面向Web的漏洞聚合和管理工具的研究与实现

发布时间：2018-10-05 09:20

【摘要】：随着近几年安全事件不断发生以及威胁程度不断加重,网络安全的危害范围小到个人隐私大到政府、国家级别的网络空间安全问题冲突,应当说安全事件是愈演愈烈。基于此,个人以及政府也越来越重视网络安全问题。网络安全问题的本质是存在可以利用的漏洞,所以对漏洞的管理和分析对于网络管理人员来说就显得十分重要。目前市场上的漏洞扫描工具种类繁多,兼容性很差,单一的漏洞扫描通常都会有比较高的漏洞错报和误报。并且通常来说,都只是负责漏洞的检测和比较初步的修复,并不是真正意义上的漏洞分析和漏洞管理。普遍采用的依然是工具扫描出报告然后人工整合漏洞修复的低效率过程,对于整个漏洞的从发现到修复的周期来说花费太多不必要的精力。本文描述的基于Web的漏洞管理工具研究和开发,集成了目前市场比较常用的软件型漏洞扫描工具,将漏洞扫描工具导出的XML文件作为分析的数据来源,通过上传到本漏洞管理工具,使用Java Sax技术进行XML文件的解析,解析完成后,漏洞信息会保存到数据存储设备中。分析各漏洞管理结果的XML文档结构,然后通过XML的结构特点和特性,编写相同漏洞合并算法。算法的主要原理描述,首先主要通过判断漏洞扫描工具的动态扫描还是静态扫描类别、漏洞产生的类型、漏洞发生时的路径信息、漏洞中的参数描述、漏洞官方CWE编号等因素来判断是否是同一个漏洞,相同漏洞会进行漏洞合并。这样减少了漏洞管理的开销,提高了效率,也减少了单一扫描工具的误报率错报率高的问题。以Web形式展示漏洞详情,可以查看漏洞扫描的总体情况,不同危害等级不同颜色高亮显示,在表现形式上,可以选择优先展示危害等级高的漏洞,通过对漏洞的分析,对漏洞修复趋势进行展示,并且突出漏洞数量最多的应用,某一个具体漏洞的描述详情,修复进展,漏洞评论等,安全状态一目了然。便于网站管理人员、项目经理以及安全测试人员对最新进展做出修复安排。加入了对Bugzilla工具的支持,实现了对漏洞缺陷的跟踪管理,对于漏洞的发现、修复、关闭等整个周期监控,及时反应漏洞修复状态。增加了对JasperReport工具的支持,漏洞分析结果可以通过下载到本地进行分析,结果展示更加丰富。在本地搭建了测试靶机,进行了多工具的漏洞扫描以及结果导入,成功解析上传文件并且展示了漏洞详情和具体漏洞的详细信息,成功实现某些相同漏洞合并,成功实现了漏洞生命周期的缺陷跟踪管理,下载到本地的文件对于漏洞分析与修复也具有一定的指导作用。基本实现了漏洞管理工具的需求功能。
[Abstract]:With the continuous occurrence of security incidents and the increasing threat degree in recent years, the harm of network security ranges from personal privacy to the government, and the national level of cyberspace security conflicts, it should be said that security events are becoming more and more serious. Based on this, the individual and the government also pay more and more attention to the problem of network security. The essence of network security is that there are vulnerabilities that can be exploited, so it is very important for network managers to manage and analyze vulnerabilities. At present, there are many kinds of vulnerability scanning tools in the market, and the compatibility is very poor. Single vulnerability scanning usually has high vulnerability false positives and false positives. Generally speaking, it is only responsible for vulnerability detection and preliminary repair, and is not the real vulnerability analysis and vulnerability management. It is still widely used that tools scan out reports and then manually integrate the inefficient process of vulnerability repair, and spend too much effort on the whole cycle from discovery to repair. The research and development of vulnerability management tool based on Web is described in this paper, which integrates the software vulnerability scanning tool which is commonly used in the market at present. The XML file exported by the vulnerability scanning tool is used as the data source of the analysis. By uploading to the vulnerability management tool, using Java Sax technology to parse the XML file, after parsing, the vulnerability information will be saved to the data storage device. The XML document structure of each vulnerability management result is analyzed, and the same vulnerability merging algorithm is written through the structural characteristics and characteristics of XML. The main principle description of the algorithm is to determine whether the dynamic scan of the vulnerability scanning tool or the static scan category, the type of vulnerability generation, the path information when the vulnerability occurs, and the parameter description of the vulnerability. Vulnerability official CWE number and other factors to determine whether the same vulnerability, the same vulnerability will be merged. In this way, the cost of vulnerability management is reduced, the efficiency is improved, and the problem of high false alarm rate of single scanning tool is reduced. By displaying the details of the vulnerability in the form of Web, you can view the overall situation of the vulnerability scan. Different damage levels and different colors can be highlighted. In the form of presentation, you can choose to give priority to displaying the vulnerability of the high level of vulnerability, and through the analysis of the vulnerability, Show the trend of vulnerability repair and highlight the application of the largest number of vulnerabilities, a specific vulnerability description details, repair progress, vulnerability review, security status at a glance. Facilitate site managers, project managers and security testers to make repair arrangements for the latest developments. We add the support to Bugzilla tools, realize the tracking and management of vulnerability defects, monitor the whole cycle of vulnerability detection, repair, closing, and respond to the state of vulnerability repair in time. Increased support for JasperReport tools, vulnerability analysis results can be downloaded to the local analysis, the results are more rich. Set up the test target machine in the local area, carry on the vulnerability scan and the result import of the multiple tools, parse and upload the file successfully and display the details of the vulnerability and the details of the specific vulnerability, and successfully realize the merge of some of the same vulnerabilities. The vulnerability lifecycle defect tracking management is successfully implemented, and downloading to the local file also has a certain guidance for vulnerability analysis and repair. Basic implementation of vulnerability management tools requirements function.
【学位授予单位】：山东大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP311.52;TP393.08

【相似文献】