Automatic inspection platform based on grey box test

Abstract

The invention relates to the technical field of software testing, and particularly discloses an automatic inspection platform based on a grey box test, comprising a detection console module used for managing and controlling a test process; the grey box security test overall module is used for enabling the data flow generated by the test to penetrate through the network; the grey box security test network module is used for taking a rear-end server as a computing resource and a storage resource, and packaging the rear-end server into a service by a certain management server for external provision; the grey box security test function module is used for detecting newly generated vulnerabilities in the software development process in real time; and the grey box security test tool module is used for detecting security problems in the software. By using the instrumentation technology and the flow agent, real-time vulnerability detection is carried out on the running application and API in the research and development test stage, full life cycle management and multi-dimensional application security management and control of vulnerabilities detected by an application system are supported, and the method has the advantages of high coverage, low false alarm, real-time detection and the like, and can be seamlessly fused with a DevSecOps process.

Description

Technical Field

[0001] The present invention relates to the technical field of software testing, and in particular to an automatic inspection platform based on grey box testing. Background Art

[0002] Gray box testing is a test between white box testing and black box testing. Gray box testing is mostly used in the integration testing phase. It not only focuses on the correctness of output and input, but also on the internal situation of the program. Gray box testing is not as detailed and complete as white box testing, but it pays more attention to the internal logic of the program than black box testing. It often judges the internal operating status through some representative phenomena, events, and signs.

[0003] Currently, the gray box detection tools on the market have many problems such as low vulnerability detection quality, inability to meet relevant management requirements, relatively low degree of automation, and complex operation methods. These problems can be mainly summarized into the following categories: low vulnerability detection accuracy, difficulty in associating test tools with test results, easy blocking of automated processes, insufficient security personnel resources, incomplete vulnerability information, and detection of open source components only covering the tip of the iceberg. As a result, the gray box detection tools in the existing technology cannot meet people's usage needs. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and to propose an automatic inspection platform based on gray box testing.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] Automatic inspection platform based on gray box testing, including:

[0007] Detection console module, used to manage and control the test process;

[0008] Gray-box security testing overall module, used to run the test-generated data streams through the network;

[0009] The gray box security testing network module is used to use the backend server as a computing resource and storage resource, which is packaged into a service by a management server and provided to the outside world;

[0010] Gray box security testing function module, used to detect new vulnerabilities in the software development process in real time;

[0011] Gray box security testing tool module, used to detect security issues in software.

[0012] Optionally, the specific management and control process of the test by the detection control module includes the following steps:

[0013] A1: Adopt the notification function, and the enterprise administrator will notify the display interface of the relevant messages based on the message notification content released by each group and group members;

[0014] A2: Collect statistics on all vulnerabilities and display the percentage of statistical information in a pie chart. This system classifies security vulnerabilities according to their severity. The classification levels include: critical, high risk, medium risk, low risk and recommended.

[0015] A3: Rank the number of application weaknesses detected, extract the five with the largest application weaknesses, and display the information percentage and ranking in the form of a bar chart;

[0016] A4: Statistics and display of the growth trend of application security vulnerabilities, summary statistics of detected vulnerabilities, and display in the form of an area chart;

[0017] A5: Count the usage distribution of group licenses, count the usage distribution of each group under the enterprise, and display the number of licenses of different groups in the form of a bar chart;

[0018] A6: Statistics on user growth trends, record all enterprise administrators, group administrators and common users, summarize and display them here in the form of an area chart;

[0019] A7: Count the global license usage and display it in the form of a pie chart;

[0020] A8: Collect statistics on the distribution of enterprise licenses and display them in the form of a bar chart;

[0021] A9: Confirm the database synchronization status and check whether the master-slave backup synchronization is successful.

[0022] A10: JDK version statistics, statistics on the JDK distribution of all tested applications on the system, by default displayed in the form of a pie chart;

[0023] A11: Statistics on web containers. Statistics on the distribution of web containers of all tested applications on the system are displayed in the form of a pie chart.

[0024] Optionally, the testing process of the gray box security testing overall module is:

[0025] B1: The generated data stream runs through the network and reaches the application server;

[0026] B2: Data in the business testing process is collected at different stages. The collected content includes setting up proxy or VPN channels on the user client, traffic mirroring on the switch port, traffic sniffing on the application server port, and deploying agent probes on the application server for instrumentation. The collected content is introduced into the detection engine to complete security testing.

[0027] B3: Analyze data results and save them in database;

[0028] B4: Testers log in to the Gray Box backend management system through a browser, the Internet or a local area network, to perform security testing operations, view and verify results, and export reports.

[0029] Optionally, the test process of the gray box security test network module is:

[0030] C1: Set up a load balancing server in front of the Web server cluster as the entrance for Web server traffic;

[0031] C2: Select a Web server that meets the preset conditions and forward the client's request to the Web server for processing.

[0032] Optionally, when the gray box security test network module adopts a local deployment solution, the gray box operation architecture includes two major components: a server-side Server and an instrumentation probe Agent.

[0033] Optionally, the gray box security test network module uses the local deployment solution using the following process:

[0034] D1: The server is deployed and runs on a server in the local network environment of the bank. After the agent is deployed on the server, it is downloaded from the server service and configured in the web server where the detected application is located.

[0035] D2: The server and agent jointly complete the security test of the application at runtime, and the application generates data flow interaction during operation;

[0036] D3: The Agent reports the detected security risk results to the Server to complete the tool's security testing of the application.

[0037] Optionally, when the gray box security testing network module adopts a cloud deployment solution, it is necessary to download a probe gray box .jar and put it into a Docker image, or use a script to put the probe into a Docker container. When the container is running, it automatically distinguishes the tested projects and automatically creates an application on the gray box page. The vulnerabilities of each project are reported and displayed independently.

[0038] Optionally, the data source of the gray box security testing function module is divided into two categories: instrumentation data source and flow data source, and the specific contents are as follows:

[0039] S1. Access portal: Users can access the system after logging in through the preset login method, which includes logging in from the IAST account, from the integrated OA system or single sign-on method. After the login is completed, the data user is imported into the IAST system;

[0040] S2. Data visualization: After accessing, users can view multiple data in the data source, including dashboard navigation data, report data, and docking data;

[0041] S3, data storage distribution: data storage distribution specifically includes MySQL relational database and MongoDB distributed file storage database;

[0042] S4. Middleware: The middleware specifically includes ActiveMQ and Haproxy. ActiveMQ is a high-performance message middleware, and Haproxy provides availability and load balancing solutions.

[0043] The beneficial effects of the present invention are:

[0044] 1. This invention has rich detection modes and diversified detection scenarios; it supports passive instrumentation, active instrumentation detection modes and traffic proxy, traffic mirroring, and traffic sniffing detection modes; it supports single-machine application detection, RPC protocol detection, and full-link tracking of various complex scenario detections of microservice applications.

[0045] 2. This invention is compatible with a variety of application environments and has more comprehensive security detection capabilities; it supports Java, Node.js, C# / .Net, PHP, Python, Go detection languages ​​and 11 mainstream Web application frameworks such as Netty, Play, and Spring Framework; it supports 13 mainstream and domestic Web containers such as Tomcat, Weblogic, ApusicVlO, TongWeb, and multiple security detection standards such as CWE and OWASP.

[0046] 3. This invention has multi-dimensional security risk management to ensure application security; it supports more than 90 vulnerability detection rules such as injection vulnerabilities, logical vulnerabilities, sensitive information, etc. and continuously updates them; it supports security detection of open source components and provides detailed vulnerability information; it supports visualization of application function test coverage; it supports multiple verification methods such as vulnerability self-verification, repair verification, and auxiliary verification; it supports enterprises to customize vulnerability rules according to their own security standards.

[0047] 4. In this invention, the deployment is simple and the probe management methods are rich; it supports cold deployment, hot deployment and script deployment, and supports pipeline integration; it supports various types of probe fuse mechanisms such as CPU and memory; it supports various probe usage application scenarios such as high concurrency and performance priority; it supports monitoring probe server health detection.

[0048] 5. In this invention, enterprise-level security products are used, which makes it safer to use; it supports encrypted storage and encrypted transmission of detected vulnerability information; it supports fine-grained user authority control; it supports leaving traces of key system operations and system watermarks.

[0049] 6. In this invention, DevSecOps solutions are integrated; support integration of project management platforms such as Jira and ZenTao to seamlessly integrate enterprise processes; provide standard API interfaces to support customized business scenario requirements; support integration with Cl / CD platforms such as Jenkins and provide Jenkins plug-ins; support docking with DevOps platforms to achieve automated testing; support single sign-on integration and LDAP integration. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0051] Figure 1 A system block diagram of the present invention;

[0052] Figure 2 is a schematic diagram of the overall gray box system of the present invention;

[0053] Figure 3 It is a schematic diagram of a gray box security test network module in the present invention;

[0054] Figure 4 It is a schematic diagram of the gray box security test function module in the present invention;

[0055] Figure 5 This is a system block diagram of the gray box security testing tool module in the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Reference Figure 1-Figure 5 , an automatic inspection platform based on gray box testing, including:

[0058] Detection console module, used to manage and control the test process;

[0059] Gray-box security testing overall module, used to run the test-generated data streams through the network;

[0060] The gray box security testing network module is used to use the backend server as a computing resource and storage resource, which is packaged into a service by a management server and provided to the outside world;

[0061] Gray box security testing function module, used to detect new vulnerabilities in the software development process in real time;

[0062] The gray box security testing tool module is used to detect security issues in software. The key technical points of the gray box security testing tool mainly include the following aspects:

[0063] S01. Instrumentation technology: Instrumentation technology is one of the core technologies of gray box security testing tools. It monitors and analyzes the runtime behavior of applications by inserting detection logic into key classes and methods of target applications. This technology allows testing tools to obtain runtime data at key locations of applications, such as function execution paths, input validation, access control, etc., to discover potential security vulnerabilities. For example, programming languages ​​such as Java, NodeJs, .Net, and PHP can all be instrumented based on their own language characteristics. Taking Java as an example, the Instrument feature can be used to transform bytecodes when classes are loaded, and combined with bytecode operation frameworks such as ASM, Javassist, Aspectj, etc., to modify classes and methods.

[0064] S02. Traffic proxy and VPN technology: Traffic proxy and VPN technology enable testers to conduct deep penetration testing on a single website without relying on the language environment of the test system. This technology can perform security testing without intervening in the test environment, which improves the flexibility and convenience of testing. It is particularly suitable for security testing of Web applications and APIs, and can discover potential security vulnerabilities by simulating the behavior of external attackers.

[0065] S03. Runtime OSS analysis: Runtime OSS analysis technology focuses on third-party components and dependencies that are dynamically loaded during the actual operation of the application system. By monitoring the behavior of these components and dependencies in real time, gray box security testing tools can detect various security vulnerabilities and open source protocol risks hidden in the components. This is especially important for modern applications, because modern applications often incorporate a large number of open source components, which may have known security vulnerabilities.

[0066] S04. Automated vulnerability detection: Automated vulnerability detection is one of the key functions of gray box security testing tools. It uses predefined security rules and machine learning algorithms to automatically identify and report potential security vulnerabilities. This technology can significantly reduce the false positive rate and improve the accuracy and efficiency of vulnerability detection. Testers can quickly locate and resolve security issues through these automated tools, thereby improving the security of the overall application.

[0067] S05. Integration with CI / CD process: Gray box security testing tools usually support integration with CI / CD process. This means that the testing tools can be embedded in the development and operation process to automatically perform security testing at key stages such as code submission, building, and deployment. This integration method can ensure that each code submission undergoes a strict security check, thereby improving the overall quality and security of the software.

[0068] S06. Multi-language and multi-framework support: In order to cope with challenges such as rich business scenarios, numerous development languages, and complex deployment environments, gray box security testing tools usually support multiple programming languages ​​and frameworks. This enables testing tools to remain efficient and accurate in different development environments and application scenarios.

[0069] As a technical optimization solution in the present invention, the specific management and control process of the test by the detection control module includes the following steps:

[0070] A1: The notification function is used. The enterprise administrator notifies the display interface of relevant messages based on the message notification content released by each group and group members. It belongs to the category of global message display in the Web interface. Generally, the enterprise administrator is responsible for publishing messages, and the recipients of the messages are group administrators and ordinary users.

[0071] A2: Collect statistics on all vulnerabilities and display the percentage of statistical information in a pie chart. This system classifies security vulnerabilities according to their severity. The classification levels include: critical, high risk, medium risk, low risk and recommended.

[0072] A3: Rank the number of application weaknesses detected, extract the five with the largest application weaknesses, and display the information percentage and ranking in the form of a bar chart;

[0073] A4: Statistics and display of the growth trend of security weaknesses of applications, statistics of detected vulnerabilities, and display in the form of an area chart; mainly highlighting the growth trend, the X-axis represents the statistical time, the minimum statistical interval is 7 days, that is, once a week; the Y-axis represents the total number of security weaknesses, all applications under the current user's jurisdiction, the security weaknesses are summarized and statistically displayed, the unit is the number.

[0074] A5: Count the usage distribution of group licenses, count the usage distribution of each group under the enterprise, and display the number of licenses of different groups in the form of a bar chart;

[0075] A6: Statistics on user growth trends, record all enterprise administrators, group administrators and common users, summarize and display them here in the form of an area chart;

[0076] A7: Counts global license usage and displays it in the form of a pie chart; used to count license usage on the system.

[0077] A8: Collect statistics on the distribution of enterprise licenses and display them in the form of a bar chart; used to count the license usage of each enterprise on the system.

[0078] A9: Confirm the database synchronization status and check whether the master-slave backup synchronization is successful. It is mainly used to confirm whether the data information is synchronized normally.

[0079] A10: JDK version statistics, statistics on the JDK distribution of all tested applications on the system, by default displayed in the form of a pie chart; users can also choose to display in table mode.

[0080] A11: Statistics on web containers: Statistics on the distribution of web containers of all tested applications on the system, and display them in the form of a pie chart. Users can also select table mode for display.

[0081] As a technical optimization solution in the present invention, the test process of the gray box security test overall module is as follows:

[0082] B1: The generated data stream runs through the network and reaches the application server;

[0083] B2: Data in the business testing process is collected at different stages. The collected content includes setting up proxy or VPN channels on the user client, traffic mirroring on the switch port, traffic sniffing on the application server port, and deploying agent probes on the application server for instrumentation. The collected content is introduced into the detection engine to complete security testing.

[0084] B3: Analyze data results and save them in database;

[0085] B4: Testers log in to the Gray Box backend management system through a browser, the Internet or a local area network, to perform security testing operations, view and verify results, and export reports.

[0086] As a technical optimization solution in the present invention, the test process of the gray box security test network module is as follows:

[0087] C1: Before the Web server cluster, set up a load balancing server as the entrance for Web server traffic; the task of the load balancing device is to serve as the entrance for Web server traffic.

[0088] C2: Select a web server that meets the preset conditions and forward the client's request to the web server for processing. This realizes transparent forwarding from the client to the real server. As a distributed architecture, the backend server is essentially used as a computing resource and storage resource, which is encapsulated into a service by a management server and provided to the outside world.

[0089] As a technical optimization solution in the present invention, when the gray box security test network module adopts a local deployment solution, the gray box operation architecture includes two major components: the server-side Server and the plug-in probe Agent.

[0090] As a technical optimization solution in the present invention, the use process of the gray box security test network module using the local deployment solution is as follows:

[0091] D1: The server is deployed and runs on a server in the local network environment of the bank. After the agent is deployed on the server, it is downloaded from the server service and configured in the web server where the detected application is located.

[0092] D2: The server and agent jointly complete the security test of the application at runtime, and the application generates data flow interaction during operation;

[0093] D3: The Agent reports the detected security risk results to the Server to complete the tool's security testing of the application.

[0094] As a technical optimization solution in the present invention, when the gray box security test network module adopts the cloud deployment solution, it is necessary to download a probe gray box .jar and put it into the Docker image, or use a script to put the probe into the Docker container. When the container is running, it automatically distinguishes the tested projects, and automatically creates applications on the gray box page. The vulnerabilities of each project are reported and displayed independently. Currently, common cloud environments mainly include virtual clouds and container clouds, which are supported by gray boxes. Gray boxes are also adapted for the newer trusted cloud environments. The gray box is perfectly adapted to the container cloud, and its probe can be directly inserted into the container template, making the probe insertion process transparent to testers, greatly reducing the cost of conducting detection work.

[0095] As a technical optimization solution in the present invention, the data source of the gray box security test function module is divided into two categories: the source of instrumentation data and the source of flow data. The specific contents are as follows:

[0096] S1. Access portal: Users can access the system after logging in through the preset login method, which includes logging in from an IAST account, from an integrated OA system, or through a single sign-on method. After logging in, the data user is imported into the IAST system; the single sign-on method can be LDAP.

[0097] S2. Data visualization: After access, users can view multiple data in the data source, including dashboard navigation data, report data and docking data; report data includes application list, server, vulnerability, component analysis, rule setting, permission role and other data; docking data includes relevant data of problem management platform and email notification system, and the docking of the above data is bidirectionally synchronized.

[0098] S3. Data storage distribution: Data storage distribution specifically includes MySQL relational database and MongoDB distributed file storage database; MySQL is used for business data storage, query, update and other management, and establishes master-slave distribution and mutual backup; MongoDB can provide scalable high-performance data storage solutions for WEB applications.

[0099] S4. Middleware: The middleware specifically includes ActiveMQ and Haproxy. ActiveMQ is a high-performance message middleware, and Haproxy provides availability and load balancing solutions.

[0100] The gray box security testing function module can detect new vulnerabilities generated during the software development process in real time, and has a good detection capability for a large number of sensitive information leakage issues discovered during the investigation, and can quickly mitigate the risk of sensitive information leakage.

[0101] Moreover, in the above-mentioned gray box security testing function module, firstly, there is no need to change the test process: using the plug-in and traffic pattern detection modes, there is no need to change the existing test process; secondly, the test efficiency can be greatly improved: it supports the detection of third-party software vulnerabilities in runtime applications, and the test is more comprehensive. At the same time, it supports multiple verification methods such as self-verification and repair verification, which greatly reduces the false alarm rate; it has strong de-specialization capabilities, allowing developers and testers to complete security testing while performing functional testing, greatly improving test efficiency; finally, it can continuously improve the level of code writing: it can provide comprehensive vulnerability information and repair solutions such as code location, request information, data flow information, and output professional application security reports to help developers continuously optimize code quality, develop the habit of standardized coding, and continuously improve code writing skills.

[0102] The present invention provides an automatic inspection platform based on gray box testing. By using plug-in technology and traffic proxy, real-time vulnerability detection is performed on runtime applications and APIs during the R&D and testing phase. It supports full life cycle management of detected vulnerabilities in application systems and multi-dimensional application security control. It has the advantages of high coverage, low false alarms, and real-time detection, and can be seamlessly integrated with the DevSecOps process.

[0103] The present invention meets the requirements for the capability assessment of the trusted cloud interactive application security testing tool in terms of supported programming languages, supported middleware, library and development framework types, supported detection methods, supported security risk vulnerability types, detection and analysis type requirements, detection and analysis configuration capability requirements, usage mode, fast defect location, multi-dimensional display of defect data, result comparison and analysis, defect repair guidance, report requirements, analysis platform integration, secondary development, self-security, access control, deployment mode, false positive rate, false positive rate, etc. The detection principle is to obtain various context information when the application is running by dynamically inserting a detection "probe" in the bytecode of the application. When the application is running, the security weaknesses of the program are analyzed in real time. Compared with products based on SAST and DAST technologies, the biggest difference of the present invention is that it obtains more accurate runtime information by inserting bytecode into the application. At the same time, it integrates the advantages of SAST and DAST technologies, does not require source code, supports bytecode detection, and greatly improves the efficiency and accuracy of security testing. It is very suitable for agile development and DevOps, and can seamlessly integrate the existing development process during the software development and testing phases, allowing developers and testers to complete security testing without perception while performing functional testing, solving the challenges faced by existing application security testing technologies.

[0104] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. The automatic inspection platform based on gray box testing is characterized by: include: Detection console module, used to manage and control the test process; Gray-box security testing overall module, used to run the test-generated data streams through the network; The gray box security testing network module is used to use the backend server as a computing resource and storage resource, which is packaged into a service by a management server and provided to the outside world; Gray box security testing function module, used to detect new vulnerabilities in the software development process in real time; Gray box security testing tool module, used to detect security issues in software.

2. The automatic inspection platform based on gray box testing according to claim 1 is characterized in that: The specific management and control process of the test by the detection control module includes the following steps: A1: Adopt the notification function, and the enterprise administrator will notify the display interface of the relevant messages based on the message notification content released by each group and group members; A2: Collect statistics on all vulnerabilities and display the percentage of statistical information in a pie chart. This system classifies security vulnerabilities according to their severity. The classification levels include: critical, high risk, medium risk, low risk and recommended. A3: Rank the number of application weaknesses detected, extract the five with the largest application weaknesses, and display the information percentage and ranking in the form of a bar chart; A4: Statistics and display of the growth trend of application security vulnerabilities, summary statistics of detected vulnerabilities, and display in the form of an area chart; A5: Count the usage distribution of group licenses, count the usage distribution of each group under the enterprise, and display the number of licenses of different groups in the form of a bar chart; A6: Statistics on user growth trends, record all enterprise administrators, group administrators and common users, summarize and display them here in the form of an area chart; A7: Count the global license usage and display it in the form of a pie chart; A8: Collect statistics on the distribution of enterprise licenses and display them in the form of a bar chart; A9: Confirm the database synchronization status and check whether the master-slave backup synchronization is successful. A10: JDK version statistics, statistics on the JDK distribution of all tested applications on the system, by default displayed in the form of a pie chart; A11: Statistics on web containers. Statistics on the distribution of web containers of all tested applications on the system are displayed in the form of a pie chart.

3. The automatic inspection platform based on gray box testing according to claim 1 is characterized in that: The testing process of the gray box security testing overall module is as follows: B1: The generated data stream runs through the network and reaches the application server; B2: Data in the business testing process is collected at different stages. The collected content includes setting up proxy or VPN channels on the user client, traffic mirroring on the switch port, traffic sniffing on the application server port, and deploying agent probes on the application server for instrumentation. The collected content is introduced into the detection engine to complete security testing. B3: Analyze data results and save them in database; B4: Testers log in to the Gray Box backend management system through a browser, the Internet or a local area network, to perform security testing operations, view and verify results, and export reports.

4. The automatic inspection platform based on gray box testing according to claim 1 is characterized in that: The test process of the gray box security test network module is as follows: C1: Set up a load balancing server in front of the Web server cluster as the entrance for Web server traffic; C2: Select a Web server that meets the preset conditions and forward the client's request to the Web server for processing.

5. The automatic inspection platform based on gray box testing according to claim 4 is characterized in that: When the gray box security test network module adopts a local deployment solution, the gray box operation architecture includes two major components: the server and the plug-in probe Agent.

6. The automatic inspection platform based on gray box testing according to claim 5 is characterized in that: The gray box security test network module adopts the local deployment solution using the following process: D1: The server is deployed and runs on a server in the local network environment of the bank. After the agent is deployed on the server, it is downloaded from the server service and configured in the web server where the detected application is located. D2: The server and agent jointly complete the security test of the application at runtime, and the application generates data flow interaction during operation; D3: The Agent reports the detected security risk results to the Server to complete the tool's security testing of the application.

7. The automatic inspection platform based on gray box testing according to claim 5 is characterized in that: When the gray box security test network module adopts the cloud deployment solution, it is necessary to download a probe gray box .jar and put it into the Docker image, or use a script to put the probe into the Docker container. When the container is running, it automatically distinguishes the tested projects and automatically creates an application on the gray box page. The vulnerabilities of each project are reported and displayed independently.

8. The automatic inspection platform based on gray box testing according to claim 1 is characterized in that: The data sources of the gray box security testing function module are divided into two categories: instrumentation data source and flow data source. The specific contents are as follows: S1. Access portal: Users can access the system after logging in through the preset login method, which includes logging in from the IAST account, from the integrated OA system or single sign-on method. After the login is completed, the data user is imported into the IAST system; S2. Data visualization: After accessing, users can view multiple data in the data source, including dashboard navigation data, report data, and docking data; S3, data storage distribution: data storage distribution specifically includes MySQL relational database and MongoDB distributed file storage database; S4. Middleware: The middleware specifically includes ActiveMQ and Haproxy. ActiveMQ is a high-performance message middleware, and Haproxy provides availability and load balancing solutions.

Images