Black box test zero-day vulnerability analysis method and system based on multi-dimensional data

Abstract

The invention discloses a black-box test zero-day vulnerability analysis method and system based on multi-dimensional data, and aims to solve the problems that a traditional black-box test means is weak in unknown vulnerability recognition capability, high in false alarm rate, lack of path modeling and verification mechanisms and the like. The method comprises the following steps: constructing a cross-time window behavior graph by acquiring multi-dimensional heterogeneous information such as network input, system call, log information and abnormal signals; on the basis, potential abnormal paths are identified through structure entropy change and graph structure mutation analysis, path vector representation is constructed by combining graph representation learning and a path embedding method, and path-level risk modeling and mode clustering analysis are achieved; furthermore, vulnerability confirmation is carried out on the suspicious path through multiple verification mechanisms such as attack replay, fuzzy testing and sensitive function combination identification. The system has a multi-module cooperation capability, can realize automatic mining, verification and visual tracing of zero-day vulnerabilities in a source-source-free environment, and has good universality and expansibility.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a black-box testing method and system for zero-day vulnerability analysis based on multi-dimensional data. Background Technology

[0002] With the acceleration of informatization, software systems are widely deployed in various critical fields, bringing with them increasingly severe information security risks. Especially in complex application environments such as the Internet, industrial control, the Internet of Things, and smart devices, systems face increasingly diverse and covert attack methods, with zero-day vulnerabilities becoming a major focus of current cybersecurity offense and defense. Zero-day vulnerabilities refer to security flaws that exist before vendors release patches or users are aware of them. These vulnerabilities are often exploited by attackers to bypass traditional security measures, causing system crashes, sensitive information leaks, and even privilege hijacking, seriously threatening user data security and the stable operation of critical national information infrastructure.

[0003] Existing technologies for the detection and analysis of zero-day vulnerabilities can be broadly categorized into two types: static analysis and dynamic analysis. Static analysis methods typically rely on source code auditing, symbolic execution, or model reasoning for vulnerability discovery. While offering high accuracy, these methods are often limited by the availability of source code, code complexity, and the coverage of static analysis paths, making them difficult to fully adapt to "black box" environments such as closed systems or commercial software. Dynamic analysis techniques, on the other hand, utilize runtime behavior monitoring, fuzzing, and sandbox execution to trigger and locate vulnerabilities. This can overcome source code limitations to some extent, but suffers from limitations in path exploration, redundant behavioral data, and high false positive rates. Especially when facing complex interaction scenarios and non-deterministic input / output patterns, traditional dynamic testing tools have limited effectiveness in covering deep vulnerability paths.

[0004] In recent years, with the development of artificial intelligence, automated testing, and big data analytics, some studies have attempted to introduce machine learning models and data-driven mechanisms to model vulnerability behavior. However, such methods often rely on a large number of known vulnerability samples or feature templates, and still struggle to accurately identify unprecedented zero-day attack patterns. Furthermore, existing research mostly considers only a single data dimension in the data modeling process, such as system call sequences, network requests, or error logs, neglecting the temporal, correlational, and contextual evolution relationships between multi-source heterogeneous data during system operation, thus limiting the ability to perceive overall abnormal system behavior.

[0005] Meanwhile, black-box testing, as an important method for functional and security testing without obtaining system source code, has high adaptability and practical value in practical applications. However, existing black-box testing methods generally lack the ability to structure and analyze multi-dimensional system behavior in depth, making it difficult to automatically perceive the evolution path of potential vulnerabilities and their deep disturbances to the system. As a result, the testing effect is often limited to surface-level anomaly capture, and it is unable to effectively discover highly concealed zero-day vulnerabilities that rely on multi-step interactions or chains of abnormal behavior.

[0006] Against this backdrop, there is an urgent need to develop a novel black-box testing solution that integrates multi-dimensional data analysis, behavioral modeling, system evolution identification, and automated verification capabilities. This solution would break away from the reliance of existing technologies on known vulnerability characteristics and enhance the proactive discovery and response capabilities for zero-day vulnerabilities in unknown attack environments. This has significant practical implications and research value for promoting the development of cyberspace security technologies and building a more proactive and effective defense system. Summary of the Invention

[0007] To address the aforementioned technical issues, this invention provides a black-box testing method and system for zero-day vulnerability analysis based on multidimensional data. Through behavioral graph construction, graph evolution analysis, attack path entropy variableization, and simulation replay verification, unknown zero-day vulnerabilities are modeled, identified, and verified.

[0008] Specifically, the technical solution provided by this invention is as follows: A black-box testing zero-day vulnerability analysis method based on multidimensional data includes the following steps: S1. Obtain multi-dimensional runtime status data of the target system in the black-box testing environment, including network layer information, system log information, process execution information, and input / output data; S2. Construct the acquired multidimensional running status data into a heterogeneous behavior graph. The nodes in the graph represent the objects or behavioral events observed during the test, the edges in the graph represent the interactions, dependencies or causal relationships between nodes, and the attributes in the graph represent the attributes of nodes and edges. S3. By analyzing the structural changes of the graph in a continuous time window, abnormal graph regions are identified, and potential zero-day vulnerability triggering paths in the system are extracted. S4. Perform feature extraction and cluster analysis on the extracted vulnerability triggering paths, and take the center of each cluster as a representative high-risk path; S5. Perform attack replay and verification on high-risk paths to determine whether the vulnerability actually exists.

[0009] Furthermore, in step S1, all inbound and outbound network requests are collected using a packet capture tool, including IP address, port, protocol, URL path, response code, and response time; the system monitoring interface is called or a lightweight log proxy module is implanted to obtain runtime logs, system call logs, crash records, and abnormal warning records; operational behaviors are dynamically tracked and recorded, including process startup, function calls, module loading, and thread switching; all events are timestamped, and the event triggering order and the causal path between input and response are recorded.

[0010] Further, step S3 includes: S301, Constructing the time series map By time window Multiple sub-map snapshots are generated by sliding on the map, each sub-map Indicates the time interval The system behavior within the graph constitutes the time series of the graph. ; S302. Calculate the rate of change of structural entropy of subgraphs in adjacent time windows. , in, express t Time-based subgraph and t -1 Time Subgraph The rate of change of structural entropy; and Subgraphs and The structural entropy, and ; Represents a node The degree weight it occupies in the graph, and , Represents a node The total number of inbound and outbound edges; S303, Mutation Detection and Abnormal Subgraph Recognition Set a threshold for structural entropy change θ ,like Then the subgraph is considered This is an abnormal subgraph, and potential abnormal behaviors exist within the corresponding time period. , The mean of the rate of change of graph structure entropy represents the average level of graph structure entropy change under normal operating conditions. ; The standard deviation of the rate of change of entropy in the graph represents the range of fluctuation in entropy change. ; S304. Extract potential zero-day vulnerability trigger paths. For subgraphs marked as anomalous Extract all valid paths from the entry node to the exception / termination node, forming a path set. , , Indicates the first i A behavior path represents a complete chain of system interaction behaviors. This represents the sequence of nodes that make up the path.

[0011] Furthermore, in S303, a multi-indicator joint judgment mechanism is introduced. If any one of the multiple indicators exceeds a set threshold, or if the weighted comprehensive score of the multiple indicators meets a set threshold, the phase is judged as an abnormal sub-graph, indicating potential abnormal behavior within its corresponding time period. The multiple indicators include the structural entropy change rate. Subgraph burst degree and abnormal concentration : , , Here, the subgraph burst degree represents the relative growth rate of the number of edges. and They represent t Time and t The total number of edges in the subgraph at time -1; if This indicates that the system's interactive behavior has become more intensive; if This indicates reduced system interaction; if If the anomaly concentration is high, it indicates an explosive anomaly; the anomaly concentration is used to reflect the proportion of log errors and crash nodes in the subgraph, helping to improve the credibility of entropy mutations.

[0012] Further, step S4 includes: Each behavior path is encoded as a vector representation. Unsupervised clustering is performed on all extracted path vectors. After clustering, each cluster represents a potential zero-day attack pattern family. For each cluster, calculate the path to the cluster center. With respect to the change in system state entropy: , like If the value exceeds the set threshold, then the path... It was identified as a high-risk route; in, The path perturbation entropy change represents the path The change in entropy of the system state before and after execution is used to measure whether the path causes an abnormal change in the system's operating state. and These represent the information entropy of the system state before and after the execution path.

[0013] Assume that each node in the graph has obtained its embedding vector through a graph representation learning mechanism. , d For vector dimensions; for paths Define the path vector as mean means to calculate the average value; The graph representation learning mechanism learns each node through a graph neural network model. vector representation The goal is to map nodes with similar semantic or structural roles to similar vector spaces while preserving the edge relationships and node attribute influences in the graph structure. If there are historically labeled vulnerability sample paths, the graph neural network model is semi-supervised to optimize objectives such as cross-entropy loss. Otherwise, an unsupervised graph-based learning method is used to perform embedding learning by maximizing the similarity between neighboring nodes and the differences between distant nodes.

[0014] Furthermore, the graph neural network model adopts the R-GCN model, and its inter-layer propagation formula is:

[0015] in, Indicates that node v is at the th l The representation vector obtained after layer propagation The initial input features of node v are represented by the initial feature vectors of different types of nodes, which are extracted from their attribute sets. R represents the set of neighboring nodes of node v under relation r, which is extracted from the edge type information in the graph structure, where R is the set of edge types. This indicates that the neighbor node u is in the graph neural network at the th . l The representation vector obtained after propagation through -1 layer; For the first relation type r, the first... l The layer propagation weight matrix is ​​obtained automatically through model training and has a parameter dimension of [missing information]. These settings can be shared or configured individually during training. The weight matrix represents the self-loop propagation and is used to preserve the historical characteristics of the nodes themselves. As the normalization factor, This is the activation function used for nonlinear mapping.

[0016] Preferably, the behavioral path is regarded as an event sequence, the event sequence is input into the BiGRU or Transformer model, and the high-dimensional features extracted by the model are used as path vectors for similarity measurement between paths.

[0017] Further, step S5 includes: S501, Input Generation For high-risk routes The original input is deduced from its entry node and mutated to generate a fuzzy variant. S502, Attack Replay Execute the input sequence one by one in the secure sandbox environment and record the running information, including: changes in system structure entropy before and after, program standard output, system log / crash log, whether an exception return code is triggered, and whether there are any identifiable signs of attack. S503, Verification and Judgment If any of the set judgment logics are met, the path is marked as a real vulnerability; the judgment logics include: the path perturbation entropy change is greater than a set threshold; the system returns an abnormal status code or a crash signal; the system experiences a core dump; the behavior graph structure is broken or there is a sudden increase in local density; and a sensitive function combination appears in the call stack.

[0018] A black-box testing zero-day vulnerability analysis system based on the above method includes the following modules: The data acquisition module is used to acquire multi-dimensional operational status data of the target system in a black-box testing environment; The behavior graph construction module is used to construct heterogeneous behavior graphs from the acquired multidimensional operational status data; The graph structure evolution analysis module is used to analyze changes in graph structure within a continuous time window and identify anomalous subgraphs. The suspicious path extraction and feature modeling module is used to extract potential vulnerability triggering paths and generate corresponding path vectors; The zero-day pattern clustering analysis module is used to perform unsupervised clustering of path vectors and screen high-risk paths; The attack replay and vulnerability verification module is used to automatically replay and verify high-risk paths; The results evaluation and visualization module is used to generate vulnerability analysis reports, display the graph structure evolution process, entropy change curves, and attack chain call stacks. It also provides an API interface for upper-layer security platforms to retrieve vulnerability verification results and reports.

[0019] Traditional black-box testing methods mostly rely on static signatures, rule matching, or simple fuzzing, which are insufficient to handle unknown attack behaviors, lack context modeling capabilities, and cannot effectively characterize the dynamic behavior of the system under complex input stimuli, easily generating a large number of false positives and false negatives. This invention introduces a multi-dimensional behavioral data acquisition mechanism, comprehensively utilizing heterogeneous information such as network requests, system calls, log outputs, and abnormal signals to construct a structured behavioral graph. Combined with graph structure evolution analysis and path entropy variable calculation, it can keenly capture the microstructural perturbations of the system during abnormal state transitions, thereby discovering zero-day vulnerability trigger chains that traditional methods cannot identify.

[0020] Furthermore, this invention introduces graph embedding modeling and clustering analysis at the path level, resulting in stronger aggregation capabilities and robust representation of potential attack patterns in complex behavioral sequences, avoiding classification ambiguity caused by relying solely on shallow features. Simultaneously, by integrating multiple verification mechanisms such as fuzz testing, sensitive function combination identification, and core dump detection, the accuracy and depth of vulnerability analysis are effectively improved, ensuring that the identified paths possess actual attack value. The system as a whole possesses the capabilities for automated operation, visual traceability, and multi-platform deployment, significantly improving the efficiency and practicality of discovering unknown security threats in a black-box environment, and has broad engineering promotion prospects and industrial application value. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0022] Figure 1 This is a flowchart illustrating a black-box testing zero-day vulnerability analysis method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the module composition of a black-box testing zero-day vulnerability analysis system provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, other embodiments obtained by those skilled in the art without creative effort are all within the scope of protection of the present invention.

[0024] Example 1 This embodiment provides a black-box testing zero-day vulnerability analysis method based on multi-dimensional data, such as... Figure 1 As shown, the method mainly includes the following steps: Step 1: Multidimensional Data Acquisition and Behavioral Map Construction This step aims to comprehensively and structurally model the operating status of the target system under test in a black-box testing environment, providing a foundation for subsequent graph evolution analysis and abnormal path identification.

[0025] 1.1 Multidimensional Data Acquisition In black-box testing scenarios, since the source code cannot be directly accessed, this step uses external behavior monitoring technology to obtain the following multi-dimensional data: Network layer data: Collect all inbound / outbound network requests using packet capture tools (such as tcpdump and Wireshark), including IP address, port, protocol, URL path, response time, response code, etc.

[0026] System log information: By calling the system monitoring interface or embedding a lightweight log proxy module, runtime logs, system call logs, crash records, exception warnings, and other content can be obtained.

[0027] Process execution behavior: Record process startup, function calls, module loading, thread switching and other operations through dynamic tracing (such as using ptrace, Dtrace or ETW).

[0028] Input and output data: including test input cases, input format, parameter variation method, output results, return value structure, etc.

[0029] Time and causal information: All events are timestamped with high precision, and the order of event triggering and the causal path between input and response are recorded.

[0030] To ensure the comprehensiveness and consistency of data collection, middleware proxies (such as Burp or mitmproxy) can be deployed between the system under test and the test interface, or test objects can be encapsulated using Docker / Sandbox containers to centrally record all interaction behaviors.

[0031] 1.2 Heterogeneous Behavioral Graph Modeling The collected multidimensional data is transformed into a unified heterogeneous behavior graph, represented as a triple: G = (V, E, A). Here, V represents the set of nodes, signifying the objects or behavioral units observed during testing, such as input events, system calls, exception logs, and module loading; E represents the set of edges, representing the interactions, dependencies, or causal relationships between nodes, such as function A calling B, a request triggering a response, or an operation causing an exception; and A represents the set of attributes, representing the attributes of nodes and edges. Each node or edge has multidimensional attributes, such as timestamps, response codes, input characteristics, call counts, and exception levels.

[0032] For example, when performing black-box testing on the login interface of a web application, the behavior graph construction process is as follows: ① Test Input: The test case is a set of abnormal login attempts, such as entering an empty username, abnormal encoded characters, etc.

[0033] ②System data collection Network request log: A corresponding POST request was captured, with a response code of 500; Log entries: The system log shows "SQL syntax error near...". System call tracing: Calls to open(" / var / db / user.db") and sqlite_query(...) were detected; Program behavior: The program crash was traced, and the stack trace contained sqlite_exec→strcpy.

[0034] ③ Constructing the behavior map G Node V: v1: Input node POST / api / login v2: System call open(...) v3: System call sqlite_query(...) v4: Error log node SQL syntax error v5: Stack node strcpy → crash Side E: e1: v1→v2 (trigger edge) e2: v2→v3 (Calling edge) e3: v3→v4 (causal edge) e4: v3→v5 (Stack crash edge) Attribute A: v1.time = 1623490000; v1.input_size = 158 bytes; v4.error_level = "critical"; v5.crash_type = "segfault" Step 2: Graph Structure Evolution Analysis and Potential Anomaly Identification This step aims to identify graph regions with sudden and nonlinear evolution characteristics by analyzing the structural changes of the graph in a continuous time window, based on the behavioral graph constructed in step 1, and then determine the potential zero-day vulnerability trigger paths or abnormal behavior paths that may exist in the system.

[0035] During system operation, the behavioral graph continuously grows and evolves. Under normal conditions, the overall graph structure is relatively stable, and structural changes are relatively smooth. However, once an abnormal attack occurs or a zero-day vulnerability is triggered, it often leads to structural disturbances such as a surge in system behavior, dramatic log changes, and path expansion. This step introduces structural entropy theory and a graph mutation rate quantification mechanism to model and identify the continuous graph evolution sequence. By setting an entropy difference threshold, the moment of abrupt change is determined, and high-risk subgraph regions are located, providing input for subsequent path mining.

[0036] 2.1 Construction of time series maps During system operation, by time window Slide to generate multiple map snapshots: Each subgraph Indicates the time interval The system behavior within the system. For ordinary systems, a time window of 1-5 seconds is recommended; for highly interactive systems (such as the Web), a time window of 0.5-2 seconds is recommended. Simultaneously, set the sliding overlap (e.g., 50%) to facilitate capturing boundary events.

[0037] 2.2 Calculation of Graph Structure Change Degree (Entropy Change Model) To measure the structural complexity of the graph at different times, the structural entropy metric is introduced:

[0038] in, , representing a node The degree weight it occupies in the graph. Represents a node The total number of inbound and outbound edges. Entropy. The higher the value, the more likely it is to be a subgraph. The more dispersed the graph structure, the higher the complexity.

[0039] Then, the rate of change of structural entropy of any two adjacent time window subplots is calculated:

[0040] Under normal conditions The entropy is relatively small, but when the system experiences a sudden change in behavior, the structural entropy will change significantly, manifesting as a sudden increase or decrease in entropy at a certain moment.

[0041] 2.3 Mutation Detection and Abnormal Time Period Identification Set a threshold for structural entropy change θ The judgment rules are as follows:

[0042] Threshold θ It can be based on the system baseline entropy mean. Dynamic setting of deviation, i.e.:

[0043] in, The mean of the rate of change of graph structure entropy represents the average level of graph structure entropy change under normal operating conditions. ; The standard deviation of the rate of change of entropy in the graph represents the range of fluctuation in entropy change. .

[0044] Once an abnormal subgraph is detected, it is determined that there is potential abnormal behavior within that time period, and the subgraph is extracted for subsequent path clustering and verification.

[0045] In practical applications, while a single indicator (such as structural entropy change) is effective, it may lead to false positives or false negatives. Therefore, a multi-indicator joint judgment mechanism can be introduced to determine whether the system exhibits abnormal evolutionary behavior from multiple dimensions and with multiple granularities. In some embodiments, to enhance the ability to capture complex evolutionary behavior, the following indicators can be introduced for multiple verifications: Subgraph burstiness:

[0046] This represents the relative growth rate of the number of edges, reflecting a sudden increase in call / interaction behavior. Among them, and They represent t Time and t The total number of edges in the subgraph at time -1. If This indicates that the system's interactive behavior has become more intensive; if This indicates reduced system interaction; if If so, the window can be identified as an explosive anomaly, and further path analysis is required.

[0047] Abnormal concentration:

[0048] This reflects the proportion of log errors and crashed nodes in the subgraph, helping to improve the credibility of entropy mutations.

[0049] As long as the rate of change of structural entropy Subgraph burst degree and abnormal concentration If any indicator exceeds the set threshold, the corresponding result will be determined. This is an abnormal subgraph where potential abnormal behavior exists within the time period [t-1, t].

[0050] Alternatively, multiple indicators can be weighted and combined into a comprehensive score. ,set up:

[0051] Set threshold ,like If so, it is determined that there is potential abnormal behavior within the corresponding time period [t-1, t].

[0052] Step 3: Anomaly Path Discovery and Zero-Day Pattern Clustering This step aims to extract potential vulnerability triggering paths from the subgraphs identified as abnormal evolution maps, model these paths using feature representations, and use unsupervised clustering or map aggregation algorithms to identify zero-day attack pattern clusters with similar structures and similar abnormal behaviors, providing a set of candidate paths for subsequent vulnerability verification and source tracing analysis.

[0053] 3.1 Path Extraction from Anomaly Subgraphs For subgraphs marked as anomalous Extract all valid paths from the entry node to the exception / termination node. Entry nodes: such as network requests, user input, API calls (with the "input" attribute); Termination nodes: such as crash log nodes, exception returns, system exit calls (with the "is_error" or "is_crash" flag).

[0054] Using Depth-First Search (DFS) or a shortest path algorithm with a limited number of levels (k-hop BFS), traverse the graph starting from the entry node to form a set of paths: ,

[0055] Indicates the first i A behavior path represents a complete chain of system interaction behaviors; This represents the sequence of nodes that make up the path, derived from the graph. The set of nodes in the [theme / system].

[0056] 3.2 Path Feature Representation Modeling Each path It consists of a series of ordered nodes, which need to be encoded into a vector representation for easy subsequent clustering.

[0057] Method 1: Node Embedding Vector Aggregation Assume that each node in the graph has obtained its embedding vector through a graph representation learning mechanism. , d For vector dimensions; for paths Path vectors can be defined: Alternatively, semantic enhancement can be achieved through methods such as weighted pooling or position-weighted methods.

[0058] Graph representation learning mechanisms are used to map nodes (representing behavioral objects or events) and edges (representing structural relationships between behaviors) in a graph to dense representations (embeddings) in a high-dimensional vector space. This embodiment learns each node using a graph neural network (GNN) model. vector representation The goal is to map nodes with similar semantic or structural roles to similar vector spaces, while preserving the edge relationships and node attribute influences in the graph structure. If there are historically labeled vulnerability sample paths, the model can be semi-supervised to optimize objectives such as cross-entropy loss; otherwise, unsupervised graph-based learning methods (such as graph autoencoders or contrastive learning) are used to perform embedding learning by maximizing the similarity between neighboring nodes and the differences between distant nodes.

[0059] Specifically, given the multiple node and edge types in the behavioral graph in this embodiment, a Relational Graph Convolutional Network (R-GCN) is used for modeling. This model introduces edge type differentiation when updating node representations, and the core propagation formula is as follows:

[0060] in, Indicates that node v is at the th l The representation vector obtained after layer propagation This represents the initial input features (attribute encoding) of node v. Different types of nodes have their initial feature vectors extracted from their attribute sets. For example, for an input event node, For system call nodes, For abnormal log nodes, Among them, string fields can be converted into vectors using word2vec, BERT, or hash encoding. R represents the set of neighboring nodes of node v under relation r, which is extracted from the edge type information in the graph structure, such as relation edges such as call, dependency, and trigger. R is the set of edge types. This indicates that the neighbor node u is in the graph neural network at the th . l The representation vector obtained after propagation through -1 layer; For the first relation type r, the first... l The layer propagation weight matrix is ​​obtained automatically through model training and has a parameter dimension of [missing information]. These settings can be shared or configured individually during training. The weight matrix represents the propagation of the self-loop (the node itself), which is used to preserve the historical characteristics of the node itself, and can be set independently or shared in each layer of GCN; This is a normalization factor, typically the number of neighboring nodes or adjusted based on edge weights; This is the activation function used for nonlinear mapping.

[0061] Method 2: Sequence Modeling Treating paths as a sequence of events, and modeling them using a bidirectional GRU (BiGRU) or Transformer model, the path vector is defined as: That is, the event sequence is input into the model, and the high-dimensional features extracted by the model are used as path vectors for measuring the similarity between paths.

[0062] 3.3 Zero-day pattern cluster analysis Unsupervised clustering is performed on all extracted path vectors. Clustering methods can include HDBSCAN (density-based hierarchical clustering), spectral clustering, or K-Means. After clustering, each cluster represents a potential zero-day attack pattern family, where multiple paths have similar behavioral patterns (e.g., the same system call order), input triggering logic, abnormal response structure, and dependent execution chains.

[0063] 3.4 High-risk path screening For each cluster, calculate the path to the cluster center. Based on the change in system state entropy, the most representative high-risk paths are selected: ,like Then the path Included in the candidate vulnerability verification set. Among them, The path perturbation entropy change represents the path The change in entropy of the system state before and after execution is used to measure whether the path causes an abnormal change in the system's operating state. and These represent the information entropy of the system state before and after the execution path.

[0064] Step 4: Attack Replay and Verification This step aims to systematically verify the suspicious paths identified in the previous stage by perturbing them. Based on the changes in system structural entropy before and after the path is executed, it determines whether the path has caused structural collapse or unexpected behavior. An automated mechanism is used to simulate attacks, generate fuzzy variants, and perform multiple replay tests on the path to confirm whether the vulnerability actually exists and enhance the credibility of the verification.

[0065] 4.1 Input Generation For path It reverse-engineers the original input (such as API parameters, file content, etc.) from its entry node and then performs mutations to generate fuzzy variants:

[0066] Mutation strategies include: numerical boundary mutation (e.g., 127→128), insertion of special characters, length extension (e.g., repeating characters), and encoding method change (e.g., URL encoding, Base64).

[0067] In black-box testing, the path It usually starts from a user input behavior (entry node) and gradually expands along the system's call chain, dependency chain, and exception chain. Entry node v 1 is often triggered by network requests, system commands, file reads, or user form submissions, and the core objective of reverse engineering is to start from the node. vThe original input content of the trigger path is reconstructed from the context information of 1. During the graph construction process, the entry node... v 1. It will include attribute fields. For network request type inputs, the request path can be deduced from the input_uri and input_type attribute fields, and the POST or GET request body can be restored from the input_param and input_payload attribute fields. For file input type paths, the original input source (file path) can be deduced from the relevant attribute fields. For command line or system parameter inputs, the command or parameter can be deduced from the corresponding attributes.

[0068] 4.2 Attack Replay Execution Execute the input sequence one by one in the secure sandbox environment and record the following information: changes in system structure entropy before and after, program standard output, system log / crash log, whether an exception return code is triggered (such as HTTP 500, SIGSEGV, etc.), and whether there are any identifiable attack signs (such as database errors, remote code execution traces).

[0069] 4.3 Vulnerability Verification and Judgment Set up verification logic that marks a path as a real vulnerability if any of the following conditions are met: ①

[0070] ② Returns an exception status code or crash signal ③ A core dump occurs. A core dump is a memory snapshot file automatically generated by the operating system when a program encounters a serious error. This file records key information about the program crash.

[0071] ④ Behavioral graph structural breaks or local density surges. Behavioral graph structural breaks refer to the sudden interruption or truncation of previously continuous call paths or behavioral chains during graph evolution. Examples include: some nodes becoming dangling nodes or isolated subgraphs; call chains no longer being closed or unable to be fully traced from entry events to termination events; and some critical nodes suddenly disappearing from the graph. Local density surges refer to the sudden appearance of an abnormally high number of edge connections or node clusters in a local region of the graph (such as around a node), which can be quantified using the aforementioned subgraph burst degree.

[0072] ⑤ A combination of sensitive functions appears in the call stack (such as strcpy→malloc→abort). Sensitive functions refer to function calls in the program that have high-risk attributes and are easily exploited by attackers to cause memory corruption, security escape, or privilege escalation.

[0073] To facilitate understanding of this step, a specific example is given below: Assume path P 12The path was identified as a high-entropy disturbance originating from a user's file upload input to the / api / upload interface, resulting in an "unexpected EOF" log output and triggering a file read / write error. The attack is now being replayed and verified: (1) Original input reconstruction POST / api / upload HTTP / 1.1 Content-Type: multipart / form-data Content-Disposition: form-data; name="file"; filename="crash.jpg" [Payload = '...JPEG_HEADER...EOF_MAGIC...'] (2) Generate 3 variant inputs (fuzzy processing) input_1: Add an illegal ending character input_2: Insert a large number of null bytes input_3: Replace part of the binary segment with a repeating structure. (3) Analysis of attack execution results

[0074] Judgment result: input_1 and input_3 are confirmed as real vulnerability triggering test cases, and path P is marked. 12 For verified zero-day paths, generate vulnerability reports, including trigger inputs, stack call chains, system disturbance levels, etc.

[0075] Example 2 Based on the above methods, this embodiment provides a black-box testing zero-day vulnerability analysis system. This system aims to perform in-depth monitoring and graphical modeling of the behavior of a target system running in a black-box testing environment. It combines structural evolution, entropy change judgment, path clustering, and automated verification to proactively discover, identify, and verify zero-day vulnerabilities. This system does not rely on source code and is applicable to closed-source software, security auditing, and network warfare applications.

[0076] like Figure 2 As shown, the system mainly includes the following modules: (1) Data acquisition module This system is used to collect multi-source data during target system operation, including network requests, system calls, log output, input / output streams, and timestamps, supporting non-intrusive data collection. It also performs standardization, time alignment, and structured processing on raw data to provide input for subsequent mapping. It includes: a network data monitoring submodule (e.g., packet capture, proxy), a system behavior capture submodule (e.g., ptrace, DTrace, auditd), a log access submodule (e.g., syslog interface, stdout capture), and a data preprocessing unit (format cleaning, encoding standardization, field extraction).

[0077] (2) Behavioral Graph Construction Module Used to construct time-stamped heterogeneous behavioral graphs based on collected data: Nodes represent observed objects or behavioral units in the system, such as input events, system calls, exception logs, module loading, etc.; Edges represent interactions, dependencies, or causal relationships between nodes, such as function calls, request-triggered responses, and operations leading to exceptions; Attributes store the type, time, parameters, exception flags, etc. of nodes / edges.

[0078] (3) Graph structure evolution analysis module Used to monitor structural evolution in a continuous sequence of spectral snapshots and calculate the rate of change of structural entropy. Subgraph burst degree Abnormal concentration The system uses indicators such as statistical thresholds to determine "mutation windows" and identify potential anomalous subgraphs. It may further include submodules such as a sliding window graph generator, a graph entropy calculation unit, a density analysis module, and an anomalous mutation determiner.

[0079] (4) Suspicious path extraction and feature modeling module Used in anomaly graphs to extract the set of paths from input nodes to anomaly nodes using graph search algorithms (such as Depth-First Search). Each path is quantized and encoded using techniques such as GNN and GRU to form a path semantic representation, which serves as input for cluster analysis. This includes: a path builder, path representation modeling units, and a path vector database.

[0080] (5) Zero-day pattern clustering analysis module Used for unsupervised clustering of path representation vectors, calculating the path to the cluster center. Based on the change in system state entropy, the most representative high-risk paths are selected.

[0081] (6) Attack replay and vulnerability verification module This tool is used to automatically replay and mutate representative paths after clustering, execute the paths, and monitor system responses (structural entropy changes, logs, crashes, etc.). If it triggers a core dump, abnormal termination, or sensitive function combinations, it is determined to be a real vulnerable path. It mainly includes: an input restoration and mutation generator (based on path entry point reverse engineering), an automatic attack executor (encapsulating the test environment), a system response analyzer (supporting entropy difference calculation, log analysis, and call stack analysis), and a sensitive function combination detection submodule (call sequence analysis).

[0082] (7) Results Evaluation and Visualization Module It is used to generate vulnerability analysis reports (including path structure, abnormal behavior graphs, and verification results), show the graph structure evolution process, entropy change curves, and attack chain call stacks. It can also provide API interfaces for upper-layer security platforms to retrieve vulnerability verification results and reports.

[0083] The data acquisition module collects system behavior data in real time; the behavior graph construction module constructs a time-series graph sequence using a sliding window; the evolutionary analysis module detects graph structure anomalies (such as entropy mutations, breaks, and density anomalies); the suspicious path extraction and feature modeling module identifies suspicious paths in the anomaly graph and represents them as vectors; the clustering analysis module automatically discovers attack pattern clusters; the attack replay and vulnerability verification module performs input restoration, fuzzy mutation, and vulnerability verification on representative paths; and the evaluation module outputs verification conclusions and visualizes the results. All modules collaborate through internal message queues or memory data buses, forming a closed-loop zero-day vulnerability discovery process.

[0084] The above system can execute the black-box testing zero-day vulnerability analysis method described in Embodiment 1, and has the corresponding functional modules and beneficial effects of the method. For technical details not described in detail in this embodiment, please refer to the black-box testing zero-day vulnerability analysis method provided in Embodiment 1 of this invention.

[0085] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; under the concept of the present invention, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the present invention as described above, which are not provided in detail for the sake of brevity; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A black-box testing zero-day vulnerability analysis method based on multidimensional data, characterized in that, Including the following steps: S1. Obtain multi-dimensional runtime status data of the target system in the black-box testing environment, including network layer information, system log information, process execution information, and input / output data; S2. Construct the acquired multidimensional running status data into a heterogeneous behavior graph. The nodes in the graph represent the objects or behavioral events observed during the test, the edges in the graph represent the interactions, dependencies or causal relationships between nodes, and the attributes in the graph represent the attributes of nodes and edges. S3. By analyzing the structural changes of the graph in a continuous time window, abnormal graph regions are identified, and potential zero-day vulnerability triggering paths in the system are extracted. S4. Perform feature extraction and cluster analysis on the extracted vulnerability triggering paths, and take the center of each cluster as a representative high-risk path; S5. Perform attack replay and verification on high-risk paths to determine whether the vulnerability actually exists.

2. The black-box testing zero-day vulnerability analysis method as described in claim 1, characterized in that, In step S1, all inbound and outbound network requests are collected using a packet capture tool, including IP address, port, protocol, URL path, response code, and response time. Call the system monitoring interface or embed a lightweight log agent module to obtain runtime logs, system call logs, crash records, and exception warning records; dynamically track and record operational behaviors, including process startup, function calls, module loading, and thread switching; timestamp all events and record the event triggering order and the causal path between input and response.

3. The black-box testing zero-day vulnerability analysis method as described in claim 1, characterized in that, Step S3 includes: S301, Constructing the time series map By time window Multiple sub-map snapshots are generated by sliding on the map, each sub-map Indicates the time interval The system behavior within the graph constitutes the time series of the graph. ; S302. Calculate the rate of change of structural entropy of subgraphs in adjacent time windows. ， in, express t Time-based subgraph and t -1 Time Subgraph The rate of change of structural entropy; and Subgraphs and The structural entropy, and ; Represents a node The degree weight it occupies in the graph, and , Represents a node The total number of inbound and outbound edges; S303, Mutation Detection and Abnormal Subgraph Recognition Set a threshold for structural entropy change θ ,like Then the subgraph is considered This is an abnormal subgraph, and potential abnormal behaviors exist within the corresponding time period. , The mean of the rate of change of graph structure entropy represents the average level of graph structure entropy change under normal operating conditions. ; The standard deviation of the rate of change of entropy in the graph represents the range of fluctuation in entropy change. ; S304. Extract potential zero-day vulnerability trigger paths. For subgraphs marked as anomalous Extract all valid paths from the entry node to the exception / termination node, forming a path set. , , Indicates the first i A behavior path represents a complete chain of system interaction behaviors. This represents the sequence of nodes that make up the path.

4. The black-box testing zero-day vulnerability analysis method as described in claim 3, characterized in that, In S303, a multi-indicator joint judgment mechanism is introduced. If any one of the multiple indicators exceeds the set threshold, or the weighted comprehensive score of the multiple indicators meets the set threshold, the phase is judged as an abnormal sub-graph, and there is potential abnormal behavior in the corresponding time period. The multiple indicators include the rate of change of structural entropy. Subgraph burst degree and abnormal concentration : ， ， Here, the subgraph burst degree represents the relative growth rate of the number of edges. and They represent t Time and t The total number of edges in the subgraph at time -1; if This indicates that the system's interactive behavior has become more intensive; if This indicates reduced system interaction; if If the anomaly concentration is high, it indicates an explosive anomaly; the anomaly concentration is used to reflect the proportion of log errors and crash nodes in the subgraph, helping to improve the credibility of entropy mutations.

5. The black-box testing zero-day vulnerability analysis method as described in claim 3, characterized in that, Step S4 includes: Each behavior path is encoded as a vector representation. Unsupervised clustering is performed on all extracted path vectors. After clustering, each cluster represents a potential zero-day attack pattern family. For each cluster, calculate the path to the cluster center. With respect to the change in system state entropy: ， like If the value exceeds the set threshold, then the path... It was identified as a high-risk route; in, The path perturbation entropy change represents the path The change in entropy of the system state before and after execution is used to measure whether the path causes an abnormal change in the system's operating state. and These represent the information entropy of the system state before and after the execution path.

6. The black-box testing zero-day vulnerability analysis method as described in claim 4, characterized in that: Assume that each node in the graph has obtained its embedding vector through a graph representation learning mechanism. , d For vector dimensions; for paths Define the path vector as mean means to calculate the average value; The graph representation learning mechanism learns each node through a graph neural network model. vector representation The goal is to map nodes with similar semantic or structural roles to similar vector spaces while preserving the edge relationships and node attribute influences in the graph structure. If there are historically labeled vulnerability sample paths, the graph neural network model is semi-supervised to optimize objectives such as cross-entropy loss. Otherwise, an unsupervised graph-based learning method is used to perform embedding learning by maximizing the similarity between neighboring nodes and the differences between distant nodes.

7. The black-box testing zero-day vulnerability analysis method as described in claim 5, characterized in that, The graph neural network model adopts the R-GCN model, and its inter-layer propagation formula is as follows: in, Indicates that node v is at the th l The representation vector obtained after layer propagation The initial input features of node v are represented by the initial feature vectors of different types of nodes, which are extracted from their attribute sets. R represents the set of neighboring nodes of node v under relation r, which is extracted from the edge type information in the graph structure, where R is the set of edge types. This indicates that the neighbor node u is in the graph neural network at the th . l The representation vector obtained after propagation through -1 layer; For the first relation type r, the first... l The layer propagation weight matrix is ​​obtained automatically through model training and has a parameter dimension of [missing information]. These settings can be shared or configured individually during training. The weight matrix represents the self-loop propagation and is used to preserve the historical characteristics of the nodes themselves. As the normalization factor, This is the activation function used for nonlinear mapping.

8. The black-box testing zero-day vulnerability analysis method as described in claim 4, characterized in that: The behavior path is treated as an event sequence. The event sequence is input into the BiGRU or Transformer model, and the high-dimensional features extracted by the model are used as path vectors for measuring the similarity between paths.

9. The black-box testing zero-day vulnerability analysis method as described in claim 4, characterized in that, Step S5 includes: S501, Input Generation For high-risk routes The original input is deduced from its entry node and mutated to generate a fuzzy variant. S502, Attack Replay Execute the input sequence one by one in the secure sandbox environment and record the running information, including: changes in system structure entropy before and after, program standard output, system log / crash log, whether an exception return code is triggered, and whether there are any identifiable signs of attack. S503, Verification and Judgment If any of the set judgment logics are met, the path is marked as a real vulnerability; the judgment logics include: the path perturbation entropy change is greater than a set threshold; the system returns an abnormal status code or a crash signal; the system experiences a core dump; the behavior graph structure is broken or there is a sudden increase in local density; and a sensitive function combination appears in the call stack.

10. A black-box testing zero-day vulnerability analysis system based on the method of any one of claims 1 to 9, characterized in that, Includes the following modules: The data acquisition module is used to acquire multi-dimensional operational status data of the target system in a black-box testing environment; The behavior graph construction module is used to construct heterogeneous behavior graphs from the acquired multidimensional operational status data; The graph structure evolution analysis module is used to analyze changes in graph structure within a continuous time window and identify anomalous subgraphs. The suspicious path extraction and feature modeling module is used to extract potential vulnerability triggering paths and generate corresponding path vectors; The zero-day pattern clustering analysis module is used to perform unsupervised clustering of path vectors and screen high-risk paths; The attack replay and vulnerability verification module is used to automatically replay and verify high-risk paths; The results evaluation and visualization module is used to generate vulnerability analysis reports, display the graph structure evolution process, entropy change curves, and attack chain call stacks. It also provides an API interface for upper-layer security platforms to retrieve vulnerability verification results and reports.

Images