Method and system for automatically detecting network application vulnerabilities based on large language model

Abstract

The invention discloses a network application vulnerability automatic detection method and system based on a large language model, and solves the problems of low vulnerability detection efficiency and low accuracy in the prior art. The method comprises the following steps of: S1, searching a path of an application programming interface (API) (Application Program Interface); s2, a big language model vulnerability analysis step; s3, a step of generating a script of a vulnerability PoC (Proof Of Concept: Conceptual Verification); s4, an IDOR (Insecure Direct Object Reference) vulnerability crawler identification step is carried out, and the step S4 is carried out according to the vulnerability crawler identification step and the step S4, the step S4 is carried out according to the vulnerability crawler identification step, and the step S4 is carried out according to the vulnerability crawler identification step. S5, a vulnerability verification step; and S6, a report generation step. According to the method and the system, the whole process from path searching to vulnerability hypothesis generation to automatic vulnerability verification is realized through driving the synergistic effect of multiple modules, the targets of zero false alarm and near-zero manual confirmation are achieved, the efficiency and the accuracy of network application security testing are greatly improved, and powerful support is provided for network security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network security, in particular to a network application vulnerability automatic detection method and system based on a large language model. BACKGROUND

[0002] With the widespread deployment of network applications in various industries, their security vulnerabilities have become increasingly prominent and have become an important issue that needs to be addressed. Currently, the main network application vulnerability detection methods are divided into static analysis and dynamic testing. Static analysis tools generally have a high false positive problem, and a large number of false alarms not only consume a lot of manpower and resources for verification, but also may cover up real high-risk vulnerabilities. Dynamic testing can reduce the false positive rate, but has problems such as high cost, low coverage, and the need for a large amount of manual confirmation.

[0003] A large language model is an artificial intelligence model based on deep learning technology, which has strong natural language understanding and generation capabilities through the training of massive text data. The large language model uses the Transformer architecture and processes input information through the self-attention mechanism, which can understand the context semantics and perform logical reasoning. In the security field, the large language model can understand code semantics, analyze vulnerability features, and reason attack paths, providing a new technical means for automated security detection. However, directly using a general large language model for security detection has problems such as lack of professionalism and high false positive rate, which needs to be optimized and improved.

[0004] Therefore, there is an urgent need for an automated vulnerability detection method that combines a large language model and professional security testing technology, which can achieve full-process automation, significantly reduce the false positive rate and eliminate the need for manual confirmation, and improve the efficiency and accuracy of network application security testing. SUMMARY

[0005] The present application addresses the pain points in the current network application security vulnerability detection field, and innovatively combines a large language model and automated verification technology to solve the high false positive rate and efficiency bottleneck of manual confirmation of traditional methods. The method builds a complete intelligent detection framework, accurately locates the API path, analyzes vulnerabilities based on a large language model, and automatically verifies the concept, achieving an automated process from vulnerability discovery to verification, and achieving zero false positives and near-zero manual confirmation.

[0006] To achieve the above purpose, the technical solutions provided by the present application are as follows.

[0007] On the one hand, a network application vulnerability automatic detection method based on a large language model includes:

[0008] S1, API path lookup step: using an API path lookup module to perform HTTP API path lookup on the web application to be detected, finding all API paths in the web service to be detected, and being able to find the API paths that can reach the given web application source code location according to the given web application source code location;

[0009] S2, large language model vulnerability analysis step: using a large language model trained with network security field knowledge, analyzing the API paths and context information of the web application to be detected, and generating candidate vulnerability information containing vulnerability types, impact ranges and verification directions;

[0010] S3, PoC script generation step: through the PoC script generation module integrated with the security test knowledge base, analyzing the candidate vulnerability information generated by the large language model, automatically completing the vulnerability exploitation context including parameters, injection points and attack payloads, performing feasibility analysis, and generating PoC scripts for vulnerability verification;

[0011] S4, IDOR vulnerability crawler identification step: running a crawler module based on headless browser technology, simulating user login and operation behavior, automatically exploring and parameter analyzing the web application to be detected, and identifying unsafe direct object reference vulnerabilities through request response similarity comparison and other methods;

[0012] S5, vulnerability verification step: using a vulnerability verification module with isolated environment, integrating professional vulnerability scanning, penetration testing tools and security vulnerability feature library, according to the candidate vulnerability information and proof of concept scripts generated in the previous steps, performing automatic security testing in a controlled environment, and confirming the existence and exploitation conditions of the vulnerability through dynamic monitoring and multi-dimensional feature analysis;

[0013] S6, report generation step: using a report generation module, performing security impact analysis and risk level assessment on the verified vulnerability information, integrating to generate multi-level reports containing vulnerability description, technical details, and reproduction steps, and outputting three formats according to different use scenarios: HTML security report for online viewing and interaction, PDF format document for formal archiving and distribution, and Web page format supporting real-time updating and team collaboration.

[0014] Further, the API path lookup step specifically includes:

[0015] S11, by using static code analysis technology, analyzing the source code of the web application, extracting the defined API paths and route configurations, and in the source code, there is usually a special route configuration part that specifies which API path is handled by which code, providing basic data for building a complete API path set;

[0016] S12, combined with dynamic request analysis and historical traffic log mining, monitors the actual requests and responses of network application runtime, captures comprehensive API path information including low frequency and seasonality, and supplements the paths that static analysis may miss;

[0017] S13, integrate static and dynamic analysis results, build API path association graph according to the call relationship in source code, realize the bidirectional mapping and reverse lookup ability of API path and source code location, and provide accurate context for vulnerability analysis.

[0018] Further, the vulnerability analysis step specifically includes:

[0019] S21, professional processing of large language model for network space security field, including field knowledge fine-tuning training and introduction of low-rank adaptation technology for parameter optimization, while retaining the general ability of the model, significantly improving its professional analysis ability in the security field;

[0020] S22, apply specially designed prompting engineering technology to guide the large language model to conduct in-depth analysis based on API path information, and combine context information to infer possible vulnerability types and exploitation conditions;

[0021] S23, generate structured candidate vulnerability information, including vulnerability type, impact range and preliminary verification direction, to provide comprehensive and accurate input for subsequent vulnerability verification.

[0022] Further, the PoC script generation step specifically includes:

[0023] S31, automatically complete the complete context information required for vulnerability exploitation, analyze the required parameters, injection points and construction methods of malicious payloads (Payload) and environmental prerequisites;

[0024] S32, generate PoC script according to vulnerability type and context information, and perform syntax checking and security audit on the script to ensure its effectiveness and security;

[0025] S33, execute the generated PoC script in an isolated environment to realize the automatic execution process of vulnerability proof of concept.

[0026] Further, the IDOR vulnerability identification step specifically includes:

[0027] S41, use headless browser technology to simulate user behavior, automatically explore website functions and page interactions, and capture object reference patterns and parameters in website requests;

[0028] S42, try to access unauthorized resources by parameter tampering technology, automatically generate ID (Identifier: identifier) increment / decrement, GUID (Globally Unique Identifier: globally unique identifier) replacement and other tampering strategies, and send modified requests to simulate unauthorized attempts;

[0029] S43, calculate the similarity of the original response and the attacker's response, and the similarity of the original response and the unauthorized user's response. When the similarity of the original response and the attacker's response is higher than the preset threshold (such as 90%) and the similarity of the original response and the unauthorized user's response is significantly lower than the threshold, it is confirmed that there is an IDOR vulnerability.

[0030] Further, the vulnerability verification step specifically includes:

[0031] S51, collect and integrate the verification results generated by the PoC script generation step and the IDOR vulnerability identification step, and use dynamic monitoring technology to record the system state changes and network interaction during all execution processes;

[0032] S52, according to the preset multi-dimensional vulnerability confirmation standard (including vulnerability response characteristics, system state changes, security impact degree, utilization feasibility and vulnerability persistence, etc.), the integrated verification results are analyzed and preliminarily confirmed for technical feasibility, and the key state changes and system responses during the verification process are recorded, and the verification execution result set is constructed, which provides technical basis for subsequent classification evaluation and report generation.

[0033] Further, the report generation step specifically includes:

[0034] S61, analyze the security impact of the verified vulnerability, classify and risk level evaluation from the dimensions of vulnerability harm degree, influence range and utilization difficulty, and build a vulnerability knowledge base containing complete utilization chain and repair priority;

[0035] S62, generate a multi-level vulnerability report based on the severity and impact of the vulnerability, including vulnerability overview, technical details and reproduction steps, and output three formats according to different use scenarios: HTML security report for online viewing and interaction, PDF format document for formal archiving and distribution, and Web page format supporting real-time update and team collaboration.

[0036] On the other hand, a network application vulnerability automatic detection system based on a large language model includes:

[0037] API path lookup module: used for finding the HTTP API path of the web application to be detected, constructing an API path association graph through static code analysis, dynamic request analysis and historical traffic log mining, realizing the bidirectional mapping of API path and source code location and the reverse lookup capability;

[0038] Large language model vulnerability analysis module: used for receiving API path information provided by the API path lookup module, analyzing and generating candidate vulnerability information; the vulnerability detection large language model module is fine-tuned and trained in the field of network space security, adopts low-rank adaptation technology for parameter optimization, guides the model to perform deep analysis through a special prompt engineering, reasons the vulnerability type and exploitation condition in combination with context information, and generates structured candidate vulnerability information;

[0039] PoC script generation module: used for analyzing candidate vulnerability information, automatically completing the complete context required for vulnerability exploitation, performing vulnerability hypothesis analysis, generating a PoC script for the candidate vulnerability, and performing syntax checking and security auditing on the script to ensure the effectiveness and security of the script;

[0040] Crawler module: based on headless browser technology, simulates user operations, automatically explores and parameter analyzes the web application to be detected, identifies IDOR vulnerabilities through parameter tampering and request response similarity comparison.

[0041] Vulnerability verification module: used for executing verification scripts in an isolated environment, integrating professional security testing tools and multi-element knowledge bases, confirming the existence, exploitation condition and authenticity of the vulnerability through dynamic monitoring, multi-dimensional feature analysis and automated security testing.

[0042] Report generation module: used for performing security impact analysis and risk level assessment on the confirmed vulnerability, generating a multi-level report containing vulnerability description, technical details and reproduction steps, and outputting an HTML security report for online viewing and interaction, a PDF format document for formal archiving and distribution, and a Web page format supporting real-time updating and team collaboration according to different use scenarios.

[0043] Compared with the prior art, the present application has the following beneficial effects:

[0044] The application realizes the goal of "zero false positives" by combining the semantic understanding ability of a large language model with a multi-level automatic verification mechanism. The method first uses the contextual understanding ability of a large language model to perform in-depth analysis on API paths, accurately identifying potential vulnerability points. Then, through the use of automatically generated precise PoC scripts in an isolated environment, the method performs actual verification and combines multi-dimensional feature analysis to strictly evaluate the verification results, ensuring that each reported vulnerability is stable and reproducible. This dual verification mechanism significantly reduces the high false positive problem commonly found in traditional tools, fundamentally solving the reliability problem in vulnerability detection.

[0045] The application realizes the goal of "near-zero manual confirmation" by building a complete automated detection loop, eliminating the need for high levels of human intervention. The system automatically discovers API paths, intelligently analyzes vulnerabilities, automatically generates PoC scripts, verifies in an isolated environment, and automatically evaluates and generates reports, forming an integrated fully automated workflow. This significantly reduces the time investment of the security team in the manual confirmation process, making the vulnerability detection process fully automated and significantly improving the efficiency and accuracy of security detection. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 A flowchart of the large language model-based network application security vulnerability automated detection method provided by the embodiment of the application is shown.

[0047] Figure 2 A flowchart of the API path search and large language model vulnerability analysis steps provided by the embodiment of the application is shown.

[0048] Figure 3 A flowchart of the vulnerability verification and confirmation process, i.e., PoC script generation, IDOR vulnerability identification, and vulnerability verification steps, provided by the embodiment of the application is shown.

[0049] Figure 4 A flowchart of the report generation step provided by the embodiment of the application is shown.

[0050] Figure 5 A structural block diagram of the large language model-based network application security vulnerability automated detection system provided by the embodiment of the application is shown. DETAILED DESCRIPTION

[0051] To make the objectives, technical solutions, and advantages of the application clearer, the large language model-based network application security vulnerability automated detection method and system will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the application, not all embodiments. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the application.

[0052] The automated detection method for network application security vulnerabilities based on a large language model provided in this application embodiment, such as Figure 1 As shown, the steps include the following.

[0053] S1, API Path Lookup Step: The API path lookup module is used to analyze the HTTP API paths of the web application under test, identifying all API paths within the web service being tested. It can also find API paths that reach a given location in the web application's source code. This step utilizes various methods, including static code analysis, dynamic request analysis, and historical traffic log analysis, to comprehensively construct an API path relationship graph, providing foundational data for subsequent analysis.

[0054] S2, Large Language Model Vulnerability Analysis Steps: Utilizing a large language model trained with cybersecurity knowledge, the API paths and contextual information of the web application under test are analyzed to generate candidate vulnerability information containing vulnerability type, scope of impact, and verification direction. This step fine-tunes and optimizes the parameters of the large language model in the cybersecurity domain, enabling it to infer possible vulnerability types and exploitation conditions based on contextual information, and output targeted candidate vulnerability information.

[0055] S3, PoC Script Generation Steps: The PoC script generation module, integrated with a security testing knowledge base, analyzes candidate vulnerability information generated by a large language model, automatically completes the vulnerability exploitation context including parameters, injection points, and attack payloads, performs feasibility analysis, and generates a PoC script for vulnerability verification. This step can automatically generate an executable verification script based on the vulnerability type, requiring no manual intervention.

[0056] S4, IDOR Vulnerability Crawler Identification Steps: Run a crawler module based on headless browser technology to simulate user login and operation behaviors. Automatedly explore and analyze parameters of the web application to be detected, identifying IDOR vulnerabilities through methods such as request-response similarity comparison. This step employs automated crawler technology, combined with parameter tampering testing and response analysis, specifically targeting IDOR-type vulnerabilities.

[0057] S5, Vulnerability Verification Step: Utilizing a vulnerability verification module with an isolated environment, integrating professional vulnerability scanning, penetration testing tools, and a security vulnerability signature library, automated security testing is performed in a controlled environment based on candidate vulnerability information and proof-of-concept scripts generated in the previous steps. The existence and exploitation conditions of the vulnerability are confirmed through dynamic monitoring and multi-dimensional feature analysis. This step executes verification operations in an isolated environment, determining the existence of the vulnerability through dynamic monitoring and result evaluation.

[0058] S6, report generation step: using the report generation module, the verified vulnerability information is analyzed for security impact and risk level assessment, and a multi-level report containing vulnerability description, technical details, and reproduction steps is generated, and three formats are output according to different use scenarios: HTML security report for online viewing and interaction, PDF format document for formal archiving and distribution, and Web page format supporting real-time updating and team collaboration. This step can automatically generate a structured security report according to the verification results, providing vulnerability description, risk level, and reproduction steps.

[0059] Referring to Figure 2 As shown in the API path lookup and large language model vulnerability analysis step, the specific implementation is as follows.

[0060] S11, using static code analysis technology, analyze the source code of network application, extract the API path and route configuration defined therein; for example, through static code scanning to obtain the source code of web application, identify the route configuration (such as Spring's @RequestMapping annotation, Express's app.get() function and Django's urls.py) for different frameworks. Then use AST (Abstract Syntax Tree) parsing technology (such as JavaParser, Babel) to convert the source code into an abstract syntax tree. During this process, the system first reads the timestamp information of the source file to ensure that the latest version of the source code is processed, and parses the source code into a tree structure with node time information, supporting incremental analysis and code change recognition, so as to accurately extract path templates, HTTP methods and parameter definitions, and understand complex routing structures. Finally, generate source code path mapping, establish the association between API path and source code location, record path, method, controller and source file location, etc. information, lay the foundation for building a complete association graph.

[0061] S12, combined with dynamic request analysis and historical traffic log mining, monitor the actual request and response of network application runtime, capture comprehensive API path information including low frequency and seasonality, supplement the paths that may be missed by static analysis; for example, the system uses tcpdump, Wireshark and other tools through dynamic traffic mirroring to deploy on server or gateway layer, non-intrusively replicates HTTP / HTTPS traffic to analysis environment. Then use HTTP proxy server (such as mitmproxy, Charles) to parse data packets, extract URL, method and parameter information, and parse HTTPS traffic through TLS (Transport Layer Security) certificate or log collection. Finally, build traffic path set, perform deduplication and structured processing, and form actual API path data.

[0062] S13, integrate static and dynamic analysis results, construct API path association graph according to call relationship in source code, realize bidirectional mapping of API path and source code location and reverse lookup capability, and provide accurate context for vulnerability analysis.

[0063] S21, professional processing of large language models for network space security field, including field knowledge fine-tuning training and introduction of low-rank adaptation technology for parameter optimization, significantly improving the professional analysis capability of the model in the security field while retaining the general capability of the model; for example, the system collects network security professional literature, vulnerability library (such as CVE (Common Vulnerabilities and Exposures: Common Vulnerabilities and Exposures), CWE (Common Weakness Enumeration: Common Weakness Enumeration)) and security research reports, etc. High-quality data to build a security field-specific dataset. Use LoRA (Low-Rank Adaptation) technology to effectively fine-tune the parameters of the pre-trained large language model, only optimize the key layer parameter matrix, while retaining the general capability of the model, significantly improving the security analysis capability, while reducing the demand for computing resources.

[0064] S22, apply specially designed prompting engineering technology, guide the large language model to conduct in-depth analysis based on API path information, combine context information to reason possible vulnerability types and exploitation conditions; for example, the system designs multi-level prompting templates, including API path information, parameter types, authorization mechanisms and business logic elements, and demonstrates high-quality vulnerability analysis cases through few-shot learning. Use chain-of-thought (Chain-of-Thought) and self-reflection (Self-reflection) technology to guide the model to analyze potential vulnerabilities step by step, evaluate the reliability of each step of reasoning, and simulate the thinking process of security experts.

[0065] S23, generate structured candidate vulnerability information, including vulnerability type, impact range and preliminary verification direction, to provide comprehensive and accurate input for subsequent vulnerability verification; for example, the system outputs structured vulnerability information conforming to the CVSS (Common Vulnerability Scoring System) standard, including vulnerability type classification, attack vector, impact range, technical details and verification direction. Assign a unique identifier to each candidate vulnerability, establish an association with the source API path, and ensure traceability. The generated candidate vulnerability information serves as input for subsequent PoC script generation and vulnerability verification phase, providing complete vulnerability context.

[0066] Referring to Figure 3 As shown in the figure, the specific implementation of the vulnerability verification and confirmation process is as follows.

[0067] S31, automatically complete the complete context information required for exploit, analyze the required parameters, injection points, and construction methods and environmental prerequisites of malicious payloads (Payloads); for example, according to different vulnerability types such as SQL injection, XSS, etc., the system can automatically identify injection points and generate targeted attack payloads.

[0068] S32, generate PoC scripts according to the vulnerability type and context information, and perform syntax checking and security auditing on the scripts to ensure their effectiveness and security.

[0069] S33, execute the generated PoC scripts in an isolated environment to realize the automated execution process of vulnerability proof of concept; for example, the system runs the verification scripts in a sandbox environment to prevent malicious code that may exist from affecting the production system, while using dynamic monitoring technology to record the system state changes and network interactions during script execution, providing data support for subsequent verification.

[0070] S41, for IDOR type vulnerabilities, use headless browser technology to simulate user behavior, automatically explore website functions and page interactions, and capture object reference patterns and parameters in website requests; for example, the system deploys technologies such as Puppeteer or Selenium to automatically complete the authentication process to obtain session credentials, intelligently identify website navigation structures and interactive elements, and combine depth-first and breadth-first strategies to comprehensively cover website accessible paths.

[0071] S42, try to access unauthorized resources through parameter tampering technology, automatically generate tampering strategies such as ID increment / decrement, GUID replacement, etc., and send modified requests to simulate unauthorized attempts; for example, the system captures object reference patterns and parameters in website requests, focuses on identifying URL parameters, request body identifiers, and sensitive data identifiers, and builds an object reference pattern library. Based on these patterns, try to access unauthorized resources through parameter tampering technology, automatically generate tampering strategies such as ID increment / decrement, GUID replacement, etc., and send modified requests to simulate unauthorized attempts.

[0072] S43, calculate the similarity between the original response and the attacker's response, and the similarity between the original response and the unauthorized user's response, when the similarity between the original response and the attacker's response is 90% or more and the similarity between the original response and the unauthorized user's response is significantly lower than 90%, confirm the existence of IDOR vulnerabilities.

[0073] The verification results of the two paths are summarized in the multi-dimensional standard analysis evaluation link.

[0074] S51, collect and integrate verification results; the system collects and integrates the verification results generated in S33 and S43 in a unified manner, and uses dynamic monitoring technology to record all system state changes and network interactions during the execution process.

[0075] S52 performs technical feasibility analysis and preliminary confirmation on the integrated verification results based on the preset multi-dimensional vulnerability confirmation criteria, records key state changes and system responses during the verification process, and constructs a verification execution result set to provide technical basis for subsequent classification assessment and report generation.

[0076] See Figure 4 As shown, the specific implementation of the report generation step is as follows.

[0077] S61 performs security impact analysis and classification on verified vulnerabilities. For example, the system first organizes and summarizes the verification results, then analyzes them from multiple dimensions such as vulnerability severity, scope of impact, and exploitation difficulty, establishing classification standards and a risk level assessment system. Finally, it constructs a vulnerability knowledge base containing complete exploitation chains and remediation priorities, providing a data foundation for subsequent report generation.

[0078] S62 generates multi-level vulnerability reports based on vulnerability severity and impact. For example, the system automatically generates a structured report containing a vulnerability overview, technical details, and reproduction steps based on classification and rating information in the vulnerability knowledge base. Depending on the usage scenario, the system provides three output formats: an HTML security report for online viewing and interaction, a PDF document for formal archiving and distribution, and a web page format that supports real-time updates and team collaboration, meeting the security reporting needs of different users.

[0079] See Figure 5 As shown, this invention also discloses an automatic network application vulnerability detection system based on a large language model, comprising:

[0080] This invention is divided into three stages: the retrieval and analysis stage, the verification and confirmation stage, and the result output stage. The retrieval and analysis stage includes the following modules:

[0081] API Path Lookup Module 701: Uses static code analysis technology to analyze the source code of network applications, extract the defined API paths and routing configurations; monitors the requests and responses of network applications during runtime through dynamic request analysis, and captures the actual API paths called; combines historical traffic log analysis to mine potential API path information; and constructs a relationship graph between API paths based on the call relationships in the source code, enabling reverse lookup capabilities for a given source code location.

[0082] The large language model vulnerability analysis module 702 is used for fine-tuning training of the large language model using network space security field knowledge; low-rank adaptation technology is introduced for parameter optimization, general ability is retained while professional ability in the security field is improved; a special prompt engineering is designed to guide the large language model to perform deep analysis based on API path information; in combination with context information, a possible vulnerability type and exploitation condition are reasoned; structured candidate vulnerability information is generated, including a vulnerability type, an influence range and a preliminary verification direction.

[0083] The verification confirmation stage includes the following modules:

[0084] The PoC script generation module 703 is used for automatically completing complete context information required for vulnerability exploitation; analyzing parameters, injection points and construction methods, environments and preconditions of malicious payloads required for vulnerability exploitation; generating a PoC script according to a vulnerability type and context information thereof; and performing syntax checking and security auditing on the generated script to ensure validity and security of the script.

[0085] The crawler module 704 is used for simulating user login and operation behavior by using a headless browser technology; automatically exploring website functions and page interaction; capturing object reference patterns and parameters in website requests; attempting to access unauthorized resources by parameter tampering technology; and calculating a request response similarity ratio and determining IDOR vulnerability existence.

[0086] The vulnerability verification module 705 is used for executing a proof of concept script in an isolated environment to prevent the script code generated by the large model from affecting the system; adopting dynamic monitoring technology to record system state changes and network interaction in a script execution process; evaluating a verification result according to a preset vulnerability confirmation standard and multi-dimensional feature analysis; and completely recording the verification process and result to support subsequent analysis and reproduction.

[0087] The result output stage includes the following modules:

[0088] The report generation module 706 is used for summarizing and arranging vulnerability verification result information; generating a multi-level vulnerability report according to a risk level; and generating an HTML security report, a PDF format document and a Web page format report containing vulnerability details and reproduction steps to meet security report requirements in different scenarios.

[0089] The specific implementation of the large language model-based network application security vulnerability automatic detection method and system is the same as that of the large language model-based network application security vulnerability automatic detection method, and the embodiment will not be described again.

[0090] To sum up, the application can automatically detect security vulnerabilities existing in network applications, significantly reduce false positive rate, eliminate the need for manual confirmation, and improve the coverage and efficiency of vulnerability detection. At the same time, through the combination of large language model and automatic verification technology, the whole process automation from API path discovery to vulnerability report generation is realized, and the industry problems of relying on manual confirmation and high false positive rate of traditional security detection tools are completely solved.

[0091] The above merely describes preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can make equivalent replacements or changes within the technical range disclosed by the present application according to the technical solutions and inventive concepts of the present application, which should be covered within the protection scope of the present application.

Claims

1. A large language model-based network application vulnerability automatic detection method, characterized in that, Comprise: S1, API path lookup step: using API path lookup module to detect web (World Wide Web: World Wide Web) application HTTP (Hypertext Transfer Protocol: Hypertext Transfer Protocol) API path lookup, find out all API paths in the web service to be detected, and can find out the API path that can reach the given web application source code position; S2, Large language model (Large Language Model, LLM for short) vulnerability analysis step: using large language model trained by network security field knowledge, analyze API path and context information of the web application to be detected, generate candidate vulnerability information including vulnerability type, impact range and verification direction; S3, PoC script generation step: through the PoC script generation module integrated with security test knowledge base, analyze the candidate vulnerability information generated by the large language model, automatically complete the vulnerability exploitation context including parameters, injection points and attack payloads, perform feasibility analysis, and generate PoC script for vulnerability verification; S4, IDOR vulnerability crawler identification step: running the crawler module based on headless browser technology, simulating user login and operation behavior, automatically exploring and parameter analyzing the web application to be detected, identifying IDOR vulnerability through request response similarity comparison and other methods; S5, vulnerability verification step: using the vulnerability verification module with isolated environment, integrating professional vulnerability scanning, penetration testing tools and security vulnerability feature library, according to the candidate vulnerability information and proof of concept script generated in the previous steps, performing automatic security testing in the controlled environment, confirming the existence and exploitation conditions of the vulnerability through dynamic monitoring and multi-dimensional feature analysis; S6, report generation step: using the report generation module, performing security impact analysis and risk level assessment on the verified vulnerability information, integrating to generate multi-level report including vulnerability description, technical details and reproduction steps, and outputting three formats according to different use scenarios: HTML (Hypertext Markup Language: Hypertext Markup Language) security report for online viewing and interaction, PDF (Portable Document Format: Portable Document Format) format document for formal archiving and distribution, and Web page format supporting real-time updating and team collaboration.

2. The method for automatic detection of network application security vulnerabilities based on large language models according to claim 1, characterized in that, The API path lookup step specifically comprises: S11, by static code analysis technology, analyzing the source code of network application, extracting the defined API path and route configuration, in the source code, there is usually a special route configuration part, which specifies which API path is processed by which code, providing basic data for building complete API path set; S12, combined with dynamic request analysis and historical traffic log mining, monitoring the actual request and response of network application runtime, capturing comprehensive API path information including low frequency and seasonality, supplementing the paths missed by static analysis; S13, integrate static and dynamic analysis results, construct API path association graph according to call relationship in source code, realize bidirectional mapping of API path and source code location and reverse lookup capability, and provide accurate context for vulnerability analysis.

3. The method of claim 1, wherein the method further comprises: The vulnerability analysis step specifically includes: S21, professional processing of large language models for network space security field, including field knowledge fine-tuning training and introduction of low-rank adaptation technology for parameter optimization, while retaining the general ability of the model, significantly improving its professional analysis capability in the security field; S22, applying a specially designed prompting engineering technology, guiding the large language model to conduct in-depth analysis based on API path information, and reasoning possible vulnerability types and exploitation conditions combined with context information; S23, generating structured candidate vulnerability information, including vulnerability type, impact range and preliminary verification direction, providing comprehensive and accurate input for subsequent vulnerability verification.

4. The method for automatic detection of network application security vulnerabilities based on large language models according to claim 1, characterized in that, The PoC script generation step specifically includes: S31, automatically complete the complete context information required for vulnerability exploitation, analyze the required parameters, injection points and construction methods and environmental prerequisites of malicious payloads (Payloads); S32, generating PoC scripts according to vulnerability types and context information, and performing syntax checking and security auditing on the scripts to ensure their effectiveness and security; S33, executing the generated PoC scripts in an isolated environment to realize the automated execution process of vulnerability proof of concept.

5. The method of claim 1, wherein the method further comprises: The IDOR vulnerability identification step specifically includes: S41, using headless browser technology to simulate user behavior, automatically exploring website functions and page interactions, while capturing object reference patterns and parameters in website requests; S42, attempting to access unauthorized resources through parameter tampering techniques, automatically generating tampering strategies such as ID (Identifier) increment / decrement, GUID (Globally Unique Identifier) replacement, and sending modified requests to simulate unauthorized attempts; S43, calculating the similarity between the original response and the attacker's response, and the similarity between the original response and the unauthorized user's response. When the similarity between the original response and the attacker's response is higher than the preset threshold (such as 90%) and the similarity between the original response and the unauthorized user's response is significantly lower than the threshold, it is confirmed that there is an IDOR vulnerability.

6. The method of claim 1, wherein the method further comprises: The vulnerability verification step specifically includes: S51, collecting and integrating the verification results generated by the PoC script generation step and the IDOR vulnerability identification step, and using dynamic monitoring technology to record system state changes and network interactions during all execution processes; S52, according to the preset multi-dimensional vulnerability confirmation standard (including vulnerability response characteristics, system state changes, security impact degree, exploitation feasibility and vulnerability persistence), the integrated verification results are analyzed for technical feasibility and preliminary confirmation, the key state changes and system responses during the verification process are recorded, and the verification execution result set is constructed, providing technical basis for subsequent classification evaluation and report generation.

7. The method of claim 1, wherein the method further comprises: The report generation step specifically includes: S61, security impact analysis of verified vulnerabilities, classification and risk level assessment from vulnerability harm degree, impact range and exploitation difficulty, etc. dimensions, and construction of vulnerability knowledge base containing complete exploit chain and repair priority; S62, generate multi-level vulnerability report based on vulnerability severity and impact range, including vulnerability overview, technical details and reproduction steps, and output three formats according to different use scenarios: HTML security report for online viewing and interaction, PDF format document for formal archiving and distribution, and Web page format supporting real-time update and team collaboration.

8. A large language model-based network application vulnerability automatic detection system, characterized in that, Including: API path finding module: used to find the HTTP API path of the web application to be detected, through static code analysis, dynamic request analysis and historical traffic log mining, to build API path association graph, realize bidirectional mapping and reverse lookup ability of API path and source code location; Large language model vulnerability analysis module: used to receive API path information provided by API path finding module, analyze and generate candidate vulnerability information; this module is trained through network space security field knowledge fine tuning, adopts low rank adaptive technology for parameter optimization, guides the model to conduct deep analysis through special prompt engineering, combines with context information to reason vulnerability type and exploitation condition, generates structured candidate vulnerability information; PoC script generation module: used to analyze candidate vulnerability information, automatically complete the complete context required for vulnerability exploitation, conduct vulnerability hypothesis analysis, generate PoC script for candidate vulnerabilities, and perform syntax checking and security audit on the script to ensure the effectiveness and security of the script; Crawler module: used to simulate user operations based on headless browser technology, automatically explore and parameterize the web application to be detected, and identify IDOR vulnerabilities through request response similarity comparison and other methods; Vulnerability verification module: used to execute verification scripts in isolated environment, integrate professional security testing tools and multi-element knowledge base, confirm the existence and exploitation conditions of vulnerabilities through dynamic monitoring and multi-dimensional feature analysis; Report generation module: used to perform security impact analysis and risk level assessment on confirmed vulnerabilities, generate multi-level reports containing vulnerability description, technical details and reproduction steps, and output HTML security report for online viewing and interaction, PDF format document for formal archiving and distribution, and Web page format supporting real-time update and team collaboration according to different use scenarios.

Images