CN111385249B - A Vulnerability Detection Method - Google Patents

Abstract

The present invention relates to a vulnerability detection method. The method includes: step S1: verifying whether the message is authenticated; and step S2: verifying whether the message is encrypted. The present invention has a powerful independent industrial control vulnerability library, which can detect a large number of undisclosed "0 day" vulnerabilities in power distribution automation system equipment and software. At the same time, by configuring the corresponding scanning strategy, the feature of "non-destructive detection of loopholes" can be realized; it can check whether the commonly used power distribution 101/104 protocol adopts authentication and encryption measures, so as to ensure the stable operation of the system.

Description

A Vulnerability Detection Method

【Technical field】

The invention belongs to the technical field of distribution automation, and in particular relates to a vulnerability detection method.

【Background technique】

Distribution automation system vulnerabilities mainly include system vulnerabilities, 101/104 protocol security risks, etc. In the distribution automation system that has been built in the early days, the distribution terminal access to the main station lacks an identity authentication mechanism, and the interactive data such as remote signaling and telemetry are mostly transmitted in plain text, which is easy to cause data leakage and tampering. If there are application program vulnerabilities, operating system vulnerabilities, WEB application vulnerabilities, database vulnerabilities, etc. in the equipment in the distribution automation system, lawbreakers can use these vulnerabilities to attack the distribution automation system and affect the stable operation of the system. The safety protection system of the distribution automation system that has been established in the early stage mainly refers to the requirements of the company's "Notice on Strengthening the Safety Protection of the Distribution Network Automation System" (State Grid Tiao [2011] No. 168), which includes that the distribution network automation system should Support the one-way authentication function based on asymmetric key technology. The remote control command issued by the master station should have a digital signature based on the dispatch certificate. Security authentication and data integrity verification of control commands and parameter setting instructions. However, the main station lacks an authentication mechanism for the terminal when it is running online, resulting in the main station lacking the ability to identify the authenticity of the terminal. Moreover, the telemetry and telematics data interaction between the master station and the terminal is transmitted in plain text, which is easy to cause data leakage and tampering. Therefore, there is an urgent need for a new vulnerability detection method. The present invention has a powerful independent industrial control vulnerability library, which can detect a large number of undisclosed "0day" vulnerabilities in power distribution automation system equipment and software. At the same time, by configuring the corresponding scanning strategy, the feature of "non-destructive detection of loopholes" can be realized; it can check whether the commonly used power distribution 101/104 protocol adopts authentication and encryption measures, so as to ensure the stable operation of the system.

【Content of invention】

In order to solve the above-mentioned problems in the prior art, the present invention proposes a vulnerability detection method, which method includes:

Step S1: Verify whether the message is authenticated;

Step S2: Verify whether the message is encrypted.

Further, the step S1 specifically includes: verifying by actively sending a message to a terminal that has been determined to run the protocol.

Further, the verification is performed by actively sending a message to the terminal that has determined to run the protocol, specifically:

Step S11: Determine whether the terminal that has been confirmed to be running the protocol to be verified is a terminal running a specific protocol; if yes, go to the next step; otherwise, go to step S1X;

Step S12: Determine whether a link can be established with the terminal; if yes, proceed to the next step; otherwise, proceed to step S16;

Step S13: Send a protocol link request test message, if the terminal returns a link test success message, then go to step S14, otherwise, go to step S17;

Step S14: Send a protocol general call test message, if the terminal returns a general call test success message, then go to step S15, otherwise go to step S18;

Step S15: Determine that the protocol is not authenticated;

Step S16: The connection is abnormal, and the protocol authentication status cannot be tested; go to step S1X;

Step S17: determine that the link request test fails, and enter step S14;

Step S18: Determine that the general call test has failed, and proceed to step S19;

Step S19: determine that the protocol has been authenticated;

Step S1X: end.

Further, the step S2 specifically includes: actively grabbing and analyzing the port data packet of the terminal running the protocol to determine whether the packet is encrypted.

Further, by actively grabbing and analyzing the port data packet of the terminal running the protocol, to determine whether the message is encrypted, specifically:

Step S21: Determine whether the terminal is a terminal running a specific protocol; if yes, proceed to the next step, otherwise proceed to step S2X;

Step S22: capture port data packets in real time;

Step S23: determine whether the data packet contains data of a specific type;

Step S24: Determine that the protocol is not encrypted, and proceed to step S2X;

Step S25: determine that the protocol has been encrypted;

Step S2X: end.

Further, capture port 2404 packets through tshark.

Further, the specific type is 60870-5-105-Asdu data.

Further, the protocol is 104 protocol.

The beneficial effects of the present invention include: possessing a powerful independent industrial control vulnerability library, capable of detecting a large number of undisclosed "0day" vulnerabilities in power distribution automation system equipment and software. At the same time, by configuring the corresponding scanning strategy, the feature of "non-destructive detection of loopholes" can be realized; it can check whether the commonly used power distribution 101/104 protocol adopts authentication and encryption measures, so as to ensure the stable operation of the system.

【Description of drawings】

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application, but do not constitute an improper limitation of the present invention. In the accompanying drawings:

FIG. 1 is a schematic structural diagram of the vulnerability detection system of the present invention.

Fig. 2 is a schematic structural diagram of the script execution module of the present invention.

Fig. 3 is a schematic diagram of the vulnerability scanning strategy of the present invention.

Fig. 4 is a schematic diagram of the protocol authentication testing method of the present invention.

Fig. 5 is a schematic diagram of the protocol encryption testing method of the present invention.

Fig. 6 is a schematic diagram of the vulnerability detection result of the present invention.

【Detailed ways】

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, wherein the schematic embodiments and descriptions are only used to explain the present invention, but are not intended to limit the present invention.

As shown in Figure 1, a vulnerability detection system applied in the present invention is described in detail; the vulnerability detection system includes a vulnerability scanning system and a configuration management module;

The communication connection between the vulnerability scanning system and the configuration management module is used to issue tasks and return results;

The vulnerability scanning system includes a task analyzer, a script engine, and a vulnerability scanning test script library; wherein: the task analyzer is used to analyze the tasks issued by the configuration management module, and the script engine is used to load and complete the tests that need to be executed for the issued tasks A script, performing grammatical analysis and execution on the test script, and returning the execution result of the test script to the configuration management module;

The task analyzer is used to analyze the tasks issued by the configuration management module; specifically: the tasks are issued in the form of instructions, and the instructions include task names and task details, task data addresses, etc.; when receiving task data, analyze Task details, based on the analysis results to obtain task data and create a new test process for task processing;

The configuration management module is used to issue test tasks and receive test results returned by the vulnerability scanning system; the test task includes the script name and parameter information required for the test; it also includes the task name and task details, and the task data address; when receiving When the task data is received, the task details are parsed; it is also used to configure the scheduling strategy for the required test script; the scheduling strategy can be an initial default scheduling strategy;

The task processing based on obtaining task data and creating a new test process based on the analysis result is specifically: analyzing task details to obtain task type, when the script execution type is in the task type, obtaining task data address, and based on the task data address Obtain the script name and parameter information, create a new test process based on the script name and parameter information, and copy the script name and parameter information in the process storage space of the new test process; Passing, there is no shared storage space between the task analyzer and the script engine, avoiding the possibility of data pollution;

The task details include the task type, which can be divided into multiple types, the main types are as follows:

CREQ_ATTACHED_FILE: The received content is a file type, and the received file will be stored;

CREQ_LONG_ATTACK: After receiving the script execution command, the specified script (policy configuration selection) will be invoked to send packets to the configuration target;

CREQ_PAUSE_WHOLE_TEST: Send a SIGUSR1 signal to all test processes to pause all tests;

CREQ_PLUGIN_INFO: Get the test script information of the specified OID value;

CREQ_PREFERENCES: Get scan engine parameter information;

CREQ_RESUME_WHOLE_TEST: Send a SIGUSR2 signal to all test processes to resume the suspended test;

CREQ_STOP_ATTACK: Send a SIGTERM signal to the test process of the specified host to end the scanning process;

CREQ_STOP_WHOLE_TEST: Send a SIGTERM signal to the test process of all hosts to end all scanning processes;

CREQ_NVT_INFO: get NVT script library information;

CREQ_UNKNOWN: The default type, the received task is not compliant or cannot be parsed, and the task request will not be processed;

The script engine includes a script scheduling module, a script execution module, and a knowledge base; wherein, the script scheduling module selects the test scripts to be executed, and the script execution module is used to execute the selected test scripts;

The script scheduling module is used to read the test script and complete the initialization and serialization of the script call; the script scheduling module includes a script loading module and a script organization module;

The loading module is used to load the corresponding test script according to the script name and parameter information that needs to be executed, and initialize it; specifically: load all the test scripts, and store them as script engine in the process of starting, running and ending. A global variable linked list of all information; preferably: said global variable linked list is stored in the process space of the test process; when the control right is handed over from the task analyzer to the script engine, data exchange and preservation are carried out through the process;

The organization module is used to determine the execution order of the script according to the scheduling strategy of the script and the relevant scheduling information stored in the knowledge base, and to interpret and execute the test script based on the execution order; specifically; the organization module is used to Acquiring the scheduling policy of the script to determine the preliminary execution order; adjusting the preliminary execution order through the relevant scheduling information stored in the knowledge base to obtain the execution order of the script; interpreting and executing the test script based on the execution order;

Preferably: each test script has its corresponding dispatching strategy, and described dispatching strategy is that configuration management module is set; In the described dispatching strategy, comprise script running state, policy coding, priority, overtime, tcp port, udp short even , the node ID in the required global variable linked list, the node ID in the mandatory global variable linked list, etc.;

The organization module is used to obtain and determine the preliminary execution order according to the scheduling strategy of the script, specifically: the organization module obtains all test scripts, and obtains the strategy type of the scheduling strategy based on the scheduling strategy of the test script, and based on the scheduling strategy Obtain its corresponding priority; based on the priority and policy code to determine the initial execution order; the following table is a comparison table of policy types and their priorities;

Table 1: Comparison table of policy types and their priorities

The determination of the preliminary execution order based on the priority and policy coding is specifically: sorting the script policies according to the priority, the greater the priority, the higher the execution order, and vice versa; if the priority of the two test scripts If the size is the same, they will be sorted according to the strategy code. When the value of the strategy code is smaller, the execution order will be higher;

The step of adjusting the preliminary execution sequence by using the relevant scheduling information stored in the knowledge base to obtain the execution sequence of the scripts is specifically: adjusting the preliminary execution sequence based on the dependencies between test scripts to obtain the execution sequence;

The adjustment of the preliminary execution sequence based on the dependency between the test scripts is carried out to obtain the execution sequence; specifically: when the execution sequence of the two test scripts in the preliminary execution sequence violates the sequence requirements between the two test scripts , adjusting the sequence of the two test scripts to meet the sequence requirements; taking the execution sequence that meets the sequence requirements as the execution sequence;

The explanation and execution of the test script based on the execution sequence is specifically: predicting based on the execution environment whether the running requirements of the test script to be executed can be satisfied by the execution environment of the script engine, and if so, continue to execute the test script; Otherwise, the execution sequence of the execution script is postponed; the most direct and effective way to optimize the script scheduling is to confirm the situation of the script engine without starting the script. For example, if the script needs to establish a connection to the remote host on port 123/TCP, there is no need to run the script if it is known that this port is closed. Operate the relevant information in the knowledge base to determine the scheduling strategy of the script;

The post-processing of the execution order of the execution script is specifically: placing the execution script in a waiting queue different from the execution order queue, and regularly checking the execution environment. When the running requirements of the test script can be met, the test script is awakened, and the test script is placed first in the execution sequence;

Preferably: by querying the knowledge base and the scheduling strategy corresponding to the test script to obtain the running requirements of the test script; by querying the global variable linked list to obtain the execution environment information;

Preferably: the script engine obtains the test script and its parameter information that the test task needs to complete from the process space;

The system will load all the scripts and store them as an arglist structure, which is a global variable linked list, which contains all the information of the engine during startup, operation and termination, including startup configuration, script interpretation and execution, and return information, etc., and its node data The structure contains information such as node name, node type (representing the type of saved information), node value (representing the content of the saved information), node length, node address of the next node, node number (calculated according to the hash algorithm) and other information ;Every information required by the script engine, such as script information, target host information, etc., is contained in a linked list corresponding to it, and these linked lists are connected to the global variable linked list. When the script engine starts, an empty global variable will be initialized Linked list, fill in the global variable linked list during operation; the script engine searches the required information from the global variable linked list during running; the global variable linked list is modified in real time with the operation of the script engine ;

The script engine searches the required information from the global variable linked list during operation, specifically: the script engine saves a summary table of the global variable linked list; the script engine searches the global variable linked list through the summary table; The summary table of the global variable linked list saves the corresponding relationship between the node summary value and its type and position; the summary value is the key information of the node, and the key information is the common search content, key value, etc.; After the modification of the global variable linked list, the summary table needs to be modified in real time;

The knowledge base is used to store test scripts and interact with test script information; in the work of the script engine, the information collected by script execution is stored in the knowledge base, which can effectively avoid repeated scanning and reduce unnecessary waste of resources and improve work efficiency;

The script knowledge base maintained by the script engine records some useful information obtained after the script runs, such as the type of operating system, opened ports, services provided, and login accounts, etc. The knowledge base can be used for information interaction between scripts, It provides the basis for the operation of some scripts, and at the same time, it simplifies the writing of script codes; for example, there is no need to specify the system environment, port status and other information that need to be relied on during the operation in the test script; during the actual execution of the test script, for Dependent system environment, port status and other information, make reasonable operations by querying the knowledge base; for example: query script-related information based on the type of script; during the maintenance process of the script engine, perform knowledge based on the commonality in the script Automatic filling of the library; after the script engine executes the script, based on the execution information during the execution process, the knowledge base is filled;

As shown in Figure 2: the script execution module is used to explain and execute specific test scripts; the script execution module includes a script interpreter, and the script interpreter will analyze and explain sentence by sentence according to the dynamic order of the sentences in the test script, through lexical analysis, Syntactic analysis, semantic analysis, combined with symbol tables and error handling mechanisms, convert scripts into internal functions and variables and execute them;

Preferably: after completing the loading and organization of the script, the script engine will call the script execution module to execute the specific test script;

Preferred: lexical analysis is mainly used to divide the NASL script into two-tuples of type and value, separate individual words, and fill them in the symbol table; grammatical analysis is to analyze the word list formed in the lexical analysis stage, and identify complete statement, and perform grammatical integrity verification; in the process of executing the script, identify the various variables defined, and fill the variables into the symbol table; semantic analysis is used in the grammatical analysis stage to check the Each statement is parsed and the corresponding semantic action is executed;

The vulnerability scanning test script library stores the vulnerability scanning test script; the vulnerability scanning test script is written in nasl language, and the test script includes the vulnerability and script description part and the vulnerability test process part;

The vulnerability and script description part describes the test script itself and the vulnerability itself, including the vulnerability name, vulnerability description, vulnerability id number, vulnerability cve number, vulnerability bid number, vulnerability cnvd number, vulnerability cnnvd number, vulnerability affected version, and vulnerability resolution Solution, vulnerability threat level, vulnerability family, vulnerability-related link address, KB value required for vulnerability, KB value required for vulnerability enforcement, KB value for vulnerability exclusion, vulnerability script scanning parameters, etc.;

The loophole testing process part is a logic flow for loophole verification, that is, the method of sending data packets, including string analysis, socket related functions, file operation related functions, etc.;

The vulnerability scanning test can select the corresponding scanning strategy for vulnerability detection according to the operating status of the device under test and the scanning schedule; Figure 3 shows several vulnerability scanning strategies;

As far as the test strategy of the specific test script is concerned, the safety protection system of the distribution automation system that has been built in the early stage supports the one-way authentication function based on asymmetric key technology, and the remote control command issued by the master station should carry the digital key based on the dispatching certificate. Signature, the sub-station side or the terminal side should be able to identify the digital signature of the master station, and realize the security authentication and data integrity verification of the control commands and parameter setting instructions of the master station system. However, the main station lacks an authentication mechanism for the terminal when it is running online, resulting in the main station lacking the ability to identify the authenticity of the terminal. Moreover, the telemetry and telematics data interaction between the master station and the terminal is transmitted in plain text, which is easy to cause data leakage and tampering. In view of this situation, the security authentication and encryption functions of the power distribution protocol are tested by using the detection system to actively send packets and passively intercept data packet analysis. At present, the power distribution master station and the terminal generally use the 101/104 protocol for communication. Therefore, by analyzing the power distribution 101/104 protocol, construct the protocol connection establishment and communication data packets, actively send them to the target system under test, and respond to the situation through the target system to test whether it has a valid authentication process. If the connection and communication with the target system can be successfully established and communicated with the unauthenticated data packet, it indicates that the target system does not use an authentication mechanism. In addition, by intercepting the 101/104 protocol communication data packets, performing in-depth packet analysis on them, filtering the data packets of the specified target device IP and specified port (2404) through tshark, and then through the built-in 60870-5-104-Asdu component of tshark To analyze whether the data packet conforms to the 101/104 protocol, if it conforms to the Typeid information and function code information in the extracted data packet, if the extracted information conforms to the 101/104 standard protocol, the protocol is considered unencrypted.

Next, based on the 104 protocol, the protocol security testing method is analyzed in detail; for example: the 104 protocol security test is to check the protocol security of the distribution network system running the 104 protocol, including verifying whether the 104 message is authenticated, the 104 message Whether to encrypt two parts;

The vulnerability detection method of the present invention comprises the following steps:

Step S1: Verify whether the message is authenticated; specifically: verify by actively sending a message to a terminal that has determined to run the protocol (as shown in Figure 4);

Step S11: Determine whether the terminal that has been confirmed to be running the protocol to be verified is a terminal running a specific protocol; if yes, go to the next step; otherwise, go to step S1X;

Step S12: Determine whether a link can be established with the terminal; if yes, proceed to the next step; otherwise, proceed to step S16;

Step S13: Send a protocol link request test message, if the terminal returns a link test success message, then go to step S14, otherwise, go to step S17;

Step S14: Send a protocol general call test message, if the terminal returns a general call test success message, then go to step S15, otherwise go to step S18;

Step S15: Determine that the protocol is not authenticated;

Step S16: The connection is abnormal, and the protocol authentication status cannot be tested; go to step S1X;

Step S17: determine that the link request test fails, and enter step S14;

Step S18: Determine that the general call test has failed, and proceed to step S19;

Step S19: determine that the protocol has been authenticated;

Step S1X: end;

Step S2: verify whether the message is encrypted; specifically: analyze by actively capturing the port data packet of the terminal running the protocol to determine whether the message is encrypted (as shown in Figure 5);

Step S21: Determine whether the terminal is a terminal running a specific protocol; if yes, proceed to the next step, otherwise proceed to step S2X;

Step S22: capture port data packets in real time;

Preferable: Capture port 2404 data packets through tshark;

Step S23: determine whether the data packet contains data of a specific type;

Preferably: the specific type is 60870-5-105-Asdu data;

Step S24: Determine that the protocol is not encrypted, and proceed to step S2X;

Step S25: determine that the protocol has been encrypted;

Step S2X: end;

As shown in accompanying drawing 6, the vulnerability detection method of the present invention can quickly find loopholes, and the vulnerability detection results of the present invention are shown in accompanying drawing 6;

In the several embodiments provided by the present invention, it should be understood that the disclosed method and terminal may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

In addition, the technical solutions in the above several embodiments may be combined and replaced with each other under the condition that no contradiction occurs.

The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each unit may physically exist separately, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software function modules.

It will be apparent to those skilled in the art that the invention is not limited to the details of the above-described exemplary embodiments, but that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Accordingly, the embodiments should be regarded in all points of view as exemplary and not restrictive, the scope of the invention being defined by the appended claims rather than the foregoing description, and it is therefore intended that the scope of the invention be defined by the appended claims rather than by the foregoing description. All changes within the meaning and range of equivalents of the elements are embraced in the present invention. Any reference sign in a claim should not be construed as limiting the claim concerned. In addition, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of modules or devices stated in the system claims may also be realized by one module or device through software or hardware. The words first, second, etc. are used to denote names and do not imply any particular order.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention without limitation. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be Modifications or equivalent replacements can be made without departing from the spirit and scope of the technical solutions of the present invention.

Claims (8)

1. A vulnerability detection method, the system used for the vulnerability detection method includes a vulnerability scanning system and a configuration management module; The communication connection between the vulnerability scanning system and the configuration management module is used to issue tasks and return results; The vulnerability scanning system includes a task analyzer, a script engine, and a vulnerability scanning test script library; wherein: the task analyzer is used to analyze the tasks issued by the configuration management module, and the script engine is used to load and complete the tests that need to be executed for the issued tasks A script, performing grammatical analysis and execution on the test script, and returning the execution result of the test script to the configuration management module; Described script engine comprises script scheduling module and script execution module, knowledge base; Wherein, script scheduling module selects the test script that needs to be carried out, and script execution module is used for carrying out the selected test script; The script scheduling module is used to read the test script and complete the initialization and serialization of the script call; the script scheduling module includes a script loading module and a script organization module; The loading module is used to load the corresponding test script according to the script name and parameter information that needs to be executed, and initialize it; specifically: load all the test scripts, and store them as script engine in the process of starting, running and ending. The global variable linked list of all information in; The global variable linked list is stored in the process space of the test process; When the control right is handed over from the task analyzer to the process of the script engine, data exchange and preservation are carried out by the process; The task analyzer is used to analyze the tasks issued by the configuration management module; specifically: the tasks are issued in the form of instructions, and the instructions include task names and task details, task data addresses, etc.; when receiving task data, analyze Task details, based on the analysis results to obtain task data and create a new test process for task processing; The configuration management module is used to issue test tasks and receive test results returned by the vulnerability scanning system; the test task includes the script name and parameter information required for the test; it also includes the task name and task details, and the task data address; To configure a scheduling strategy for each required test script; the scheduling strategy is an initial default scheduling strategy; The task processing based on obtaining task data and creating a new test process based on the analysis result is specifically: analyzing task details to obtain task type, when the script execution type is in the task type, obtaining task data address, and based on the task data address Obtain the script name and parameter information, create a new test process based on the script name and parameter information, and copy the script name and parameter information in the process storage space of the new test process; Passing, there is no shared storage space between the task analyzer and the script engine, avoiding the possibility of data pollution; It is characterized in that the method comprises: Step S1: Verify whether the message is authenticated; Step S2: Verify whether the message is encrypted. 2. The vulnerability detection method according to claim 1, wherein the step S1 is specifically: verifying by actively sending a message to a terminal whose operation protocol has been determined. 3. The vulnerability detection method according to claim 2, wherein the verification is performed by actively sending a message to a terminal whose operation protocol has been determined, specifically: Step S11: Determine whether the terminal that has been confirmed to be running the protocol to be verified is a terminal running a specific protocol; if yes, go to the next step; otherwise, go to step S1X; Step S12: Determine whether a link can be established with the terminal; if yes, go to the next step; otherwise, go to step S16; Step S13: Send a protocol link request test message, if the terminal returns a link test success message, then go to step S14, otherwise, go to step S17; Step S14: Send a protocol general call test message, if the terminal returns a general call test success message, then go to step S15, otherwise go to step S18; Step S15: Determine that the protocol has not been authenticated; Step S16: The connection is abnormal, and the protocol authentication status cannot be tested; go to step S1X; Step S17: determine that the link request test fails, and enter step S14; Step S18: Determine that the general call test has failed, and proceed to step S19; Step S19: determine that the protocol has been authenticated; Step S1X: end. 4 . The vulnerability detection method according to claim 3 , wherein the step S2 specifically includes: actively grabbing and analyzing port data packets of terminals running the protocol to determine whether the packets are encrypted. 5 . 5. The vulnerability detection method according to claim 4, wherein the analysis is performed by actively capturing the port data packet of the terminal running the protocol to determine whether the message is encrypted, specifically: Step S21: Determine whether the terminal is a terminal running a specific protocol; if yes, proceed to the next step, otherwise proceed to step S2X; Step S22: capture port data packets in real time; Step S23: determine whether the data packet contains data of a specific type; Step S24: Determine that the protocol is not encrypted, and proceed to step S2X; Step S25: determine that the protocol has been encrypted; Step S2X: end. 6. The vulnerability detection method according to claim 5, characterized in that the 2404 port data packets are captured by tshark. 7. The vulnerability detection method according to claim 6, wherein the specific type is 60870-5-105-Asdu data. 8. The vulnerability detection method according to claim 7, wherein the protocol is 104 protocol.