Vulnerability detection method, device, electronic device and storage medium

Abstract

One or more embodiments of the present application provide a vulnerability detection method, device, electronic device, and storage medium, including: in response to an event of testing an application server, obtaining access traffic generated by the application server; establishing a vulnerability detection task according to the access traffic; scanning the application server according to the vulnerability detection task to obtain vulnerability detection results. The present application can automatically obtain access traffic, improve the degree of automation, and obtain traffic that can be covered by all normal functional tests, thereby improving the coverage of vulnerability detection. By scanning the application server, it is possible to discover long-standing and undiscovered general vulnerabilities in the application server during the application function test, which helps to supplement the internal security detection capabilities.

Description

Technical Field

[0001] One or more embodiments of the present application relate to the field of security testing technology, and in particular, to a vulnerability detection method, device, electronic device, and storage medium. Background Art

[0002] In the existing technology, security testing must be performed in the daily version process, mainly including white-box code scanning, black-box web page scanning and manual penetration work. However, after the introduction of DevOps and the agility of the current R&D process, products are released several times a day and continuous integration and continuous deployment processes are required. Relying solely on manpower for black-box scanning and manual penetration cannot go deep and cannot avoid introducing security vulnerabilities, resulting in a high false alarm rate of vulnerabilities in the existing technology. Summary of the invention

[0003] In view of this, the purpose of one or more embodiments of the present application is to provide a vulnerability detection method, device, electronic device and storage medium to solve at least one of the above-mentioned problems existing in the prior art.

[0004] Based on the above objectives, one or more embodiments of the present application provide a vulnerability detection method, including:

[0005] In response to an event of testing an application server, obtaining access traffic generated by the application server;

[0006] Establishing a vulnerability detection task according to the access traffic;

[0007] The application server is scanned according to the vulnerability detection task to obtain a vulnerability detection result.

[0008] Optionally, scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result specifically includes:

[0009] Scan the application server according to the vulnerability detection task to obtain scanning data;

[0010] The scan data is compared with preset vulnerability data to obtain the vulnerability detection result.

[0011] Optionally, the scan data includes at least: call stack information and / or stack information.

[0012] Optionally, comparing the scan data with preset vulnerability data to obtain the vulnerability detection result specifically includes:

[0013] Determining whether the scan data exceeds the preset vulnerability data;

[0014] If so, the vulnerability detection result is that a vulnerability exists.

[0015] Optionally, scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result further includes:

[0016] The vulnerability detection result is compared with a preset vulnerability information database to determine the vulnerability type.

[0017] Optionally, the step of comparing the vulnerability detection result with a preset vulnerability information database to determine the vulnerability type further includes:

[0018] Visually display the vulnerability type and the vulnerability detection result;

[0019] Generate a repair report based on the vulnerability type and the vulnerability detection result.

[0020] Optionally, the establishing of the vulnerability detection task according to the access traffic also includes:

[0021] Determine whether there is duplicate traffic in the access traffic;

[0022] If so, the duplicate traffic is discarded.

[0023] Based on the same inventive concept, one or more embodiments of the present application further propose a vulnerability detection device, including:

[0024] An acquisition module, configured to acquire access traffic generated by the application server in response to an event of the test application server;

[0025] An establishing module, configured to establish a vulnerability detection task according to the access traffic;

[0026] The detection module is configured to scan the application server according to the vulnerability detection task to obtain a vulnerability detection result.

[0027] Based on the same inventive concept, one or more embodiments in the present application also propose an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any one of the vulnerability detection methods described above when executing the program.

[0028] Based on the same inventive concept, one or more embodiments in the present application also propose a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute any one of the vulnerability detection methods described above.

[0029] From the above, it can be seen that a vulnerability detection method provided by one or more embodiments of the present application includes: in response to an event of testing an application server, obtaining access traffic generated by the application server; establishing a vulnerability detection task according to the access traffic; scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result. The method provided by the present application can automatically obtain access traffic in response to an event of testing an application server, thereby improving the degree of automation, and by obtaining access traffic, it can obtain all traffic that can be covered by all normal functional tests, thereby improving the coverage of vulnerability detection, and can discover long-undiscovered common vulnerabilities in the application server during application function testing, thereby providing help for the completion of internal security detection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate one or more embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only one or more embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 A flowchart of a vulnerability detection method in one or more embodiments of the present application;

[0032] Figure 2 A schematic diagram of the structure of a vulnerability detection device in one or more embodiments of the present application;

[0033] Figure 3 A schematic diagram of an application scenario of a vulnerability detection device in one or more embodiments of the present application;

[0034] Figure 4 It is a schematic diagram of the structure of an electronic device in one or more embodiments of the present application. DETAILED DESCRIPTION

[0035] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0036] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present application should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in one or more embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "include" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0037] As described in the background technology section, in the existing technology, security testing must be performed in the daily version process, mainly including white-box code scanning, black-box web page scanning and manual penetration work. However, after the introduction of DevOps and the agility of the current R&D process, products are released several times a day and need to go through continuous integration and continuous deployment processes. Relying solely on manpower to perform black-box scanning and manual penetration cannot go deep enough and cannot avoid introducing security vulnerabilities, resulting in a high false alarm rate of vulnerabilities in the existing technology.

[0038] The applicant found through research that in the existing technology, security testing must be performed in the daily version process, which mainly includes several parts: white box code scanning (SAST), black box web page scanning (DAST) and manual penetration work. Both black box web page scanning and manual penetration work require security testers to understand the business, use manual business operations, and then use tools to scan and generate scanning results, or perform manual penetration testing to discover problems. Active vulnerability detection cannot be seamlessly connected with the DevOps process. Therefore, after the introduction of DevOps and agility in the current R&D process, products are released several times a day and all need to go through continuous integration and continuous deployment processes. Relying solely on manpower for black box scanning and manual penetration cannot go deep and cannot avoid introducing security vulnerabilities. The current fragmented R&D and security testing processes make it difficult to promote security improvements. The discovery of security issues is often very delayed, the cost of R&D changes is high, and the false alarm rate of vulnerabilities is high. For this reason, the present application responds to events of the test application server, obtains the access traffic generated by the application server, establishes a vulnerability detection task based on the access traffic, and scans the application server according to the vulnerability detection task to obtain vulnerability detection results. A passive detection method is used to solve the problem that DAST cannot be integrated into the development process, destroying the agility of software development, thereby solving the problem of high false alarm rate.

[0039] The technical solution of the present disclosure is further described in detail below through specific embodiments.

[0040] refer to Figure 1 Therefore, one or more embodiments of the present application provide a vulnerability detection method, which specifically includes the following steps:

[0041] S101: In response to an event of testing an application server, obtaining access traffic generated by the application server.

[0042] In this embodiment, in response to the event of the test application server, the access traffic generated by the application server is obtained. Specifically, a test probe can be used, and the test probe can be integrated into the test environment application server, and can be integrated into the underlying call of the application server such as Tomcat (also known as a free open source network application server). When the tester performs functional testing, the tester sends trigger traffic to the application server where the test probe is located, thereby triggering the event of the test application server. In response to the event of the test application server, the application server generates access traffic and receives all http traffic accessing the application server.

[0043] It should be noted that the access traffic generated by the application server is generated based on the trigger traffic and the event of the test application server, and the test event can generate access traffic by using actions such as access, click and refresh. Traffic can also be generated by calling automated test tasks through the CI / CD process (such as interface automation, UI automation, etc.).

[0044] In some optional implementations, a separate traffic collection queue may be established to collect access traffic returned by a test probe, wherein the test probe may be an IAST probe.

[0045] S102: Establish a vulnerability detection task according to the access traffic.

[0046] In this embodiment, a vulnerability detection task is established based on the acquired access traffic. In addition to receiving the access traffic returned from the test probe, it can also receive the traffic sent by calling the API (also known as the application programming interface). A vulnerability detection task is established based on all the acquired traffic, which is used to perform vulnerability detection on the application server in subsequent processes.

[0047] In some optional implementations, before establishing a vulnerability detection task based on access traffic, it is necessary to deduplicate access traffic according to the URL (also known as the uniform resource locator), specifically, determine whether there is duplicate access traffic; if there is duplicate access traffic, discard the duplicate access traffic, do not establish a vulnerability detection task based on it, and establish a vulnerability detection task based on non-duplicate access traffic. The duplicate traffic may be the access traffic with the same domain name, path, and parameters as the domain name, path, and parameters of the collected historical access traffic.

[0048] S103: Scan the application server according to the vulnerability detection task to obtain a vulnerability detection result.

[0049] In this embodiment, the application server is scanned according to the vulnerability detection task, so as to obtain the vulnerability detection result of the application server. Specifically, the application server is scanned according to the vulnerability detection task to obtain the scanning data, and the scanning data is compared with the preset vulnerability data to obtain the vulnerability detection result, wherein the scanning data at least includes: call stack information and / or stack information. After obtaining the scanning data, it is determined whether the scanning data exceeds the preset vulnerability data. If so, the vulnerability detection result is that there is a vulnerability. Among them, the preset vulnerability data is called according to the vulnerability database, and the vulnerability database stores the vulnerability data of all known vulnerabilities that have appeared. If the call stack information and / or stack information in the scanning data exceeds the call stack information and / or stack information of the preset vulnerability data, it proves that the scanning data exceeds the preset vulnerability data, and the vulnerability detection result is that there is a vulnerability. If all data in the scanning data does not exceed the preset vulnerability data, the vulnerability detection result is that there is no vulnerability.

[0050] In some optional implementations, after scanning the application server according to the vulnerability detection task to obtain the vulnerability detection result, the vulnerability type can be determined based on the vulnerability detection result and the preset vulnerability information library. Specifically, the preset vulnerability information library stores information about vulnerabilities that have appeared on the application server, including the type of vulnerability. If the vulnerability detection result is the same as the vulnerability in the preset vulnerability information library, the vulnerability type corresponding to the vulnerability detection result is determined based on the preset vulnerability information library. For example, if the vulnerability data determined based on the vulnerability detection result is the same as the vulnerability data of vulnerability A in the preset vulnerability information library, the vulnerability type of the vulnerability in the vulnerability detection result is determined to be vulnerability A.

[0051] It should be noted that if the vulnerability data determined according to the vulnerability detection results are different from the vulnerability data of the vulnerability in the preset vulnerability information library, it is proved that the vulnerability data determined according to the vulnerability detection results is the vulnerability data of a new vulnerability, and the vulnerability data of the vulnerability is stored in the preset vulnerability information library, and the preset vulnerability information library is updated.

[0052] In some optional implementations, after comparing the vulnerability detection results with a preset vulnerability information library to determine the vulnerability type, the vulnerability type and vulnerability detection results can be visualized, and a repair report can be generated based on the vulnerability type and vulnerability detection results. If the vulnerability type is determined to be an existing vulnerability type after comparison with the preset vulnerability information library, a repair report is directly generated based on the vulnerability type to provide vulnerability repair suggestions.

[0053] As can be seen from the above, a vulnerability detection method provided in one or more embodiments of the present application includes: in response to an event of testing an application server, obtaining the access traffic generated by the application server; establishing a vulnerability detection task according to the access traffic; scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result. The method provided in the present application can automatically obtain access traffic in response to an event of testing an application server, thereby improving the degree of automation. The entire test process is designed to be automated and triggered with one click. After obtaining the trigger traffic of the tester or the CI / CD process triggers the automated test, a vulnerability detection task is automatically created to automatically obtain the access traffic generated by the application server. And by obtaining the access traffic, all the traffic that can be covered by all normal functional tests can be obtained, thereby improving the coverage rate of vulnerability detection, and being able to discover long-undiscovered general vulnerabilities in the application server during the application function test, thereby providing help for the completion of internal security detection capabilities. In the CI / CD process of R&D management, the passive vulnerability detection method is used to solve the problem that the current DAST cannot be integrated into the development process, which destroys the agility of software development, and helps to realize the DevSecOps process, while also solving the problem of high false alarm rate.

[0054] It can be understood that the method can be executed by any device, equipment, platform, or device cluster having computing and processing capabilities.

[0055] It should be noted that the method of one or more embodiments of this specification can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of one or more embodiments of this specification, and the multiple devices will interact with each other to complete the described method.

[0056] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0057] Based on the same inventive concept, one or more embodiments of the present application further propose a vulnerability detection device, referring to Figure 2 , the vulnerability detection device comprises:

[0058] An acquisition module, configured to acquire access traffic generated by the application server in response to an event of the test application server;

[0059] An establishing module, configured to establish a vulnerability detection task according to the access traffic;

[0060] The detection module is configured to scan the application server according to the vulnerability detection task to obtain a vulnerability detection result.

[0061] In some optional implementations, a data analysis module may also be provided to statistically analyze the safety of the entire project as a basis for subsequent data analysis.

[0062] In some optional implementations, scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result specifically includes:

[0063] Scan the application server according to the vulnerability detection task to obtain scanning data;

[0064] The scan data is compared with preset vulnerability data to obtain the vulnerability detection result.

[0065] In some optional implementations, the scan data includes at least: call stack information and / or stack information.

[0066] In some optional implementations, the comparing the scan data with the preset vulnerability data to obtain the vulnerability detection result specifically includes:

[0067] Determining whether the scan data exceeds the preset vulnerability data;

[0068] If so, the vulnerability detection result is that a vulnerability exists.

[0069] In some optional implementations, scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result further includes:

[0070] The vulnerability detection result is compared with a preset vulnerability information database to determine the vulnerability type.

[0071] In some optional implementations, the step of comparing the vulnerability detection result with a preset vulnerability information library to determine the vulnerability type further includes:

[0072] Visually display the vulnerability type and the vulnerability detection result;

[0073] Generate a repair report based on the vulnerability type and the vulnerability detection result.

[0074] In some optional implementations, the step of establishing a vulnerability detection task according to the access traffic also includes:

[0075] Determine whether there is duplicate traffic in the access traffic;

[0076] If so, the duplicate traffic is discarded.

[0077] refer to Figure 3 As a specific embodiment of a vulnerability detection device, when the tester performs functional testing or when the CI / CD process triggers automated testing, the tester sends the trigger traffic to the application server and uses the acquisition module to obtain the access traffic. Specifically, the acquisition module can be a detection probe, and a detection probe, such as an IAST probe, is placed in the application server. After the access traffic is obtained by the detection probe, the access traffic is forwarded to the establishment module. Specifically, the establishment module can be an IAST server. After the IAST server receives the access traffic, a vulnerability detection task is established, and the detection module performs vulnerability detection on the application server to obtain a vulnerability detection result. Specifically, the detection module can be a scanner. After the vulnerability detection result is obtained by the scanner, the result is returned to the IAST server. The IAST server visualizes the vulnerability type and vulnerability detection result according to the vulnerability detection result, as well as a repair report, so that the tester can repair the vulnerability after the vulnerability is detected.

[0078] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more embodiments of this specification, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0079] The apparatus of the above-mentioned embodiment is used to implement the corresponding method in the above-mentioned embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0080] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, one or more embodiments of this specification also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the vulnerability detection method described in any of the above embodiments is implemented.

[0081] Figure 4 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 410, a memory 420, an input / output interface 430, a communication interface 440, and a bus 450. The processor 410, the memory 420, the input / output interface 430, and the communication interface 440 are connected to each other through the bus 450 in the device.

[0082] The processor 410 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0083] The memory 420 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 420 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 420 and are called and executed by the processor 410.

[0084] The input / output interface 430 is used to connect the input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0085] The communication interface 440 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0086] The bus 450 comprises a pathway for transmitting information between the various components of the device (eg, the processor 410, the memory 420, the input / output interface 430, and the communication interface 440).

[0087] It should be noted that, although the above device only shows the processor 410, the memory 420, the input / output interface 430, the communication interface 440 and the bus 450, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0088] The electronic device of the above embodiment is used to implement the corresponding method in the above embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0089] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, one or more embodiments of this specification also provide a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the vulnerability detection method described in any of the above embodiments.

[0090] The non-transitory computer-readable storage media of this embodiment include permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0091] The computer instructions stored in the storage medium of the above embodiments are used to enable the computer to execute the vulnerability detection method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0092] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0093] In addition, to simplify the description and discussion, and in order not to obscure one or more embodiments of the present specification, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the device may be shown in the form of a block diagram so as to avoid obscuring one or more embodiments of the present specification, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which one or more embodiments of the present specification will be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that one or more embodiments of the present specification may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0094] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0095] One or more embodiments in this application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments in this application should be included in the scope of protection of this disclosure.

Claims

1. A vulnerability detection method, characterized in that: include: In response to an event of testing an application server, obtaining access traffic generated by the application server; Establishing a vulnerability detection task according to the access traffic and the traffic sent by receiving and calling the application programming interface; Scan the application server according to the vulnerability detection task to obtain a vulnerability detection result; Scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result specifically includes: Scan the application server according to the vulnerability detection task to obtain scanning data, the scanning data at least including: call stack information and / or stack information; Comparing the scan data with preset vulnerability data to obtain the vulnerability detection result; The comparing the scan data with the preset vulnerability data to obtain the vulnerability detection result specifically includes: Determining whether the scanned data exceeds the preset vulnerability data, the preset vulnerability data is called according to a vulnerability database, and the vulnerability database stores vulnerability data of all known vulnerabilities that have appeared; If yes, then the vulnerability detection result is that a vulnerability exists; If the vulnerability data determined according to the vulnerability detection result is different from the vulnerability data of the vulnerability in the preset vulnerability information library, the vulnerability data determined according to the vulnerability detection result is the vulnerability data of the new vulnerability, the vulnerability data of the new vulnerability is stored in the preset vulnerability information library, and the preset vulnerability information library is updated; The step of establishing a vulnerability detection task according to the access traffic also includes: Determine whether there is duplicate traffic in the access traffic; If so, discard the duplicate traffic according to the uniform resource locator method, where the duplicate traffic is the access traffic with the same domain name, path and parameters as the domain name, path and parameters of the collected historical access traffic; Scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result further includes: Compare the vulnerability detection result with a preset vulnerability information database to determine the vulnerability type; The vulnerability detection result is compared with a preset vulnerability information database to determine the vulnerability type, and then the following steps are further included: Visually display the vulnerability type and the vulnerability detection result; Generate a repair report based on the vulnerability type and the vulnerability detection result.

2. A vulnerability detection device, characterized in that: include: An acquisition module, configured to acquire access traffic generated by the application server in response to an event of the test application server; An establishing module, configured to establish a vulnerability detection task according to the access traffic and the traffic sent by receiving and calling an application programming interface; A detection module, configured to scan the application server according to the vulnerability detection task to obtain a vulnerability detection result; Scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result specifically includes: Scan the application server according to the vulnerability detection task to obtain scanning data, the scanning data at least including: call stack information and / or stack information; Comparing the scan data with preset vulnerability data to obtain the vulnerability detection result; The comparing the scan data with the preset vulnerability data to obtain the vulnerability detection result specifically includes: Determining whether the scanned data exceeds the preset vulnerability data, the preset vulnerability data is called according to a vulnerability database, and the vulnerability database stores vulnerability data of all known vulnerabilities that have appeared; If yes, then the vulnerability detection result is that a vulnerability exists; If the vulnerability data determined according to the vulnerability detection result is different from the vulnerability data of the vulnerability in the preset vulnerability information library, the vulnerability data determined according to the vulnerability detection result is the vulnerability data of the new vulnerability, the vulnerability data of the new vulnerability is stored in the preset vulnerability information library, and the preset vulnerability information library is updated; The step of establishing a vulnerability detection task according to the access traffic also includes: Determine whether there is duplicate traffic in the access traffic, where the duplicate traffic is the access traffic with the same domain name, path and parameters as the domain name, path and parameters of the collected historical access traffic; If yes, discard the duplicate traffic according to the uniform resource locator method; Scanning the application server according to the vulnerability detection task to obtain a vulnerability detection result further includes: Compare the vulnerability detection result with a preset vulnerability information database to determine the vulnerability type; The vulnerability detection result is compared with a preset vulnerability information database to determine the vulnerability type, and then the following steps are further included: Visually display the vulnerability type and the vulnerability detection result; Generate a repair report based on the vulnerability type and the vulnerability detection result.

3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to claim 1 is implemented.

4. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the method of claim 1.

Images