WO2020244307A1 - 一种漏洞检测方法及装置 - Google Patents

一种漏洞检测方法及装置 Download PDF

Info

Publication number
WO2020244307A1
WO2020244307A1 PCT/CN2020/084320 CN2020084320W WO2020244307A1 WO 2020244307 A1 WO2020244307 A1 WO 2020244307A1 CN 2020084320 W CN2020084320 W CN 2020084320W WO 2020244307 A1 WO2020244307 A1 WO 2020244307A1
Authority
WO
WIPO (PCT)
Prior art keywords
project
item
vulnerability
code
file
Prior art date
Application number
PCT/CN2020/084320
Other languages
English (en)
French (fr)
Inventor
余炯斌
Original Assignee
深圳前海微众银行股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海微众银行股份有限公司 filed Critical 深圳前海微众银行股份有限公司
Publication of WO2020244307A1 publication Critical patent/WO2020244307A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security

Definitions

  • the present invention relates to the technical field of financial technology (Fintech), in particular to a method and device for vulnerability detection.
  • the financial industry (such as banking, insurance, and securities institutions) generally involves transaction processing operations. Due to the nature of the financial industry, it is necessary to ensure the accuracy, safety and non-loss of the transaction processing process as much as possible, which requires Monitor the security status of network information in real time during the process. If it is determined that there are loopholes in the control used by a certain project in the current system, the loopholes can be fixed in time to ensure the normal operation of the transaction processing process.
  • the database-based vulnerability scanning method is a common way to detect vulnerabilities in the system. Take banks as an example. Banks can usually be set up with Configuration Management Database (CMDB), and CMDB can be stored and managed by the bank.
  • CMDB Configuration Management Database
  • CMDB Various configuration information related to the information technology industry (Information Technology, IT) architecture, such as project component information, service information, and framework information.
  • IT Information Technology
  • project personnel can add project-related configuration information to the CMDB when creating a new project. Based on this, when using this method for vulnerability detection, if it is determined that a certain control is a vulnerability control, you can use the CMDB to find multiple projects during the registration of the system and related configuration information of multiple projects, so as to determine which projects are used The vulnerability control.
  • the configuration information in the CMDB may not be accurate; for example, take the component as an example, if the project’s components are updated after the project is online Or upgrade, the actual components used by the project are not consistent with the components of the project in the CMDB. It can be seen that using the above-mentioned method for vulnerability detection cannot accurately locate the item that uses the vulnerability control, so that the accuracy of vulnerability detection is low.
  • the embodiments of the present invention provide a vulnerability detection method and device, which are used to accurately locate items using vulnerability controls, thereby improving the accuracy of vulnerability detection.
  • an embodiment of the present invention provides a vulnerability detection method, the method includes:
  • the identification of at least one vulnerability control stored in the preset vulnerability library is obtained; further, for the first vulnerability control in the at least one vulnerability control, if it is determined that the preset database exists Use the first target item of the first vulnerability control to display the first target item to the user; the preset database is detected by executing code on at least one item, and the preset database stores There are an identifier of the at least one item and a control used by the at least one item.
  • the controls used by the project can be obtained by performing code inspection on the project to ensure that the acquired controls are the latest controls used in the execution of the project. So, based on The latest control used by the project for vulnerability detection can improve the accuracy of the detected project vulnerabilities; and, by storing the results of the code detection corresponding to the project in the preset database, you can obtain the information used by the project through the preset database. Control, without the need to re-check the code of the project, which can improve the efficiency of detecting project vulnerabilities, thereby improving the efficiency of repairing project vulnerabilities.
  • the controls used by the at least one project include any one or more of the framework, third-party components, and services used by the at least one project; the third-party used by the at least one project
  • the component is a dependent library and/or plug-in used by the at least one project.
  • one or more of the framework, dependent libraries, plug-ins, and services used by the project can be accurately identified, such as the name of the framework, dependent libraries, plug-ins, and services And/or version; that is to say, the above design can quickly and accurately locate the item to which the vulnerable control belongs, thereby reducing the possibility of the system being exposed to weakness or being attacked, and improving the security of the system.
  • the preset database is detected by executing code for at least one item, including: obtaining code files corresponding to the at least one item according to the identifier of the at least one item; further, For the first item in the at least one item, the programming language used by the first item is determined according to the suffix of the code file corresponding to the first item, and according to the directory of the code file corresponding to the first item.
  • the structure and/or the programming language used by the first item determines the item type of the first item; according to the item type of the first item, obtain the file to be detected from the code file corresponding to the first item, and Detecting the file to be detected, determining the control used by the first item; generating the preset database using the identifier of the at least one item and the control used by the at least one item.
  • the project is divided into multiple types by using the directory structure of the code file corresponding to the project and/or the programming language, and the scanning method corresponding to the project type can be used to obtain the files to be detected, thereby improving the efficiency and accuracy of detecting project vulnerabilities Moreover, by determining a variety of project types and corresponding scanning methods for each project type, the process of detecting project vulnerabilities can be more in line with the actual situation, making the scene of project vulnerability detection more extensive.
  • the obtaining the file to be detected from the code file corresponding to the first item according to the item type of the first item includes: if it is determined that the first item uses the first preset Assuming that the tool is built, the content corresponding to the properties tag, dependencies tag, and/or plugins tag is obtained from the pom.xml data package of the code file corresponding to the first project; or, if it is determined that the first project is not If it is built using the first preset tool, the programming language used by the first project is acquired; if the programming language used by the first project is java language, the jar data package file of the code file is acquired, Or, if the programming language used by the first project is Javascript type, then obtain the package.json data package file and/or package-lock.json data package file of the code file, or, if the first project uses If the programming language is python type, the header file of the code file is obtained.
  • the file to be detected corresponding to the item type can be quickly obtained based on the corresponding scanning method, thereby improving the efficiency of detecting project vulnerabilities.
  • the method further includes: if there is no target project using the first vulnerability control in the preset database, determining one or more projects currently in a running state, and according to all The identification of the one or more projects, the project address of the one or more projects is obtained; further, according to the project address of the one or more projects, the application programming API interface is called to obtain the one or more projects Corresponding to one or more files to be detected, and perform code detection on the one or more files to be detected to determine the controls used by the one or more items. If the one or more items are used The second target item of the first vulnerability control is displayed to the user.
  • the code analysis of the currently running project can accurately locate the project using the first vulnerability control, thereby improving the accuracy of detecting the vulnerability.
  • an embodiment of the present invention provides a vulnerability detection device, the device includes:
  • the transceiver module is used to obtain the identifier of at least one vulnerability control stored in the preset vulnerability library after receiving the vulnerability detection instruction triggered by the user;
  • the processing module is configured to target the first vulnerability control in the at least one vulnerability control, and if it is determined that there is a first target item that uses the first vulnerability control in the preset database, display the first target item to The user; the preset database is detected by executing code on at least one item, and the identification of the at least one item and the controls used by the at least one item are stored in the preset database.
  • the controls used by the at least one project include any one or more of the framework, third-party components, and services used by the at least one project; the third-party used by the at least one project
  • the component is a dependent library and/or plug-in used by the at least one project.
  • the processing module is further configured to: obtain code files corresponding to the at least one item according to the identifier of the at least one item; further, for the first item in the at least one item For a project, determine the programming language used by the first project according to the suffix of the code file corresponding to the first project, and use the programming language according to the directory structure of the code file corresponding to the first project and/or the first project
  • the programming language for determining the item type of the first item; according to the item type of the first item, the file to be detected is obtained from the code file corresponding to the first item, and the file to be detected is detected to determine
  • the control used by the first item; the preset database is generated using the identifier of the at least one item and the control used by the at least one item.
  • the processing module is specifically configured to: if it is determined that the first project is built using a first preset tool, then from the pom.xml data of the code file corresponding to the first project Obtain the contents corresponding to the properties tag, dependencies tag, and/or plugins tag in the package; or, if it is determined that the first project is not built using the first preset tool, then obtain the programming used by the first project Language; if the programming language used by the first project is java language, then the jar data package file of the code file is obtained, or if the programming language used by the first project is the Javascript type, then the code file is obtained The package.json data package file and/or the package-lock.json data package file, or, if the programming language used by the first project is of the python type, the header file of the code file is obtained.
  • the processing module is further configured to: if there is no target project using the first vulnerability control in the preset database, determine one or more projects that are currently running, and According to the identification of the one or more projects, obtain the project address of the one or more projects; further, according to the project address of the one or more projects, call the application programming API interface to obtain the one or more projects.
  • Each item corresponds to one or more files to be detected, and code detection is performed on the one or more files to be detected to determine the controls used by the one or more items; if the one or more items exist Using the second target item of the first vulnerability control, the second target item is displayed to the user.
  • a computer-readable storage medium provided by an embodiment of the present invention includes instructions that, when run on a processor of a computer device, cause the processor of the computer device to execute the steps of the method described in the first aspect.
  • a computer program product provided by an embodiment of the present invention, when it runs on a computer device, causes the computer device to execute the steps of the method described in the first aspect.
  • an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and running on the processor.
  • the processor implements the first aspect when the program is executed. The steps of the method.
  • the control used by the project can be obtained by performing code detection on the project, which can ensure that the obtained control is the latest control used during the execution of the project.
  • Vulnerability detection based on the latest controls used in the project can improve the accuracy of the detected project vulnerabilities; and by storing the results of the code detection corresponding to the project in the preset database, the project can be used through the preset database Without re-checking the code of the project, the efficiency of detecting project vulnerabilities can be improved, and the efficiency of repairing project vulnerabilities can be improved.
  • FIG. 1 is a schematic diagram of the architecture of a network information security system provided by an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a vulnerability detection method provided by an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a vulnerability detection device provided by an embodiment of the present invention.
  • Figure 4 is a schematic structural diagram of a computer device provided by an embodiment of the present invention.
  • Fintech refers to a new innovative technology brought to the financial field after the integration of information technology into the financial field.
  • the financial system can be improved by using advanced information technology to assist in financial operations, transaction execution and financial system improvements. Processing efficiency, business scale, and can reduce costs and financial risks.
  • Transaction processing operations are a regular operation method in the financial technology industry. Since transaction processing operations involve information such as transaction accounts and transaction amounts, it is usually necessary to ensure that the transactions processed by transaction processing operations are accurate and safe. And not to be lost. Generally speaking, transaction processing operations are executed by a variety of network devices. If there are current network information security problems (for example, a project running on a network device uses vulnerability controls), the entire transaction processing process may be severely affected. influences.
  • FIG. 1 is a schematic diagram of the architecture of a network information security system provided by an embodiment of the present invention.
  • the network information security system may include a client device 100, a vulnerability detection server 200, a central server 300, and a connection with the central server 300 At least one web server (such as the web server 410 to the web server 460 shown in FIG. 1).
  • the central server 300 and at least one network server may constitute a cluster server.
  • At least one network server may be connected to the central server 300 in a wired manner, or may also be connected to the central server 300 in a wireless manner, which is not specifically limited.
  • At least one network server may include various servers in a network information security system, such as a domain name server (DNS) 410, a World Wide Web (web) server 420, a database server 430, and files A server 440, a mail server 450, a File Transfer Protocol (FTP) server 460, and so on.
  • DNS domain name server
  • the DNS server 410 may be used to provide a domain name function.
  • the network administrator may query the domain name information of other servers through the DNS server 410, or may also respond to the domain name information of its own server through the DNS server 410.
  • the web server 420 can be used to provide network functions. For example, a network administrator can obtain a web page through the web server 420, and then can search for data on the web page.
  • the database server 430 can be used to provide database functions. Specifically, the database server 430 can be equipped with multiple database software, and can use multiple database software to generate different databases; for example, Oracle server, MySQL server, Microsoft SQL
  • the Server server can be a database server.
  • the file server 440 can be used to provide a sharing function. For example, the file server 440 can store shared files, so that other servers can obtain shared files through communication with the file server 440; for example, a Windows Server 2003 server can be regarded as a file server.
  • the mail server 450 can be used to provide mail functions. For example, a network administrator can send and receive mails, edit mails, etc.
  • the mail server 450 can be provided with one or more software related to mail functions, such as WebEasyMail software, Sendmail software, Postfix software, Qmail software, Microsoft Exchange software, etc.
  • the FTP server 460 can also be called an acting server.
  • the FTP server 460 can be used to provide extended access rights. For example, a network administrator can use the Internet Protocol Address (IP) of the FTP server 460 to change the IP of the client device 100 to The IP of other servers, so that the client device 100 can access other servers and obtain resources on other servers.
  • IP Internet Protocol Address
  • FIG. 1 is only an exemplary simple description, and the network servers listed therein are only for the convenience of explaining the solution, and do not constitute a limitation on the solution. It is understandable that the network information security system may also include other network servers, such as office servers, financial servers, etc., which are not specifically limited.
  • FIG. 2 is a schematic diagram of a process corresponding to a vulnerability detection method provided by an embodiment of the present invention, and the method includes:
  • Step 201 Receive a vulnerability detection instruction triggered by a user.
  • a World Wide Web (web) browser can be set on the client device 100, and the user can obtain the vulnerability management interface by entering a preset link on the web browser; the vulnerability management interface
  • a variety of function icons can be set on the screen, such as "vulnerability detection” function icon, "display vulnerability information” function icon, etc.
  • the vulnerability detection instruction can be generated by triggering the "vulnerability detection" function icon on the vulnerability management interface; in this way, the client device 100 can The vulnerability detection instruction is sent to the vulnerability detection server 200; accordingly, the vulnerability detection server 200 can perform vulnerability detection on at least one network server based on the vulnerability detection instruction after receiving the vulnerability detection instruction triggered by the user.
  • Step 202 Obtain an identifier of at least one vulnerability control stored in a preset vulnerability library.
  • the vulnerability detection server 200 may obtain one or more preset vulnerability libraries after receiving the vulnerability detection instruction triggered by the user.
  • one or more preset vulnerability databases can be any vulnerability database or any multiple vulnerability databases in multiple vulnerability databases in the global information security field, such as China National Vulnerability Database of Information Security, CNNVD), the National Information Security Vulnerability Database, Symantec Vulnerability Database, etc.
  • each of the one or more preset vulnerability libraries may store at least one vulnerability control that has been determined to have a vulnerability.
  • CNNVD may store at least one vulnerability control that has been determined to exist worldwide Hundreds of thousands or even millions of vulnerability controls for vulnerabilities.
  • the vulnerability detection server 200 can obtain the identification of at least one vulnerability control stored in one or more preset vulnerability libraries, and can perform vulnerability detection based on the identification of the at least one vulnerability control.
  • the first vulnerability control is taken as an example to describe the process of using the first vulnerability control to perform vulnerability detection.
  • the first vulnerability control can be any vulnerability control stored in one or more preset vulnerability libraries, which can be understood
  • the process of using other vulnerability controls to perform vulnerability detection can be implemented with reference to this method, and the details will not be repeated.
  • Step 203 Determine whether there is an item that uses the vulnerability control in the preset database.
  • a preset database may be obtained in advance, and the preset database may be obtained by performing code detection on at least one item, and the identification of at least one item and the control used by at least one item may be stored in the preset database; so, if it is determined If there is a project that uses the first vulnerability control in the preset database (for example, project a), it can be determined that the project a is a project that uses the vulnerability control, so that the project a can be displayed to the user.
  • the preset database for example, project a
  • the control used by the project can be obtained by performing code detection on the project, which can ensure that the obtained control is the latest control used during the execution of the project.
  • Vulnerability detection based on the latest controls used in the project can improve the accuracy of the detected project vulnerabilities; and by storing the results of the code detection corresponding to the project in the preset database, the project can be used through the preset database Without re-checking the code of the project, the efficiency of detecting project vulnerabilities can be improved, and the efficiency of repairing project vulnerabilities can be improved.
  • the controls used by the project may include any one or more of the framework, third-party components, and services called by the project, and the third-party components may be dependent libraries and/or plug-ins.
  • the controls used by the project can be open source controls, and the code of the open source controls may be partially or completely incompatible with the project. Therefore, if incompatible open source controls are called during the execution of the project, it may cause the project to execute There were loopholes in the process.
  • one or more of the framework, dependent library, plug-in, and service used by the project can be accurately identified, such as the framework, dependent library, plug-in, and service information.
  • Name and/or version that is, the solution in the embodiment of the present invention can quickly and accurately locate the item to which the vulnerability control belongs, thereby reducing the possibility of the system being exposed to weakness or being attacked, and improving the security of the system.
  • the preset database may be obtained through the following steps a to c:
  • Step a Obtain the code file of at least one project according to the identification of the at least one project.
  • a code warehouse may be provided on the central server 300, and the code warehouse may store project codes and project information of all projects used by the web server 410 to the web server 460.
  • the code warehouse can store the project code of each project in one code file.
  • the project codes of different projects can be stored in different project files, thereby improving the flexibility of managing project codes; accordingly, the code warehouse
  • a preset configuration table may be set in the, and the preset configuration table may store project information of all the projects used by the network server 410-the network server 460, such as project name, project start time, etc.
  • the code warehouse may be a code warehouse generated based on an open source tool, such as a gitlab code warehouse.
  • a gitlab code warehouse is taken as an example to describe the process of obtaining code files.
  • a preset key may be set on the vulnerability detection server 200, and the preset key may be used to successfully unlock the code repository set on the central server 300, and the vulnerability detection server 200 and the client device 100 are relatively isolated Yes, that is, the client device 100 cannot obtain the code file pulled by the vulnerability detection server 200; in this way, the vulnerability detection server 200 can successfully obtain the code file and can ensure the security of the code file.
  • the vulnerability detection server 200 can obtain the code files of the projects executed in the web server 410 to the web server 460 from the code warehouse according to a preset cycle; for example, there are 10 projects on the web server 410 to the web server 460 respectively.
  • the central server 300 can store the code files of these 60 projects. If the preset period is 5 minutes, the vulnerability detection server 200 can go to the central server 300 to obtain the code files of these 60 projects every 5 minutes; thus, vulnerability detection The server 200 can detect the controls used by the 60 projects based on the code files of the 60 projects, and obtain the controls used by each of the 60 projects.
  • the vulnerability detection server 200 can obtain the code files of all projects from the code repository in various ways, for example, the code files can be obtained through the network administrator, or the code files can also be obtained automatically, and the specifics are not limited. The following describes the specific implementation process of obtaining code files from these two examples.
  • the vulnerability detection server 200 can automatically obtain the code file.
  • the vulnerability detection server 200 may send a code acquisition instruction to the central server 300.
  • the code acquisition instruction may be used to acquire item information of all items stored in the code warehouse; the code acquisition instruction may include a preset key.
  • the central server 300 can perform identity verification on the vulnerability detection server 200; if it is determined that the preset key matches the key of the code warehouse. It is determined that the identity of the vulnerability detection server 200 is legal. In this way, the central server 300 can send the project information of all items to the vulnerability detection server 200.
  • the vulnerability detection server 200 may display the project information of all projects to the user through the client device 100 after obtaining the project information of all the projects, so that the user can determine the target project; further, if the vulnerability detection server 200 receives After receiving the identification of the target project sent by the client device 100, the code acquisition instruction can be sent to the central server 300. In this way, the central server can send the code file of the target project to the vulnerability detection server 200 after receiving the code acquisition instruction. In another example, the vulnerability detection server 200 can send a code acquisition instruction to the central server 300 after acquiring the project information of all projects. In this way, after receiving the code acquisition instruction, the central server can send the code files of all the projects to the vulnerability Check the server 200.
  • the vulnerability detection server 200 can send a partial code acquisition instruction to the central server 300 after acquiring the project information of all projects. In this way, after the central server receives the partial code acquisition instruction, it can add all the project code files Part of the code content of is sent to the vulnerability detection server 200.
  • the vulnerability detection server 200 can obtain the code file through the network administrator.
  • the network administrator can send code acquisition instructions to the vulnerability detection server 200 through the client device 100.
  • the network administrator can obtain the management interface of the gitlab code repository through the web browser on the client device 100, and can Log in to the management interface of the gitlab code repository through the preset URL, the account information of the network administrator and the preset key, and then the "Get Code" function icon can be triggered on the management interface to generate code acquisition instructions; or the network administrator can Obtain the command line of the gitlab code repository, and enter the account information and preset key of the network administrator in the command line to generate code acquisition instructions.
  • the central server 300 can perform identity verification on the network administrator; if it is determined that the account information of the network administrator is legal, it can display the item information of all items in the code warehouse to the user. For example, if all projects include project w 1 to project w 3 , the central server 300 can display the project information of project w 1 to project w 3 on the management interface of the gitlab code repository of the client device 100, or it can also display project w The item information of 1 to item w 3 is displayed on the command line, or the item information of item w 1 to item w 3 can be voice broadcasted to the user, and the details are not limited.
  • the project information of the project may include any one or more of the project address and/or project number, project name, project description, project members, and project address of the project.
  • the project address of the project can be the location information where the project code file is stored in the gitlab code repository. In this way, the network administrator can obtain the project code file from the gitlab code repository through the project address.
  • Step b Obtain the file to be tested for each project according to the code file of each project, and perform code testing on the file to be tested to determine the controls used by each project.
  • obtaining an item code files w can be analyzed code file directory structure, and may be determined in accordance with item 1 w code file extension
  • the programming language used determines the file type of the code file, and then the project type of the project w 1 can be determined through the directory structure and file type of the code file.
  • the execution subject of the project w 1 can be determined according to the directory structure of the code file, for example, the execution subject is a server or a terminal (Android type).
  • the project type of project w 1 can be determined by the first method; if project w 1 is not built using maven , The item type of item w 1 can be determined by the second method.
  • an item not to use POM w construct obtained it may be determined item type item w 1 w according to item 1 using the programming language, for example, if the item code file for w 1 php file, it may be determined The project type of project w 1 is php; if the code file of project w 1 is a php file, the project type of project w 1 can be java type; if the code file of project w 1 is a Javescript file, the project type of project w 1 may Javescript type; if the item code file is python w 1, w the item may be an item type python type.
  • the scanning method corresponding to the item type can be used to obtain the file to be detected, and the code detection of the file to be detected can be performed to determine the control used by the item w 1 .
  • the code detection of the file to be detected can be performed to determine the control used by the item w 1 .
  • project w 1 is a project built using maven.
  • the directory structure of the code file of the project w 1 may include a pom.xml data package, and the pom.xml data package stores the creation and running projects w 1.
  • the pom.xml data package can include properties tag, dependencies tag and/or plugins tag, where the content corresponding to the properties tag is used to define the name and version of the framework used by project w 1 , and the content corresponding to the dependencies tag the name and version of dependent libraries using a definition item w, plugins corresponding to the tag name and version for the content item definitions w 1 used in the plug.
  • the vulnerability detection server 200 determines that the project w 1 is a project built using POM, it can obtain the properties tag, dependencies tag, and plugins tag under the pom.xml data package, and can determine the project w 1 by analyzing the properties tag the name and version of the framework used to determine the name and version of dependent libraries used by the project w 1 by analyzing the dependencies label, determine the name and version of the project w 1 plug-in used by analyzing plugins label.
  • the controls used by the project w 1 may include the name and version of the framework determined above, the name and version of the dependent library, and the name and version of the plug-in.
  • the properties tag can be used to define public version variables used by the project w 1 , such as the name and version of the framework. If the name and version of the framework are defined in the properties tag as an example, the vulnerability detection server 200 can obtain the name and version of the framework used by the project w 1 by analyzing the code structure of the properties tag.
  • the structure of the properties tag can be:
  • the version logo can be set in the properties tag
  • the content before the version logo ie "***”
  • the content after the version logo ie "***. version ”
  • version of the framework may be used to define an item used w.
  • Embodiment of the present invention may be used to label dependencies name and version of the definition of dependent libraries w 1 used in the project; accordingly, can obtain the name and version of program dependencies w 1 used in the code structure by analyzing the dependencies tag.
  • one or more public variables can be defined in the dependencies tag, and the name and version of the dependent library can be obtained by assigning values to one or more public variables.
  • the structure of the dependencies tag can be:
  • the dependencies tag can be set with groupId identification, artifactId identification and version identification; among them, the content after the groupId identification and artifactId identification (ie "***”) can be used to define the public variables used by project w 1 public versions of variable names after the version identification of the content (that is, "***. version”) can be used to define the project w 1 used.
  • the name of the framework used by the project w 1 can be spring, and the version of the framework can be 1.2.
  • the dependencies tag can also directly define the name and version of the dependent library.
  • the structure of the dependencies tag can be:
  • Embodiment of the present invention may be used to label plugins widget information items defined as w 1 used, such as the name and version of the plug. If the name and version of the plug-in are defined in the plugins tag, the name and version of the plug-in used by the project w 1 can be obtained by analyzing the code structure of the plugins tag.
  • the structure of the plugins tag can be:
  • the groupId identification, artifactId identification and version identification can be set in the plugins tag; among them, the groupId identification can be used to define the project type of project w 1 (ie maven type), and the artifactId identification can be used to define the use of project w 1
  • the plug-in ie jar plug-in
  • the version identifier can be used to define the version of the plug-in used by the project w 1 (ie version 3.0.2).
  • the version tag can be set in the properties tag
  • the groupId, artifactId, and version tags can be set in the dependencies tag and plugins tag. Therefore, in specific implementation, if the vulnerability detection server 200 determines that the project w 1 is a project built using the maven tool, it can obtain the properties tag, dependencies tag, and plugins tag from the code file of the project w 1 , and pass the property tag and dependencies tag. Analyze with the groupId identification, artifactId identification and version identification in the plugins tag, that is, the name and version of the controls (such as services, dependent libraries, plug-ins, and frameworks) used by the project w 1 can be obtained.
  • the groupId identification, artifactId identification and version identification in the plugins tag that is, the name and version of the controls (such as services, dependent libraries, plug-ins, and frameworks) used by the project w 1 can be obtained.
  • the project w 1 is not obtained by using the build, so it can be executed in the following sub-scenarios.
  • the item type of item w 1 is java type.
  • the directory structure of the code file of project w 1 may include a jar data package, and the jar data package stores what is needed to create and run project w 1
  • the name and version of the control such as the name and version of the framework, dependent libraries, and third-party components. Therefore, if the vulnerability detection server 200 determines that the project type of the project w 1 is java type, it can obtain the jar data package from the code file of the project w 1 , and by analyzing the jar data package, it can obtain the controls used by the project w 1 (Such as frameworks, dependent libraries and third-party components) name and version.
  • the item type of item w 1 is the Javascript type.
  • project code files w 1 package.json packet may include files and / or package-lock.json package file, package.
  • the json data package file and/or package-lock.json data package file stores the names and versions of the controls required to create and run the project w 1 , such as the names and versions of frameworks, dependent libraries, and third-party components.
  • the vulnerability detection server 200 determines that the project type of the project w 1 is the Javescript type, it can obtain the package.json data package file and/or the package-lock.json data package file from the code file of the project w 1 , and pass the package
  • the .json data package file and/or package-lock.json data package can be analyzed to obtain the names and versions of the controls (such as frameworks, dependent libraries, and third-party components) used by the project w 1 .
  • the item type of item w 1 is a python type.
  • controls in python-type projects usually need to identify the starting position of the imported code file through import; therefore, if the vulnerability detection server 200 determines that the project type of the project w 1 is the python type, it can Obtain the file header from the code file of the project w 1 , and analyze the import identifier in the header file to obtain the name and version of the third-party component used in the project w 1 .
  • the item type of item w 1 is a type other than the above-mentioned case one and case two.
  • the requirements.txt file is set in the code file of the project, which can be used to record the name and version of the third-party component used by the project. Therefore, if the vulnerability detection server 200 determines that the project type of the project w 1 is a type other than the above four types, it can obtain the requirements.txt file from the code file of the project w 1 and analyze the requirements.txt file. Then you can get the name and version of the third-party component used in project w 1 .
  • the project is divided into multiple types by using the directory structure of the code file corresponding to the project and the programming language, and the corresponding scanning method is set for each project type, so that the client device can use the scanning corresponding to the project type.
  • the detection scenarios are more extensive.
  • Step c Generate a preset database according to the identifier of the at least one project and the controls used by the at least one project.
  • the vulnerability detection server 200 can obtain the identities of all projects executed by the web server 410 to the web server 460 and the controls used by all the projects; in this way, the vulnerability detection server 200 can obtain the identities of all the projects and The controls used in all projects generate a preset database.
  • Table 1 is a schematic table of a preset database generated by using steps a to c.
  • Table 1 A schematic diagram of a preset database
  • the projects executed by the web server 410 include project w 1 to project w 3 , the control used by project w 1 is Spring framework version 1.2.6, the control used by project w 2 is Guice plug-in version 4.2, project The control used by w 3 is the Beta version of the Jar dependency library; the projects executed by the web server 420 include project w 4 , and the control used by the project w 4 is the recyclerview dependency library of version 24.0.0; the projects executed by the web server 430 include project w 5 , The control used by project w 5 is the Spring framework of version 4.0.1.
  • the vulnerability detection server 200 can perform the steps 204a: If the identifier of the first vulnerability control is ocx, it can be determined by checking the preset database that no project uses the ocx control. In this way, the vulnerability detection server 300 can perform step 204b.
  • Step 204a Obtain the target project using the vulnerability control from the preset database.
  • the item w 2 can be determined as the target item by viewing the preset database. In this way, the vulnerability detection server 200 can send the item information of the item w 2 To the client device 100.
  • Step 204b Obtain the codes of all the projects in the code warehouse, and determine the target projects that use the vulnerability control in all the projects.
  • the vulnerability detection server 200 can obtain the code files of all the projects running on the web server 410 to the web server 460 from the code warehouse according to the method in step b, and then can use the scanning method corresponding to the project type to which each project belongs to the The code file performs code inspection to determine the controls used by each project. Further, query whether there are projects using the ocx control in all projects, and if there is a project (such as project w 6 ) that uses the ocx control, the project information of the project w 6 can be sent to the client device 100.
  • the controls used by the project can be obtained through the preset database without rechecking the code of the project, thereby improving the vulnerability of the project. Therefore, when there are no projects using vulnerable controls in the preset database, the code analysis of all items in the code warehouse can determine the controls currently used by each project. Thereby, the accuracy of detecting project vulnerabilities can be improved.
  • Step 205 Display the target item using the first vulnerability control to the user.
  • the client device 100 after the client device 100 receives the project information of the project w 6 sent by the vulnerability detection server 200, it can display the project information of the project w 6 to the user, for example, it can be displayed through the vulnerability management interface on the client device 100 It can be displayed to the user, or can also be displayed to the user through the command line of the client device 100, which is not specifically limited.
  • the client device 100 may also generate a warning information item corresponding to w 6, and may obtain items from members of the project w 6 w 6 project information items, the alarm information can be pushed to project Project members of w 6 ; for example, the client device 100 can push alarm information to project members of project w 6 in real time through WeChat, Dingding, etc., or can also send alarm information to project members of project w 6 regularly via email ,
  • the specific is not limited.
  • w project members 6 project in the received alarm information transmitted from the client device 100 can control the vulnerabilities 6 w repair items, such control can be upgraded version of vulnerability, or may be a control code vulnerability to modify. In this way, by using real-time push to send alarm information to project members, vulnerability controls in the project can be repaired in time, thereby avoiding running projects that use vulnerability controls, reducing the risk of system attacks, and improving system security.
  • the identifier of at least one vulnerability control stored in the preset vulnerability library is obtained, and then the first vulnerability control in the at least one vulnerability control is obtained, if If it is determined that there is a first target item using the first vulnerability control in the preset database, the first target item is displayed to the user; the preset database is detected by executing code on at least one item, so The identification of the at least one item and the controls used by the at least one item are stored in the preset database.
  • the control used by the project can be obtained by performing code detection on the project, which can ensure that the obtained control is the latest control used during the execution of the project.
  • Vulnerability detection based on the latest controls used in the project can improve the accuracy of the detected project vulnerabilities; and by storing the results of the code detection corresponding to the project in the preset database, the project can be used through the preset database Without re-checking the code of the project, the efficiency of detecting project vulnerabilities can be improved, and the efficiency of repairing project vulnerabilities can be improved.
  • an embodiment of the present invention also provides a vulnerability detection device, and the specific content of the device can be implemented with reference to the foregoing method.
  • Figure 3 is a schematic structural diagram of a vulnerability detection device provided by an embodiment of the present invention, including:
  • the transceiver module 301 is configured to obtain the identifier of at least one vulnerability control stored in the preset vulnerability library after receiving the vulnerability detection instruction triggered by the user;
  • the processing module 302 is configured to target the first vulnerability control in the at least one vulnerability control, and if it is determined that there is a first target item using the first vulnerability control in the preset database, display the first target item To the user; the preset database is detected by executing code on at least one item, and the identification of the at least one item and the controls used by the at least one item are stored in the preset database.
  • the controls used by the at least one project include any one or more of the framework, third-party components, and services used by the at least one project; the third-party components used by the at least one project are the At least one dependent library and/or plugin used by the project.
  • processing module 302 is further configured to:
  • the programming language used by the first item is determined according to the suffix of the code file corresponding to the first item, and according to the directory of the code file corresponding to the first item.
  • the structure and/or the programming language used by the first item determines the item type of the first item; according to the item type of the first item, obtain the file to be detected from the code file corresponding to the first item, and Detect the file to be detected and determine the control used by the first item;
  • the preset database is generated using the identifier of the at least one item and the control used by the at least one item.
  • processing module 302 is specifically configured to:
  • the corresponding properties tag, dependencies tag and/or plugins tag are obtained from the pom.xml data package of the code file corresponding to the first project Content; or,
  • the programming language used by the first project is acquired; if the programming language used by the first project is java, then the The jar data package file of the code file, or, if the programming language used in the first project is the Javascript type, the package.json data package file and/or the package-lock.json data package file of the code file are obtained, or If the programming language used by the first project is of the python type, the header file of the code file is obtained.
  • processing module 302 is further configured to:
  • the target project using the first vulnerability control does not exist in the preset database, determine one or more projects currently running, and obtain the one or more projects according to the identifiers of the one or more projects Project addresses of multiple projects;
  • the application programming API interface to obtain one or more files to be tested corresponding to the one or more projects, and code the one or more files to be tested Detect and determine the controls used by the one or more items;
  • the second target item is displayed to the user.
  • the identification of at least one vulnerability control stored in the preset vulnerability library is obtained, and then the identification of the at least one vulnerability control If it is determined that there is a first target item using the first vulnerability control in the preset database, the first target item is displayed to the user; the preset database is for at least one item
  • the identification of the at least one item and the control used by the at least one item are stored in the preset database when the code is executed.
  • the control used by the project can be obtained by performing code detection on the project, which can ensure that the obtained control is the latest control used during the execution of the project.
  • Vulnerability detection based on the latest controls used in the project can improve the accuracy of the detected project vulnerabilities; and by storing the results of the code detection corresponding to the project in the preset database, the project can be used through the preset database Without re-checking the code of the project, the efficiency of detecting project vulnerabilities can be improved, and the efficiency of repairing project vulnerabilities can be improved.
  • an embodiment of the present invention provides a computer device, as shown in FIG. 4, including: a memory 401, a processor 402, and a computer program stored in the memory 401 and running on the processor 402.
  • the processor 402 implements the steps of the above-mentioned vulnerability detection method when the program is executed.
  • embodiments of the present invention also provide a computer-readable storage medium, including instructions, which when run on the processor of the computer device, cause the processor of the computer device to execute the steps of the vulnerability detection method.
  • embodiments of the present invention also provide a computer program product, which when running on a computer device, enables the computer device to execute the steps of the above-mentioned vulnerability detection method.
  • the embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本发明实施例涉及金融科技，并公开了一种漏洞检测方法及装置，其中方法包括：接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识，若确定预设数据库中存在使用第一漏洞控件的第一目标项目，则将第一目标项目显示给用户。本发明实施例中，通过对项目进行代码检测获取项目使用的控件，可以保证获取到的控件为项目执行过程中所使用的最新控件，如此，基于项目所使用的最新控件进行漏洞检测可以提高检测得到的项目漏洞的准确性；且，通过预设数据库即可获取到项目使用的控件，可以无需对项目重新进行代码检测，从而可以提高项目漏洞的检测效率，进而提高修复项目漏洞的效率。

Description

一种漏洞检测方法及装置
相关申请的交叉引用
本申请要求在2019年06月06日提交中国专利局、申请号为201910492144.6、申请名称为“一种漏洞检测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及金融科技(Fintech)技术领域，尤其涉及一种漏洞检测方法及装置。
背景技术
随着计算机技术的发展，越来越多的技术应用在金融领域，传统金融业正在逐步向金融科技(Fintech)转变，但由于金融行业的安全性、实时性要求，也对技术提出了更高的要求。金融行业(比如银行、保险、证券机构)一般都会涉及到交易处理作业，由于金融行业的性质，需要尽可能地保证交易处理过程的准确性、安全性和不可丢失性，这就要求在交易处理的过程中实时监控网络信息的安全状况。若确定当前***中某一项目使用的控件出现漏洞，则可以及时修复漏洞，保证交易处理过程的正常运行。
基于数据库的漏洞扫描方式为对***中的漏洞进行检测的一种常用方式，以银行为例，银行中通常可以设置有配置管理数据库(Configuration Management Database，CMDB)，CMDB中可以存储与银行的管理信息技术产业(Information Technology，IT)架构相关的各种配置信息，比如项目的组件信息、服务信息、框架信息等。一般来说，项目人员可以在创建新的项目时将与项目相关的配置信息添加到CMDB中。基于此，采用该种方式进行漏洞检测时，若确定某一控件为漏洞控件，则可以通过CMDB查找***在注册时的多个项目以及多个项目的相关配置信息，从而确定该哪些项目使用了该漏洞控件。然而，采用上述方式，由于CMDB中的配置信息是在创建项目时添加的，因此，CMDB中的配置信息可能并不准确；比如以组件为例，若在项目上线之后对项目的组件进行了更新或升级，则项目实际所使用的组件与CMDB中项目的组件并不一致。由此可知，采用上述方式进行漏洞检测，无法准确定位使用漏洞控件的项目，从而使得漏洞检测的准确性较低。
综上，目前亟需一种漏洞检测方法，用以准确定位使用漏洞控件的项目，进而提高漏洞检测的准确性。
发明内容
本发明实施例提供一种漏洞检测方法及装置，用以准确定位使用漏洞控件的项目，进而提高漏洞检测的准确性。
第一方面，本发明实施例提供的一种漏洞检测方法，所述方法包括：
接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识；进一步地，针对于所述至少一个漏洞控件中的第一漏洞控件，若确定预设数据库中存在使用所述第一漏洞控件的第一目标项目，则将所述第一目标项目显示给所述用户；所述预设数据库为对至少一个项目执行代码检测到的，所述预设数据库中存储有所述至少一个项目的标识和所述至少一个项目使用的控件。
在上述设计中，由于项目的代码是执行项目的基本单元，因此，通过对项目进行代码检测获取项目使用的控件，可以保证获取到的控件为项目执行过程中所使用的最新控件，如此，基于项目所使用的最新控件进行漏洞检测可以提高检测得到的项目漏洞的准确性；且，通过将项目对应的代码检测的结果存储在预设数据库中，可以通过预设数据库即可获取到项目使用的控件，而无需对项目重新进行代码检测，从而可以提高项目漏洞的检测效率，进而提高修复项目漏洞的效率。
在一种可能的设计中，所述至少一个项目使用的控件包括所述至少一个项目使用的框架、第三方组件和服务中的任意一项或任意多项；所述至少一个项目使用的第三方组件为所述至少一个项目使用的依赖库和/或插件。
在上述设计中，通过对项目的代码进行检测，可以精确地识别出项目所使用的框架、依赖库、插件、服务中的一项或多项信息，比如框架、依赖库、插件、服务的名称和/或版本；也就是说，采用上述设计可以在快速而精确地定位漏洞控件所属的项目，从而降低***暴露弱点或遭受攻击的可能性，提高***的安全性。
在一种可能的设计中，所述预设数据库为对至少一个项目执行代码检测到的，包括：根据所述至少一个项目的标识，获取所述至少一个项目分别对应的代码文件；进一步地，针对于所述至少一个项目中的第一项目，根据所述第一项目对应的代码文件的后缀名确定所述第一项目使用的编程语言，并根据所述第一项目对应的代码文件的目录结构和/或所述第一项目使用的编程语言确定所述第一项目的项目类型；根据所述第一项目的项目类型，从所述第一项目对应的代码文件中获取待检测文件，并对所述待检测文件进行检测，确定所述第一项目使用的控件；使用所述至少一个项目的标识和所述至少一个项目使用的控件生成所述预设数据库。
在上述设计中，通过使用项目对应的代码文件的目录结构和/或编程语言将项目划分为 多种类型，可以使用项目类型对应的扫描方法获取待检测文件，从而提高检测项目漏洞的效率和准确度；且，通过确定多种项目类型和每种项目类型对应的扫描方法，可以使得对项目漏洞进行检测的过程更加符合实际情况，使得项目漏洞检测的场景更为广泛。
在一种可能的设计中，所述根据所述第一项目的项目类型，从所述第一项目对应的代码文件中获取待检测文件，包括：若确定所述第一项目是使用第一预设工具构建得到的，则从所述第一项目对应的代码文件的pom.xml数据包中获取properties标签、dependencies标签和/或plugins标签分别对应的内容；或者，若确定所述第一项目不是使用所述第一预设工具构建得到的，则获取所述第一项目使用的编程语言；若所述第一项目使用的编程语言为java语言，则获取所述代码文件的jar数据包文件，或者，若所述第一项目使用的编程语言为Javescript类型，则获取所述代码文件的package.json数据包文件和/或package-lock.json数据包文件，或者，若所述第一项目使用的编程语言为python类型，则获取所述代码文件的头文件。
在上述设计中，通过对每种项目类型设置对应的扫描方法，可以基于对应的扫描方法快速地获取项目类型对应的待检测文件，从而可以提高检测项目漏洞的效率。
在一种可能的设计中，所述方法还包括：若所述预设数据库中不存在使用所述第一漏洞控件的目标项目，则确定当前处于运行状态的一个或多个项目，并根据所述一个或多个项目的标识，获取所述一个或多个项目的项目地址；进一步地，根据所述一个或多个项目的项目地址，调用应用程序编程API接口获取所述一个或多个项目分别对应的一个或多个待检测文件，并对所述一个或多个待检测文件进行代码检测，确定所述一个或多个项目使用的控件，若所述一个或多个项目中存在使用所述第一漏洞控件的第二目标项目，则将所述第二目标项目显示给用户。
在上述技术中，在预设数据库中不存在使用第一漏洞控件的项目时，通过对当前运行的项目进行代码分析，可以准确定位使用第一漏洞控件的项目，从而可以提高检测漏洞的准确性。
第二方面，本发明实施例提供的一种漏洞检测装置，所述装置包括：
收发模块，用于接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识；
处理模块，用于针对于所述至少一个漏洞控件中的第一漏洞控件，若确定预设数据库中存在使用所述第一漏洞控件的第一目标项目，则将所述第一目标项目显示给所述用户；所述预设数据库为对至少一个项目执行代码检测到的，所述预设数据库中存储有所述至少一个项目的标识和所述至少一个项目使用的控件。
在一种可能的设计中，所述至少一个项目使用的控件包括所述至少一个项目使用的框架、第三方组件和服务中的任意一项或任意多项；所述至少一个项目使用的第三方组件为所述至少一个项目使用的依赖库和/或插件。
在一种可能的设计中，所述处理模块还用于：根据所述至少一个项目的标识，获取所述至少一个项目分别对应的代码文件；进一步地，针对于所述至少一个项目中的第一项目，根据所述第一项目对应的代码文件的后缀名确定所述第一项目使用的编程语言，并根据所述第一项目对应的代码文件的目录结构和/或所述第一项目使用的编程语言确定所述第一项目的项目类型；根据所述第一项目的项目类型，从所述第一项目对应的代码文件中获取待检测文件，并对所述待检测文件进行检测，确定所述第一项目使用的控件；使用所述至少一个项目的标识和所述至少一个项目使用的控件生成所述预设数据库。
在一种可能的设计中，所述处理模块具体用于：若确定所述第一项目是使用第一预设工具构建得到的，则从所述第一项目对应的代码文件的pom.xml数据包中获取properties标签、dependencies标签和/或plugins标签分别对应的内容；或者，若确定所述第一项目不是使用所述第一预设工具构建得到的，则获取所述第一项目使用的编程语言；若所述第一项目使用的编程语言为java语言，则获取所述代码文件的jar数据包文件，或者，若所述第一项目使用的编程语言为Javescript类型，则获取所述代码文件的package.json数据包文件和/或package-lock.json数据包文件，或者，若所述第一项目使用的编程语言为python类型，则获取所述代码文件的头文件。
在一种可能的设计中，所述处理模块还用于：若所述预设数据库中不存在使用所述第一漏洞控件的目标项目，则确定当前处于运行状态的一个或多个项目，并根据所述一个或多个项目的标识，获取所述一个或多个项目的项目地址；进一步地，根据所述一个或多个项目的项目地址，调用应用程序编程API接口获取所述一个或多个项目分别对应的一个或多个待检测文件，并对所述一个或多个待检测文件进行代码检测，确定所述一个或多个项目使用的控件；若所述一个或多个项目中存在使用所述第一漏洞控件的第二目标项目，则将所述第二目标项目显示给用户。
第三方面，本发明实施例提供的一种计算机可读存储介质，包括指令，当其在计算机设备的处理器上运行时，使得计算机设备的处理器执行上述第一方面所述方法的步骤。
第四方面，本发明实施例提供的一种计算机程序产品，当其在计算机设备上运行时，使得计算机设备执行上述第一方面所述方法的步骤。
第五方面，本发明实施例提供了一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述第一方面所 述方法的步骤。
本发明实施例中，由于项目的代码是执行项目的基本单元，因此，通过对项目进行代码检测获取项目使用的控件，可以保证获取到的控件为项目执行过程中所使用的最新控件，如此，基于项目所使用的最新控件进行漏洞检测可以提高检测得到的项目漏洞的准确性；且，通过将项目对应的代码检测的结果存储在预设数据库中，可以通过预设数据库即可获取到项目使用的控件，而无需对项目重新进行代码检测，从而可以提高项目漏洞的检测效率，进而提高修复项目漏洞的效率。
本发明的这些设计或其他设计在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种网络信息安全***的架构示意图；
图2为本发明实施例提供的一种漏洞检测方法的流程示意图；
图3为本发明实施例提供的一种漏洞检测装置的结构示意图；
图4为本发明实施例提供的一种计算机设备的结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
金融科技(Fintech)是指将信息技术融入金融领域后，为金融领域带来的一种新的创新科技，通过使用先进的信息技术辅助实现金融作业、交易执行以及金融***改进，可以提升金融***的处理效率、业务规模，并可以降低成本和金融风险。
金融科技行业涉及到多种作业方式，比如交易处理作业、办公处理作业、监控处理作业等。以交易处理作业为例，交易处理作业是金融科技行业的一种常规作业方式，由于交易处理作业涉及到交易账户和交易金额等信息，因此通常需要保证交易处理作业处理的交易是准确的、安全的和不可丢失的。一般来说，交易处理作业的执行主体为多种网络设备， 若当前网络信息安全存在问题(比如某一网络设备运行的项目使用了漏洞控件)，则可能会使得整个交易处理过程会受到严重的影响。
基于此，目前亟需一种漏洞检测方法，用于准确定位使用漏洞控件的项目，进而提高漏洞检测的准确性。
图1为本发明实施例提供的一种网络信息安全***的架构示意图，如图1所示，网络信息安全***可以包括客户端设备100、漏洞检测服务器200、中心服务器300和与中心服务器300连接的至少一个网络服务器(比如图1所示意的网络服务器410～网络服务器460)。其中，中心服务器300和至少一个网络服务器可以构成集群服务器，至少一个网络服务器可以通过有线方式与中心服务器300连接，或者也可以通过无线方式与中心服务器300连接，具体不作限定。
如图1所示，至少一个网络服务器可以包括网络信息安全***中的各个服务器，比如域名服务器(Domain Name Server，DNS)410、全球广域网(World Wide Web，web)服务器420、数据库服务器430、文件服务器440、邮件服务器450和文件传输协议(File Transfer Protocol，FTP)服务器460等。其中，DNS服务器410可以用于提供域名功能，比如网络管理员可以通过DNS服务器410查询其它服务器的域名信息，或者也可以通过DNS服务器410响应自身服务器的域名信息。web服务器420可以用于提供网络功能，比如网络管理员可以通过web服务器420获取web网页，进而可以在web网页上搜索数据。数据库服务器430可以用于提供数据库功能，具体地说，数据库服务器430中可以设置有多种数据库软件，并可以使用多种数据库软件生成不同的数据库；举例来说，Oracle服务器、MySQL服务器、Microsoft SQL Server服务器均可以为数据库服务器。文件服务器440可以用于提供共享功能，比如，文件服务器440中可以存储共享文件，从而使得其它服务器通过与文件服务器440通信获取共享文件；举例来说，Windows Server 2003服务器即可以为一个文件服务器。邮件服务器450可以用于提供邮件功能，比如网络管理员可以通过邮件服务器450收发邮件、编辑邮件等；一般来说，邮件服务器450上可以设置有与邮件功能相关的一项或多项软件，比如WebEasyMail软件、Sendmail软件、Postfix软件、Qmail软件、Microsoft Exchange软件等。FTP服务器460又可以称为署理服务器，FTP服务器460可以用于提供扩展访问权限，比如网络管理员可以通过FTP服务器460的互联网协议地址(Internet Protocol Address，IP)将客户端设备100的IP变成其它服务器的IP，从而可以通过客户端设备100访问其它服务器，获取其它服务器上的资源。
需要说明的是，图1仅是一种示例性的简单说明，其所列举的网络服务器仅是为了便于说明方案，并不构成对方案的限定。可以理解的，网络信息安全***中还可以包括其它 网络服务器，比如办公服务器、财务服务器等，具体不作限定。
基于图1所示意的***架构，图2为本发明实施例提供的一种漏洞检测方法对应的流程示意图，该方法包括：
步骤201，接收用户触发的漏洞检测指令。
在一种可能的实现方式中，客户端设备100上可以设置有全球广域网(World Wide Web，web)浏览器，用户可以通过在web浏览器上输入预设链接，获取漏洞管理界面；漏洞管理界面上可以设置有多种功能图标，比如“漏洞检测”功能图标、“显示漏洞信息”功能图标等。具体实施中，若用户想要对网络信息安全***中的至少一个网络服务器进行漏洞检测，则可以通过触发漏洞管理界面上的“漏洞检测”功能图标生成漏洞检测指令；如此，客户端设备100可以将漏洞检测指令发送给漏洞检测服务器200；相应地，漏洞检测服务器200接收到用户触发的漏洞检测指令后，可以基于漏洞检测指令对至少一个网络服务器进行漏洞检测。
步骤202，获取预设漏洞库中存储的至少一个漏洞控件的标识。
具体实施中，漏洞检测服务器200接收到用户触发的漏洞检测指令后，可以获取一个或多个预设漏洞库。其中，一个或多个预设漏洞库可以为全球信息安全领域中的多个漏洞数据库中的任意一个漏洞数据库或任意多个漏洞数据库，比如国家信息安全漏洞库(China National Vulnerability Database of Information Security，CNNVD)，美国国家信息安全漏洞库、赛门铁克漏洞库等。
本发明实施例中，一个或多个预设漏洞库中的每个预设漏洞库中可以存储有已确定存在漏洞的至少一个漏洞控件，比如，以CNNVD中可以存储有世界范围内已确定存在漏洞的数十万甚至数百万个漏洞控件。如此，漏洞检测服务器200可以获取一个或多个预设漏洞库中存储的至少一个漏洞控件的标识，并可以基于至少一个漏洞控件的标识进行漏洞检测。
本发明的下列实施例中以第一漏洞控件为例描述使用第一漏洞控件执行漏洞检测的过程，第一漏洞控件可以为一个或多个预设漏洞库中存储的任一漏洞控件，可以理解地，使用其它漏洞控件执行漏洞检测的过程可以参照该方法进行实现，具体不再赘述。
步骤203，确定预设数据库中是否存在使用了漏洞控件的项目。
具体实施中，可以预先获取预设数据库，预设数据库可以为对至少一个项目进行代码检测得到的，预设数据库中可以存储有至少一个项目的标识和至少一个项目使用的控件；如此，若确定预设数据库中存在使用第一漏洞控件的项目(比如项目a)，则可以确定项目a为使用了漏洞控件的项目，从而可以将项目a显示给用户。
本发明实施例中，由于项目的代码是执行项目的基本单元，因此，通过对项目进行代码检测获取项目使用的控件，可以保证获取到的控件为项目执行过程中所使用的最新控件，如此，基于项目所使用的最新控件进行漏洞检测可以提高检测得到的项目漏洞的准确性；且，通过将项目对应的代码检测的结果存储在预设数据库中，可以通过预设数据库即可获取到项目使用的控件，而无需对项目重新进行代码检测，从而可以提高项目漏洞的检测效率，进而提高修复项目漏洞的效率。
在一个示例中，项目使用的控件可以包括该项目调用的框架、第三方组件、服务中的任意一项或任意多项，第三方组件可以为依赖库和/或插件。具体地说，项目使用的控件可以为开源控件，开源控件的代码可能与项目存在部分或完全不兼容的情况，因此，若在项目执行的过程中调用不兼容的开源控件，可能会使得项目执行过程出现漏洞。
本发明实施例中，通过对项目的代码进行检测，可以精确地识别出项目所使用的框架、依赖库、插件、服务中的一项或多项信息，比如框架、依赖库、插件、服务的名称和/或版本；也就是说，采用本发明实施例中的方案可以快速而精确地定位漏洞控件所属的项目，从而降低***暴露弱点或遭受攻击的可能性，提高***的安全性。
在一种可能的实现方式中，预设数据库可以为通过如下步骤a～步骤c得到的：
步骤a，根据至少一个项目的标识，获取至少一个项目的代码文件。
本发明实施例中，中心服务器300上可以设置有代码仓库，代码仓库中可以存储有网络服务器410～网络服务器460所使用的全部项目的项目代码以及项目信息。其中，代码仓库可以将每个项目的项目代码存储在一个代码文件中，如此，不同项目的项目代码可以存储在不同的项目文件中，从而可以提高管理项目代码的灵活性；相应地，代码仓库中可以设置有预设配置表，预设配置表中可以存储网络服务器410～网络服务器460所使用的全部项目的项目信息，比如项目名称、项目启动时间等。
本发明实施例中，代码仓库可以为基于开源工具生成的代码仓库，比如gitlab代码仓库。本发明的下列实施例中以gitlab代码仓库为例描述获取代码文件的过程。
在一个示例中，漏洞检测服务器200上可以设置有预设密钥，该预设密钥可以用于成功解锁中心服务器300上设置的代码仓库，且漏洞检测服务器200与客户端设备100是相对隔离的，即客户端设备100无法获取漏洞检测服务器200拉取到的代码文件；如此，漏洞检测服务器200即可以成功获取到代码文件，又可以保证代码文件的安全性。
具体实施中，漏洞检测服务器200可以按照预设周期从代码仓库中获取网络服务器410～网络服务器460中执行的项目的代码文件；比如，以网络服务器410～网络服务器460上分别设置有10个项目为例，中心服务器300中可以存储这60个项目的代码文件，若预设周 期为5min，则漏洞检测服务器200可以每5min去中心服务器300中获取这60个项目的代码文件；如此，漏洞检测服务器200可以基于这60个项目的代码文件对这60个项目使用的控件进行检测，获取这60个项目中每个项目所使用的控件。
具体实施中，漏洞检测服务器200可以通过多种方式从代码仓库中获取全部项目的代码文件，比如可以通过网络管理员获取代码文件，或者也可以自动获取代码文件，具体不作限定。下面分别从这两个示例描述获取代码文件的具体实现过程。
示例一
在示例一中，漏洞检测服务器200可以自动获取代码文件。
具体实施中，漏洞检测服务器200可以向中心服务器300发送代码获取指令，代码获取指令可以用于获取代码仓库中存储的全部项目的项目信息；代码获取指令可以包括预设密钥。相应地，中心服务器300接收代码获取指令后，可以对漏洞检测服务器200进行身份验证；若确定预设密钥与代码仓库的密钥匹配。则确定漏洞检测服务器200的身份合法，如此，中心服务器300可以将所有项目的项目信息发送给漏洞检测服务器200。
在一个示例中，漏洞检测服务器200可以在获取全部项目的项目信息后，将全部项目的项目信息通过客户端设备100显示给用户，以使用户确定目标项目；进一步地，漏洞检测服务器200若接收到客户端设备100发送的目标项目的标识，则可以向中心服务器300发送代码获取指令，如此，中心服务器接收到代码获取指令后，可以将目标项目的代码文件发送给漏洞检测服务器200。在另一个示例中，漏洞检测服务器200可以在获取全部项目的项目信息后，向中心服务器300发送代码获取指令，如此，中心服务器接收到代码获取指令后，可以将全部项目的代码文件发送给漏洞检测服务器200。在又一个示例中，漏洞检测服务器200可以在获取全部项目的项目信息后，向中心服务器300发送部分代码获取指令，如此，中心服务器接收到部分代码获取指令后，可以将全部项目的代码文件中的部分代码内容发送给漏洞检测服务器200。
示例二
在示例二中，漏洞检测服务器200可以通过网络管理员获取代码文件。
具体实施中，网络管理员可以通过客户端设备100向漏洞检测服务器200发送代码获取指令，比如，网络管理员可以通过客户端设备100上的web浏览器获取到gitlab代码仓库的管理界面，并可以通过预设网址和网络管理员的账号信息和预设密钥登录gitlab代码仓库的管理界面，进而可以在管理界面上触发“获取代码”功能图标，从而生成代码获取指令；或者，网络管理员可以获取gitlab代码仓库的命令行，并可以在命令行中输入网络管理员的账号信息和预设密钥，从而生成代码获取指令。
相应地，中心服务器300在接收代码获取指令后，可以对网络管理员进行身份验证；若确定网络管理员的账号信息合法，则可以将代码仓库中的所有项目的项目信息显示给用户。比如，若全部项目包括项目w 1～项目w 3，则中心服务器300可以在客户端设备100的gitlab代码仓库的管理界面上显示项目w 1～项目w 3的项目信息，或者也可以将项目w 1～项目w 3的项目信息显示在命令行中，或者也可以将项目w 1～项目w 3的项目信息语音播报给用户，具体不作限定。
本发明实施例中，项目的项目信息可以包括项目的项目地址和/或项目的项目编号、项目名称、项目描述、项目成员、项目地址中的任意一项或任意多项。其中，项目的项目地址可以为项目的代码文件在gitlab代码仓库中存储的位置信息，如此，网络管理员可以通过项目的项目地址从gitlab代码仓库中获取项目的代码文件。
步骤b，根据每个项目的代码文件，获取每个项目的待检测文件，并对待检测文件进行代码检测确定每个项目使用的控件。
以将项目w 1～项目w 3中的项目w 1为例，具体实施中，获取项目w 1的代码文件后，可以分析代码文件的目录结构，并可以根据代码文件的后缀名确定项目w 1使用的编程语言确定代码文件的文件类型，进而可以通过代码文件的目录结构和文件类型确定项目w 1的项目类型。其中，根据代码文件的目录结构可以确定项目w 1的执行主体，比如执行主体为服务器或终端(安卓类型)。以项目w 1的执行主体为服务器为例，若项目w 1为使用对象模型maven构建得到的，则可以通过第一方法确定项目w 1的项目类型；若项目w 1并非为使用maven构建得到的，则可以通过第二方法确定项目w 1的项目类型。具体地说，若项目w 1并非为使用POM构建得到的，则可以根据项目w 1使用的编程语言确定项目w 1的项目类型，比如，若项目w 1的代码文件为php文件，则可以确定项目w 1的项目类型为php；若项目w 1的代码文件为php文件，则项目w 1的项目类型可以为java类型；若项目w 1的代码文件为Javescript文件，则项目w 1的项目类型可以为Javescript类型；若项目w 1的代码文件为python，则项目w 1的项目类型可以为python类型。
进一步地，在确定项目w 1的项目类型后，可以使用该项目类型对应的扫描方法获取待检测文件，并可以对待检测文件进行代码检测确定项目w 1使用的控件。下面具体描述确定项目w 1使用的控件的几种可能的情形。
情形一
在情形一中，项目w 1为使用maven构建得到的项目。
本发明实施例中，若项目w 1为使用POM构建得到的项目，则项目w 1的代码文件的目录结构中可以包括一个pom.xml数据包，pom.xml数据包中存储了创建和运行项目w 1时所需的 控件的名称和版本。具体地说，pom.xml数据包下可以包括properties标签、dependencies标签和/或plugins标签，其中，properties标签对应的内容用于定义项目w 1所使用的框架的名称和版本，dependencies标签对应的内容用于定义项目w 1所使用的依赖库的名称和版本，plugins标签对应的内容用于定义项目w 1所使用的插件的名称和版本。
作为一个示例，若漏洞检测服务器200确定项目w 1为使用POM构建得到的项目，则可以获取pom.xml数据包下的properties标签、dependencies标签和plugins标签，并可以通过分析properties标签确定项目w 1所使用的框架的名称和版本，通过分析dependencies标签确定项目w 1所使用的依赖库的名称和版本，通过分析plugins标签确定项目w 1所使用的插件的名称和版本。如此，项目w 1所使用的控件可以包括上述确定得到的框架的名称和版本、依赖库的名称和版本以及插件的名称和版本。
下面分别描述根据properties标签、dependencies标签和plugins标签确定项目w 1使用的控件的具体实现方式。
properties标签
本发明实施例中，properties标签可以用于定义项目w 1所使用的公共版本变量，比如框架的名称和版本。若properties标签中定义了框架的名称和版本为例，则漏洞检测服务器200可以通过分析properties标签的代码结构获取项目w 1所使用的框架的名称和版本。
在一个示例中，properties标签的结构可以为：
<***version>${***.version}</***version>
其中，properties标签中可以设置有version标识，version标识前的内容(即“***”)可以用于定义项目w 1所使用的框架的名称，version标识后的内容(即“***.version”)可以用于定义项目w 1所使用的框架的版本。
举例来说，若properties标签为<spring.version>1.2.6</spring.version>，则可以确定项目w 1使用了spring框架，spring框架的版本为1.2.6。
dependencies标签
本发明实施例中，dependencies标签可以用于定义项目w 1所使用的依赖库的名称和版本；相应地，可以通过分析dependencies标签的代码结构获取项目w 1所使用的依赖库的名称和版本。
在一个示例中，dependencies标签中可以定义有一个或多个公共变量，通过对一个或多个公共变量赋值可以获取依赖库的名称和版本。在该示例中，dependencies标签的结构可以为：
Figure PCTCN2020084320-appb-000001
Figure PCTCN2020084320-appb-000002
在该示例中，dependencies标签中可以设置有groupId标识、artifactId标识和version标识；其中，groupId标识和artifactId标识后的内容(即“***”)可以用于定义项目w 1所使用的公共变量的名称，version标识后的内容(即“***.version”)可以用于定义项目w 1所使用的公共变量的版本。
相应地，若将“***”变量赋值为spring，将“***.version”变量赋值为1.2，则项目w 1所使用的框架的名称可以为spring，框架的版本可以为1.2。
在另一个示例中，dependencies标签也可以直接定义依赖库的名称和版本。在该示例中，dependencies标签的结构可以为：
Figure PCTCN2020084320-appb-000003
在该示例中，通过dependencies标签中定义的“<groupId>org.springframework</groupId>”可以确定项目w 1使用的框架的名称为spring；通过dependencies标签定义的“<version>1.2.6</version>”可以确定项目w 1使用的框架的版本为1.2。
plugins标签
本发明实施例中，plugins标签可以用于定义项目w 1所使用的插件的信息，比如插件的名称和版本。若plugins标签中定义了插件的名称和版本，则可以通过分析plugins标签的代码结构获取项目w 1所使用的插件的名称和版本。
在一个示例中，plugins标签的结构可以为：
Figure PCTCN2020084320-appb-000004
在该示例中，plugins标签中可以设置groupId标识、artifactId标识和version标识；其中，groupId标识可以用于定义项目w 1的项目类型(即maven类型)，artifactId标识可以用于定义 项目w 1所使用的插件(即jar插件)，version标识可以用于定义项目w 1所使用的插件的版本(即版本3.0.2)。
综上所述，properties标签中可以设置有version标识，而dependencies标签和plugins标签中可以设置有groupId标识、artifactId标识和version标识。因此，具体实施中，漏洞检测服务器200若确定项目w 1为使用maven工具构建的项目，则可以从项目w 1的代码文件中获取properties标签、dependencies标签和plugins标签，通过对properties标签、dependencies标签和plugins标签中的groupId标识、artifactId标识和version标识进行分析，即可以获取项目w 1所使用的控件(比如服务、依赖库、插件以及框架)的名称和版本。
情形二
在情形二中，项目w 1不是使用构建得到的，如此，可以按照如下几个子情形执行。
子情形一
在子情形一中，项目w 1的项目类型为java类型。
本发明实施例中，若项目w 1的项目类型为java类型，则项目w 1的代码文件的目录结构中可以包括一个jar数据包，jar数据包中存储了创建和运行项目w 1时所需的控件的名称和版本，比如框架、依赖库和第三方组件的名称和版本。因此，漏洞检测服务器200若确定项目w 1的项目类型为java类型，则可以从项目w 1的代码文件中获取jar数据包，通过对jar数据包进行分析，可以获取项目w 1所使用的控件(比如框架、依赖库和第三方组件)的名称和版本。
子情形二
在子情形二中，项目w 1的项目类型为Javescript类型。
本发明实施例中，若项目w 1的项目类型为Javescript类型，则项目w 1的代码文件的目录结构中可以包括package.json数据包文件和/或package-lock.json数据包文件，package.json数据包文件和/或package-lock.json数据包文件中存储了创建和运行项目w 1时所需的控件的名称和版本，比如框架、依赖库和第三方组件的名称和版本。因此，漏洞检测服务器200若确定项目w 1的项目类型为Javescript类型，则可以从项目w 1的代码文件中获取package.json数据包文件和/或package-lock.json数据包文件，通过对package.json数据包文件和/或package-lock.json数据包进行分析，可以获取项目w 1所使用的控件(比如框架、依赖库和第三方组件)的名称和版本。
子情形三
在子情形三中，项目w 1的项目类型为python类型。
一般来说，python类型的项目中的控件(比如第三方组件)通常需要通过import标识导 入代码文件的起始位置；因此，漏洞检测服务器200若确定项目w 1的项目类型为python类型，则可以从项目w 1的代码文件中获取文件头，通过对头文件中的import标识进行分析，即可获取项目w 1所使用的第三方组件的名称和版本。
情形三
在情形三中，项目w 1的项目类型为除上述情形一和情形二以外的类型。
一般来说，项目的代码文件中都会设置有requirements.txt文件，该文件可以用于记录项目所使用的第三方组件的名称和版本。因此，漏洞检测服务器200若确定项目w 1的项目类型为除上述四种类型之外的类型，则可以从项目w 1的代码文件中获取requirements.txt文件，通过对requirements.txt文件进行分析，即可获取项目w 1所使用的第三方组件的名称和版本。
本发明实施例中，通过使用项目对应的代码文件的目录结构和编程语言将项目划分为多种类型，并设置每种项目类型设置对应的扫描方法，可以使得客户端设备使用项目类型对应的扫描方法获取待检测文件，从而提高检测项目漏洞的效率和准确度；且，通过确定多种项目类型和每种项目类型对应的扫描方法，可以使得对漏洞进行检测的过程更加符合实际情况，使得漏洞检测的场景更为广泛。
步骤c，根据至少一个项目的标识和至少一个项目使用的控件生成预设数据库。
具体实施中，通过步骤b中的方法，漏洞检测服务器200可以获取网络服务器410～网络服务器460执行的全部项目的标识以及全部项目使用的控件；如此，漏洞检测服务器200可以根据全部项目的标识以及全部项目使用的控件生成预设数据库。
表1为采用步骤a～步骤c生成的一种预设数据库的示意表。
表1：一种预设数据库的示意
Figure PCTCN2020084320-appb-000005
如表1所示，网络服务器410执行的项目包括项目w 1～项目w 3，项目w 1使用的控件为1.2.6版本的Spring框架，项目w 2使用的控件为4.2版本的Guice插件，项目w 3使用的控件为Beta版本的Jar依赖库；网络服务器420执行的项目包括项目w 4，项目w 4使用的控件为24.0.0版本 的recyclerview依赖库；网络服务器430执行的项目包括项目w 5，项目w 5使用的控件为4.0.1版本的Spring框架。
基于表1所示意的预设数据库，若第一漏洞控件的标识为Spring，则可以通过查看预设数据库确定项目w 5和项目w 1均使用了Spring控件，如此，漏洞检测服务器200可以执行步骤204a；若第一漏洞控件的标识为ocx，则可以通过查看预设数据库确定不存在项目使用了ocx控件，如此，漏洞检测服务器300可以执行步骤204b。
步骤204a，从预设数据库中获取使用了漏洞控件的目标项目。
基于表1所示意的预设数据库，若第一漏洞控件的标识为Guice，则可以通过查看预设数据库确定项目w 2为目标项目，如此，漏洞检测服务器200可以将项目w 2的项目信息发送给客户端设备100。
步骤204b，获取代码仓库中的全部项目的代码，并确定全部项目中使用了漏洞控件的目标项目。
在一个示例中，若第一漏洞控件的标识为ocx，则预设数据库中不存在与第一漏洞控件的标识匹配的漏洞控件，即预设数据库中不存在使用了ocx控件的项目；如此，漏洞检测服务器200可以按照步骤b的方法从代码仓库中获取网络服务器410～网络服务器460上运行的所有项目的代码文件，进而可以使用每个项目所属的项目类型对应的扫描方法对每个项目的代码文件进行代码检测，从而确定出每个项目使用的控件。进一步地，查询所有项目中是否存在项目使用了ocx控件，若存在某一项目(比如项目w 6)使用了ocx控件，则可以将项目w 6的项目信息发送给客户端设备100。
本发明实施例中，通过将项目对应的代码检测的结果存储在预设数据库中，可以通过预设数据库即可获取到项目使用的控件，而无需对项目重新进行代码检测，从而可以提高项目漏洞的检测效率，进而提高修复项目漏洞的效率；相应地，在预设数据库中不存在使用漏洞控件的项目时，通过对代码仓库中所有项目进行代码分析，可以确定每个项目当前使用的控件，从而可以提高检测项目漏洞的准确性。
步骤205，将使用第一漏洞控件的目标项目显示给用户。
具体实施中，客户端设备100接收到漏洞检测服务器200发送的项目w 6的项目信息后，可以将项目w 6的项目信息显示给用户，比如，可以通过客户端设备100上的漏洞管理界面显示给用户，或者也可以通过客户端设备100的命令行显示给用户，具体不作限定。
在一种可能的实现方式中，客户端设备100还可以生成项目w 6对应的告警信息，并可以从项目w 6的项目信息中获取项目w 6的项目成员，从而可以将告警信息推送给项目w 6的项目成员；比如，客户端设备100可以通过微信、钉钉等方式将告警信息实时推送给项目w 6 的项目成员，或者也可以通过邮件将告警信息定时推送给项目w 6的项目成员，具体不作限定。相应地，项目w 6的项目成员在接收到客户端设备100发送的告警信息后，即可对项目w 6中的漏洞控件进行修复，比如可以升级漏洞控件的版本，或者可以对漏洞控件的代码进行修改。如此，通过采用实时推送的方式将告警信息发送给项目成员，可以及时项目中的漏洞控件进行修复，从而可以避免运行使用了漏洞控件的项目，降低***遭受攻击的风险，提高***的安全性。
本发明的上述实施例中，接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识，进而针对于所述至少一个漏洞控件中的第一漏洞控件，若确定预设数据库中存在使用所述第一漏洞控件的第一目标项目，则将所述第一目标项目显示给所述用户；所述预设数据库为对至少一个项目执行代码检测到的，所述预设数据库中存储有所述至少一个项目的标识和所述至少一个项目使用的控件。本发明实施例中，由于项目的代码是执行项目的基本单元，因此，通过对项目进行代码检测获取项目使用的控件，可以保证获取到的控件为项目执行过程中所使用的最新控件，如此，基于项目所使用的最新控件进行漏洞检测可以提高检测得到的项目漏洞的准确性；且，通过将项目对应的代码检测的结果存储在预设数据库中，可以通过预设数据库即可获取到项目使用的控件，而无需对项目重新进行代码检测，从而可以提高项目漏洞的检测效率，进而提高修复项目漏洞的效率。
针对上述方法流程，本发明实施例还提供一种漏洞检测装置，该装置的具体内容可以参照上述方法实施。
图3为本发明实施例提供的一种漏洞检测装置的结构示意图，包括：
收发模块301，用于接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识；
处理模块302，用于针对于所述至少一个漏洞控件中的第一漏洞控件，若确定预设数据库中存在使用所述第一漏洞控件的第一目标项目，则将所述第一目标项目显示给所述用户；所述预设数据库为对至少一个项目执行代码检测到的，所述预设数据库中存储有所述至少一个项目的标识和所述至少一个项目使用的控件。
可选地，所述至少一个项目使用的控件包括所述至少一个项目使用的框架、第三方组件和服务中的任意一项或任意多项；所述至少一个项目使用的第三方组件为所述至少一个项目使用的依赖库和/或插件。
可选地，所述处理模块302还用于：
根据所述至少一个项目的标识，获取所述至少一个项目分别对应的代码文件；
针对于所述至少一个项目中的第一项目，根据所述第一项目对应的代码文件的后缀名确定所述第一项目使用的编程语言，并根据所述第一项目对应的代码文件的目录结构和/或所述第一项目使用的编程语言确定所述第一项目的项目类型；根据所述第一项目的项目类型，从所述第一项目对应的代码文件中获取待检测文件，并对所述待检测文件进行检测，确定所述第一项目使用的控件；
使用所述至少一个项目的标识和所述至少一个项目使用的控件生成所述预设数据库。
可选地，所述处理模块302具体用于：
若确定所述第一项目是使用第一预设工具构建得到的，则从所述第一项目对应的代码文件的pom.xml数据包中获取properties标签、dependencies标签和/或plugins标签分别对应的内容；或者，
若确定所述第一项目不是使用所述第一预设工具构建得到的，则获取所述第一项目使用的编程语言；若所述第一项目使用的编程语言为java语言，则获取所述代码文件的jar数据包文件，或者，若所述第一项目使用的编程语言为Javescript类型，则获取所述代码文件的package.json数据包文件和/或package-lock.json数据包文件，或者，若所述第一项目使用的编程语言为python类型，则获取所述代码文件的头文件。
可选地，所述处理模块302还用于：
若所述预设数据库中不存在使用所述第一漏洞控件的目标项目，则确定当前处于运行状态的一个或多个项目，并根据所述一个或多个项目的标识，获取所述一个或多个项目的项目地址；
根据所述一个或多个项目的项目地址，调用应用程序编程API接口获取所述一个或多个项目分别对应的一个或多个待检测文件，并对所述一个或多个待检测文件进行代码检测，确定所述一个或多个项目使用的控件；
若所述一个或多个项目中存在使用所述第一漏洞控件的第二目标项目，则将所述第二目标项目显示给用户。
从上述内容可以看出：本发明的上述实施例中，接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识，进而针对于所述至少一个漏洞控件中的第一漏洞控件，若确定预设数据库中存在使用所述第一漏洞控件的第一目标项目，则将所述第一目标项目显示给所述用户；所述预设数据库为对至少一个项目执行代码检测到的，所述预设数据库中存储有所述至少一个项目的标识和所述至少一个项目使用的控件。本发明实施例中，由于项目的代码是执行项目的基本单元，因此，通过对项目进行代码检测获取项目使用的控件，可以保证获取到的控件为项目执行过程中所使用的最新控件，如此， 基于项目所使用的最新控件进行漏洞检测可以提高检测得到的项目漏洞的准确性；且，通过将项目对应的代码检测的结果存储在预设数据库中，可以通过预设数据库即可获取到项目使用的控件，而无需对项目重新进行代码检测，从而可以提高项目漏洞的检测效率，进而提高修复项目漏洞的效率。
基于同一发明构思，本发明实施例提供了一种计算机设备，如图4所示，包括：存储器401、处理器402及存储在存储器401上并可在处理器402上运行的计算机程序，所述处理器402执行所述程序时实现上述漏洞检测方法的步骤。
基于同一发明构思，本发明实施例还提供一种计算机可读存储介质，包括指令，当其在计算机设备的处理器上运行时，使得计算机设备的处理器执行上述漏洞检测方法的步骤。
基于同一发明构思，本发明实施例还提供一种计算机程序产品，当其在计算机设备上运行时，使得计算机设备执行上述漏洞检测方法的步骤。
本领域内的技术人员应明白，本发明的实施例可提供为方法、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (13)

  1. 一种漏洞检测方法，其特征在于，所述方法包括：
    接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识；
    针对于所述至少一个漏洞控件中的第一漏洞控件，若确定预设数据库中存在使用所述第一漏洞控件的第一目标项目，则将所述第一目标项目显示给所述用户；所述预设数据库为对至少一个项目执行代码检测到的，所述预设数据库中存储有所述至少一个项目的标识和所述至少一个项目使用的控件。
  2. 根据权利要求1所述的方法，其特征在于，所述至少一个项目使用的控件包括所述至少一个项目使用的框架、第三方组件和服务中的任意一项或任意多项；所述至少一个项目使用的第三方组件为所述至少一个项目使用的依赖库和/或插件。
  3. 根据权利要求1所述的方法，其特征在于，所述预设数据库为对至少一个项目执行代码检测到的，包括：
    根据所述至少一个项目的标识，获取所述至少一个项目分别对应的代码文件；
    针对于所述至少一个项目中的第一项目，根据所述第一项目对应的代码文件的后缀名确定所述第一项目使用的编程语言，并根据所述第一项目对应的代码文件的目录结构和/或所述第一项目使用的编程语言确定所述第一项目的项目类型；根据所述第一项目的项目类型，从所述第一项目对应的代码文件中获取待检测文件，并对所述待检测文件进行检测，确定所述第一项目使用的控件；
    使用所述至少一个项目的标识和所述至少一个项目使用的控件生成所述预设数据库。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述第一项目的项目类型，从所述第一项目对应的代码文件中获取待检测文件，包括：
    若确定所述第一项目是使用第一预设工具构建得到的，则从所述第一项目对应的代码文件的pom.xml数据包中获取properties标签、dependencies标签和/或plugins标签分别对应的内容；或者，
    若确定所述第一项目不是使用所述第一预设工具构建得到的，则获取所述第一项目使用的编程语言；若所述第一项目使用的编程语言为java语言，则获取所述代码文件的jar数据包文件，或者，若所述第一项目使用的编程语言为Javescript类型，则获取所述代码文件的package.json数据包文件和/或package-lock.json数据包文件，或者，若所述第一项目使用的编程语言为python类型，则获取所述代码文件的头文件。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法还包括：
    若所述预设数据库中不存在使用所述第一漏洞控件的目标项目，则确定当前处于运行状态的一个或多个项目，并根据所述一个或多个项目的标识，获取所述一个或多个项目的项目地址；
    根据所述一个或多个项目的项目地址，调用应用程序编程API接口获取所述一个或多个项目分别对应的一个或多个待检测文件，并对所述一个或多个待检测文件进行代码检测，确定所述一个或多个项目使用的控件；
    若所述一个或多个项目中存在使用所述第一漏洞控件的第二目标项目，则将所述第二目标项目显示给用户。
  6. 一种漏洞检测装置，其特征在于，所述装置包括：
    收发模块，用于接收到用户触发的漏洞检测指令后，获取预设漏洞库中存储的至少一个漏洞控件的标识；
    处理模块，用于针对于所述至少一个漏洞控件中的第一漏洞控件，若确定预设数据库中存在使用所述第一漏洞控件的第一目标项目，则将所述第一目标项目显示给所述用户；所述预设数据库为对至少一个项目执行代码检测到的，所述预设数据库中存储有所述至少一个项目的标识和所述至少一个项目使用的控件。
  7. 根据权利要求6所述的装置，其特征在于，所述至少一个项目使用的控件包括所述至少一个项目使用的框架、第三方组件和服务中的任意一项或任意多项；所述至少一个项目使用的第三方组件为所述至少一个项目使用的依赖库和/或插件。
  8. 根据权利要求6所述的装置，其特征在于，所述处理模块还用于：
    根据所述至少一个项目的标识，获取所述至少一个项目分别对应的代码文件；
    针对于所述至少一个项目中的第一项目，根据所述第一项目对应的代码文件的后缀名确定所述第一项目使用的编程语言，并根据所述第一项目对应的代码文件的目录结构和/或所述第一项目使用的编程语言确定所述第一项目的项目类型；根据所述第一项目的项目类型，从所述第一项目对应的代码文件中获取待检测文件，并对所述待检测文件进行检测，确定所述第一项目使用的控件；
    使用所述至少一个项目的标识和所述至少一个项目使用的控件生成所述预设数据库。
  9. 根据权利要求8所述的装置，其特征在于，所述处理模块具体用于：
    若确定所述第一项目是使用第一预设工具构建得到的，则从所述第一项目对应的代码文件的pom.xml数据包中获取properties标签、dependencies标签和/或plugins标签分别对应的内容；或者，
    若确定所述第一项目不是使用所述第一预设工具构建得到的，则获取所述第一项目使用的编程语言；若所述第一项目使用的编程语言为java语言，则获取所述代码文件的jar数据包文件，或者，若所述第一项目使用的编程语言为Javescript类型，则获取所述代码文件的package.json数据包文件和/或package-lock.json数据包文件，或者，若所述第一项目使用的编程语言为python类型，则获取所述代码文件的头文件。
  10. 根据权利要求6至9中任一项所述的装置，其特征在于，所述处理模块还用于：
    若所述预设数据库中不存在使用所述第一漏洞控件的目标项目，则确定当前处于运行状态的一个或多个项目，并根据所述一个或多个项目的标识，获取所述一个或多个项目的项目地址；
    根据所述一个或多个项目的项目地址，调用应用程序编程API接口获取所述一个或多个项目分别对应的一个或多个待检测文件，并对所述一个或多个待检测文件进行代码检测，确定所述一个或多个项目使用的控件；
    若所述一个或多个项目中存在使用所述第一漏洞控件的第二目标项目，则将所述第二目标项目显示给用户。
  11. 一种计算机可读存储介质，其特征在于，包括指令，当其在计算机设备的处理器上运行时，使得计算机设备的处理器执行如权利要求1至5任一项所述方法的步骤。
  12. 一种计算机程序产品，其特征在于，当其在计算机设备上运行时，使得计算机设备执行如权利要求1至5任一项所述方法的步骤。
  13. 一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现权利要求1至5任一权利要求所述方法的步骤。
PCT/CN2020/084320 2019-06-06 2020-04-10 一种漏洞检测方法及装置 WO2020244307A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910492144.6A CN110232279A (zh) 2019-06-06 2019-06-06 一种漏洞检测方法及装置
CN201910492144.6 2019-06-06

Publications (1)

Publication Number Publication Date
WO2020244307A1 true WO2020244307A1 (zh) 2020-12-10

Family

ID=67859288

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/084320 WO2020244307A1 (zh) 2019-06-06 2020-04-10 一种漏洞检测方法及装置

Country Status (2)

Country Link
CN (1) CN110232279A (zh)
WO (1) WO2020244307A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110232279A (zh) * 2019-06-06 2019-09-13 深圳前海微众银行股份有限公司 一种漏洞检测方法及装置
CN110806978A (zh) * 2019-10-31 2020-02-18 吉林亿联银行股份有限公司 一种第三方组件的缺陷管理方法及装置
CN111666203B (zh) * 2020-04-17 2023-10-27 北京百度网讯科技有限公司 风险软件的定位处理方法、装置、电子设备及存储介质
CN111783103B (zh) * 2020-07-03 2024-06-04 Oppo广东移动通信有限公司 基于Maven的依赖管理方法、装置、电子装置及存储介质
CN112118251A (zh) * 2020-09-15 2020-12-22 四川长虹电器股份有限公司 一种基于maven插件的Java项目开源组件的漏洞检测方法
CN112883342A (zh) * 2021-03-26 2021-06-01 中国工商银行股份有限公司 一种组件管控方法、装置及设备
CN114626068B (zh) * 2022-02-24 2024-06-07 南开大学 基于java函数调用序列的高精度第三方库漏洞模块检测方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090182753A1 (en) * 2008-01-15 2009-07-16 Microsoft Corporation Recording user-driven events withi a computing system
CN101751530A (zh) * 2009-12-29 2010-06-23 成都市华为赛门铁克科技有限公司 检测漏洞攻击行为的方法及设备
CN103020529A (zh) * 2012-10-31 2013-04-03 中国航天科工集团第二研究院七○六所 一种基于场景模型的软件漏洞分析方法
CN106446691A (zh) * 2016-11-24 2017-02-22 工业和信息化部电信研究院 检测软件中集成或定制的开源项目漏洞的方法和装置
CN109697162A (zh) * 2018-11-15 2019-04-30 西北大学 一种基于开源代码库的软件缺陷自动检测方法
CN110232279A (zh) * 2019-06-06 2019-09-13 深圳前海微众银行股份有限公司 一种漏洞检测方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090182753A1 (en) * 2008-01-15 2009-07-16 Microsoft Corporation Recording user-driven events withi a computing system
CN101751530A (zh) * 2009-12-29 2010-06-23 成都市华为赛门铁克科技有限公司 检测漏洞攻击行为的方法及设备
CN103020529A (zh) * 2012-10-31 2013-04-03 中国航天科工集团第二研究院七○六所 一种基于场景模型的软件漏洞分析方法
CN106446691A (zh) * 2016-11-24 2017-02-22 工业和信息化部电信研究院 检测软件中集成或定制的开源项目漏洞的方法和装置
CN109697162A (zh) * 2018-11-15 2019-04-30 西北大学 一种基于开源代码库的软件缺陷自动检测方法
CN110232279A (zh) * 2019-06-06 2019-09-13 深圳前海微众银行股份有限公司 一种漏洞检测方法及装置

Also Published As

Publication number Publication date
CN110232279A (zh) 2019-09-13

Similar Documents

Publication Publication Date Title
WO2020244307A1 (zh) 一种漏洞检测方法及装置
US11722514B1 (en) Dynamic vulnerability correlation
US10873596B1 (en) Cybersecurity alert, assessment, and remediation engine
CN112131882A (zh) 一种多源异构网络安全知识图谱构建方法及装置
US20220156383A1 (en) Method And System For Real Time Detection And Prioritization Of Computing Assets Affected By Publicly Known Vulnerabilities Based On Topological And Transactional Monitoring Data
US11621974B2 (en) Managing supersedence of solutions for security issues among assets of an enterprise network
US9330184B2 (en) Methods and systems for machine learning to discover application compatibility status
US20150089300A1 (en) Automated risk tracking through compliance testing
US20160381060A1 (en) Systems and methods for aggregating asset vulnerabilities
WO2021174870A1 (zh) 网络安全风险检测方法、***、计算机设备和存储介质
CN111654495B (zh) 用于确定流量产生来源的方法、装置、设备及存储介质
Mitropoulos et al. Time present and time past: analyzing the evolution of JavaScript code in the wild
CN114205216A (zh) 微服务故障的根因定位方法、装置、电子设备和介质
US11977872B2 (en) Method and system for code maintenance
US20240048566A1 (en) Lateral movement analysis using certificate private keys
US11971813B2 (en) Data driven testing automation using machine learning
US11418570B2 (en) Robust computing device identification framework
CN113434400A (zh) 测试用例的执行方法、装置、计算机设备及存储介质
KR101625890B1 (ko) 인터넷 응용 트래픽 프로토콜의 시그니처 변경 탐지를 위한 테스트 자동화 방법 및 시스템
US20230254340A1 (en) Apparatus for processing cyber threat information, method for processing cyber threat information, and medium for storing a program processing cyber threat information
CN115982713A (zh) 漏洞修复方法、装置、电子设备和计算机可读存储介质
CN113326506A (zh) 一种小程序监控方法及装置
TWI696080B (zh) 基於檢核資料庫日誌檔的資訊安全管控系統及其實施方法
CN116401319B (zh) 数据同步方法及装置、电子设备和计算机可读存储介质
KR102675087B1 (ko) 위협 ti 기반 온톨로지 생성과 시각화 방법 및 이를 이용한 컴퓨팅 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20818930

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20818930

Country of ref document: EP

Kind code of ref document: A1