Interface security test method and device, storage medium and product
By employing a large language model (LLM)-driven agent approach, a multi-step Web API call is constructed to simulate the human penetration testing process, thereby addressing the issue of low vulnerability detection accuracy in complex scenarios by existing tools and achieving efficient vulnerability scanning and accurate vulnerability verification.
Patent Information
- Application Number
- CN202511155116.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-18
- Publication Date
- 2025-12-19
AI Technical Summary
Existing automated Web API vulnerability detection tools struggle to effectively cover complex privilege escalation vulnerability scenarios, and their reliance on static code parsing leads to high costs and low accuracy. Traditional scanners also cannot simulate the logic of human penetration testing.
Employing an agent-driven approach based on Large Language Model (LLM), this method simulates the workflow of a human penetration test engineer by constructing multiple vulnerability detection plugins. It utilizes multi-step Web API calls to achieve meticulous vulnerability verification and combines the agent's acquisition of interface information and construction of vulnerability scanning processes to cover vulnerability types that are difficult for traditional scanners to detect.
It improves the accuracy of vulnerability detection, covers vulnerability types that are difficult for traditional scanners to find, saves system resources, and provides an efficient vulnerability scanning solution.
Smart Images
Figure CN121167731A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of information technology, and in particular to an interface security testing method and device, a storage medium and a product. BACKGROUND
[0002] In recent years, most enterprises that set up external applications on the Internet use Application Programming Interface (API) to implement the functional requirements of Web applications. This makes the Web API itself an important part of the enterprise's digital assets, and also makes the Web API an important target of malicious external attackers. Therefore, an automated Web API security detection system is an important part of enterprise security construction.
[0003] Existing automated Web API vulnerability detection methods largely rely on static code auditing or a combination of dynamic requests and static code auditing. This method requires the deployment of complex static code analysis tools, and the accuracy of these tools is often not high, resulting in high costs in deployment, operation, and other aspects, and it is difficult to effectively cover the most common privilege violations of Web API (such as user 1 reading user 2's sensitive data through Web API). In order to cover the privilege violations of Web API at a low cost and avoid the high cost of parsing static code, a dynamic Web API security vulnerability scanning design based on actual Web API HTTP request and response traffic, replacing the user authentication information, and then replaying, has appeared.
[0004] For example, for Web API / getOrder, the scanner obtains the HTTP request {“orderId”: 123} sent by user A. The order with id 123 is user A's private data, and the content of this private data will appear in the response. The scanner will replace this request with user B, and if the user A's private data still appears in the response, it is considered that the interface has a privilege violation, and user B has read user A's private data.
[0005] However, this design pattern of simple login state replacement and replay in a single Web API dimension cannot cover relatively complex scenarios. For example, some Web APIs that update or delete data, as the responses of these Web APIs are usually empty, it is not possible to simply judge whether the API function has been successfully executed by the response.
[0006] The complex scenarios that are difficult for the above-mentioned automated security vulnerability scanning tools to cover are all systematic test processes for manual penetration testing. However, these processes themselves rely on human logic and cannot be described by hard rules, so the existing API security vulnerability scanners do not have an implementation based on this. SUMMARY
[0007] An object of the present application is to provide an interface security testing method, device, storage medium and product, at least to solve the problem that the complex scenarios that are difficult for the above-mentioned automated security vulnerability scanning tools to cover.
[0008] To achieve the above-mentioned object, some embodiments of the present application provide the following aspects:
[0009] In a first aspect, the present application provides an interface security testing method based on an intelligent agent, the interface security testing method comprising:
[0010] Constructing a plurality of vulnerability detection plug-ins corresponding to different interface security testing categories, the vulnerability detection plug-ins comprising the basic principles of vulnerability types;
[0011] Obtaining, by a first intelligent agent, interface information of a target interface and interfaces associated with the target interface;
[0012] Constructing, by the first intelligent agent, vulnerability orchestration information according to the interface information and the basic principles of vulnerability types, and creating a vulnerability scanning process;
[0013] Performing, by a second intelligent agent, vulnerability scanning on the target interface according to the vulnerability scanning process, and obtaining a scanning result.
[0014] In a second aspect, some embodiments of the present application further provide an electronic device, comprising: one or more processors; and a memory having stored computer program instructions which, when executed, cause the processor to perform the steps of the above-mentioned method.
[0015] In a third aspect, some embodiments of the present application further provide a computer readable medium having stored computer program instructions which can be executed by a processor to implement the above-mentioned method.
[0016] In a fourth aspect, some embodiments of the present application further provide a computer program product comprising computer program / instructions which, when executed by a processor, implement the steps of the above-mentioned method.
[0017] Compared with the related art, in the scheme provided by the embodiment of the application, a method for performing security vulnerability scanning on a Web API (interface) is provided, which is completely driven by a large language model (LLM). By means of the endogenous capability of multiple agents, the working process of a human penetration test engineer is simulated, and through multi-step Web API calling, fine and careful vulnerability verification conforming to human thinking is realized, which not only has an accuracy far higher than that of a traditional vulnerability scanner, but also can cover many types of vulnerabilities that are difficult to cover by a traditional scanner. BRIEF DESCRIPTION OF DRAWINGS
[0018] One or more embodiments are illustrated by way of example in the figures that form a part of this disclosure and which are shown by way of illustration in the drawings. When the same reference numbers are used in different drawings, it is intended to refer to the same or like components. The drawings are not necessarily to scale, the emphasis instead being placed upon illustrating the principles of the embodiments.
[0019] Figure 1 A flowchart of an agent-based interface security testing method provided for an exemplary embodiment of the present disclosure;
[0020] Figure 2 A flowchart of another agent-based interface security testing method provided for an exemplary embodiment of the present disclosure;
[0021] Figure 3 An exemplary structural diagram of the electronic device provided for some embodiments of the present application. DETAILED DESCRIPTION
[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.
[0023] First, the concept of the Web API to which the present application is directed needs to be explained. The Web API is an interface exposed by a Web application for calling through an HTTP protocol. For example, for an API, there can be a request HTTP message as follows
[0024] POST / api / getOrder?groupId=1HTTP / 1.1
[0025] HOST:www.test.com
[0026] Cookie:user=a
[0027] {“orderId”:“12345”}
[0028] The API can be abbreviated as getOrder, and its function is to obtain the detailed information of the Order corresponding to the requested orderId 12345. The example response message is as follows
[0029] HTTP / 1.1 200 OK
[0030] Content-Type: application / json
[0031] {“address”:“Shanghai, China”}
[0032] If the interface is successfully called, the detailed information of the order will appear in the response. For the present application, the main concern is the user authentication information in the request message (that is, the Cookie: user = a field, which indicates that the requesting user is a, and the actual situation will be more complex, but the function and logic are consistent), the request parameter (that is, the query groupId = 1 part and the request body {“orderId”:“12345”} part, and the request parameter will be mainly illustrated by the request body {“orderId”:“12345”} in the following examples), and the response (that is, the {“address”:“Shanghai, China”} part).
[0033] Then define the object (Object), and each object can be regarded as a piece of data in the database of the backend of the Web application. For example, for the getOrder interface in the above example, Order is an object, and each Order object has its own address address information.
[0034] For the object, the concept of index (reference) is also defined. Each object has a unique index value, which is mostly generated by the application itself, to locate the data itself. From the perspective of database design, the index can be equivalent to the primary key (primary key) of the data table. For the getOrder interface in the above example, orderId is the index of the order object, which corresponds to a unique Order object, so the interface requests to query the information of the order object with the index orderId 12345.
[0035] Index can be found in both request parameters and response of a Web API. If an object's index is found in the request parameters of a Web API, it is considered that the API "consumes" the object; if an object's index is found in the response of a Web API, it is considered that the API "produces" the object.
[0036] Since request parameters need to be constructed by the subsequent scanning system, and the response is passively obtained, a little more needs to be said about the index appearing in the request parameters. Request parameters can be regarded as index parameters and non-index parameters. Take the following request parameters as an example:
[0037] {“orderId”:“12345”,“name”:“test”}
[0038] orderId is an index parameter, and name is a non-index parameter. For an index such as orderId, its value must be a value of an index that already exists in the backend system, otherwise the corresponding object cannot be found. Non-index parameters such as name often have no such restrictions, and directly replaying the original request message or manually constructing by parameter name can normally execute the API function.
[0039] After defining the objects consumed and produced by a Web API, the specified Web API can be associated with other Web APIs that have also been classified according to the calling relationship. The association logic is as follows: find all the APIs that produce the objects consumed by the target API, and consider them as first-level associated APIs; for these first-level associated APIs, repeat the above operation on all their consumption objects to find the APIs that produce these objects, and consider them as second-level associated APIs; constantly repeat the above process until there are no objects consumed by a certain level of API, or all the found APIs are repeated, and all the APIs of the above levels are collectively considered as the associated APIs of the target API.
[0040] Through the above definition and logic, an API can be described by objects and indexes. For example, for the API getOrder, it can be described as: through the index OrderId of the requested Order object, the information of the corresponding Order is obtained. At the same time, we can also obtain the associated APIs of this API.
[0041] For a security test engineer, when testing an API and the API has sufficient associated APIs, a multi-step API calling test process can be developed to determine whether a specified vulnerability exists, as in the following case:
[0042] Judge whether the interface deleteOrder exists the unauthorized (unauthorized is the relative expression of Chinese, English expression is Insecure Direct Object Reference, IDOR, will be called IDOR later) delete, that is, user A can call this Web API to delete the order of user B. At the same time, according to the above association strategy, we can also know the API CreateOrder and ListOrder related to the API. The request response information of the three APIs is assumed as follows:
[0043] The request parameter of DeleteOrder is {“orderId”:“111”}, and the response is empty.
[0044] The request parameter of CreateOrder is {“address”:“xxxx”}, and the response is {“orderId”:“xxxx”}
[0045] The request parameter of ListOrder is empty, and the response is {“orderList”:[{“orderId”:“xxxxx”}]}
[0046] Any experienced security test engineer will develop the following test process:
[0047] 1. Use user A to call CreateOrder, create an order and get OrderID.
[0048] 2. Use user B to call DeleteOrder interface with the OrderID in the previous step, execute cross-user deletion behavior.
[0049] 3. Use user A to call ListOrder interface to check whether the OrderId exists, if not, the order is deleted by user B, indicating that the vulnerability exists.
[0050] Figure 1 An interface security test method based on an agent is provided for an example embodiment of the present disclosure, and the interface security test method comprises:
[0051] S101, a plurality of vulnerability detection plug-ins are constructed, the vulnerability detection plug-ins correspond to different interface security test categories, and the vulnerability detection plug-ins comprise the basic principles of vulnerability types;
[0052] Specifically, first, a plug-in design is adopted, and each plug-in corresponds to a vulnerability type that needs to be detected, such as IDOR_READ (unauthorized reading), IDOR_DELETE (unauthorized deletion), and the like. Each plug-in mainly specifies the basic principle of the corresponding vulnerability type (for example, the principle of the unauthorized deletion vulnerability is that the API does not check the object index in the request and the ownership relationship of the user requesting, which causes a malicious user to be able to delete the objects of other users by requesting the object index of other users) and other information. These contents will be part of the LLM Agent (intelligent agent) prompt words, and the main purpose is to limit the behavior of LLM and avoid the LLM from performing too much divergence.
[0053] S102, obtaining, by the first intelligent agent, interface information of a target interface and interfaces associated with the target interface.
[0054] Specifically, when a certain Web API has the possibility to produce a certain type of vulnerability, the target API will enter the first intelligent agent based on LLM, and the first intelligent agent will obtain the interface information of the target interface and the interfaces associated with the target interface. The interface information includes request parameters and response parameters and the like.
[0055] S103, constructing, by the first intelligent agent, vulnerability arrangement information according to the interface information and the basic principle of the vulnerability type, and creating a vulnerability scanning process.
[0056] Specifically, after obtaining the API information associated with the target API, the first intelligent agent will construct vulnerability arrangement auxiliary information according to the API information and the basic principle of the vulnerability type provided by the vulnerability plug-in, and arrange a sequentially executed scanning process, such as the above-mentioned artificially customized test process.
[0057] S104, performing, by the second intelligent agent, vulnerability scanning on the target interface according to the vulnerability scanning process, and obtaining a scanning result.
[0058] Specifically, the scanning process will be subsequently issued to the second intelligent agent based on LLM. The Agent will call the scanning nodes in turn according to the previously arranged scanning process to initiate a request to the Web API, get the response, and then the LLM will judge whether to execute the next request or output the conclusion according to the response of the Web API.
[0059] An embodiment is given below: scanning the Web API interface / api / deleteShare.
[0060] After the target Web API / api / deleteShare is passed in, the basic information of the target Web API is first acquired, and for the example API, it is "the interface passes in the index shareId of a Share object through a request, deletes the shared object, and the response is empty", and then different scanning plugins are sequentially called to combine the information to execute the scanning process.
[0061] For example, the unauthorized deletion plugin is called, which specifies that the basic principle of the vulnerability is "the API does not check the object index in the request and the ownership relationship of the user requesting it, so that a malicious user can delete the objects of other users by requesting the object index of other users", and the target interface is passed into the first agent. Then in the Agent node, the associated API of the target API is first queried, and the specific method is as described above, and the following Web APIs are taken out:
[0062] / api / ShareMessages: The interface passes in the index messageIds of a Message object through a request, creates a Share object, and the response contains the index shareId of the Share object and the title, subtitle, and other information of the object.
[0063] / api / ListShares: The interface requests are empty, and the function is to list all shared objects, and the response contains the index shareId of the shared object.
[0064] / api / ChatStream: The interface passes in the index chatSessionId of a ChatSession object through a request, creates a Message object, and the response contains the index messageId of the Message object.
[0065] / api / CreateChatSession: The interface requests are empty, and the function is to create a new chat session, and the response contains the index chatSessionId of the ChatSession object.
[0066] Combined with the above associated API information, the first agent will give the following test process:
[0067] You need to perform the scanning process as follows to scan the interface / api / agent / capy.agent.v1.AgentService / DeleteShare for "unauthorized deletion of other user's private objects":
[0068] 1. User 1 invokes the / api / CreateChatSession interface to create a chatSession and gets the chatSessionId in the interface response, denoted as chatSessionId_user1.
[0069] 2. User 1 invokes the / api / ChatStream interface using chatSessionId_user1 to create a message and gets the messageId in the response, denoted as messageId_user1.
[0070] 3. User 1 invokes the / api / ShareMessages interface using messageId_user1 to create a share and gets the shareId in the interface response, denoted as shareId_user1.
[0071] 4. User 2 invokes the / api / DeleteShare interface, passing in shareId_user1, to attempt to delete shareId_user1.
[0072] 5. User 1 invokes the / api / ListShares interface to check if shareId_user1 has been deleted. If it has been deleted, there is a privilege deletion vulnerability; otherwise, there is not.
[0073] This scan process will pass in a second agent to perform execution. The agent requests a scan node through tool invocation, sends a specified request, and returns a response. The response is supplemented in the context of the multi-round conversation of the LLM, so that the LLM can determine how to send the next request. For example, for the second step of the scan process, the LLM will issue the following request instruction:
[0074]
[0075] When the LLM considers that the information in the context is sufficient to make a judgment on whether there is a vulnerability, it will output a conclusion in the following format:
[0076]
[0077] The ListShares interface query indicates that the deletion operation was not successfully executed, and there is no privilege deletion vulnerability.
[0078] Therefore, it is concluded that the interface api / deleteShare does not have a privilege deletion vulnerability, and the scan of the privilege deletion vulnerability plugin is also complete.
[0079] Other vulnerability plugins are not repeated here.
[0080] This embodiment provides a method for security vulnerability scanning of Web APIs (interfaces) driven entirely by a Large Language Model (LLM). Leveraging the intrinsic capabilities of multiple intelligent agents, it simulates the workflow of a human penetration test engineer. Through multi-step Web API calls, it achieves meticulous and human-like vulnerability verification, boasting accuracy far exceeding traditional vulnerability scanners and covering many vulnerability types that traditional scanners struggle to cover.
[0081] In one embodiment, such as Figure 2 Before obtaining the interface information of the target interface and the interface associated with the target interface through the first intelligent agent, as shown, the interface security testing method further includes:
[0082] The vulnerability detection plugin also includes vulnerability preconditions;
[0083] The third intelligent agent determines whether the target interface meets the vulnerability preconditions based on the vulnerability preconditions.
[0084] In response to the target interface satisfying the vulnerability precondition, the step of obtaining the interface information of the target interface and the interface associated with the target interface through the first intelligent agent is executed;
[0085] If the target interface does not meet the preconditions for the vulnerability, no further steps will be executed.
[0086] Specifically, each plugin specifies the preconditions for the occurrence of its corresponding vulnerability type (e.g., an API that allows unauthorized deletion must first functionally delete an object). When scanning each plugin, the target API first passes through an LLM-based third-party agent. This agent mainly determines whether an API is likely to have the target vulnerability based on the vulnerability preconditions specified in the plugin description. If it is not likely, the scan will not continue, thus saving system overhead.
[0087] For example, after the target Web API / api / deleteShare is passed in, the third agent node uses an unauthorized read plugin. This plugin specifies that the prerequisite for the vulnerability is that "the API will pass in the object index and then return the object content in the response". Since the target interface is a delete interface and the response is empty, the third agent node believes that there is no possibility of a vulnerability. Therefore, it directly outputs the scan conclusion that the Web API interface / api / deleteShare does not have an unauthorized read vulnerability.
[0088] In this embodiment, when determining whether a certain API may have a target vulnerability, if there is no possibility of a vulnerability, the scan will not continue, thereby saving system overhead.
[0089] In one embodiment, the interface information of the interface associated with the target interface obtained by the first intelligent agent through the target interface comprises:
[0090] The first intelligent agent obtains the interface information of the interface associated with the target interface through the knowledge base.
[0091] Specifically, the target API enters the first intelligent agent based on LLM. The Agent will first perform RAG (Retrieval-Augmented Generation) to obtain the associated API of the target scanning API from the API knowledge base.
[0092] In one embodiment, the knowledge base traverses all interfaces through a large model, labels the request parameters and response parameters of each interface, and is used to determine the interface associated with the target interface according to the target interface.
[0093] Specifically, the API knowledge base also labels all APIs of the target web application through LLM according to their request parameters and responses, mainly to label the consumer object and producer object of each API for subsequent association, so as to determine the interface associated with the target interface according to the target interface.
[0094] In one embodiment, the interface security testing method further comprises:
[0095] The large model also generates a function description of the interface through the request parameters and response parameters of each interface, the function description is in natural language format, and the function description is used by the second intelligent agent to build a vulnerability scanning process.
[0096] Specifically, the API knowledge base also labels all APIs of the target web application through LLM according to their request parameters and responses, mainly to label the consumer object and producer object of each API for subsequent association, and also generates a function description of the API in natural language format, which is also used to assist the first intelligent agent in diagnosis and arrangement.
[0097] In the above embodiment, after the API knowledge base labels all APIs of the target web application through LLM according to their request parameters and responses, it can automatically associate the target interface and assist in arrangement.
[0098] In one embodiment, the second intelligent agent executes vulnerability scanning on the target interface according to the vulnerability scanning process to obtain a scanning result, which specifically comprises:
[0099] The second intelligent agent initiates a request to the interface in the vulnerability scanning process and obtains an interface response according to the vulnerability scanning process in sequence.
[0100] In response to the vulnerability scanning process being executed, the second intelligent agent outputs a target interface vulnerability scanning result according to the interface response.
[0101] Specifically, the scanning process is then issued to the second intelligent agent based on LLM. The Agent will call the scanning nodes in turn according to the previously arranged scanning process, initiate a request to the Web API, get the response, and then the LLM will judge whether to execute the next request or output the conclusion according to the response of the Web API. When all the steps are executed or the LLM Agent considers that there is no need to continue to execute, the LLM Agent will output a conclusion, the main content of which is whether the process execution has an error, whether the target vulnerability exists, and the reason why the large model makes the judgment.
[0102] In one embodiment, the vulnerability scanning performed by the second intelligent agent on the target interface according to the vulnerability scanning process to obtain a scanning result further includes:
[0103] In response to the second intelligent agent executing the vulnerability scanning process with an error, an alarm is output.
[0104] Specifically, if the execution process has an error, these reasons will be used for error troubleshooting and subsequent improvement.
[0105] In the above embodiment, the second intelligent agent outputs the scanning result, and the scanning result includes whether the process execution has an error, whether the target vulnerability exists, and the reason why the large model makes the judgment. Thus, the reason for the vulnerability of the target API is determined, and then manual troubleshooting and repair can be performed more quickly. If the execution process has an error, these reasons will be used for error troubleshooting and subsequent improvement.
[0106] In addition, some embodiments of the present application also provide an electronic device. The electronic device can be various forms of digital computers, such as a laptop computer, a desktop computer, a workstation, a personal digital assistant, a server, a blade server, a mainframe computer, etc. The electronic device can also be various forms of mobile devices, such as a personal digital processing, a cellular phone, a smart phone, a wearable device, and other similar computing devices.
[0107] The electronic device includes one or more processors and a memory having stored computer program instructions that, when executed, cause the processor to perform the steps of the method provided by any one or more of the above embodiments. Figure 3An exemplary structural diagram of the electronic device is disclosed. The electronic device includes one or more processors 1101, a memory 1102, and an interface for connecting the components, including a high-speed interface and a low-speed interface. The components are interconnected through different buses, and can be mounted on a common main board or otherwise installed as needed. The processor can process instructions executed within the electronic device, including instructions stored in the memory or on the memory to display a GUI on an external input / output device such as a display device coupled to the interface. In some other embodiments, a plurality of processors and / or buses can be used with a plurality of memories and a plurality of memories, if necessary. Also, a plurality of electronic devices can be connected, each device providing part of the necessary operations. Among them, the components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present application described and / or claimed herein.
[0108] The electronic device can further include an input device 1103 and an output device 1104. The processor 1101, the memory 1102, the input device 1103, and the output device 1104 can be connected by a bus or otherwise, and are connected by a bus in the figure.
[0109] The input device 1103 can receive input digital or character information, and generate key signal input related to user settings and function control of the electronic device, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 1104 can include a display device, an auxiliary lighting device (e.g., an LED), and a tactile feedback device (e.g., a vibration motor), etc. The display device can include, but is not limited to, a liquid crystal display, a light emitting diode display, and a plasma display. In some embodiments, the display device can be a touch screen.
[0110] To provide interaction with the user, the electronic device can be a computer. The computer has a display device (e.g., a cathode ray tube or an LCD monitor) for displaying information to the user, and a keyboard and a pointing device (e.g., a mouse) through which the user can provide input to the computer. Other kinds of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback); and input from the user can be received in any form (e.g., voice input or tactile input).
[0111] In the embodiments of the present application, the computer program / instruction stored on the computer readable medium is executed by the processor to implement the steps of the method provided by any one or more of the embodiments described above. The computer readable medium can be included in the electronic device described in the embodiments above, or can exist separately and not be assembled into the device. The computer readable medium carries one or more computer readable instructions.
[0112] The memory 1102 can be used to store non-transitory software programs, non-transitory computer executable programs and modules. The processor 1101 executes various functions and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 1102, so as to implement the program instructions / modules corresponding to the method provided by any one or more of the embodiments described above in the embodiments of the present application.
[0113] The memory 1102 can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function. The data storage area can store data created according to the use of the electronic device. In addition, the memory 1102 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 1102 can optionally include a memory disposed remotely with respect to the processor 1101, and these remote memories can be connected to the electronic device through a network. Examples of the network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.
[0114] It should be noted that the computer readable medium described in the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or instrument, or any combination of the above. More specific examples of computer readable storage media can include, but are not limited to, an electrical connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or instrument.
[0115] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory, static random access memory, dynamic random access memory, other types of random access memory, read-only memory, electrically erasable programmable read-only memory, flash memory or other memory technologies, read-only optical discs, digital versatile discs or other optical storage, magnetic cassette tapes, magnetic tape discs storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device.
[0116] Computer program code for carrying out operations of the present application can be written in one or more programming languages or combinations of languages including object-oriented, such as Java, Smalltalk, C++, conventional procedural programming languages, such as the C programming language or similar programming languages. Program code can be executed entirely on a user computer, partially on a user computer, as a standalone software package, partially on a user computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network or a wide area network, or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).
[0117] In the above embodiments, all or part can be implemented by software, hardware, firmware or any combination thereof. For example, a dedicated integrated circuit, a general-purpose computer or any other similar hardware device can be used. In some embodiments, the software program of the present application can be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, magnetic or optical drive or soft disc and similar devices. In addition, some steps or functions of the present application can be implemented by hardware, for example, as a circuit cooperating with the processor to perform each step or function.
[0118] The computer program product provided by the embodiments of the present application includes one or more computer programs / instructions, which, when executed by a processor, generate all or part of the processes or functions described in the embodiments of the present application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media (such as DVD), or semiconductor media (such as solid state disk), etc.
[0119] The flowcharts or block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of devices, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in a different order than that shown in the figures. For example, two blocks noted in succession can actually be executed substantially concurrently, or they can sometimes be executed in reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowcharts, as well as combinations of blocks in the block diagrams and / or flowcharts, can be implemented by dedicated hardware-based systems that perform the specified functions or operations, or they can be implemented by a combination of dedicated hardware and computer instructions.
[0120] The scope of the present application is defined by the appended claims rather than the description set forth above, and therefore the intent of the application is to be encompassed within the meaning and range of equivalents of the claims. Any reference signs in the claims should not be construed as limiting the claims to the figures in which the reference signs are used. Furthermore, the words "comprise", "comprising", "comprises" and "comprised of" do not exclude the presence of elements or steps other than those listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Multiple elements can be provided by a single element if this is clearly supported by the context. The word "comprise" or "comprising" or "comprises" does not exclude the presence of elements or steps other than those listed in a claim. The word "first", "second" and the like do not imply any particular order but are used to distinguish one element from another. They do not imply a sequence or order of steps.
[0121] The above merely provides specific examples of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims, and the above examples should be regarded as exemplary and non-limiting.
Claims
1. A method for interface security testing based on intelligent agents, characterized in that, The interface security testing method includes: Multiple vulnerability detection plugins are constructed, each corresponding to a different interface security test category, and each vulnerability detection plugin includes the basic principles of vulnerability types. The first intelligent agent obtains the interface information of the target interface and the interfaces associated with the target interface; The first intelligent agent constructs vulnerability orchestration information and creates a vulnerability scanning process based on the interface information and the basic principles of the vulnerability type. The second intelligent agent performs a vulnerability scan on the target interface according to the vulnerability scanning process and obtains the scan results.
2. The interface security testing method according to claim 1, characterized in that, Before obtaining the interface information of the target interface and the interface associated with the target interface through the first intelligent agent, the interface security testing method further includes: The vulnerability detection plugin also includes vulnerability preconditions; The third intelligent agent determines whether the target interface meets the vulnerability preconditions based on the vulnerability preconditions. In response to the target interface satisfying the vulnerability precondition, the step of obtaining the interface information of the target interface and the interface associated with the target interface through the first intelligent agent is executed; If the target interface does not meet the preconditions for the vulnerability, no further steps will be executed.
3. The interface security testing method according to claim 1, characterized in that, The step of obtaining interface information of the target interface and the interface associated with the target interface through the first intelligent agent specifically includes: The first intelligent agent obtains interface information of the target interface and the interfaces associated with the target interface through a knowledge base.
4. The interface security testing method according to claim 3, characterized in that, The knowledge base traverses all interfaces through a large model, marking the request and response parameters of each interface, and is used to determine the interfaces associated with the target interface based on the target interface.
5. The interface security testing method according to claim 4, characterized in that, The interface security testing method also includes: The large model also generates a functional description of each interface using the request and response parameters of each interface. The functional description is in natural language format and is used by the second intelligent agent to construct a vulnerability scanning process.
6. The interface security testing method according to claim 1, characterized in that, The step of performing a vulnerability scan on the target interface by a second intelligent agent according to the vulnerability scanning process and obtaining the scan results specifically includes: The second intelligent agent, according to the vulnerability scanning process, sequentially initiates requests to the interfaces in the vulnerability scanning process and obtains the interface responses; Upon completion of the vulnerability scanning process, the second agent outputs the target interface vulnerability scanning results based on the interface response.
7. The interface security testing method according to claim 1, characterized in that, The step of performing a vulnerability scan on the target interface by a second intelligent agent according to the vulnerability scanning process and obtaining the scan results further includes: In response to an error in the execution of the vulnerability scanning process by the second intelligent agent, an alarm is output.
8. An electronic device, characterized in that, The electronic device includes: One or more processors; and A memory storing computer program instructions, which, when executed, cause the processor to perform the steps of the method as described in any one of claims 1 to 7.
9. A computer-readable medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 7.
10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 7.