Logic vulnerability detection method and device, equipment and medium
By using preset resend rules and judgment rules in logic vulnerability detection to analyze and count information exchange traffic, the problems of low efficiency and poor accuracy of logic vulnerability detection in the existing technology are solved, and higher detection accuracy and Generalization.
Patent Information
- Application Number
- CN202411489529.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-23
- Publication Date
- 2025-01-10
AI Technical Summary
Existing logic vulnerability detection tools are difficult to effectively detect business logic vulnerabilities, and their detection efficiency is low, their accuracy is poor, and their generalization capabilities are insufficient, so they cannot meet the needs of complex business scenarios.
By obtaining information exchange traffic from the detector scheduling center, calling preset resend and analyze the information exchange traffic, generating resend requests, and using historical response results for statistical analysis to improve logical vulnerability detection accuracy and generalization.
It lowers the threshold for logical vulnerability detection, improves the accuracy and generalization of detection, and enhances the adaptability and flexibility to complex business scenarios.
Smart Images
Figure CN119299201A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a logic vulnerability detection method, device, equipment and medium. Background Art
[0002] When penetration testers conduct penetration tests on websites, they often use scanners to scan for common vulnerabilities. Unlike common vulnerabilities, business logic vulnerabilities are caused by loose program logic or overly complex logic, which results in some logic branches not being processed normally or processing errors. In other words, the programmer's thinking logic is not rigorous enough, which leads to vulnerabilities that attackers can exploit. There are many types of business logic vulnerabilities, which are usually unique to applications and their specific functions. Usually, identifying these vulnerabilities often requires certain human knowledge, such as understanding the business field or the goals that attackers may have in specific situations. Therefore, it is difficult to detect them using existing scanners. Due to the large number of website functions and the uneven capabilities of penetration testers, the testing efficiency of business logic vulnerabilities is low and the testing quality is difficult to guarantee. Most of the existing logic vulnerability detection tools can only detect a certain type of business logic vulnerability, and the way to determine whether there is a vulnerability is relatively simple, and the accuracy needs to be improved.
[0003] At present, the above problems are usually solved from the perspective of automatic execution of security test cases and intelligent analysis of case execution results. First, the automatic execution module of security test cases determines the key parameters in the business message as the target parameters according to the business scenario information, and selects the corresponding test cases from the case library. This module replaces the target parameter values in the original business message with the target parameter values in the test case, generates a test message, and sends it to the application server. The intelligent analysis module of case execution results is responsible for matching the response information of the application server to the test message with the response information of the normal business message without replacing the target parameter. By comparing their differences, it is determined whether there are loopholes in the business logic and generates corresponding detection results. Although the method based on automatic execution of security test cases and intelligent analysis of case execution results solves the problem of low efficiency of manual testing and complete reliance on personal experience, the generation of test cases is completely dependent on sample messages in different scenarios. The quantity and quality of sample messages have a great impact on test cases, and the generalization ability is poor and has limitations. In addition, the intelligent analysis of case execution results only focuses on the similarity between response information, but due to the large number of business scenarios and the extremely complex response information, only focusing on similarity will lead to large-scale underreporting and false alarms.
[0004] From the above, it can be seen that how to lower the threshold of logic vulnerability detection and improve the generalization and accuracy of logic vulnerability detection is an urgent problem to be solved. Summary of the invention
[0005] In view of this, the purpose of the present invention is to provide a logic vulnerability detection method, device, equipment and medium, which can lower the threshold of logic vulnerability detection and improve the generalization and accuracy of logic vulnerability detection. The specific scheme is as follows:
[0006] In a first aspect, the present application provides a logic vulnerability detection method, which is applied to a target detector, comprising:
[0007] Acquire information exchange traffic generated by a target interface collected by a traffic collection system from a detector scheduling center, and call a preset resending rule from a rule center to generate a resending request for the information exchange traffic;
[0008] Obtaining a current response result corresponding to the resending request, and calling a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result;
[0009] The judgment result is returned to the detector dispatch center to complete the logic vulnerability detection process.
[0010] Optionally, the logic vulnerability detection method further includes:
[0011] The traffic collection system collects the information exchange traffic generated by the target interface and sends the information exchange traffic to the detector scheduling center so that the detector scheduling center performs interface function analysis on the information exchange traffic to determine the logical vulnerability type corresponding to the information exchange traffic, and determines the target detector corresponding to the information exchange traffic from a number of detectors based on the logical vulnerability type.
[0012] Optionally, before calling a preset resending rule from a rule center to generate a resending request for the information exchange traffic, the method further includes:
[0013] The preset access rule is called from the rule center to obtain the logical vulnerability feature information of the information exchange traffic, and based on the logical vulnerability feature information, it is determined whether the traffic feature of the information exchange traffic meets the preset detection standard corresponding to the target detector.
[0014] Optionally, the calling of a preset resending rule from a rule center to generate a resending request for the information exchange traffic includes:
[0015] Calling a preset resending rule from a rule center, and performing a parameter detection operation on the logic vulnerability feature information based on the preset resending rule to determine a request feature parameter corresponding to the logic vulnerability feature information;
[0016] Performing a fuzzy test on the request characteristic parameter based on the preset resending rule, determining the parameter type of the request characteristic parameter, and acquiring a replacement parameter list of a corresponding type based on the parameter type;
[0017] The request characteristic parameters are replaced based on the replacement parameter list, and a resending request for the information exchange traffic is generated based on the parameter replacement result.
[0018] Optionally, the obtaining a current response result corresponding to the resending request, and calling a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result, includes:
[0019] Resending the request based on the resending request to obtain a current response result corresponding to the resending request;
[0020] Obtain historical response results from the preset data storage space;
[0021] The preset judgment rule is called from the rule center, and the current response result and the historical response result are statistically analyzed using the preset judgment rule to obtain a corresponding judgment result.
[0022] Optionally, before returning the judgment result to the detector scheduling center to complete the logic vulnerability detection process, the method further includes:
[0023] Saving the detection data contained in the judgment result to the preset data storage space;
[0024] The detection data includes a current response result corresponding to the resending request.
[0025] Optionally, the logic vulnerability detection method further includes:
[0026] Based on the newly added type of logic vulnerability feature information, corresponding preset access rules, preset resending rules and preset judgment rules are created in the rule center, and a new detector for performing logic vulnerability detection for the newly added type of logic vulnerability feature information is created through the detector scheduling center;
[0027] Accordingly, the logic vulnerability detection method further includes:
[0028] The corresponding preset access rules, preset resending rules and preset judgment rules in the rule center are modified according to the known types of logical vulnerability feature information.
[0029] In a second aspect, the present application provides a logic vulnerability detection device, which is applied to a target detector, comprising:
[0030] A resending request generating module is used to obtain the information exchange traffic generated by the target interface collected by the traffic collection system from the detector scheduling center, and call the preset resending rule from the rule center to generate a resending request for the information exchange traffic;
[0031] A judgment result generating module, used for obtaining a current response result corresponding to the resending request, and calling a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result;
[0032] The judgment result transmission module is used to return the judgment result to the detector scheduling center to complete the logic vulnerability detection process.
[0033] In a third aspect, the present application provides an electronic device, including:
[0034] Memory, used to store computer programs;
[0035] The processor is used to execute the computer program to implement the aforementioned logic vulnerability detection method.
[0036] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned logic vulnerability detection method when executed by a processor.
[0037] The present application provides a logic vulnerability detection method applied to a target detector. First, the information exchange traffic generated by the target interface collected by the traffic collection system is obtained from the detector scheduling center, and a preset resending rule is called from the rule center to generate a resending request for the information exchange traffic; then, a current response result corresponding to the resending request is obtained, and a preset judgment rule is called from the rule center to judge the current response result to obtain a corresponding judgment result; finally, the judgment result is returned to the detector scheduling center to complete the logic vulnerability detection process.
[0038] As can be seen from the above, this application can improve the diversity of logic vulnerability detection data samples by calling the preset resending rule for the information exchange traffic to resend the information exchange traffic, thereby improving the generalization of logic vulnerability detection; by calling the preset judgment rule to judge the current response result and returning the detection result, it can improve the accuracy of logic vulnerability detection. In this way, the threshold for logic vulnerability detection can be lowered and the generalization and accuracy of logic vulnerability detection can be improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0040] Figure 1 A flow chart of a logic vulnerability detection method applied to a target detector disclosed in the present application;
[0041] Figure 2 A schematic diagram of a specific logic vulnerability detection system framework disclosed in this application;
[0042] Figure 3 A schematic diagram of a logic vulnerability detection device disclosed in this application;
[0043] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION
[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0045] When penetration testers conduct penetration tests on websites, they often use scanners to scan for conventional vulnerabilities. Unlike conventional vulnerabilities, business logic vulnerabilities are caused by the lack of rigorous program logic or the logic being too complex, which leads to some logical branches not being processed normally or processing errors, that is, the programmer's thinking logic is not rigorous enough, which leads to vulnerabilities that attackers can take advantage of. There are many types of business logic vulnerabilities, which are usually unique to applications and their specific functions. Usually, identifying these vulnerabilities often requires certain human knowledge, such as understanding the business field or the goals that attackers may have in specific situations, so it is difficult to detect them using existing scanners. Due to the large number of website functions and the uneven capabilities of penetration testers, the testing efficiency of business logic vulnerabilities is low and the testing quality is difficult to guarantee. However, most of the existing logic vulnerability detection tools can only detect a certain type of business logic vulnerability, and the method of judging whether there is a vulnerability is relatively simple, and the accuracy needs to be improved. To this end, the present application provides a logic vulnerability detection scheme that can lower the threshold for logic vulnerability detection and improve the generalization and accuracy of logic vulnerability detection.
[0046] See also Figure 1As shown, the embodiment of the present application discloses a logic vulnerability detection method, which is applied to a target detector, including:
[0047] Step S11: acquiring the information exchange traffic generated by the target interface collected by the traffic collection system from the detector scheduling center, and calling the preset resending rule from the rule center to generate a resending request for the information exchange traffic.
[0048] In this embodiment, the traffic collection system collects the information exchange traffic generated by the target interface located at the target server, and sends the information exchange traffic to the detector scheduling center. The information exchange traffic includes request traffic and response traffic, and the detector scheduling center can perform interface function analysis on the request traffic and response traffic to understand the business logic and possible vulnerability characteristics therein, and determine the target detector that meets the vulnerability characteristics from a number of detectors based on the vulnerability characteristics. Specifically, in a specific implementation, the logic vulnerability detection method may also include: the traffic collection system collects the request traffic and response traffic generated by the target interface, and sends the request traffic and response traffic to the detector scheduling center, so that the detector scheduling center performs interface function analysis on the request traffic and response traffic to determine the logical vulnerability type corresponding to the request traffic and response traffic, and determines the target detector corresponding to the request traffic and response traffic from a number of detectors based on the logical vulnerability type.
[0049] In this embodiment, the target detector can call the preset detection rules in the rule center for different types of logical vulnerabilities. Among them, the preset detection rules are rules set in advance for possible business scenarios of different types of logical vulnerabilities, including preset access rules, preset resending rules and preset judgment rules. It can be understood that relevant personnel can modify, add and delete the preset detection rules in the rule center for known or newly emerging logical vulnerability features. Specifically, in a specific implementation, the logic vulnerability detection method may also include: creating corresponding preset detection rules in the rule center based on the newly added type of logical vulnerability feature information, and creating a new detector for performing logical vulnerability detection for the newly added type of logical vulnerability feature information through the detector scheduling center; modifying or deleting the corresponding preset detection rules in the rule center for the known type of logical vulnerability feature information. That is, by managing the preset detection rules in the rule center and adjusting the newly added logical vulnerabilities in a timely manner, the adaptability of the logic vulnerability detection method to the newly added business environment can be enhanced, and the flexibility and scalability of the entire logic vulnerability detection system can be improved.
[0050] In this embodiment, after the target detector is confirmed by the detector scheduling center, the detector also needs to call the preset access rule in the preset detection rule to further detect the information exchange traffic to confirm whether the information exchange traffic meets the detection standard of the target detector. Specifically, in a specific implementation, before calling the preset resending rule from the rule center to generate a resending request for the information exchange traffic, it also includes: calling the preset access rule from the rule center to obtain the logical vulnerability feature information of the information exchange traffic, and judging whether the traffic characteristics of the information exchange traffic meet the preset detection standard corresponding to the target detector based on the logical vulnerability feature information. Further improving the matching degree between the information exchange traffic and the target detector through the preset access rule can make the logical vulnerability detection more accurate.
[0051] In this embodiment, the target detector calls the preset resending rule from the rule center to analyze the information exchange traffic, determines the characteristic parameters where the logical vulnerability characteristics are located, and generates new request traffic for resending to the target server by replacing the parameter values of the characteristic parameters. It can be understood that by replacing the parameter values, several request traffics can be generated, and the several request traffics are resent to the target server through the target port to obtain several response traffics. Specifically, the calling of the preset resending rule from the rule center to generate a resending request for the information exchange traffic may include: calling the preset resending rule from the rule center, and performing a parameter detection operation on the logical vulnerability characteristic information based on the preset resending rule to determine the request characteristic parameters corresponding to the logical vulnerability characteristic information, and obtaining a replacement parameter list of the corresponding type based on the request characteristic parameters; performing parameter replacement on the request characteristic parameters based on the replacement parameter list, and generating several resending requests for the information exchange traffic based on the parameter replacement results.
[0052] Step S12: Obtain a current response result corresponding to the resending request, and call a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result.
[0053] In this embodiment, after the target detector generates several resending requests, the several resending requests are sent to the target server through the target port, and several current response results generated by the target server after receiving the several resending requests are obtained from the target port. The judgment rule is called from the rule center to perform statistical analysis on all current response results and several historical response results pre-stored in the preset data storage space to obtain the judgment result for the logical vulnerability feature. Specifically, in a specific implementation, the obtaining of the current response result corresponding to the resending request and calling the preset judgment rule from the rule center to judge the current response result to obtain the corresponding judgment result may include: sending the several resending requests to the target server through the target port, and obtaining several current response results generated by the target server after receiving the several resending requests from the target port; obtaining several historical response results from the preset data storage space; calling the preset judgment rule from the rule center, and using the preset judgment rule to perform statistical analysis on the current response result and the historical response result to obtain the corresponding judgment result.
[0054] It should be noted that the method for judging the above-mentioned response results by the judgment rule includes but is not limited to text similarity comparison, dictionary structure similarity comparison, text feature detection and response body length comparison. The specific judgment method can be determined according to the actual application scenario.
[0055] Step S13: Return the judgment result to the detector dispatch center to complete the logic vulnerability detection process.
[0056] In this embodiment, the target detector returns the judgment result to the detector scheduling center to complete the logic vulnerability detection process. Among them, the target detector needs to save the judgment result to a preset data storage space. Specifically, before returning the judgment result to the detector scheduling center to complete the logic vulnerability detection process, it may also include: saving the detection data contained in the judgment result to the preset data storage space; wherein the detection data includes the current response result corresponding to the resending request. That is, storing the current response result corresponding to the resending request in the preset data storage space can enrich the historical corresponding data, and when the target detector subsequently calls the judgment rule to perform statistical analysis on the current response result and the historical response result, it can provide a more accurate judgment result and improve the accuracy of logic vulnerability detection.
[0057] As can be seen from the above, the embodiment of the present application determines the target detector for logical vulnerability detection by the detector scheduling center for the type of vulnerability features that may exist in the information exchange traffic; the target detector analyzes the logical vulnerability features in the information exchange traffic by calling the preset resending rules for the information exchange traffic, determines the feature parameters where the logical vulnerability features are located, and generates a corresponding resending request based on the feature parameters; generates a corresponding current response result by sending the resending request to the target server; and performs statistical analysis on the current response result and the historical response results pre-stored in the preset data storage space by calling the preset judgment rules, and returns the detection result. In this way, the threshold for logical vulnerability detection can be lowered, and the generalization and accuracy of logical vulnerability detection can be improved.
[0058] See also Figure 2 As shown, the present application provides a specific logic vulnerability detection method, including:
[0059] In this embodiment, the traffic collection system can passively obtain the request and response traffic of each functional interface of each site to be tested during the penetration test by relevant personnel, and parse the above request and response traffic to obtain valid request information such as request type, request header and request body, and valid response information such as status code, response header and response body, and pass these traffic information to the detector dispatch center for classification and detection. The request and response traffic includes but is not limited to the original request traffic, the original response traffic and the user input traffic.
[0060] Furthermore, the detector dispatch center can perform interface function analysis on the collected request and response traffic to understand the business logic and possible vulnerability characteristics, and use this as a basis to call detectors for different logical vulnerability types. It is understandable that multiple detectors for different business scenarios are pre-set in the detector dispatch center. Among them, each detector has a fixed structure composed of a parameter detection module and an interface detection module, so that relevant personnel can add detectors for other scenarios according to the fixed structure, which improves the flexibility and scalability of the system.
[0061] In this embodiment, the detector needs to call the detection rules of different scenarios preset by the rule center to perform vulnerability detection on the target interface. The rule center classifies the business scenarios of business logic vulnerabilities and presets a set of detection rules for each scenario; each detection rule includes access rules, replay rules and judgment rules, and each detection rule corresponds to a logic vulnerability feature; for known and newly emerging logic vulnerability features, relevant personnel can quickly add, delete and modify the rules.
[0062] The detector first calls the access rules in the rule center through the parameter detection module to further confirm whether the request and response traffic meets the detection criteria of the detector, and then calls the replay rules to guess and detect parameters to accurately locate the request parameters where the vulnerability characteristics are located. The location of the request parameters includes but is not limited to the request type, request header and request body of the valid request information. Furthermore, the detector uses the replay rules to replace the parameter values of the request parameters through the interface detection module. Among them, the specific type of the parameter value is automatically identified by using fuzzy testing, such as mobile phone number, ID number, email address and address. By replacing the parameter values of the request parameters, a set of replay requests is generated, and the requests are replayed in sequence to obtain the corresponding response information.
[0063] In this embodiment, the detector performs statistical analysis on all response information by calling the judgment rule to obtain the corresponding judgment result. It should be noted that the method by which the judgment rule judges the above-mentioned corresponding response results includes but is not limited to text similarity comparison, dictionary structure similarity comparison, text feature detection and response body length comparison. The specific judgment method can be determined according to the actual application scenario.
[0064] As can be seen from the above, the embodiment of the present application first classifies and analyzes the request and response traffic through the detector scheduling center, and then performs detection according to the detection rules preset by the rule center, so that vulnerability detection is more accurate. The detector can locate the request parameters where the vulnerability characteristics are located by guessing and detecting parameters through the parameter detection module, thereby improving the precision and accuracy of vulnerability detection. The replay rules preset by the rule center have fuzzy testing capabilities, which can generalize known vulnerability characteristics and improve the scope of application and generalization ability of the rules. In this way, the threshold for logical vulnerability detection can be lowered and the generalization and accuracy of logical vulnerability detection can be improved.
[0065] See also Figure 3 As shown, the present application provides a logic vulnerability detection device, which is applied to a target detector, including:
[0066] The resending request generating module 11 is used to obtain the information exchange traffic generated by the target interface collected by the traffic collection system from the detector scheduling center, and call the preset resending rule from the rule center to generate a resending request for the information exchange traffic;
[0067] A judgment result generating module 12 is used to obtain a current response result corresponding to the resending request, and to call a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result;
[0068] The judgment result transmission module 13 is used to return the judgment result to the detector scheduling center to complete the logic vulnerability detection process.
[0069] As can be seen from the above, the embodiment of the present application can improve the diversity of logic vulnerability detection data samples by calling the preset resending rule for the information exchange traffic to resend the information exchange traffic, thereby improving the generalization of logic vulnerability detection; by calling the preset judgment rule to judge the current response result and returning the detection result, the accuracy of logic vulnerability detection can be improved. Therefore, the threshold for logic vulnerability detection can be lowered, and the generalization and accuracy of logic vulnerability detection can be improved.
[0070] In some specific implementations, the resending request generating module 11 may specifically include:
[0071] A request characteristic parameter determination unit, configured to call a preset resending rule from a rule center, and perform a parameter detection operation on the logic vulnerability characteristic information based on the preset resending rule to determine a request characteristic parameter corresponding to the logic vulnerability characteristic information;
[0072] A replacement parameter list generating unit, configured to perform a fuzzy test on the request characteristic parameter based on the preset resending rule, determine the parameter type of the request characteristic parameter, and obtain a replacement parameter list of a corresponding type based on the parameter type;
[0073] The resending request generating unit is used to perform parameter replacement on the request characteristic parameter based on the replacement parameter list, and generate a resending request for the information exchange traffic based on the parameter replacement result.
[0074] In some specific implementations, the judgment result generating module 12 may specifically include:
[0075] a current response result obtaining unit, configured to perform a request resending based on the resending request to obtain a current response result corresponding to the resending request;
[0076] A historical response result acquisition unit, used to acquire historical response results from a preset data storage space;
[0077] The judgment result generating unit is used to call the preset judgment rule from the rule center, and use the preset judgment rule to perform statistical analysis on the current response result and the historical response result to obtain a corresponding judgment result.
[0078] In some specific implementations, the logic vulnerability detection device may further include:
[0079] a target detector determination module, which is used for the traffic collection system to collect the information exchange traffic generated by the target interface, and send the information exchange traffic to the detector scheduling center, so that the detector scheduling center performs interface function analysis on the information exchange traffic to determine the logical vulnerability type corresponding to the information exchange traffic, and determines the target detector corresponding to the information exchange traffic from a plurality of detectors based on the logical vulnerability type;
[0080] An access rule calling module, used to call a preset access rule from a rule center to obtain the logical vulnerability feature information of the information exchange traffic, and determine whether the traffic feature of the information exchange traffic meets the preset detection standard corresponding to the target detector based on the logical vulnerability feature information;
[0081] A judgment result storage module, used for saving the detection data contained in the judgment result to the preset data storage space; the detection data includes a current response result corresponding to the resending request;
[0082] A vulnerability detection rule creation module, used to create corresponding preset access rules, preset resending rules and preset judgment rules in the rule center based on the newly added type of logical vulnerability feature information, and to create a new detector for performing logical vulnerability detection for the newly added type of logical vulnerability feature information through the detector scheduling center;
[0083] Accordingly, the logic vulnerability detection device may further include:
[0084] The vulnerability detection rule modification module is used to modify the corresponding preset access rules, preset resending rules and preset judgment rules in the rule center according to the known type of logical vulnerability feature information.
[0085] Furthermore, the present application also discloses an electronic device. Figure 4 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input and output interface 25 and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the logic vulnerability detection method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment can specifically be an electronic computer.
[0086] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.
[0087] In addition, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.
[0088] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the logic vulnerability detection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.
[0089] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed logic vulnerability detection method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.
[0090] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.
[0091] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0092] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0093] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0094] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
Claims
1. A logic vulnerability detection method, characterized in that: Applied to target detectors, including: Acquire information exchange traffic generated by a target interface collected by a traffic collection system from a detector scheduling center, and call a preset resending rule from a rule center to generate a resending request for the information exchange traffic; Obtaining a current response result corresponding to the resending request, and calling a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result; The judgment result is returned to the detector dispatch center to complete the logic vulnerability detection process.
2. The logic vulnerability detection method according to claim 1, characterized in that: Also includes: The traffic collection system collects the information exchange traffic generated by the target interface and sends the information exchange traffic to the detector scheduling center so that the detector scheduling center performs interface function analysis on the information exchange traffic to determine the logical vulnerability type corresponding to the information exchange traffic, and determines the target detector corresponding to the information exchange traffic from a number of detectors based on the logical vulnerability type.
3. The logic vulnerability detection method according to claim 1, characterized in that: Before calling the preset resending rule from the rule center to generate a resending request for the information exchange traffic, the method further includes: The preset access rule is called from the rule center to obtain the logical vulnerability feature information of the information exchange traffic, and based on the logical vulnerability feature information, it is determined whether the traffic feature of the information exchange traffic meets the preset detection standard corresponding to the target detector.
4. The logic vulnerability detection method according to claim 3, characterized in that: The calling of a preset resending rule from a rule center to generate a resending request for the information exchange traffic includes: Calling a preset resending rule from a rule center, and performing a parameter detection operation on the logic vulnerability feature information based on the preset resending rule to determine a request feature parameter corresponding to the logic vulnerability feature information; Performing a fuzzy test on the request feature parameter based on the preset resending rule, determining a parameter type of the request feature parameter, and acquiring a replacement parameter list of a corresponding type based on the parameter type; The request characteristic parameters are replaced based on the replacement parameter list, and a resending request for the information exchange traffic is generated based on the parameter replacement result.
5. The logic vulnerability detection method according to claim 4, characterized in that: The obtaining of the current response result corresponding to the resending request, and calling a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result, includes: Resending the request based on the resending request to obtain a current response result corresponding to the resending request; Obtain historical response results from the preset data storage space; The preset judgment rule is called from the rule center, and the current response result and the historical response result are statistically analyzed using the preset judgment rule to obtain a corresponding judgment result.
6. The logic vulnerability detection method according to claim 5, characterized in that: Before returning the judgment result to the detector scheduling center to complete the logic vulnerability detection process, the method further includes: Saving the detection data contained in the judgment result to the preset data storage space; The detection data includes a current response result corresponding to the resending request.
7. The logic vulnerability detection method according to any one of claims 1 to 6, characterized in that: Also includes: Based on the newly added type of logic vulnerability feature information, corresponding preset access rules, preset resending rules and preset judgment rules are created in the rule center, and a new detector for performing logic vulnerability detection for the newly added type of logic vulnerability feature information is created through the detector scheduling center; Accordingly, the logic vulnerability detection method further includes: The corresponding preset access rules, preset resending rules and preset judgment rules in the rule center are modified according to the known types of logical vulnerability feature information.
8. A logic vulnerability detection device, characterized in that: Applied to target detectors, including: A resending request generating module is used to obtain the information exchange traffic generated by the target interface collected by the traffic collection system from the detector scheduling center, and call the preset resending rule from the rule center to generate a resending request for the information exchange traffic; A judgment result generating module, used for obtaining a current response result corresponding to the resending request, and calling a preset judgment rule from the rule center to judge the current response result to obtain a corresponding judgment result; The judgment result transmission module is used to return the judgment result to the detector scheduling center to complete the logic vulnerability detection process.
9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the logic vulnerability detection method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the logic vulnerability detection method according to any one of claims 1 to 7 is implemented.