CN112822210B - Vulnerability management system based on network assets - Google Patents

Abstract

A vulnerability management system based on network assets comprises a vulnerability library module, a vulnerability information display module, a vulnerability retrieval module, an updated vulnerability library module and a vulnerability library export module; the vulnerability database module classifies the detected vulnerability information; the vulnerability information display module displays specific vulnerability information under three different classifications of CNNVD, CNVD and CVE; the vulnerability retrieval module analyzes and arranges the screened information in an HTML way; the vulnerability updating base module stores the acquired useful information into a MongoDB database; the increment detection module completes the increment updating detection; a vulnerability library exporting module exports vulnerabilities; the invention carries out automatic detection on the network assets through the Scapy framework, thereby avoiding over-reliance on manual detection; the network assets are continuously detected and the vulnerability database is updated in time, so that the hysteresis of the database is effectively avoided, meanwhile, vulnerability information can be derived from the MongoDB database and analyzed, and the security threat is solved.

Description

A Vulnerability Management System Based on Network Assets

technical field

The invention belongs to the computer field and relates to a vulnerability system, in particular to a network asset-based vulnerability management system.

Background technique

With the rapid development of network technology, the combination of computer network and asset information system can realize paperless office and effectively improve work efficiency. However, while network technology brings convenience to people, security issues in various network and asset information systems are gradually exposed. At present, network asset systems mainly rely on manual processing to discover and deal with loopholes. With the increasing complexity of network asset systems , the types of assets are becoming more and more diverse, and system maintenance is becoming more and more difficult. Attackers take advantage of this opportunity to invade the system, tamper with pages and even obtain important asset data, resulting in information leakage and threatening the normal operation of the entire company.

Contents of the invention

In order to achieve the above purpose, the present invention is to provide a vulnerability management system based on network assets, which can automatically detect the entire network assets. When the assets change, incremental or complete detection is performed in time. Check and fix and update vulnerabilities, discover potential threats faced by existing network assets, and resolve security threats emerging in network assets.

To achieve the above object, the present invention provides the following technical solutions:

A vulnerability management system based on network assets, based on CPU hardware and network environment, including a vulnerability database module 1, a vulnerability information display module 2, a vulnerability retrieval module 3, an update vulnerability database module 4 and a vulnerability database export module 5;

The vulnerability database module 1 is used to classify detected vulnerability information, including: China National Information Security Vulnerability Database CNNVD, National Information Security Vulnerability Sharing Platform CNVD, Public Vulnerability and Exposure CVE;

The vulnerability information display module 2 is used to display specific vulnerability information under three different classifications of CNNVD, CNVD, and CVE, and each piece of vulnerability information includes a vulnerability number, a vulnerability description, and a release time;

The vulnerability retrieval module 3 screens the vulnerability information and displays it in the vulnerability information display module 2, and the user can directly view it in the vulnerability information display module 2;

The update vulnerability library module 4 extracts network resources, and hands over useful information obtained to the entity pipeline, which filters and deduplicates the data, stores them in the MongoDB database, and repeats this process until the end date stops, and completes Incremental update detection;

The vulnerability database derivation module 5 is used to select the date of start and end under CNNVD, CNVD, and CVE three different classified vulnerability databases, and export the vulnerabilities from the MongoDB database.

The vulnerability retrieval module 3 includes a serial number retrieval module 31 and a keyword retrieval module 32; the serial number retrieval module 31 is used to adopt the project pipeline Item in the Scrapy framework under the vulnerability databases of three different classifications: CNNVD, CNVD, and CVE Pipeline receives the vulnerability information, uses the input number as a condition, screens the vulnerability information, parses and sorts the filtered information in HTML, and displays it in the vulnerability information display module 2, where users can directly view it The keyword retrieval module 32 is used to adopt the project pipeline Item Pipeline in the Scrapy framework to receive the vulnerability information under CNNVD, CNVD, CVE three different classified vulnerability databases, and use the input keyword as a condition to carry out the vulnerability information Screening, HTML parsing and sorting of the filtered information that meets the requirements, and displaying it in the vulnerability information display module 2, where users can directly view it.

The update vulnerability library module 4 includes a complete detection module 41 and an incremental detection module 42; the complete detection module 41 is used for the Scrapy engine to send a request to the scheduler under CNNVD, CNVD, and CVE three different classified vulnerability databases, The scheduler sends the URL address to the downloader, and the downloader hands over the network resources requested from the server to the spider, and the spider extracts the network resources, and hands the obtained useful information to the entity pipeline, which filters the data, Deduplication, stored in the MongoDB database, constantly repeating this process until the latest date stops, and completes the complete update detection; the incremental detection module 42 is used to choose to start under the vulnerability databases of three different classifications: CNNVD, CNVD, and CVE On the date of detection, the Scrapy engine sends a request to the scheduler, and the scheduler sends the URL address to the downloader, and the downloader sends the network resources requested from the server to the spider Spider, and the spider extracts the network resources and obtains useful information Hand it over to the entity pipeline, which filters and deduplicates the data, stores it in the MongoDB database, repeats this process until the end date stops, and completes the incremental update detection.

Technical effect and advantage of the present invention:

1. The present invention automatically detects network assets through the Scrapy framework, avoids over-reliance on manual detection, and greatly improves the efficiency of vulnerability detection;

2. The present invention combines the Scrapy framework and the MongoDB database to continuously detect network assets and update the vulnerability library in time, effectively avoiding the lag of the database, and also helping developers to export vulnerability information from the MongoDB database. It analyzes and resolves security threats.

Description of drawings

Fig. 1 is a schematic diagram of the overall system framework structure of the present invention.

In the figure: 1. Vulnerability database module, 2. Vulnerability information display module, 3. Vulnerability retrieval module, 4. Update vulnerability database module, 5. Vulnerability database export module, 31. Number retrieval module, 32. Keyword retrieval module, 41 . Complete detection module, 42. Incremental detection module.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Referring to Fig. 1, the vulnerability management system based on network assets, based on CPU hardware and network environment, includes a vulnerability database module 1, a vulnerability information display module 2, a vulnerability retrieval module 3, an update vulnerability database module 4 and a vulnerability database export module 5.

The vulnerability information display module 2 is used to display specific vulnerability information under three different classifications of CNNVD, CNVD, and CVE, and each piece of vulnerability information includes a vulnerability number, a vulnerability description, and a release time;

Described loophole search module 3 comprises serial number retrieval module 31 and keyword retrieval module 32; Described serial number retrieval module 31 is used for under CNNVD, CNVD, the vulnerability storehouse of three kinds of different classifications of CVE, adopts ItemPipeline (item pipeline) in Scrapy frame ) receives the vulnerability information, uses the input number as a condition, screens the vulnerability information, parses and arranges the information that meets the conditions in HTML, and displays it in the vulnerability information display module 2. Users can directly display the vulnerability information in the vulnerability information display module 2. Check; the keyword retrieval module 32 is used to adopt the Item Pipeline (project pipeline) in the Scrapy framework to receive the vulnerability information under CNNVD, CNVD, and CVE three different classified vulnerability databases, and use the input keyword as a condition to Vulnerability information is screened, and the filtered information that meets the conditions is parsed and organized in HTML, and displayed in the vulnerability information display module 2, where users can directly view it;

The update vulnerability library module 4 includes a complete detection module 41 and an incremental detection module 42; the complete detection module 41 is used for the Scrapy engine to send a request to the scheduler under CNNVD, CNVD, and CVE three different classified vulnerability databases, The scheduler sends the URL address to the downloader, and the downloader hands over the network resources requested from the server to the Spider (spider), and the Spider extracts the network resources, and hands over the obtained useful information to the entity pipeline, and the entity pipeline processes the data Filter, deduplication, store in the MongoDB database, constantly repeat this process to the latest date to stop, and complete the complete update detection; the incremental detection module 42 is used for under the vulnerability database of three different classifications of CNNVD, CNVD, and CVE, Select the date to start detection, the Scrapy engine sends a request to the scheduler, and the scheduler sends the URL address to the downloader, and the downloader hands over the network resources requested from the server to the Spider (spider), and the spider extracts the network resources and obtains Pass the useful information to the entity pipeline, and the entity pipeline filters and deduplicates the data, stores it in the MongoDB database, repeats this process until the end date, and completes the incremental update detection;

The vulnerability database derivation module 5 is used to select the date of start and end under CNNVD, CNVD, and CVE three different classified vulnerability databases, and export the vulnerabilities from the MongoDB database.

Finally, it should be noted that: the above is only a preferred embodiment of the present invention, and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, it still It is possible to modify the technical solutions recorded in the foregoing embodiments, or to perform equivalent replacements on some of the technical features. Any modifications, equivalent replacements, improvements, etc. within the spirit and principles of the present invention shall include Within the protection scope of the present invention.

Claims (1)

1. A vulnerability management system based on network assets is characterized by comprising a vulnerability library module (1), a vulnerability information display module (2), a vulnerability retrieval module (3), an updated vulnerability library module (4) and a vulnerability library export module (5) based on CPU hardware and a network environment;

the vulnerability database module (1) is used for classifying the detected vulnerability information, and comprises the following steps: the system comprises a China national information security vulnerability library CNNVD, a national information security vulnerability sharing platform CNVD, a public vulnerability and an exposed CVE;

the vulnerability information display module (2) is used for displaying specific vulnerability information under three different classifications of CNNVD, CNVD and CVE, and each piece of vulnerability information comprises a vulnerability number, vulnerability description and release time;

the vulnerability retrieval module (3) screens vulnerability information and displays the vulnerability information in the vulnerability information display module (2), and a user can directly view the vulnerability information in the vulnerability information display module (2);

the vulnerability updating library module (4) extracts network resources, the obtained useful information is delivered to the entity pipeline, the entity pipeline filters and deduplicates the data, the data are stored in the MongoDB database, the process is continuously repeated until the data are finished, and incremental updating detection is completed;

the leak library export module (5) is used for selecting starting and ending dates under three different categories of CNNVD, CNVD and CVE and exporting leaks from the MongoDB database;

the vulnerability retrieval module (3) comprises a serial number retrieval module (31) and a keyword retrieval module (32); the serial number retrieval module (31) is used for receiving vulnerability information by adopting an Item Pipeline in a script frame under three different classified vulnerability libraries of CNNVD, CNVD and CVE, screening the vulnerability information by taking the input serial number as a condition, performing HTML (hypertext markup language) analysis and arrangement on the screened information meeting the condition, and displaying the information in the vulnerability information display module (2), wherein a user directly checks the information in the vulnerability information display module (2); the keyword retrieval module (32) is used for receiving vulnerability information by adopting an Item Pipeline in a script frame under three different categories of vulnerability libraries of CNNVD, CNVD and CVE, screening the vulnerability information by taking the input keywords as conditions, performing HTML (hypertext markup language) analysis and arrangement on the screened information meeting the conditions, and displaying the information in the vulnerability information display module (2), wherein a user can directly view the information in the vulnerability information display module (2);

the updating vulnerability library module (4) comprises a complete detection module (41) and an increment detection module (42); the complete detection module (41) is used for sending a request to a scheduler by a script engine under three different classified leak libraries of CNNVD, CNVD and CVE, the scheduler sends a URL address to a downloader, the downloader gives a network resource obtained by requesting a server to a Spider, the Spider extracts the network resource, obtains useful information and gives the useful information to an entity pipeline, the entity pipeline filters and removes the duplicate of the data, the data are stored in a MongoDB database, the process is repeated continuously until the latest date is reached, and complete update detection is completed; the incremental detection module (42) is used for selecting a date for starting detection under three different types of vulnerability libraries, namely CNNVD, CNVD and CVE, the Scapy engine sends a request to the scheduler, the scheduler sends a URL address to the downloader, the downloader gives a network resource obtained by requesting the server to the Spider, the Spider extracts the network resource, the useful information is given to the entity pipeline, the entity pipeline filters and deduplicates the data, the data are stored in the MongoDB database, the process is continuously repeated until the ending date, and the incremental updating detection is completed.

Images