A web application complex network representation method with high information integration

Abstract

The application discloses a kind of information highly integrated Web application complex network representation method, belong to information security technical field, including by static analysis and dynamic analysis technology construction basic network representation, based on edge label annotation and node label annotation improves traditional software test representation method, and fuses multiple types Web vulnerability feature construction complex network representation method.The application provides new concept and method for the complete representation of the multi-level structure information of Web system, which is beneficial to solve the problems of functional fragmentation and independence of current Web security analysis tool method, single type of vulnerability detection, etc., effectively represents the static structure and dynamic behavior information of Web application, and provides a feasible basis for various types of vulnerability detection, positioning and defense research.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of information security, and in particular to a Web application complex network representation method with high information integration. BACKGROUND

[0002] With the Internet entering the Web 3.0 era, Web applications have become the interactive center and direct carrier of network information resources. According to the Acunetix Web Application Vulnerability Report, about 63% of Web sites on the Internet today have vulnerabilities and are vulnerable to hacker attacks. As a complex, dynamic and interactive system, the traditional source code representation technology cannot fully represent the complex multi-level structure information of the Web application, which makes the vulnerability detection of the Web application fragmented and independent, and the vulnerability detection type single, and it is difficult to perform multi-type vulnerability detection.

[0003] The existing Web application analysis technologies of various types are divided into static analysis and dynamic analysis. Static analysis includes source code analysis and executable file analysis, which can detect vulnerabilities that cannot or almost cannot be detected in dynamic analysis, has high coverage, but has problems such as time-consuming and false negatives. Dynamic analysis includes fuzz testing, dynamic taint analysis and symbolic execution, which can detect vulnerabilities in the runtime environment that are missed in static code analysis, but cannot guarantee the complete test coverage of the source code.

[0004] However, the three main problems existing in the representation method based on the Web application are as follows:

[0005] 1. Representing the Web application source code as a text sequence or an abstract syntax tree form cannot capture the syntax structure information of the source code and the control flow and data dependency relationship at the same time. A single analysis technology or an analysis technology combination without logic introduction is not enough to represent the multi-level structure information of the Web application.

[0006] 2. In the dynamic execution of the Web application, different roles will produce different network models, and different parameter information transmission exists between different pages. The program vulnerability analysis related to request jumping needs to obtain the request parameter information as the basis for vulnerability analysis.

[0007] 3. In the static analysis of the Web application, the variables, processing functions and operators in the program source code are diverse. The static code feature vector representation obtained at the cost of a large number of samples performs poorly in detecting Web applications in different periods. SUMMARY

[0008] The technical problem to be solved by the present application is to provide a Web application complex network representation method with high information integration, which introduces a dynamic and static combined analysis method in the Web application vulnerability detection technology, uses a complex network technology, establishes an information highly integrated complex network representation method, comprehensively reveals the multi-level information interaction mechanism of the Web system front-end input, back-end business logic processing and database operation, and improves the high reusability of the Web application representation technology in the vulnerability test.

[0009] To solve the above technical problems, the technical solution adopted by the present application is as follows: a Web application complex network representation method with high information integration, comprising the following steps:

[0010] Step S1, collect a plurality of Web application code samples to form an initial Web application code sample library, wherein each Web application contains A vulnerabilities, and each vulnerability contained in each Web application is of a business logic type, a session management type or an input verification type;

[0011] Step S2, perform dynamic analysis according to the Web application code, perform dynamic access to each page of the Web application, and construct a dynamic basic network representation method;

[0012] Step S3, perform static analysis according to the Web application code, add branches to the dynamic basic network representation method, construct a basic network representation method according to the page request transfer, and use the basic network representation method as the basis of the information highly integrated Web application complex network representation method;

[0013] Step S4, perform depth-first access according to the node list, and dynamically obtain jump information generated when the node jumps, wherein the jump information includes role type information, request response parameter information and session parameter information;

[0014] Step S5, parse and organize the jump information as edge label annotations of the information highly integrated Web application complex network representation method;

[0015] Step S6, combine the edge label annotations to the corresponding directed edges on the dynamic basic network representation method in step S2 to form a basic network representation method with edge label annotations, and use the basic network representation method as the research basis of the business logic type vulnerability and the session management type vulnerability;

[0016] Step S7, extract Web application input vulnerability analysis high-frequency words from the Web application code sample library, wherein the top C effective words are used as code elements for node label annotations, and C is a positive integer not less than 20;

[0017] Step S8, on the web application code sample library, according to the static attribute of the code element sample, the code element corresponding static attribute rule sample table is designed as the basis for the code element attribute classification;

[0018] Step S9, on the static code of the page level, the data flow analysis technology is used to track the variable data flow propagation process, and the propagation process is stopped at the dangerous function;

[0019] Step S10, according to the code element corresponding static attribute rule sample table, the variable data flow propagation process is represented as a path, which is used as the node label annotation of the information highly integrated web application complex network representation method;

[0020] Step S11, on the dynamic basic network representation method, the node label annotation is merged into the corresponding page node as the research basis of the input validation class vulnerability, and the information highly integrated web application complex network representation method is formed;

[0021] Step S12, the open source web application code is obtained through the open source platform at home and abroad, or the source code content of the secure website is obtained by using the crawler technology, and the method is migrated to the web application code sample;

[0022] Step S13, the time interval between the publication time and the collection date is taken as a period, and steps S7-S8 are repeatedly executed to update the web application complex network representation method as the research basis of the web application vulnerability detection.

[0023] The further improvement of the technical scheme of the application is that: in the step S1, A is a positive integer not less than 3, the business logic class vulnerability includes access control vulnerability, parameter tampering vulnerability, workflow bypass vulnerability, workflow conflict vulnerability, the session management class vulnerability includes CSRF vulnerability, session hijacking vulnerability, session fixation vulnerability, session sniffing vulnerability, the input validation class vulnerability includes SQL injection vulnerability, XSS vulnerability, XML injection vulnerability, LDAP injection vulnerability, OS command line injection vulnerability, remote code execution vulnerability, local or remote file inclusion vulnerability.

[0024] The further improvement of the technical scheme of the application is that: the specific steps of dynamic analysis in the step S2 are:

[0025] Step S21, the client page of the web application is dynamically rendered, all link jump nodes contained in each page and the jump relationship between the nodes are obtained, and an initial node list is formed;

[0026] Step S22, the initial nodes are arranged, the common prefix in the initial nodes is removed, the arranged initial nodes are selected, and a node list is formed;

[0027] Step S23, selecting the page node in the node list as the network node in the dynamic basic network representation method; selecting the jump relationship between the nodes in the node list as the directed edge in the dynamic basic network representation method.

[0028] Further improvement of the technical scheme of the present application is that the specific steps of step S3 are:

[0029] Step S31, statically analyzing the source code of the Web application, combining the source code page, and adding the page node that is difficult to cover by dynamic analysis through the KM algorithm;

[0030] Step S32, performing a branch operation on the dynamic basic network representation method, and the dynamic basic network representation method is represented as:

[0031] G0={N,E},

[0032] Wherein, N represents the page node set, and E represents the page request relationship edge set;

[0033] Step S33, recording the jump relationship between the page nodes, and mapping the jump relationship between the nodes in the dynamic basic network to generate a basic network representation method covering all page nodes.

[0034] Further improvement of the technical scheme of the present application is that the edge label annotation in step S5 is represented as:

[0035] Ea={R,U,HTTP,URL};

[0036] Wherein, Ea is the edge label annotation; R is the user role set; HTTP is a set of HTTP request response parameters transmitted through the request, including request response and session parameter types; URL is the source path.

[0037] Further improvement of the technical scheme of the present application is that the code element corresponding to the static attribute rule sample table in step S8 includes code element sample information, static attribute information and description information.

[0038] Further improvement of the technical scheme of the present application is that the node label annotation in step S10 is represented as:

[0039] Na={Path1,Path2,…,Path i ,…},

[0040] Wherein, Path i represents a path, defined as <N i ,V i ,L i >, wherein N i is a static attribute list existing on the path, V iL for the corresponding variable name i V for the variable i The code line where the incoming dangerous function is located.

[0041] Further improvement of the technical scheme of the present application is that the Web application code publication time in step S13 is not more than D months from the collection date, and the number of Web applications is E, wherein D is a positive integer not less than 1, and E is a positive integer not less than 10.

[0042] Due to the adoption of the above technical scheme, the present application has achieved the following technical progress:

[0043] 1. The present application combines the advantages of dynamic analysis technology, which can accurately reflect the actual execution of the program, and static analysis technology, which has high coverage of Web application source code, by fusing dynamic analysis technology and static analysis technology.

[0044] 2. The present application introduces edge label annotation features as edge label annotations of the basic network model by analyzing and extracting information such as role type, request response parameters, and session parameter type, to support research and analysis of business logic, session management, and other vulnerabilities.

[0045] 3. The present application extracts high-frequency code elements related to static properties using Web application source code and its vulnerability analysis report, formulates static security property representation rule samples based on intermediate representation, and reduces feature redundancy in input validation vulnerability detection based on machine learning.

[0046] 4. The present application uses data flow analysis technology to track variable data flow propagation processes, starting from user input points to dangerous functions, introduces data flow path features as node label annotations of the basic network model according to the static security property representation rule sample table, and supports research and analysis of input validation vulnerabilities.

[0047] 5. The present application introduces dynamic and static combined analysis methods in the field of information security technology, especially in the technology of Web application vulnerability detection, uses complex network technology to establish an information highly integrated complex network representation method, fully reveals the multi-level information interaction mechanism of Web system front-end input, back-end business logic processing, and database operation, and improves the high reusability of Web application representation technology in vulnerability testing. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 is the complex network representation method construction flowchart of the present application;

[0049] Figure 2 is a basic network representation method sample graph of the present application;

[0050] Figure 3 This is an example diagram of the basic network representation method for edge-labeled annotation in this invention;

[0051] Figure 4 This is an example diagram of the complex network representation method for web applications of the present invention. Detailed Implementation

[0052] The present invention will be further described in detail below with reference to embodiments:

[0053] like Figure 1 As shown, a method for representing complex networks in highly integrated web applications is characterized by the following steps:

[0054] Step S1: Collect several web application code samples to form an initial web application code sample library. Each web application contains A vulnerabilities, where A is a positive integer not less than 3. The vulnerability types in each web application are business logic vulnerabilities, session management vulnerabilities, and input validation vulnerabilities.

[0055] Specifically, the A vulnerabilities contained in each web application should be included in the following categories: access control vulnerabilities, parameter tampering vulnerabilities, workflow bypass vulnerabilities, and workflow conflict vulnerabilities in the business logic category; CSRF vulnerabilities, session hijacking vulnerabilities, session pinning vulnerabilities, and session sniffing vulnerabilities in the session management category; and SQL injection vulnerabilities, XSS vulnerabilities, XML injection vulnerabilities, LDAP injection vulnerabilities, OS command line injection vulnerabilities, remote code execution vulnerabilities, and local or remote file inclusion vulnerabilities in the input validation category.

[0056] This embodiment uses web application code samples extracted from the SourceForge open-source software development platform to form a web application code sample library. The programming languages ​​of the web application code are PHP, JAVA, etc. In this embodiment, A is 3. Each web application contains vulnerabilities including SQL injection, CSRF, and access control vulnerabilities for network design.

[0057] Step S2: Perform dynamic analysis based on the Web application code, dynamically access each page of the Web application, and construct a dynamic basic network representation method;

[0058] The specific steps of dynamic analysis are as follows:

[0059] Step S21: Dynamically render the client pages of the web application, obtain all the link jump nodes contained in each page and the jump relationships between nodes, and form an initial node list.

[0060] The embodiment is to use dynamic analysis, to perform dynamic rendering in a depth-first manner on a client page of a web application, to obtain all link jump nodes contained in the page, such as Src, Href, Action, and the like, window.location, window.open, location.assign, and the like, until all jumpable nodes are accessed completely, and the jump relationship between the nodes is recorded, to form an initial node list representing the page nodes and the jump relationship.

[0061] Step S22, the initial nodes are arranged, common prefixes in the initial nodes are removed, and the arranged initial nodes are selected to form a node list.

[0062] The embodiment is to arrange the nodes in the initial node list, and remove the common parts between the nodes. For example, https: / / xxx / xxx / a.php is arranged into xxx / a.php, and https: / / xxx / a.php is arranged into a.php, the common part https: / / xxx / between the two nodes is removed, to solve the problem of path repetition between the nodes.

[0063] Step S23, the page nodes in the node list are selected as network nodes in the dynamic basic network representation method, and the jump relationship between the nodes in the node list is selected as a directed edge in the dynamic basic network representation method.

[0064] Step S3, according to the static analysis of the web application code, the dynamic basic network representation method is added with branches, the basic network representation method is constructed according to the page request transfer, and serves as a basis of the information-highly-integrated web application complex network representation method.

[0065] The specific steps of step S3 are as follows:

[0066] Step S31, the web application source code is statically analyzed, the page of the source code is combined, and the KM algorithm is used to add page nodes that are difficult to cover by dynamic analysis;

[0067] Step S32, the dynamic basic network representation method is added with branches, and the dynamic basic network representation method is represented as:

[0068] G0={N,E},

[0069] Wherein, N represents a page node set, and E represents a page request relationship edge set.

[0070] Step S33, the jump relationship between the page nodes is recorded, and is mapped with the jump relationship between the nodes in the dynamic basic network, to generate a basic network representation method with full coverage of the page nodes.

[0071] The embodiment is based on the dynamic analysis generated basic network representation method, using static code analysis method, adding the page node which cannot be dynamically rendered in dynamic analysis to the dynamic basic network, recording the jump relationship between the page node and the node in the dynamic basic network, and generating the basic network representation method of full coverage of page node. Figure 2 The basic network representation method sample diagram is constructed by taking the pages of Login.php, Index.php, ForgotPwd.php and the jump relationship as examples.

[0072] In step S4, the jump information generated in the dynamic acquisition of node jump is obtained according to the node list, wherein the jump information includes role type information, request response parameter information and session parameter information.

[0073] In the embodiment, different roles will generate different network models when the node list is used to perform depth-first access to the web application sample, and different parameter information is transmitted between different pages. The role type information is divided into administrator level (administrator), ordinary user level (user) and anonymous user level (anonymous) according to the role level of accessing the web application. The request response parameter type information is divided into GET request and POST request according to the request mode. In the analysis of the request, the request is analyzed according to different request modes. For example, the parameters in the GET request are analyzed based on the standard query string format, while the parameters in the POST request are extracted from the request body using a parser to obtain the required content type, such as multipart / form-data, application / json and Content-Type header value. The session parameter type information is used as a unique identity parameter of the user, and the information that can uniquely identify the user identity in the database system should be obtained, that is, the non-repetitive parameters such as Session[“userid”] and Session[“username”]. The cookie in the session is directly related to the security of the HTTP request because it gives the HTTP request a stateful nature, and its attribute values will directly affect the security of the HTTP request, such as the Secure, Expires and HttpOnly attributes.

[0074] In step S5, the jump information is parsed and sorted as the edge label annotation of the complex network representation method of the web application with high information integration, and the edge label annotation is represented as:

[0075] Ea={R,U,HTTP,URL};

[0076] Wherein, Ea is the edge label annotation; R is the user role set; HTTP is a set of HTTP request response parameters passed by request, including request response and session parameters and the like; URL is the source path.

[0077] In the embodiment, R is the user role set, including R0 (anonymous user role), R1 (normal user role), and R2 (administrator user role). Taking R0, R1, and R2 as examples, the edge label annotation features of the web application sample are obtained as follows:

[0078] Ea1 = {[admin, user], userid, [isPOST, isHTTPOnly], url};

[0079] Ea2 = {[admin, user], [userid, cookies], [isGET, Referer], url};

[0080] Ea3 = {[admin], [userid, cookies], [isPOST, isSecure], url};

[0081] Ea1 indicates that the request allows the administrator role and the normal user role to access, the user parameter information contained in the transmission parameter is userid, the request mode is POST, and document.cookie cannot access the Cookie of the request.

[0082] Ea2 indicates that the request allows the administrator role and the normal user role to access, the transmission parameter contains the cookie parameter configured by the client and the inherent parameter userid of the user, the request mode is GET, and Referer is carried to record the link source of the link.

[0083] Ea3 indicates that the path is only allowed to be accessed by the administrator user role, the transmission parameter contains the cookie parameter configured by the client and the inherent parameter userid of the user, the request mode is POST, and the browser only transmits the Cookie in the secure protocol such as HTTPS and SSL.

[0084] Step S6, on the dynamic basic network representation method in step S2, the edge label annotation is combined to the corresponding directed edge to form a basic network representation method with edge label annotation, which is used as the research basis of the business logic class vulnerability and the session management class vulnerability.

[0085] In this embodiment, the edge label annotation Ea is marked in one-to-one correspondence with the directed edge in the base network in the dynamic base network representation method in step S2, forming a base network representation method with edge label annotation. Figure 3 A base network representation method with edge label annotation example with Login.php, Index.php, ForgotPwd.php, and other pages as nodes.

[0086] In step S7, the high-frequency words of the web application input vulnerability analysis are extracted from the web application code sample library, and the top C effective words are used as code elements for node label annotation, where C is a positive integer not less than 20.

[0087] In this embodiment, the high-frequency words of the web application input vulnerability analysis are extracted using the word frequency statistical algorithm, C is 20 in this embodiment, and the effective words of the code element example used for node label annotation are the keywords related to input validation vulnerabilities in the web application. The keywords are extracted from the input validation vulnerability analysis report library after removing meaningless words such as articles, pronouns, and quantity words, and the obtained code elements include but are not limited to: $_GET, $_POST, $_QUERY, $_SERVER, mysql_escape_string, pg_escape_bytec, mysql_real_escape_string, mysqli_stmt_bind_param, db2_escape_string, dbx_escape_string, mysql_query, mysql_unbuffered_query, mysql_db_query, mysqli_query, mysqli_real_query, mysqli_master_query, mysqli_execute, mysqli::query, mysqli::multi_query, mysqli::real_query. The removed words include but are not limited to: the, is, to, a, and, in, of, also, from.

[0088] Table 1 Code element corresponding static attribute rule example

[0089]

[0090]

[0091] Step S8, according to the static attribute of the code element sample, design the code element corresponding static attribute rule sample table as the basis of the code element attribute classification on the web application code sample library; the code element corresponding static attribute rule sample table includes code element sample information, static attribute information and description information.

[0092] In this embodiment, the security attribute of the code element (function and operator) is obtained by analyzing the relationship between the code element and the input verification and input filtering, and the commonly used code elements are classified according to the security attribute. For example, in the PHP code, the function mysql_escape_string() is used to escape the string, so as to safely execute the database query operation, and the attribute can be classified as sanitization, indicating that the security attribute of the function is input filtering. Table 1 is a code element corresponding static attribute rule sample table, which classifies all the top C valid words according to their security attributes to obtain the code element corresponding static attribute rule sample.

[0093] Step S9, on the page level static code, use data flow analysis technology to track the variable data flow propagation process, wherein the propagation process is to the dangerous function.

[0094] In this embodiment, in the page level static code of the web application sample library, different variables will correspond to multiple data flow paths. For example, in the path "$pwd=$_POST['pwd']→$pwd=mysqli_real_escape_string($pwd)→$name=mysqli_query(″select name from user where id=$id and pwd='$pwd'″)", "$_POST['pwd']" is the input point of the variable pwd, "mysqli_real_escape_string($pwd)" is the SQL injection attack filtering of the variable pwd, and "mysqli_query(″select name from user where id=$id and pwd='$pwd'″)" is the dangerous function involving the variable pwd. The path represents the propagation process of pwd from the input point to the dangerous function, wherein the input point is $POST, the dangerous function is mysql_query(), and the function can cause SQL injection attack.

[0095] Step S10, according to the code element corresponding static attribute rule sample table, path representation Path i , as the node label annotation of the web application complex network representation method with high information integration;

[0096] The node label annotation is expressed as:

[0097] Na={Path1, Path2,..., Path i ,...},

[0098] wherein Path i is defined as <M i , V i , L i >, wherein M i is a list of static attributes existing on the path, V i is a corresponding variable name, and L i is a code line where the variable V i is transmitted.

[0099] In this embodiment, in the plurality of data flow paths corresponding to different variables, the code elements can be corresponded to the static attribute rule table, matched with the corresponding classification, and the file name and line number where each path is located are recorded, and the path is mapped to the path representation Path i by the rule table. Taking the path in step 9 as an example, the corresponding path representation is:

[0100] Path i ={[user input, sqli_sanitization, sqli_sink], pwd, 2}.

[0101] The set Na of all path representations in a page node is the node label annotation of the page node, and the label annotations of each page node are different.

[0102] In step S11, the node label annotation is combined to the corresponding page node on the basis of the dynamic basic network representation method, as the research basis of the input validation class vulnerability, and the information highly integrated Web application complex network representation method is composed.

[0103] In this embodiment, on the basis of the basic network representation method with edge label annotation, the node label annotation Na is corresponded to and marked with the page node in the basic network, and the information highly integrated Web application complex network representation method is formed. Figure 4 The information highly integrated Web application complex network representation method sample diagram with Login.php, Index.php, ForgotPwd.php and the like as nodes is shown in FIG. 6.

[0104] In step S12, the method migration Web application code sample is obtained by obtaining the open source Web application code in the open source platform at home and abroad or using the crawler technology to obtain the source code content of the secure website, and a method migration Web application code sample library is composed.

[0105] The crawler technology used herein refers to a technology of a program or a script for automatically capturing information on the World Wide Web by data collection, processing and storage according to certain rules.

[0106] In this embodiment, the specific implementation process of the crawler technology is as follows:

[0107] 1. First, select index.php and login.php of the website as seed URLs;

[0108] 2. Put the above URLs into the URL queue to be captured;

[0109] 3. Take the URL from the above queue, perform DNS resolution to obtain the host IP, download the page corresponding to the URL, and store it in the page library, and put the URL into the captured URL queue;

[0110] 4. Analyze the page corresponding to the URL in the captured URL queue, parse all URLs contained in the current page, and put them into the URL queue to be captured.

[0111] 5. Repeat steps 3-4 until the URL queue to be captured is empty, and the loop ends.

[0112] Step S13: Repeat steps S7-S8 with the time interval between the publication time and the collection date as the period, update the Web application complex network representation method as the research basis for Web application vulnerability detection.

[0113] The publication time of the Web application code is not greater than D months apart from the collection date, and the number of Web applications is E, wherein D is a positive integer not less than 1, and E is a positive integer not less than 10.

[0114] In this embodiment, D is 12, the crawled website is GitHub and SourceForge, and the test years are 2020 and 2021. The Web application code sample library in 2020 contains 13 samples, and the number of samples in the Web application code sample library in 2021 is 18. The static attribute rule sample table contains 28 code elements corresponding to the code elements in 2019, the number of code elements increases to 39 after step 7-step 8 is executed in 2020, and the number of code elements increases to 46 after step 7-step 8 is executed in 2021.

[0115] In summary, the application constructs a basic network representation through static analysis and dynamic analysis, improves the traditional software testing representation method based on edge label annotation and node label annotation, fuses multiple types of Web vulnerability features, constructs a complex network representation method, effectively represents the static structure and dynamic behavior information of the Web application, and provides a feasible basis for various types of vulnerability detection, positioning and defense research.

Claims

1. A method for representing complex networks in highly integrated web applications, characterized in that: Includes the following steps: Step S1: Collect several web application code samples to form an initial web application code sample library. Each web application contains A vulnerabilities, and the types of vulnerabilities contained in each web application are business logic vulnerabilities, session management vulnerabilities, and input validation vulnerabilities, respectively. Step S2: Perform dynamic analysis based on the Web application code, dynamically access each page of the Web application, and construct a dynamic basic network representation method; Step S3: Perform static analysis based on the Web application code, add branches to the dynamic basic network representation method, and construct the basic network representation method based on page request transfer, which serves as the basis for the complex network representation method of highly integrated Web applications. Step S4: Perform depth-first access based on the node list to dynamically obtain the jump information generated when jumping between nodes. The jump information includes role type information, request and response parameter information, and session parameter information. Step S5: Parse and organize the jump information as edge label annotations for the complex network representation method of highly integrated web applications; Step S6: Based on the dynamic basic network representation method in step S2, merge the edge label annotations into the corresponding directed edges to form a basic network representation method with edge label annotations, which serves as the research basis for business logic vulnerabilities and session management vulnerabilities. Step S7: Extract high-frequency words for web application input vulnerability analysis from the web application code sample library. The top C valid words are used as code elements for node label annotations, where C is a positive integer not less than 20. Step S8: On the Web application code sample library, design a sample table of static attribute rules corresponding to code elements based on the static attributes of the code element samples, as the basis for classifying code element attributes; Step S9: On the page-level static code, use data flow analysis technology to track the propagation process of variable data flow, where the propagation process ends at the dangerous function; Step S10: Based on the sample table of static attribute rules corresponding to code elements, represent the path of variable data flow propagation process, and use it as node label annotation as a method for representing complex networks of highly integrated information web applications. Step S11: Based on the dynamic basic network representation method, merge the node label annotations into the corresponding page nodes, which serves as the research basis for input validation vulnerabilities and forms a complex network representation method for highly integrated web applications. Step S12: Obtain open-source web application code samples by acquiring open-source web application code from domestic and international open-source platforms, or by using web crawling technology to obtain the source code content of secure websites; Step S13: Repeat steps S7-S8 with the time interval between the publication date and the collection date as the cycle to update the complex network representation method of the Web application, which serves as the research basis for Web application vulnerability detection.

2. The method for representing complex networks of highly integrated Web applications according to claim 1, characterized in that: In step S1, A is a positive integer not less than 3. Business logic vulnerabilities include access control vulnerabilities, parameter tampering vulnerabilities, workflow bypass vulnerabilities, and workflow conflict vulnerabilities. Session management vulnerabilities include CSRF vulnerabilities, session hijacking vulnerabilities, session pinning vulnerabilities, and session sniffing vulnerabilities. Input validation vulnerabilities include SQL injection vulnerabilities, XSS vulnerabilities, XML injection vulnerabilities, LDAP injection vulnerabilities, OS command line injection vulnerabilities, remote code execution vulnerabilities, and local or remote file inclusion vulnerabilities.

3. The method for representing complex networks of highly integrated Web applications according to claim 1, characterized in that: The specific steps of dynamic analysis in step S2 are as follows: Step S21: Dynamically render the client pages of the web application, obtain all the link jump nodes contained in each page and the jump relationships between the nodes, and form an initial node list; Step S22: Organize the initial nodes, remove common prefixes from the initial nodes, select the organized initial nodes to form a node list; Step S23: Select page nodes from the node list as network nodes in the dynamic basic network representation method; select jump relationships between nodes in the node list as directed edges in the dynamic basic network representation method.

4. The method for representing complex networks of highly integrated Web applications according to claim 1, characterized in that: The specific steps of step S3 are as follows: Step S31: Staticly analyze the web application source code, and combine the source code pages to add page nodes that are difficult to cover through dynamic analysis using the KM algorithm; Step S32: Perform branching operations on the dynamic basic network representation method. The dynamic basic network representation method is expressed as follows: G0 = {N, E} Where N represents the set of page nodes and E represents the set of page request relationship edges; Step S33: Record the jump relationships between page nodes and map them to the jump relationships between nodes in the dynamic basic network to generate a basic network representation method that fully covers page nodes.

5. The method for representing complex networks of highly integrated Web applications according to claim 1, characterized in that: The side label annotation in step S5 is represented as follows: Ea = {R, U, HTTP, URL}; Where Ea is the edge label annotation; R is the set of user roles; HTTP is a set of HTTP request and response parameters passed through the request, including request, response and session parameter types; and URL is the source path.

6. The method for representing complex networks of highly integrated Web applications according to claim 1, characterized in that: The code element corresponding static attribute rule sample table in step S8 includes code element sample information, static attribute information, and description information.

7. The method for representing complex networks of highly integrated Web applications according to claim 1, characterized in that: The node label annotation in step S10 is represented as follows: Na={Path1,Path2,…,Path i , Where, Path i Representing a path, defined as <M i V i ,L i >, where M i V is a list of static properties that exist on the path. i For the corresponding variable name, L i For variable V i The line of code containing the dangerous function passed in.

8. The method for representing complex networks of highly integrated Web applications according to claim 1, characterized in that: In step S13, the time between the release of the Web application code and the collection date is no more than D months, and the number of Web applications is E, where D is a positive integer not less than 1 and E is a positive integer not less than 10.

Images