Security test system

Abstract

To grasp appropriate operation procedures of a Web site including operation with sequentiality and to efficiently / effectively perform automatic patrol.SOLUTION: A security test system 1 examining whether or not there is security vulnerability in a Web application acquires and analyzes a Web page to be patrolled in an object Web site 3, sets to prompt information related to a content of the acquired Web page, and inputs it to a LLM 4, creates operation procedure information on the Web page, simulates operation regarding the Web page according to the operation procedure information, acquires an URL related to a link in the Web page, and registers it to a page list 14 to be patrolled.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an application testing technique, and more particularly to a technique that is effective when applied to a security testing system that checks for vulnerabilities in Web applications. [Background technology]

[0002] Web applications are premised on using a network, and from a security perspective, it is extremely important to inspect and test for vulnerabilities. There are a variety of tools and services available for inspecting web applications for vulnerabilities, and these are being investigated and developed on a daily basis.

[0003] Web application security testing methods can be broadly divided into SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing). While SAST statically analyzes source code, etc., DAST sends simulated attack (inspection) requests to a running application from an attacker's perspective and determines whether there are vulnerabilities based on changes in the application's behavior. Therefore, a DAST security testing system must identify the pages in the web application that will be targeted for attack (inspection). To do this, the target web application (website) is crawled automatically or manually, and the link configuration and other information about the pages is collected.

[0004] As an example of a technology related to the automatic crawling of such websites, Patent Publication No. 7320211 (Patent Document 1) describes a technique for automatically crawling a website in a vulnerability inspection, in which AI (Artificial Intelligence) is used to determine functions that need to be inspected for vulnerabilities, determine the degree of association between multiple executable operations that can be performed on a web page and the functions that need to be inspected, and prioritize the execution of operations that are identified as having a high degree of association. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 7320211 Summary of the Invention [Problem to be solved by the invention]

[0006] According to the above-mentioned conventional technology, when automatically crawling a website, it is possible to crawl each web page by executing the operations with the highest priority among the multiple operations that can be executed on each web page. Therefore, it is said that it is possible to prevent important functions from being overlooked even when an upper limit is set based on the number of web pages to be automatically crawled, the number of hierarchies, the elapsed time, etc.

[0007] However, some websites require sequential operations, such as a specific operation being required before the next operation can be performed. For example, on an e-commerce (electronic commerce) website, there are cases where the order screen cannot be accessed unless the customer's address is entered, or an item is added to the cart before the order screen can be accessed. In such cases, communication cannot occur unless the appropriate procedures are followed. Therefore, in order to fully understand all the operations that can be performed on each web page, it is necessary to correctly understand the website's functions and simulate operations using the appropriate procedures.

[0008] In this regard, it is difficult to establish rules in advance that cover all patterns of the order in which operations should be performed in each case. On the other hand, it is theoretically possible to determine the appropriate operation sequence by trying every possible operation in a brute force manner. However, depending on the size and complexity of the web page, the number of combinations of operation sequences that must be tried can become enormous, making it difficult to simulate the operations in a realistic amount of time.

[0009] Therefore, an object of the present invention is to provide a security test system that can automatically and efficiently patrol a website that includes sequential operations by grasping the appropriate operation procedures.

[0010] The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0011] Among the inventions disclosed in this application, the outline of representative inventions will be briefly explained as follows.

[0012] A representative embodiment of the present invention is a security test system that checks for security vulnerabilities in a web application. It acquires and analyzes a web page to be traversed within the web application to be tested, sets information related to the content of the acquired web page as a prompt and inputs it into an LLM (large-scale language model) to create first operation procedure information related to the web page, simulates operations related to the web page in accordance with the first operation procedure information, acquires URLs related to links within the web page, and registers them in a list of pages to be traversed. [Effects of the Invention]

[0013] The effects obtained by the representative inventions disclosed in this application can be briefly explained as follows.

[0014] In other words, according to a representative embodiment of the present invention, in a mechanism for inspecting website vulnerabilities, it is possible to grasp the appropriate operating procedures for websites that include sequential operations and perform automatic patrols efficiently and effectively. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a diagram showing an overview of a configuration example of a security test system according to an embodiment of the present invention. [Figure 2] 10 is a flowchart outlining an example of the flow of an automatic patrol process in one embodiment of the present invention. [Figure 3] FIG. 10 is a diagram showing an overview of a specific example of a list of pages to be visited in one embodiment of the present invention. [Figure 4] FIG. 1 is a diagram showing an outline of an example of a Web page according to an embodiment of the present invention. [Figure 5] FIG. 10 is a diagram showing an outline of another example of a Web page according to an embodiment of the present invention. [Figure 6] FIG. 1 is a diagram showing an overview of an example of creating an operating procedure manual using LLM in one embodiment of the present invention. [Figure 7] FIG. 10 is a diagram showing an overview of another specific example of the list of pages to be visited in an embodiment of the present invention. [Figure 8] FIG. 10 is a diagram illustrating an example of determining a web page that needs to be re-routed using LLM according to an embodiment of the present invention. [Figure 9] FIG. 10 is a diagram illustrating an example of determining a web page that needs to be re-routed using LLM according to an embodiment of the present invention. [Figure 10] FIG. 2 is a diagram showing an overview of an example of the data configuration of a page list to be cycled according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In all drawings used to explain the embodiments, the same parts are generally designated by the same reference numerals, and repeated explanations will be omitted. However, parts that have been designated and explained in one drawing may be referred to by the same reference numerals in the explanation of other drawings, although they will not be shown again.

[0017] <Summary> When testing website security using DAST, it is necessary to crawl the target website to find all publicly available URLs (Uniform Resource Locators) (i.e., the URLs to be inspected). (More precisely, for URLs that share common input / output processing rather than all communications that occur, the results will not change even if each URL is inspected individually, so it is sufficient to inspect (crawl) at least one URL, which means all URLs that have different input / output processing.)

[0018] There are two ways to find URLs: statically, by analyzing the website's HTML (HyperText Markup Language), and dynamically, by simulating actual website operations and collecting the traffic that occurs. When using the latter method, as mentioned above, there are cases where a website contains sequential operations, where a specific operation must be performed before the next operation can be performed, and no traffic will occur unless the operations are performed in the correct order. Therefore, to simulate actual operations, it is necessary to correctly understand the website's functions and simulate the operations in the correct order.

[0019] In this regard, it is difficult to establish rules in advance that cover all patterns of the order in which operations should be performed in each case. On the other hand, it is theoretically possible to determine the appropriate operation sequence by trying every possible operation in a brute force manner. However, depending on the size and complexity of the web page, the number of combinations of operation sequences that must be tried can become enormous, making it difficult to simulate the operations in a realistic amount of time.

[0020] Here, websites that include the above-mentioned sequential operations may include two types of web pages: those that require multiple operations to be performed in the appropriate order within a web page, and those that require operations to be performed in the appropriate order across multiple web pages.

[0021] An example of a type where multiple operations need to be performed in the correct order within a web page is when, on a screen on an e-commerce site where you register the delivery address for a product, you press the "Register" button without filling in the name and address fields, but an error occurs prompting you to enter your name and address, and you are unable to proceed to the registration completion screen (to proceed to the registration completion screen, you must enter your name and address before pressing the "Register" button).

[0022] Another example of a type where operations need to be performed in the appropriate order across multiple web pages is when, for example, on an e-commerce site, if you go to the cart screen before adding an item to your cart, the cart is empty so the "Proceed to checkout" button is not displayed and you cannot proceed to the order screen.However, if you add an item to your cart and then go to the cart screen, there is an item in the cart so you can press the "Proceed to checkout" button and proceed to the order screen.

[0023] In one embodiment of the present invention, a security testing system responds to the former type of web page where multiple operations need to be performed in an appropriate order within the web page by using a method that obtains appropriate operating procedures based on predefined rules for what order to perform operations in what situations (the conventional method), or instead of this, that uses generative AI / Large Language Models (hereinafter sometimes collectively referred to as "LLM") such as ChatGPT (registered trademark) to obtain operating procedures that are close to the content that would be obtained if a human were to perform the operations, thereby creating appropriate operating procedures (operating procedure manuals).

[0024] Furthermore, to accommodate the latter type of web page that requires operations to be performed in the appropriate order across multiple web pages, the LLM determines whether or not a change in behavior is predicted between the target web page when it was visited in the past and when it is visited again in the present, and if a change is predicted, it is considered that the operation procedures are different even if the URL is the same, and is therefore individually subject to patrolling (inspection). Note that, as will be described later, in this embodiment, by grouping and handling web pages that are essentially the same but have different URLs, the number of web pages to be patrolled is substantially reduced, and the efficiency of the patrolling and inspection processes is improved; however, web pages that are determined to be individually subject to patrolling because their behavior has changed since the previous patrol even if they have the same URL are removed from the grouping and are subject to re-patrolling.

[0025] <System configuration> 1 is a diagram showing an overview of an example of the configuration of a security test system according to one embodiment of the present invention. The security test system 1 is configured to include, for example, server devices and virtual servers constructed on a cloud computing service, and is accessed by a user terminal 2, such as a personal computer (PC), via a network such as the Internet, a virtual private network (VPN), or a local area network (LAN), all of which are not shown, using a web browser or dedicated application, all of which are not shown.

[0026] The security test system 1 realizes various functions related to the implementation of security tests by, for example, using a central processing unit (CPU) (not shown) to execute middleware such as an operating system (OS), a database management system (DBMS), and a web server program, which are loaded onto memory from a storage device such as a hard disk drive (HDD) or solid state drive (SSD), as well as software running on the OS and DBMS. The security test system 1 includes various units implemented by software, such as an inspection management unit 11, a patrol processing unit 12, and an inspection execution unit 13. The security test system 1 also includes various data stores, such as a patrol target page list 14, operating procedure manual creation rules 15, a page list 16, and inspection results 17, which are implemented as databases, file tables, etc.

[0027] The inspection management unit 11 has management functions and user interface functions related to vulnerability inspection, such as accepting input and settings from the user regarding the target website 3 to be inspected via the user terminal 2, accepting input of various settings and instructions related to the implementation of the inspection, and creating a report based on the inspection result 17, which is the result of the inspection, and presenting it to the user via the user terminal 2.

[0028] The crawling processor 12 has the function of automatically crawling target websites 3 specified by the user, registering the detected web pages in a crawl target page list 14, and creating a page list 16 including the web pages to be inspected. As described above, the crawling processor 12 identifies appropriate operating procedures for web pages that include sequential operations and are included in the target website 3, using the operating procedure manual creation rules 15 and LLM4, and creates operating procedures for the target web pages. The details of the processing performed by the crawling processor 12 will be described later.

[0029] The test execution unit 13 has a function of testing each web page registered in the page list 16 for vulnerabilities using the DAST method, for example. That is, for each target web page, when sending a request to the target website 3, it sends a pseudo-attack request by, for example, entering invalid values ​​into a form. Then, it analyzes the response from the target website 3 to determine whether it is an unusual response, determines whether there is a vulnerability, and records the determination result in the test result 17.

[0030] <Processing flow> 2 is a flowchart outlining an example of the flow of automatic patrol processing by patrol processing unit 12 in one embodiment of the present invention. When the automatic patrol processing starts, patrol processing unit 12 first obtains the start page of target website 3 specified by the user and registers it in patrol target page list 14 (S01). Then, it determines whether the end condition of automatic patrol is met (S02). For example, if patrol target page list 14 is empty, or the number of patrolled pages has reached a preset upper limit, or the elapsed time since the start of patrol has reached a preset timeout period, it determines that the end condition is met (Yes in step S02) and terminates the automatic patrol processing.

[0031] If the termination condition is not met (No in step S02), a web page (URL) to be visited is determined from among the unvisited pages based on the list of pages to be visited 14 (S03), and the page in question on the target website 3 is accessed and analyzed (S04).

[0032] FIG. 3 is a diagram outlining a specific example of the crawled page list 14 in one embodiment of the present invention. Among the URLs in the list, those with a crawl status of "Crawled" are not crawled because they have already been crawled. Also, those with a crawl status of "URL similar to XX" are not crawled because they are similar to the "Crawled" URLs (as described above, in this embodiment, web pages that are essentially the same but have different URLs are grouped and handled, thereby reducing the number of web pages to be crawled). In the example of FIG. 3, the next URL to be crawled is, for example, URL "No. 6," which was found first among those with a crawl status of "Not Crawled."

[0033] Returning to FIG. 2, after statically analyzing the target Web page (S04), a rule-based operating procedure manual is created for appropriate operating procedures (S05). In this embodiment, an operating procedure manual refers to data configured to include information on one or more operation details in the target Web page (URL) (for convenience, it is referred to as an "operating procedure 'manual'", but in reality it is data (operating procedure information)). There may be multiple operating procedures for a single Web page, and to prevent operation details from interfering with each other during simulation, once the operation details of one operating procedure manual have been executed, the target Web page is reloaded before proceeding to the execution of the operation in the next operating procedure manual.

[0034] An example of how to create a rule-based operating procedure manual is as follows: First, in step S04 of Figure 2, the HTML of the target web page is analyzed to determine the executable operations based on the event listeners registered for the elements. At this time, operations for elements that should be operated at the same time, such as elements enclosed in HTML Form tags, are grouped.

[0035] Note that "elements that should be operated at once" here does not only refer to elements within Form tags, but also to elements that require multiple operations, such as elements that display a drop-down menu when clicked, or drag and drop. Therefore, it is possible that not only multiple operations on one element, but also operations on multiple different elements are grouped together. These rules should be registered in Operation Procedure Creation Rule 15. After that, the specific operation content (selected values, input content, etc.) for each element is determined, and an operation procedure manual is created.

[0036] Figure 4 is a diagram outlining an example of a web page in one embodiment of the present invention. This figure shows the "Address Registration" screen, which is subordinate to the "Top" screen, with the elements "Postal Code," "Prefecture," "City," "Back," and "Register" enclosed in Form tags. Operations that can be performed on this screen can be understood as follows: "Top" is an a tag, so it can be clicked; "Postal Code" is an input tag, so it can be entered; "Prefecture" is a select tag, so the selected value can be changed; "City" is an input tag, so it can be entered; and the "Back" and "Register" buttons, each with a click event set, can be clicked.

[0037] Of these elements, operations related to "Top" and "Back" are not grouped, while operations related to elements within the Form tag, such as "Postal Code," "Prefecture," "City," and "Register," are grouped together. Note that although "Back" is an operation within the Form tag, it is an operation that causes a screen transition, so it will be separated in the operating procedure manual.

[0038] After that, specific operation details for each element are determined and an operation procedure manual is created. In the example of FIG. 4, for example, "Operation Procedure Manual 1" is created with the content of clicking the "Top" link. Also, "Operation Procedure Manual 2" is created with the content of entering "123-4567" for "Postal Code," selecting "Tokyo" as "Prefecture," entering "Chuo Ward" for "City," and clicking the "Register" button. Also, "Operation Procedure Manual 3" is created with the content of clicking the "Back" button. Note that specific setting values, etc. can be determined by an appropriate method, for example, by registering patterns in the operation procedure manual creation rules 15.

[0039] Returning to FIG. 2, in addition to creating a rule-based operating procedure manual (S05), in this embodiment, LLM4 is used to create an operating procedure manual that is close to the content of operations performed by a human (S06).

[0040] Figure 5 is a diagram outlining another example of a web page in an embodiment of the present invention. This shows an example of a screen for registering a delivery address on an e-commerce site, and is designed so that the delivery address cannot be registered unless the required fields (marked with *) for name, address, and phone number are filled in beforehand. Note that no Form tag is used here.

[0041] Here, when creating an operating procedure manual based on rules in step S05 of Figure 2, multiple operations that fall under the rules set in operating procedure manual creation rule 15 as "elements that should be operated at once," such as elements within a Form tag, can be grouped into one operating procedure manual as described above.

[0042] On the other hand, some websites do not use the standard HTML Form tag but instead use their own tags, as in the example in Figure 5, which can result in the operation instructions being separated because the "elements that should be operated at once" cannot be correctly recognized.For example, if the operation instructions are created based on the rules in step S05 of Figure 2 for the example web page in Figure 5, "Operation Instruction 1" would be created with the content to enter "○○" in the "Last Name" field of "Name," "Operation Instruction 2" would be created with the content to enter "△△" in the "First Name" field of "Name," "Operation Instruction 3" would be created with the content to enter "●●" in the "Sei" field of "Name (Kana)," and so on... (omitted)... and "Operation Instruction X" would be created with the content to click the "Register" button, resulting in the operation instructions being separated.

[0043] As a result of separating the operating instructions, for example, even if the "last name" of the "name" is entered in "Operating Instruction 1," the target web page is reloaded before "Operating Instruction 2" is executed, so the "last name" is returned to a state where it has not been entered and the operation to enter the "first name" is started, resulting in a problem in which the operations that should be performed at once (in the example of Figure 5, entering into a required field) cannot be performed correctly.

[0044] In contrast, when creating an operating procedure manual using LLM4 in step S06, an operating procedure manual that is closer to the content that a human would use is created in cases where functions equivalent to Form tags are implemented with proprietary tags, or where the rule-based creation of operating procedures in step S05 requires complex operations for which appropriate operating procedures cannot be created for "elements that must be operated at once." This makes it possible to create "Operating Procedure Manual 1" with the content, for example, to enter "○○" in the "Last Name" field of the required "Name," enter "△△" in the "First Name," enter "●●" in the "Name (Kana)" field, and then click the "Register" button.

[0045] FIG. 6 is a diagram outlining an example of creating an operating procedure manual using LLM4 (step S06 in FIG. 2) in one embodiment of the present invention. Here, by setting the HTML content of a screen such as the example in FIG. 5 as a prompt template, a prompt for causing LLM4 to create an operating procedure manual, as shown in the upper diagram in FIG. 6, is obtained. Note that while the example in FIG. 6 shows the HTML information of the target page being entered, information obtained by screen capture can also be used. Also, it is not necessary to enter the entire HTML text; it can be entered after being trimmed to remove unnecessary information.

[0046] By inputting the operation procedure creation prompt shown in the upper diagram into LLM4, an operation procedure (operation procedure information in JSON (JavaScript Object Notation) format, etc.) like the one shown in the lower diagram can be obtained. Then, by simulating operations using the obtained operation procedure, it becomes more likely to find requests that could not be found by simulating operations using an operation procedure obtained from a rule base (for example, a request to register a new address in the example screen of Figure 5).

[0047] In this embodiment, the comprehensiveness of operations in the operating procedure manual is efficiently improved by performing both the conventional rule-based creation of the operating procedure manual (step S05 in FIG. 2) and the creation of the operating procedure manual using LLM4 (step S06 in FIG. 2), but it is also possible to only create the operating procedure manual using LLM4. Also, in the example of FIG. 2, it is described that the steps are performed in the order of rule-based creation of the operating procedure manual → creation of the operating procedure manual using LLM4, but the steps may be performed in the reverse order or in parallel.

[0048] Returning to Fig. 2, the process then simulates screen operations of the target Web page in accordance with the operating instructions created in steps S05 and S06 (S07). It is then determined whether the screen display has changed as a result of the operations (S08). If the screen has changed (Yes in step S08), the process returns to step S05 using information about the changed screen (e.g., DOM (Document Object Model) or screen capture, etc.) to create an operating instruction manual (rule-based and LLM4-based), and to simulate screen operations according to the created operating instruction manual.

[0049] On the other hand, if there are no more changes in the screen display due to the operation (No in step S08), a list of pages to be visited 14 is created from a list of URLs found in the target web page (S09). At this time, if the target web page has already been visited, there is a high possibility that the URLs found will be the same even if the web page is visited again. Therefore, in this embodiment, to reduce unnecessary visiting, a rule base is used to determine whether the found URLs overlap (are substantially the same) with existing web pages that have been visited in the past, and duplicates are grouped and excluded from the visiting target (S10).

[0050] However, even if a URL is substantially the same as an existing web page that has been visited in the past, if the prerequisites (operations performed) leading up to the URL are different, the behavior of the target web page may change, and in that case it will be necessary to visit it again. Therefore, in this embodiment, LLM4 is used to determine whether the behavior of the target web page is expected to change from when it was visited in the past, and if it is expected to change, the target web page is removed from the grouping targets and made a target for re-visiting (S11).

[0051] 7 is a diagram outlining another specific example of the crawl target page list 14 in one embodiment of the present invention. In the example of FIG. 7, the "No." column indicates the order in which each URL was found, and the "Parent" column indicates the number of the parent screen on which the link of the target URL was found. That is, in step S09 of FIG. 2, the analysis of the top screen "No. 1" resulted in the discovery of the cart screen "No. 2" and the product list screen "No. 3." Then, the analysis of the "No. 3" screen resulted in the discovery of the screen for adding the product "No. 4" to the cart, and the analysis of the "No. 4" screen resulted in the discovery of the cart screen "No. 5."

[0052] In this case, in the processing of step S10 in Figure 2, the cart screen for "No. 5" is similar (substantially identical) to the cart screen for "No. 2," and because it has already been visited, it is grouped with the "No. 2" screen and determined that visiting it is not necessary. However, the "No. 2" cart screen shows the cart in its initial state, with no products added to the cart and it is empty, so it is not possible to proceed to the checkout screen. However, since the "No. 5" cart screen was transitioned to after a product was added to the cart on the "No. 4" screen, it is expected that by visiting it again, a new operation (URL) to proceed to the checkout can be found (i.e., these web pages contain sequential operations across multiple web pages).

[0053] Therefore, in this embodiment, by processing step S11 in Figure 2, based on the prerequisites (operations) for reaching the target URL in the list of URLs grouped by the rule base in step S10, LLM4 is used to determine whether it is expected that the behavior of the web page will change between the previous visit (screen "No. 2") and the current visit (screen "No. 5"), i.e., whether a re-visit is necessary.

[0054] 8 and 9 are diagrams outlining an example of determining which web pages need to be re-routed using LLM4 (step S11 in FIG. 2) in one embodiment of the present invention. In this example, by setting the URLs that have already been found (routed) and the URLs found in the current roaming in the contents of the list of pages to be roamed 14, such as the example in FIG. 7, in the prompt template, a prompt is obtained, such as that shown in FIG. 8, for causing LLM4 to determine which URLs need to be re-routed.

[0055] Here, in the data for the URL that has already been visited, in addition to the screen ID ("id") and parent ID ("parentId") properties, a summary ("summary") property contains text that gives an overview of the operations, but it is also possible to include not only an overview of the operations performed in this visit, but all operations performed since the start of the visit. For example, in the example in Figure 7 above, after adding a product to the cart on screen "No. 4", the user is moved directly to cart screen "No. 5". However, if the website is structured so that after adding a product to the cart, the user cannot move to the cart screen without first returning to the top screen "No. 1", it is not possible to properly determine whether or not the cart screen "No. 5" needs to be visited again without tracing back the process that led to the move to the top screen.

[0056] By inputting a prompt such as that shown in the example of Fig. 8 into the LLM4, it is possible to obtain the output shown in Fig. 9. This output includes information on URLs that require re-routing. Note that in this embodiment, whether or not a re-routing is required is determined using the LLM4 as described above, but in cases where there are a large number of URLs to be determined, it is also possible to determine some or all of them using a rule base instead of the LLM4 to improve efficiency.

[0057] 2, the URLs determined to need to be re-routed in step S11 are registered in the list of pages to be roamed 14 (or, if the target URL is already registered in the list of pages to be roamed 14, its roaming status is changed) (S12).Then, the process returns to step S02 and repeats the subsequent processes until the condition for ending the automatic roaming is met (Yes in step S02).

[0058] <Data structure> 10 is a diagram outlining an example of the data configuration of the crawled page list 14 in one embodiment of the present invention. The crawled page list 14 is a table that holds a list of pages (URLs) that are the target of (or have been crawled by) automatic crawling, and includes items such as the crawled page ID, parent page ID, crawl request ID, URL, URL summary, method, request, response, capture, page crawl status, operation content, and operation summary.

[0059] The "Crawl Target Page ID" field holds ID information that uniquely identifies the page to be crawled. The "Parent Page ID" field holds ID information that identifies the parent page where the page to be crawled was found. The "Crawl Request ID" field holds ID information that uniquely identifies the crawl request for the target website 3 that contains the target page. By making it possible to individually identify each crawl request, for example, information on the overall status of each crawl (waiting to be crawled, crawling in progress, crawl completed, etc.) can be managed separately using a management table (not shown) or the like.

[0060] The URL field holds information about the URL of the target page. The URL summary field holds text obtained as a result of analyzing the target page that gives an overview of what the target page is (for example, "Home page" or "Add product to cart"). The Method, Request, Response, and Capture fields hold the method of the target page (GET, POST, PUT, etc.), the request for the target page and the response to it, and a screen capture of the target page, respectively. The Page Crawl Status field holds information about the crawling status of the target page (waiting to crawl, crawling in progress, crawling completed, etc.).

[0061] The operation details field contains the specific operation details required to reach the URL of the target page (e.g., [{"name":"open","url":"https: / / example.com / top / "},{"name":"clickAt","target":" / / a[.='link']"}], etc.). The operation summary field contains a sentence that outlines the operation details (e.g., "Open the top screen and click [link]").

[0062] As described above, according to the security test system 1, which is one embodiment of the present invention, in order to deal with the type of web page that requires multiple operations to be performed in an appropriate order within the web page, in addition to the conventional method of obtaining appropriate operation procedures based on predefined rules for what order operations should be performed in what situations, it is possible to create appropriate operation procedures and simulate screen operations using a method that uses LLM4 to obtain operation procedures that are close to the content that would be obtained if a human were to perform the operation.

[0063] Additionally, to handle web pages that require operations to be performed in the correct order across multiple web pages, LLM4 determines whether or not the behavior of the target web page is predicted to change between the previous visit and the current visit. If a change is predicted, the operation procedure is different even for the same URL, so the page is removed from the grouping and made a target for revisiting. This makes it possible to understand the correct operation procedure for target websites3 that include operations that require a specific order, and to perform efficient and effective automatic patrolling.

[0064] The invention made by the inventor has been specifically described above based on the embodiments, but it goes without saying that the present invention is not limited to the above embodiments and can be modified in various ways without departing from the spirit of the invention. Furthermore, the above embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those having all of the described configurations. Furthermore, it is possible to add, delete, or replace part of the configuration of the above embodiments with other configurations.

[0065] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The above-described configurations, functions, etc. may also be implemented in software, with a processor interpreting and executing a program that implements each function. Information such as the programs, tables, and files that implement each function can be stored in a storage device such as a memory, hard disk, or SSD, or in a storage medium such as an IC card, SD card, or DVD.

[0066] In addition, in the above figures, the control lines and information lines shown are those that are considered necessary for explanation, and do not necessarily show all the control lines and information lines that are actually implemented. In reality, it can be assumed that almost all components are interconnected. [Industrial Applicability]

[0067] The present invention can be used in a security test system that checks for vulnerabilities in web applications. [Explanation of symbols]

[0068] 1...Security test system, 2...User terminal, 3...Target website, 4...LLM, 11...Inspection management department, 12...Cycling processing department, 13...Inspection implementation department, 14...Cycling target page list, 15...Operation procedure manual creation rules, 16...Page list, 17...Inspection results

Claims

1. A security test system for inspecting whether or not a web application has security vulnerabilities, Acquire and analyze a web page to be traversed within the web application to be inspected, set information relating to the content of the acquired web page as a prompt, and input the information into an LLM (Large Scale Language Model) to create first operating procedure information relating to the web page; The security test system simulates an operation related to the Web page in accordance with the first operational procedure information, obtains a URL related to a link in the Web page, and registers the URL in a list of pages to be visited.

2. 2. The security test system according to claim 1, The results of past visits to the web page and the contents of the target visit are input as prompts to the LLM, and a determination is made as to whether a change in the behavior of the web page is predicted; If it is estimated that there is a change in the behavior of the web page, the web page related to the target crawling operation is registered in the crawl target page list.

3. 2. The security test system according to claim 1, In addition to the first operating procedure information created by the LLM, creating second operating procedure information for the web page based on a predetermined rule from the analysis result for the web page; A security test system that simulates an operation related to the Web page in accordance with the second operation procedure information, obtains a URL related to a link in the Web page, and registers the URL in the list of pages to be visited.

4. A security test system for inspecting whether or not a web application has security vulnerabilities, Acquire and analyze a web page to be traversed within the web application to be inspected, set information relating to the content of the acquired web page as a prompt, and input the information into an LLM (Large Scale Language Model) to create first operating procedure information relating to the web page; simulating an operation related to the Web page in accordance with the first operation procedure information, and inputting the result of the simulation into the LLM to correct the first operation procedure information; A security test system that simulates an operation related to the Web page in accordance with the modified first operating procedure information.

Images