Code-free process visualization vulnerability detection method and system

Abstract

The invention discloses a code-free process visualization vulnerability detection method and system. In the prior art, script codes or scanning rule configuration files need to be compiled manually; in order to solve the problems that in the prior art, a scanning rule configuration file needs to be written on the basis of a fixed template, a programming process and a logic rule, a user-defined function in an engine needs to be learned and manually inserted, and a specific process and a grammar specification need to be learned, the technical scheme comprises the steps that firstly, a program automatically completes a test process packaging operation; when a user creates a vulnerability detection method, a program automatically completes system variable initialization, and meanwhile it is guaranteed that variables of different detection methods do not affect one another; then, a user can customize a global variable to be quoted in subsequent operation; then, a test process is newly built, the global variable and the system variable which are created before can be quoted in the process, and a result is bound to the unused system variable; and finally, adding a judgment rule set, and carrying out logic synthesis to judge whether vulnerabilities exist or not.

Description

technical field [0001] The invention belongs to the technical field of system security, and in particular relates to a codeless process visualization loophole detection method and system. Background technique [0002] With the development of network technology, people pay more and more attention to information security. If there is a security loophole in the application program of the website or server, it will not only affect the normal use of the function, but also cause the leakage of data and confidentiality in severe cases. Cause serious economic loss and harm. Therefore, the detection of loopholes is particularly important. [0003] In the prior art, vulnerabilities are usually detected by a vulnerability scanner. In the related products of vulnerability scanners, there are usually three forms in the processing of vulnerability scanning rules: the first is to hard-code the vulnerability scanning and judgment mechanism in the scanning engine; the second is to separat...

AI Technical Summary

Problems solved by technology

[0006] Aiming at the need to manually write script codes or compile scanning rule configuration files in the existing technology; and writing scanning rule configuration files also needs to be based on fixed templates, compile process and logic rules, and also need to learn and manually insert custom functions in the engine, To solve the problem of learning specific processes and grammatical specifications, the present invention proposes a code-free process visualization vulnerability detection method and system. form, to realize the customized development of complex vulnerability scanning process

Images