Vulnerability fingerprint silent analysis monitoring method, system, device and medium

Abstract

The invention provides a vulnerability fingerprint silent analysis monitoring method, system and device and a medium, and the method comprises the steps of training a vulnerability script of a vulnerability scanning engine, and enabling the trained vulnerability scanning engine to detect a vulnerability sample according to a self-defined vulnerability framework; after the vulnerability sample detection is completed, training vulnerability conditions by adopting a modeling algorithm and analyzing vulnerability scanning results through self-learning; and adding a network space surveying and mapping function to generate an asset report while scanning the vulnerability, and displaying the asset report by adopting a UI (User Interface). Based on the method, the invention further provides a vulnerability fingerprint silent analysis monitoring system and device and a storage medium. According to the invention, the vulnerability framework is self-defined, and the latest vulnerability is timely compiled and uploaded to detect the script, so that the emergency response is timely and accurate. The invention aims at reducing internal vulnerabilities, standardizing network security behaviors, discovering and handling existing potential safety hazards in advance, greatly improving the network security protection level and discovering attack risks faced by equipment and a system in time.

Description

technical field [0001] The invention belongs to the technical field of software development, in particular to a method, system, device and medium for silent analysis and monitoring of vulnerability fingerprints. Background technique [0002] At present, network attacks emerge in endlessly. If internal vulnerabilities cannot be discovered and repaired in time, network security behaviors can be regulated, and existing security risks can be discovered and dealt with in advance, the business system will be irreversibly affected. [0003] However, the traditional vulnerability scanning technology has the following problems: First, it is difficult to quickly adapt to the changing needs of security risks. Using traditional vulnerability scanning equipment, there are problems of slow update of the security library and poor real-time performance. After the 0day vulnerability is exposed, it is impossible to quickly and effectively verify the vulnerability of the system, equipment, etc...

AI Technical Summary

Problems solved by technology

[0002] At present, network attacks emerge in endlessly. If internal vulnerabilities cannot be discovered and repaired in time, network security behaviors can be regulated, and existing security risks can be discovered and dealt with in advance, it will have an irreversible impact on the business system

[0003] However, the traditional vulnerability scanning technology has the following problems: First, it is difficult to quickly adapt to the changing needs of security risks

Second, there are many false negatives and false positives of security risks

Due to the complexity and diversity of the operating system, middleware, database and other environments, some scanning tools detect vulnerabilities through the system version number, and there are false positives and false positives, which require further analysis and confirmation by security operation and maintenance personnel, which is time-consuming and labor-intensive.

Third, it is impossible to intelligently scan and analyze

Traditional scanning tools judge the service based on the port, and then call the script to attack. There may be situations where the port cannot be detected due to port changes

And focusing on a single vulnerability, it is impossible to conduct a unified intelligent scan for most of the vulnerabilities, and it is impossible to quickly and accurately check and intelligently analyze the vulnerabilities in order to make a unified judgment on the current network vulnerability.

Images