一漏洞信息为已经在漏洞公开平台上公布的漏洞信息，而第二漏洞信息还没有被公开在漏洞公开平台上，由于漏洞信息若是需要公开在漏洞公开平台上，需要经过一定时间的审核，从而会出现有些漏洞信息已经发现了，但是在审核阶段并没有及时公开在漏洞公开平台上，因此， 第二漏洞信息无法通过各个漏洞公开平台获取到。其中第一漏洞信息和第二漏洞信息中可以包括多条不同的且不重复的漏洞信息。
例如，第一漏洞信息中包括漏洞信息A和漏洞信息B，第二漏洞信息中包括漏洞信息C和漏洞信息D，那么，漏洞信息A，漏洞信息B，漏洞信息C以及漏洞信息D均为与目标对象相关的不同漏洞信息，漏洞信息A和漏洞信息B为公开在漏洞公开平台上的，而漏洞信息C和漏洞信息D没有公开在漏洞公开平台上。
第一漏洞信息和第二漏洞信息可以是零日漏洞信息，零日漏洞信息为零日漏洞的相关信息，这些相关信息可以包括漏洞标题，漏洞产品，漏洞等级，漏洞详情等信息。其中，零日漏洞也被称为0DAY漏洞，可以理解为未被外界所利用的漏洞。
步骤S140：对所述第一漏洞信息和所述第二漏洞信息进行提示。
在通过漏洞公开平台获取到第一漏洞信息，通过与目标对象相关的链接内容获取到第二漏洞信息后，可以将所述第一漏洞信息和所述第二漏洞信息保存到漏洞数据库中，并对所述第一漏洞信息和所述第二漏洞信息进行提示，以方便对应的人员快速了解到这些漏洞信息。
作为一种实施方式，可以是预先设置有目标地址，在获取到第一漏洞信息或第二漏洞信息时，将所述第一漏洞信息或第二漏洞信息发送到目标地址。作为另一种实施方式，可以是在获取到所述第一漏洞信息或第二漏洞信息时，发送一个预设提示信息给目标地址，目标地址对应的接收人员根据所述预设提示信息访问漏洞数据库获取所述第一漏洞信息或第二漏洞信息。
在一些实施方式中，可以对所述第一漏洞信息或第二漏洞信息进行加密发送，提升第一漏洞信息或第二漏洞信息的安全性。
在一些实施方式中，可以是预先设置有发送时间段，仅在发送时间段内发送所述第一漏洞信息和第二漏洞信息。还可以是一获取到所述第一漏洞信息或第二漏洞信息，就将获取到第一漏洞信息或第二漏洞信息发送到目标地址。
本申请提出漏洞信息获取方法，从漏洞公开平台上获取第一漏洞信息，便于掌握与目标对象相关的已经被公布漏洞信息；获取与目标对象相关的链接内容，并对链接内容进行分析获取第二漏洞信，便于掌握还没有被公布的漏洞信息；在获取到第一漏洞信息和第二漏洞信息后，对所述第一漏洞信息和第二漏洞信息进行提示，从而可以及时获取到与目标对象相关的所有漏洞信息，提前防备，避免目标对象遭受非法攻击，从而提升了信息安全性。
请参阅图2，本申请另一实施例提供了一种漏洞信息获取方法，本实施例在前述实施例的基础上，重点描述了从漏洞公开平台上获取第一漏洞信息的过程，该方法可以包括：
步骤S210：获取关键字信息，所述关键字信息包括所述目标对象所使用的产品信息。
为了从漏洞公开平台上获取第一漏洞信息，可以先获取关键字信息，所述关键字信息包括所述目标对象所使用的产品信息。如前所述，所述目标对象所使用产品多种多样，可以是CPU处理器，网络设备，操作系统，虚拟化，容器，数据库，开发语言，中间件，组件。这些产品信息可以是与产品对应的产品名称，产品制造商等信息。例如，以产品信息为产品对应的名称为例，那么所述关键字信息则为所述目标对象所使用的产品的名称。
在获取到所述关键字信息时，可以将所述关键字信息存储在一个文档中。在后续需要所述关键字信息时，可以直接调用该文档以获取到所述关键字信息。
步骤S220：根据所述关键字信息从漏洞公开平台上获取所述第一漏洞信息。
在获取到所述关键字信息后，可以根据所述关键字信息从漏洞公开平台上获取第一漏洞信息。其中，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关漏洞信息。由于所述漏洞公开平台上的公开有各类漏洞信息，其中一些漏洞信息可能并非是与目标对象相关的，从而，可以根据所述关键字信息从漏洞公开平台公开的漏洞信息中筛选出所述第一漏洞信息。
具体的，可参阅图3，示出了根据所述关键字信息从漏洞公开平台上获取所述第一漏洞信息的过程，具体可以包括以下步骤。
步骤S221：根据所述关键字信息在所述漏洞公开平台上进行搜索，获取对应的搜索结果。
在获取到所述关键字信息之后，可以将所述关键字信息在所述漏洞公开平台上进行搜索。各个漏洞信息公开平台上提供有搜索功能，不同的漏洞公开平台的所使用的搜索协议不同。因此，可以获取所述漏洞公开平台的搜索协议，基于所述搜索协议对所述关键字信息进行搜索，获取对应的搜索结果。
具体的，可以是将关键字信息输入各个漏洞信息公开平台中，得到对应关键字信息的搜索结果，其中，不同的漏洞公开平台所使用的搜索协议不同，所得到搜索结果也不同。例如，关键字信息为XX，那么在一个漏洞公开平台获取到搜索结果可能是XXXX，在另一个漏洞公开平台获取到的搜索结果可能是XXXY。
大部分漏洞公开平台在进行关键字搜索时，是通过标题及内容进行搜索，只要内容中包含关键字就可以得到对应的搜索结果，存在搜索结果与关键字信息对应的较差的问题。例如，搜索NTP，搜索结果会得到currentPage的内容。为了得到更加准确的搜索结果，可以将所述关键字信息与所述搜索结果进行匹配以获取第一漏洞信息。也就是说在漏洞公开平台上搜索关键字信息时，可能得到的搜索结果并非是与该关键字信息对应的漏洞信息。
步骤S222：对所述搜索结果的第一预设内容进行切割，得到对应所述搜索结果的切割列表。
在获取到将关键字信息在各个漏洞公开平台进行搜索后的搜索结果后，为 了更加准确的获取所述第一漏洞信息，可以对所述搜索结果的第一预设内容进行切割，得到对应所述搜索结果的切割列表。可以理解的是，所述搜索结果也为漏洞信息，可以包括漏洞标题，漏洞产品，漏洞等级，漏洞详情等信息。所述第一预设内容可以是漏洞标题，漏洞产品，漏洞等级，漏洞详情中的任意一个，具体可以根据实际的需要进行设置。例如，若关键字信息一定会包括在漏洞信息的漏洞标题中，那么，可以将所述漏洞标题作为所述第一预设内容。
在获取到所述搜索结果，并设置好所述第一预设内容后，可以对所述第一预设内容进行切割，得到对应所述搜索结果的切割列表。在切割所述第一预设内容时，可以是利用Jieba对所述第一预设内容进行切割。
其中，Jieba为一个Python组件，可以用于对语句进行分词切割。Jieba切割有多种不同的模式，在切割所述第一预设内容时，可以使用全模式，即输出文本里所有可能的单词。例如，“你好啊世界”，在使用Jieba全模式切割后，得到切割的列表为“你好”，“啊”，“世界”。
步骤S223：确定所述切割列表中是否包括所述关键字信息；若是，执行步骤S224；若否，执行步骤S225。
在得到搜索结果后，对搜索结果的第一预设内容进行切割，得到对应所述搜索结果，也就是说，每一个搜索结果可以对应一个切割列表。在获取到所述切割列表之后，可以判断所述切割列表中是否包括所述关键字信息。若包括所述关键字信息，表明所述第一预设内容中包括所述关键字信息，该条搜索结果则是准确的，从而可以执行步骤S224。
若所述切割列表中不包括所述关键字信息，表明所述第一预设内容中不包括所述关键字信息，该条搜索结果不准确，从而可以执行步骤S225。
步骤S224：对所述搜索结果进行正则匹配提取所述第一漏洞信息。
若判定所述切割列表中包括所述关键字信息，表明所述切割列表所对应的搜索结果是准确的，从而可以对所述搜索结果进行正则匹配提取所述第一漏洞信息。具体的，可以是预先存储有预设的正则表达式，利用所述正则表达式提取所述第一漏洞信息。其中，所述预设的正则表达式可以是多个，预设的正则表达式可以根据想要获取的内容进行确定。例如，所述搜索结果包括漏洞标题，漏洞产品，漏洞等级，漏洞详情等信息，然而在第一漏洞信息中，需要漏洞等级和漏洞详情，那么，所述预设的正则表达式可以是提取搜索结果中的漏洞等级和漏洞详情得到所述第一漏洞信息。
步骤S225：丢弃所述搜索结果。
若所述切割列表中不包括所述关键字信息，表明该切割列表对应的搜索结果是不准确的，则可以丢弃所述搜索结果。例如，关键字为Kindeditor，基于各类漏洞公开平台得到搜索结果中，出现了一个漏洞标题为“Y软件存在文件上传漏洞”该漏洞详情中出现了“Y软件功能与Kindeditor相似”的描述。实际上，该漏洞信息是与Y软件相关的，并非是与Kindeditor相关。假设第一预 设内容为漏洞标题，对所述漏洞标题“Y软件存在文件上传漏洞”进行切割后得到切割列表为“Y““软件”“存在”“文件”“上”“的”“漏洞”，不包括Kindeditor，则可以丢弃该条搜索结果。
步骤S230：获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息。
步骤S240：对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息。
步骤S250：对所述第一漏洞信息和所述第二漏洞信息进行提示。
步骤S230至步骤S250可参照前述实施例对应部分，在此不再赘述。
本申请提出漏洞信息获取方法，获取目标对象所使用的产品信息作为所述关键字信息，并根据所述关键字信息在漏洞平台上进行搜索，获取搜索结果，在获取到搜索结果后，进行切割以及正则匹配获取所述第一漏洞信息，提升了获取所述第一漏洞信息的准确度。获取与目标对象相关的链接内容，并对链接内容进行分析获取第二漏洞信，便于掌握还没有被公布的漏洞信息；在获取到第一漏洞信息和第二漏洞信息后，对所述第一漏洞信息和第二漏洞信息进行提示，从而可以及时获取到与目标对象相关的所有漏洞信息，提前防备，避免目标对象遭受非法攻击，从而提升了信息安全性。
请参阅图4，本申请再一实施例提供了一种漏洞信息获取方法，本实施例在前述实施例的基础上，重点描述了获取第二漏洞信息的过程，该方法可以包括：
步骤S310：从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息。
步骤S310可参照前述实施例对应部分，在此不再赘述。
步骤S320：获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息。
在获取与目标对象相关的链接内容时，可以是先获取关键链接，所述关键链接包括目标对象所使用的产品的相关链接。例如，产品的官网公告，github issue、github commit、github release、安全研究个人博客链接等。其中，github issue为其他用户对该产品提漏洞的功能，可以记录其他用户发现的该产品的漏洞；github commit为查看产品更新代码明细的功能，产品负责人在更新代码后添加相应的备注，从而可以获取到对应的漏洞信息；github release为产品打包下载的地方，产品负责人备注相应的更新内容，从而可以获取到对应的漏洞信息。
在获取到所述关键链接时，爬取所述关键链接可以得到所述链接内容。
作为一种实施方式，可以预先设置有预设时间间隔，按照预设时间间隔爬取所述关键链接得到所述链接内容。
作为另一种实施方式，可以实时监控关键链接内容的更新状态，在检测关 键链接的内容进行更新时，爬取所述关键链接得到所述关键内容。
步骤S330：利用自然语言处理模型分析所述链接内容中是否包括与漏洞相关的信息；若是，执行步骤S340；若否，执行步骤S320。
在获取到所述链接内容时，由于所述链接内容中可能会包括与漏洞不相关的其他内容，因此，可以对所述链接内容进行分析。可以是利用自然语言处理的模型分析所述链接内容，确定所述链接内容中是否包括与漏洞相关的信息。
若所述链接内容中包括与漏洞相关的信息，表明可以提取到漏洞信息，从而可以执行步骤S340。若所述链接内容中不包括与漏洞相关的信息，表明不能提取到漏洞信息，从而可以执行步骤S320，继续获取链接内容，进行分析判断。
分析所述链接内容所使用的自然语言处理模型可以是根据输入的链接内容，输出与链接内容对应的与漏洞相关的信息。在使用所述自然语言处理模型之前，可以先获取训练样本集；基于所述训练样本集对所述自然语言处理模型进行训练。
具体的，在获取所述训练样本集时，可以是先获取到语料；对获取到的语料进行预处理得到处理后的语料，对所述处理后的语料进行特征工程以及特征选择得到训练样本集。语料是指语言材料，可以是从互联网上获取，在获取到语料之后，需要对语料进行一系列的预处理，可以是分词，标注等。在对语料进行处理后，需要将语料表示为计算机能够计算的类型，即特征工程，通常可以是将语料处理为特征向量，以供计算器计算。构造好特征向量后，需要选择合适的，表达能力强的特征得到训练样本集。
在获取到所述训练样本集后，可以基于所述训练样本集对机器学习模型进行训练得到所述自然语言处理模型。从而可以利用所述自然语言处理模型分析所述链接内容。
步骤S340：对所述与漏洞相关的信息进行正则匹配提取所述第二漏洞信息。
若判定所述链接内容中包括与漏洞相关的信息，表明可以提取到与漏洞信息，从而可以利用正则匹配提取所述第二漏洞信息。具体的，可以参阅图5，可以包括以下步骤。
步骤S341：根据预设的正则表达式匹配所述与漏洞相关的信息得到匹配结果。
利用自然语言处理模型分析所述链接内容时，若链接内容中包括与漏洞相关的信息，那么自然语言处理模型可以输出与漏洞相关的信息。从而可以根据预设的正则表达式匹配所述与漏洞相关的信息得到匹配结果。
具体的，可以参照前述实施例步骤S224中相应的描述，这里所使用的预设的正则表达式可以与步骤S224中保持一致，也可以在步骤S224中的预设的正则表达式上增加一些表达式进行匹配。例如，通常在链接内容中，除了漏 洞详情，漏洞标题等，还可能包括可一些漏洞更新内容，也可以提取这些漏洞更新内容。从而可以匹配所述与漏洞相关的信息得到匹配结果。
步骤S342：判断所述匹配结果是否与所述第一漏洞信息相同；若是，执行步骤S343；若否，执行步骤S344。
在得到所述匹配结果后，该匹配结果为漏洞信息，为了避免匹配结果和第一漏洞信息重复，可以判断所述匹配结果是否与所述第一漏洞信息相同。若相同，表明漏洞信息重复，从而可以执行步骤S343，若不相同，表明所述漏洞信没有重复，从而可以执行步骤S344。
作为一种实施方式，在获取到所述第一漏洞信息时，可以将所述第一漏洞信息存入漏洞数据库中，在获取到所述匹配结果后，可以比较所述匹配结果是否和漏洞数据库中的第一漏洞信息相同。
步骤S343：丢弃所述匹配结果。
步骤S344：将所述匹配结果作为所述第二漏洞信息。
若判定所述匹配结果与所述第一漏洞信息重复，则可以丢弃所述匹配结果；若判定所述匹配结果与所述第一漏洞信息不重复，则可以将所述匹配结果作为所述第二漏洞信息。
本申请提出漏洞信息获取方法，利用自然语言处理模型分析链接内容，可以准确的提取出所述链接内容中的与漏洞相关的信息，从而可以及时并准确的获取到没有被公开漏洞信息，提前防备，避免目标对象遭受非法攻击，从而提升了信息安全性。
在获取到所述第一漏洞信息和第二漏洞信息后，可以对所述第一漏洞信息和第二漏洞信息进行提示。请参阅图6，本申请又一实施例提供了一种漏洞信息获取方法，本实施例在前述实施例的基础上，重点描述了对第一漏洞信息和第二漏洞信息进行提示的过程，该方法可以包括：
步骤S410：从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息。
步骤S420：获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息。
步骤S430：对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息。
步骤S410至步骤S430可参照前述实施例对应部分，在此不再赘述。
步骤S440：获取所述第一漏洞信息和第二漏洞信息的风险级别。
在对所述第一漏洞信息和第二漏洞信息进行提示时，可以获取所述第一漏洞信息和第二漏洞信息的风险级别，根据所述风险级别选择性的提示。其中，所述风险级别可以是一个参数，参数值越高，表明漏洞的威胁越高。具体的可以参照图7，包括以下步骤：
步骤S441：获取所述第一漏洞信息和第二漏洞信息。
步骤S442：判断所述第一漏洞信息或第二漏洞信息中是否包括漏洞等级；若是，执行步骤S444；若否，执行步骤S443。
获取所述第一漏洞信息和第二漏洞信息，其中，所述第一漏洞信息为已经在漏洞公开平台上的漏洞信息，所述第二漏洞信息为没有公开在漏洞公开平台上的漏洞信息。公开在所述漏洞公开平台上的漏洞信息，通常有编号以及漏洞等级。由此，第一漏洞信息中通常包括漏洞等级。而第二漏洞信息通常是还没有公开在漏洞公开平台上的漏洞信息，通常没有漏洞等级。
在获取到所述第一漏洞信息和第二漏洞信息之后，可以判断是否包括漏洞等级，若包括，执行步骤S444；若不包括，执行步骤S443。
步骤S443：根据所述漏洞等级确定风险级别。
若所述第一漏洞信息或第二漏洞信息中包括所述漏洞等级，则可以根据所述漏洞等级确定风险级别。通常所述漏洞等级的内容为，低，较低，高，较高等。可以将所述漏洞等级转换成风险级别。具体的，可以是预先设置有转换表，所述转换表包括所述漏洞等级与风险级别的对应关系，通常查询所述转换表，则可以获取到所述漏洞等级对应的风险级别。
步骤S444：判断所述第一漏洞信息或第二漏洞信息中是否包括第二预设内容；若是，执行步骤S445；若否，执行步骤S441。
若所述第一漏洞信息或第二漏洞信息中不包括所述漏洞等级，可以继续判断是否包括第二预设内容。所述第二预设内容可以是一些威胁较大的漏洞的关键信息，具体可以根据实际使用进行设置。例如，可以是确定漏洞详情中是否包括命令执行或sql注入等关键字。若包括所述第二预设内容，则执行步骤S445，若不包括所述第二预设内容，则执行步骤S441，继续获取第一漏洞信息和第二漏洞信息，进行风险等级的确定。
步骤S445：确定包括所述第二预设内容的第一漏洞信息和第二漏洞信息的风险级别大于预设级别。
若确定所述第一漏洞信息或第二漏洞信息中包括所述第二预设内容，表明该漏洞的风险级别较高，可以直接认为该漏洞信息的风险级别大于预设级别。其中，所述风险级别可以是预先设置的等级，若漏洞信息的风险级别大于预设级别，可以认为该漏洞的威胁较大，一旦被攻击者利用，会造成较大的损失。
步骤S450：将所述风险级别大于预设级别第一漏洞信息和第二漏洞信息发送给预设人员。
在根据漏洞级别确定出所述风险级别后，还需要判断所述漏洞级别是否大于预设级别，获取所述大于预设级别的漏洞信息。为了通知对应的人员，可以将大于所述预设级别的漏洞信息发送给预设人员。
作为一种实施方式，可以是预先设置有目标地址，在获取到第一漏洞信息或第二漏洞信息时，将所述第一漏洞信息或第二漏洞信息发送到目标地址，所述目标地址可以是各类通讯地址。作为另一种实施方式，可以是在获取到所述 第一漏洞信息或第二漏洞信息时，发送一个预设提示信息给目标地址，目标地址对应的接收人员根据所述预设提示信息访问漏洞数据库获取所述第一漏洞信息或第二漏洞信息。
在一些实施方式中，可以对所述第一漏洞信息或第二漏洞信息进行加密发送，提升第一漏洞信息或第二漏洞信息的安全性。
在一些实施方式中，可以是预先设置有发送时间段，仅在发送时间段内发送所述第一漏洞信息和第二漏洞信息。还可以是一获取到所述第一漏洞信息或第二漏洞信息，就将获取到第一漏洞信息或第二漏洞信息发送到目标地址。
当然，在本申请实施例中，也可以对获取到的所有的第一漏洞信息和第二漏洞信息进行提示。
本申请提出漏洞信息获取方法，从漏洞公开平台上获取第一漏洞信息；获取与目标对象相关的链接内容；对所述链接内容进行分析获取第二漏洞信息；获取所述第一漏洞信息和第二漏洞信息的风险级别，并将风险级别大于预设级别的第一漏洞信息和第二漏洞信息发送给预设人员，及时进行提示，从而可以及时获取到与目标对象相关的所有漏洞信息，提前防备，避免目标对象遭受非法攻击，从而提升了信息安全性。
请参阅图8，其示出了本申请实施例提供的一种漏洞信息获取装置500，应用于电子设备，所述装置500包括第一漏洞信息获取模块510、链接内容获取模块520，第二漏洞获取模块530以及提示模块540。
所述第一漏洞信息获取模块510，用于从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息；所述链接获取模块520，用于获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息；所述第二漏洞获取模块530，用于对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息；所述提示模块540，用于对所述第一漏洞信息和所述第二漏洞信息进行提示。
进一步的，请参阅图9，其示出了本申请实施例提供的一种漏洞信息获取装置500，所述第一漏洞信息获取模块510还包括关键字信息获取单元511以及搜寻单元512：所述关键字信息获取单元511用于获取关键字信息，所述关键字信息包括目标对象所使用的产品信息；所述搜寻单元512用于根据所述关键字信息从漏洞公开平台上获取所述第一漏洞信息。
进一步的，所述搜寻单元512还用于根据所述关键字信息在所述漏洞公开平台上进行搜索，获取对应的搜索结果；将所述关键字信息与所述搜索结果进行匹配获取所述第一漏洞信息。
进一步的，所述搜寻单元512还用于获取所述漏洞公开平台的搜索协议；基于所述搜索协议对所述关键字信息进行搜索。
进一步的，所述搜寻单元512还用于对所述搜索结果的第一预设内容进行 切割，得到对应所述搜索结果的切割列表；确定所述切割列表中是否包括所述关键字信息；若不包括，丢弃所述搜索结果；若包括，对所述搜索结果进行正则匹配提取所述第一漏洞信息。
进一步的，所述搜寻单元512还用于根据预设的正则表达式匹配所述搜索结果得到第一漏洞信息。
进一步的，所述链接内容获取模块520还用于获取关键链接，所述关键链接包括目标对象所使用的产品的相关链接；爬取所述关键链接得到所述链接内容。
进一步的，所述链接内容获取模块520还用于按照预设时间间隔爬取所述关键链接得到所述链接内容。进一步的，所述第二漏洞信息获取模块530还用于利用自然语言处理模型分析所述链接内容中是否包括与漏洞相关的信息，所述自然语言处理模型用于根据输入的链接内容，输出与链接内容对应的与漏洞相关的信息；若是，对所述与漏洞相关的信息进行正则匹配提取所述第二漏洞信息。
进一步的，在利用自然语言处理模型分析所述链接内容中是否包括与漏洞相关的信息之前，所述第二漏洞信息获取模块530还用于获取训练样本集；基于所述训练样本集对所述自然语言处理模型进行训练。
进一步的，所述第二漏洞信息获取模块530还用于对获取到的语料进行预处理得到处理后的语料，所述预处理包括分词，标注；对所述处理后的语料进行特征工程以及特征选择得到训练样本集。
进一步的，所述第二漏洞信息获取模块530还用于根据预设的正则表达式匹配所述与漏洞相关的信息得到匹配结果；判断所述匹配结果是否与所述第一漏洞信息相同；若是，丢弃所述匹配结果；若否，将所述匹配结果作为所述第二漏洞信息。
进一步的，所述提示模块540还用于获取所述第一漏洞信息和第二漏洞信息的风险级别；将所述风险级别大于预设级别第一漏洞信息和第二漏洞信息发送给预设人员。
进一步的，所述提示模块540还用于判断所述第一漏洞信息或第二漏洞信息中是否包括漏洞等级；若是，根据所述漏洞等级确定风险级别；若否，判断所述第一漏洞信息或第二漏洞信息中是否包括第二预设内容；若包括所述第二预设内容，确定包括所述第二预设内容的第一漏洞信息和第二漏洞信息的风险级别大于预设级别。
进一步的，所述提示模块540还用于在获取第一漏洞信息之后，或获取第二漏洞信息之后，将获取到的所述第一漏洞信息或第二漏洞信息存入漏洞数据库。
进一步的，所述第一漏洞信息和所述第二漏洞信息为零日漏洞信息。
需要说明的是，所属领域的技术人员可以清楚地了解到，为描述的方便和 简洁，上述描述装置和模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
综上所述，本申请提供的漏洞信息获取方法，获取用户在管理平台上创建的目标任务，所述目标任务中包括源机房，目标机房以及同步主题，根据目标任务获取源机房中所述同步主题的数据，将数据发送给目标机房中的相同的同步主题。提供管理平台创建了同步任务，简化了同步任务的创建以及数据同步的过程，用户只需要在管理平台上建立对应的同步任务就可以将源机房中的数据同步到目标机房中，降低了实现数据同步的难度。
在本申请所提供的几个实施例中，所显示或讨论的模块相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或模块的间接耦合或通信连接，可以是电性，机械或其它的形式。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
请参考图9，其示出了本申请实施例提供的一种服务器的结构框图。本申请中的电子设备600可以包括一个或多个如下部件：处理器610、存储器620，以及一个或多个应用程序，其中一个或多个应用程序可以被存储在存储器620中并被配置为由一个或多个处理器610执行，一个或多个程序配置用于执行如前述方法实施例所描述的方法。
处理器610可以包括一个或者多个处理核。处理器610利用各种接口和线路连接整个电子设备600内的各个部分，通过运行或执行存储在存储器620内的指令、程序、代码集或指令集，以及调用存储在存储器620内的数据，执行电子设备600的各种功能和处理数据。可选地，处理器610可以采用数字信号处理(Digital Signal Processing，DSP)、现场可编程门阵列(Field－Programmable Gate Array，FPGA)、可编程逻辑阵列(Programmable Logic Array，PLA)中的至少一种硬件形式来实现。处理器610可集成中央处理器(Central Processing Unit，CPU)、图像处理器(Graphics Processing Unit，GPU)和调制解调器等中的一种或几种的组合。其中，CPU主要处理操作系统、用户界面和应用程序等；GPU用于负责显示内容的渲染和绘制；调制解调器用于处理无线通信。可以理解的是，上述调制解调器也可以不集成到处理器610中，单独通过一块通信芯片进行实现。
存储器620可以包括随机存储器(Random Access Memory，RAM)，也可以包括只读存储器(Read-Only Memory)。存储器620可用于存储指令、程序、代码、代码集或指令集。存储器620可包括存储程序区和存储数据区，其中，存储程序区可存储用于实现操作系统的指令、用于实现至少一个功能的指令(比如触控功能、声音播放功能、图像播放功能等)、用于实现下述各个方 法实施例的指令等。存储数据区还可以存储电子设备600在使用中所创建的数据(比如电话本、音视频数据、聊天记录数据)等。
请参考图11，其示出了本申请实施例提供的一种计算机可读存储介质的结构框图。该计算机可读存储介质700中存储有程序代码，所述程序代码可被处理器调用执行上述方法实施例中所描述的方法。
计算机可读存储介质700可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。可选地，计算机可读存储介质700包括非瞬时性计算机可读介质(non-transitory computer-readable storage medium)。计算机可读存储介质700具有执行上述方法中的任何方法步骤的程序代码710的存储空间。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。程序代码710可以例如以适当形式进行压缩。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不驱使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (20)

  1. 一种漏洞信息获取方法，其特征在于，所述方法包括：
    从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息；
    获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息；
    对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息；
    对所述第一漏洞信息和所述第二漏洞信息进行提示。
  2. 根据权利要求1所述的方法，其特征在于，从漏洞公开平台上获取第一漏洞信息，包括：
    获取关键字信息，所述关键字信息包括所述目标对象所使用的产品信息；
    根据所述关键字信息从漏洞公开平台上获取所述第一漏洞信息。
  3. 根据权利要求2所述的方法，其特征在于，所述根据所述关键字信息从漏洞公开平台上获取所述第一漏洞信息，包括：
    根据所述关键字信息在所述漏洞公开平台上进行搜索，获取对应的搜索结果；
    将所述关键字信息与所述搜索结果进行匹配获取所述第一漏洞信息。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述关键字信息在所述漏洞公开平台上进行搜索，包括：
    获取所述漏洞公开平台的搜索协议；
    基于所述搜索协议对所述关键字信息进行搜索。
  5. 根据权利要求3所述的方法，所述将所述关键字信息与所述搜索结果进行匹配获取所述第一漏洞信息，包括：
    对所述搜索结果的第一预设内容进行切割，得到对应所述搜索结果的切割列表；
    确定所述切割列表中是否包括所述关键字信息；
    若不包括，丢弃所述搜索结果；
    若包括，对所述搜索结果进行正则匹配提取所述第一漏洞信息。
  6. 根据权利要求5所述的方法，其特征在于，所述对所述搜索结果进行正则匹配提取所述第一漏洞信息，包括：
    根据预设的正则表达式匹配所述搜索结果得到第一漏洞信息。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述获取与目标对象相关的链接内容，包括：
    获取关键链接，所述关键链接包括目标对象所使用的产品的相关链接；
    爬取所述关键链接得到所述链接内容。
  8. 根据权利要求7所述的方法，其特征在于，所述爬取所述关键链接得到所述链接内容，包括：
    按照预设时间间隔爬取所述关键链接得到所述链接内容。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，所述对所述链接内容进行分析获取第二漏洞信息，包括：
    利用自然语言处理模型分析所述链接内容中是否包括与漏洞相关的信息，所述自然语言处理模型用于根据输入的链接内容，输出与链接内容对应的与漏洞相关的信息；
    若是，对所述与漏洞相关的信息进行正则匹配提取所述第二漏洞信息。
  10. 根据权利要求9所述的方法，其特征在于，所述利用自然语言处理模型分析所述链接内容中是否包括与漏洞相关的信息之前，还包括：
    获取训练样本集；
    基于所述训练样本集对所述自然语言处理模型进行训练。
  11. 根据权利要求10所述的方法，其特征在于，所述获取训练样本集，包括：
    对获取到的语料进行预处理得到处理后的语料，所述预处理包括分词，标注；
    对所述处理后的语料进行特征工程以及特征选择得到训练样本集。
  12. 根据权利要求9所述的方法，其特征在于，对所述与漏洞相关的信息进正则匹配提取所述第二漏洞信息，包括：
    根据预设的正则表达式匹配所述与漏洞相关的信息得到匹配结果；
    判断所述匹配结果是否与所述第一漏洞信息相同；
    若是，丢弃所述匹配结果；
    若否，将所述匹配结果作为所述第二漏洞信息。
  13. 根据权利要求1-12任一项所述的方法，所述对所述第一漏洞信息和第二漏洞信息进行提示，包括：
    获取所述第一漏洞信息和第二漏洞信息的风险级别；
    将所述风险级别大于预设级别第一漏洞信息和第二漏洞信息发送给预设人员。
  14. 根据权利要求13所述的方法，其特征在于，所述获取所述第一漏洞信息和第二漏洞信息的风险级别，包括：
    判断所述第一漏洞信息或第二漏洞信息中是否包括漏洞等级；
    若是，根据所述漏洞等级确定风险级别；
    若否，判断所述第一漏洞信息或第二漏洞信息中是否包括第二预设内容；
    若是，确定包括所述第二预设内容的第一漏洞信息和第二漏洞信息的风险级别大于预设级别。
  15. 根据权利要求1-14任一项所述的方法，其特征在于，所述获取第一漏 洞信息之后，或获取第二漏洞信息之后，还包括：
    将获取到的所述第一漏洞信息或第二漏洞信息存入漏洞数据库。
  16. 根据权利要求1-15任一项所述的方法，其特征在于，所述第一漏洞信息和所述第二漏洞信息为零日漏洞信息。
  17. 一种漏洞信息获取装置，其特征在于，所述装置包括：
    第一漏洞信息获取模块，用于从漏洞公开平台上获取第一漏洞信息，所述第一漏洞信息包括漏洞公开平台公开的与目标对象相关的漏洞信息；
    链接获取模块，用于获取与目标对象相关的链接内容，所述链接内容包括记录的与目标对象相关的漏洞信息；
    第二漏洞获取模块，用于对所述链接内容进行分析获取第二漏洞信息，所述第二漏洞信息不同于所述第一漏洞信息；
    提示模块，用于对所述第一漏洞信息和所述第二漏洞信息进行提示。
  18. 根据权利要求17所述的装置，其特征在于，所述第一漏洞信息获取模块还包括关键字信息获取单元以及搜寻单元：
    所述关键字信息获取单元用于获取关键字信息，所述关键字信息包括目标对象所使用的产品信息；
    所述搜寻单元用于根据所述关键字信息从漏洞公开平台上获取所述第一漏洞信息。
  19. 一种电子设备，其特征在于，所述电子设备包括：
    一个或多个处理器；
    一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行如权利要求1至16任一项所述的方法。
  20. 一种计算机可读取存储介质，其特征在于，所述计算机可读取存储介质中存储有程序代码，所述程序代码可被处理器调用执行如权利要求1至16任一项所述的方法。
PCT/CN2020/091272 2020-05-20 2020-05-20 漏洞信息获取方法、装置、电子设备及存储介质 WO2021232282A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080099538.6A CN115380285A (zh) 2020-05-20 2020-05-20 漏洞信息获取方法、装置、电子设备及存储介质
PCT/CN2020/091272 WO2021232282A1 (zh) 2020-05-20 2020-05-20 漏洞信息获取方法、装置、电子设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/091272 WO2021232282A1 (zh) 2020-05-20 2020-05-20 漏洞信息获取方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2021232282A1 true WO2021232282A1 (zh) 2021-11-25

Family

ID=78709062

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/091272 WO2021232282A1 (zh) 2020-05-20 2020-05-20 漏洞信息获取方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN115380285A (zh)
WO (1) WO2021232282A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107888601A (zh) * 2017-11-21 2018-04-06 国云科技股份有限公司 一种云平台服务器智能检测病毒入侵系统及其方法
CN108985068A (zh) * 2018-06-26 2018-12-11 广东电网有限责任公司信息中心 漏洞快速感知、定位及验证的方法与系统
US20190156042A1 (en) * 2017-11-21 2019-05-23 Korea Internet & Security Agency Method, system and apparatus for generating document for sharing vulnerability information
CN109948911A (zh) * 2019-02-27 2019-06-28 北京邮电大学 一种计算网络产品信息安全风险的评估方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107888601A (zh) * 2017-11-21 2018-04-06 国云科技股份有限公司 一种云平台服务器智能检测病毒入侵系统及其方法
US20190156042A1 (en) * 2017-11-21 2019-05-23 Korea Internet & Security Agency Method, system and apparatus for generating document for sharing vulnerability information
CN108985068A (zh) * 2018-06-26 2018-12-11 广东电网有限责任公司信息中心 漏洞快速感知、定位及验证的方法与系统
CN109948911A (zh) * 2019-02-27 2019-06-28 北京邮电大学 一种计算网络产品信息安全风险的评估方法

Also Published As

Publication number Publication date
CN115380285A (zh) 2022-11-22

Similar Documents

Publication Publication Date Title
WO2018036239A1 (zh) 基于行业知识图谱数据库对互联网媒体事件进行监测的方法、装置和系统
US9805022B2 (en) Generation of topic-based language models for an app search engine
CN109361643B (zh) 一种恶意样本的深度溯源方法
US8407781B2 (en) Information providing support device and information providing support method
CN104346480B (zh) 信息挖掘方法和装置
US8886660B2 (en) Method and apparatus for tracking a change in a collection of web documents
JP5558997B2 (ja) 相互検索およびアラートのための方法、情報処理システム、およびコンピュータ・プログラム（構造化データ・ソースと非構造化データ・ソースとの間の相互検索およびアラート）
CN110855676A (zh) 网络攻击的处理方法、装置及存储介质
CN111104579A (zh) 一种公网资产的识别方法、装置及存储介质
US10909174B1 (en) State detection of live feed
US20170011114A1 (en) Common data repository for improving transactional efficiencies of user interactions with a computing device
CN107807957A (zh) 实体库生成方法及装置
KR20170035892A (ko) 온라인 서비스의 거동 변화의 인식 기법
CN112532624B (zh) 一种黑链检测方法、装置、电子设备及可读存储介质
CN115150261B (zh) 告警分析的方法、装置、电子设备及存储介质
CN113810395B (zh) 一种威胁情报的检测方法、装置及电子设备
CN107566392A (zh) 一种报错型sql注入的检测方法和代理服务器
CN105468975A (zh) 恶意代码误报的追踪方法、装置及系统
CN113468524B (zh) 基于rasp的机器学习模型安全检测方法
US20240095289A1 (en) Data enrichment systems and methods for abbreviated domain name classification
WO2021103594A1 (zh) 一种默契度检测方法、设备、服务器及可读存储介质
CN117254983A (zh) 涉诈网址检测方法、装置、设备及存储介质
WO2021232282A1 (zh) 漏洞信息获取方法、装置、电子设备及存储介质
CN112559913A (zh) 一种数据处理方法、装置、计算设备及可读存储介质
CN107862016A (zh) 一种专题页面的配置方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20936637

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 17/04/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20936637

Country of ref document: EP

Kind code of ref document: A1