A distributed cloud system vulnerability detection method, device and electronic equipment

Abstract

The present invention discloses a vulnerability detection method, device and electronic device for a distributed cloud system, the method comprising: obtaining the operation log of the distributed cloud system, the cloud system code and the user parameters in the distributed cloud system; analyzing the operation log to obtain the user variables and the user-related variables; performing an abnormality check on the cloud system code to obtain the system-related variables; determining the authority check interface and the privileged operation based on the user variables, the user-related variables and the system-related variables; analyzing the distributed system according to the authority check interface, the privileged operation and the user parameters to obtain the vulnerability. The present invention can quickly and accurately identify the privileged operation through the analyzed user-related variables and system-related variables, effectively improving the efficiency and accuracy of vulnerability detection, thereby better ensuring the security of the distributed cloud system.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a vulnerability detection method, device and electronic equipment for a distributed cloud system. Background Art

[0002] Distributed cloud systems face huge security challenges. Cloud platforms host a large amount of valuable data, which naturally attracts the attention of attackers. Although various security mechanisms have been introduced to protect cloud systems, there are still widespread vulnerabilities that can be exploited, resulting in a large number of cloud vulnerabilities. Among the various types of vulnerabilities in distributed cloud systems, access control vulnerabilities are one of the most common and troublesome. Distributed cloud systems are composed of multiple components, each of which provides a set of remotely accessible APIs for communicating with users or other components in the system. Developers often forget to introduce proper permission checks in these APIs, resulting in easily exploitable missing permission checks (MPC) vulnerabilities.

[0003] At present, people have developed some methods to detect MPC vulnerabilities in operating systems and network applications. These methods are usually checked by manually specifying permissions. Different components in distributed cloud systems often implement different permission checking mechanisms. If all these permission checking methods are checked and specified in distributed cloud systems, a lot of manual work is required, and some permission checks are temporarily performed by user variables. It is not clear how to manually specify these conditional statements. If the permission check interface cannot be correctly identified, privileged operations cannot be accurately mined; in addition, a large part of privileged operations are not protected by any permission check, and existing mining-based methods cannot identify these operations. Therefore, this method is only applicable to the target system, not to distributed cloud systems. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a distributed cloud system vulnerability detection method, device and electronic device to solve the problem of poor accuracy in vulnerability detection of distributed systems in the prior art.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] An embodiment of the present invention provides a vulnerability detection method for a distributed cloud system, comprising:

[0007] Obtain the operation logs of the distributed cloud system, the cloud system code, and the user parameters and data flows in the distributed cloud system;

[0008] Analyze the operation log to obtain user variables and user-related variables;

[0009] Performing anomaly check on the cloud system code to obtain system-related variables;

[0010] Determine a permission check interface and a privileged operation based on the user variable, the user-related variable, and the system-related variable;

[0011] The communication analysis and data analysis of the distributed system are performed according to the permission check interface, the privileged operation, the user parameters and the data flow to obtain vulnerabilities.

[0012] Optionally, the analyzing the operation log to obtain the user variable and the user-related variable includes:

[0013] extracting variables from the run log;

[0014] Filter out user variables representing users and other variables from the variables;

[0015] The relationship between the user variable and the remaining variables is judged to obtain user-related variables.

[0016] Optionally, determining the relationship between the user variable and the remaining variables to obtain the user-related variable includes:

[0017] Determine whether the current variable among the remaining variables and the user variable or the user-related variable are in the same running log;

[0018] If the current variable and the user variable or the user-related variable are in the same running log, the current variable is determined as the user-related variable.

[0019] Optionally, determining the relationship between the user variable and the remaining variables to obtain the user-related variable includes:

[0020] Analyze the remaining variables and the user variable to obtain their corresponding variable types;

[0021] Matching the variable type of the current variable among the remaining variables with the variable type of the user variable;

[0022] If the variable type of the current variable is the same as the variable type of the user variable, the current variable is determined as a user-related variable.

[0023] Optionally, performing an abnormality check on the cloud system code to obtain system-related variables includes:

[0024] Traversing the cloud system code to obtain an error prompt point that terminates normal execution;

[0025] Searching for a first conditional statement related to the error prompt point based on the error prompt point;

[0026] The corresponding instance field is obtained according to the first conditional statement, and the instance field is used as a system-related variable.

[0027] Optionally, determining the permission check interface and the privileged operation based on the user variable, the user-related variable, and the system-related variable includes:

[0028] A conditional statement for testing a user variable is obtained according to the user variable and marked as a permission check interface;

[0029] Screening access operations to the user-related variables and the system-related variables;

[0030] The access operation is treated as a privileged operation.

[0031] Optionally, analyzing the distributed system according to the permission check interface, the privileged operation, and the user parameter to obtain a vulnerability includes:

[0032] Parsing the user parameters to obtain a user request;

[0033] Determine the processing method of the user request, and if the user request has a privileged operation in its corresponding processing program and no permission check is performed through the permission check interface, mark the user request as a vulnerability;

[0034] Analyze user requests through data streams to obtain program paths and multiple nodes on the program paths;

[0035] A permission check and a privileged operation check are performed on multiple nodes on the program path. If there is a node that has performed a privileged operation and all nodes have not undergone a permission check through a permission check interface, the user request is marked as a vulnerability.

[0036] The embodiment of the present invention also provides a vulnerability detection device for a distributed cloud system, comprising:

[0037] An acquisition module is used to obtain the operation log of the distributed cloud system and the user parameters in the distributed cloud system;

[0038] An analysis module, used for analyzing the operation log to obtain user variables and user-related variables;

[0039] A checking module, used for performing an abnormality check on the cloud system code to obtain system-related variables;

[0040] A determination module, configured to determine a permission check interface and a privileged operation based on the user variable, the user-related variable and the system-related variable;

[0041] A vulnerability module is used to analyze the distributed system according to the permission check interface, the privileged operation and the user parameters to obtain vulnerabilities.

[0042] An embodiment of the present invention further provides an electronic device, including:

[0043] A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the vulnerability detection method for the distributed cloud system provided by an embodiment of the present invention by executing the computer instructions.

[0044] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the distributed cloud system vulnerability detection method provided by the embodiment of the present invention.

[0045] The technical solution of the present invention has the following advantages:

[0046] The present invention provides a vulnerability detection method for a distributed cloud system, which obtains the operation log of the distributed cloud system, the cloud system code and the user parameters in the distributed cloud system; analyzes the operation log to obtain user variables and user-related variables; performs an abnormality check on the cloud system code to obtain system-related variables; determines the permission check interface and privileged operations based on the user variables, user-related variables and system-related variables; and analyzes the distributed system according to the permission check interface, privileged operations and user parameters to obtain vulnerabilities. The present invention can quickly and accurately identify privileged operations through the analyzed user-related variables and system-related variables, effectively improving the efficiency and accuracy of vulnerability detection, thereby better ensuring the security of the distributed cloud system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 is a flow chart of a vulnerability detection method for a distributed cloud system in an embodiment of the present invention;

[0049] Figure 2 A flowchart of analyzing the operation log to obtain user variables and user-related variables according to an embodiment of the present invention;

[0050] Figure 3A flowchart of obtaining user-related variables according to variable positions according to an embodiment of the present invention;

[0051] Figure 4 A flowchart of obtaining user-related variables according to variable types according to an embodiment of the present invention;

[0052] Figure 5 A flowchart of obtaining system-related variables according to an embodiment of the present invention;

[0053] Figure 6 A flowchart for determining a permission check interface and a privileged operation according to an embodiment of the present invention;

[0054] Figure 7 A flowchart of a vulnerability analyzed according to an embodiment of the present invention;

[0055] Figure 8 It is a schematic diagram of the structure of a vulnerability detection device for a distributed cloud system in an embodiment of the present invention;

[0056] Fig. 9 Schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0058] According to an embodiment of the present invention, an embodiment of a vulnerability detection method for a distributed cloud system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0059] In this embodiment, a distributed cloud system vulnerability detection method is provided, which can be used for the above-mentioned terminal devices, such as computers, etc. Figure 1 As shown, the vulnerability detection method of the distributed cloud system includes the following steps:

[0060] Step S1: Obtain the operation log of the distributed cloud system and the user parameters in the distributed cloud system.

[0061] Step S2: Analyze the operation log to obtain user variables and user-related variables.

[0062] Step S3: Perform an abnormality check on the cloud system code to obtain system-related variables.

[0063] Step S4: Determine the permission check interface and privileged operation based on the user variable, the user-related variable and the system-related variable.

[0064] Step S5: Analyze the distributed system to obtain vulnerabilities based on the permission check interface, privileged operations and user parameters.

[0065] Through the above steps S1 to S5, the vulnerability detection method for the distributed cloud system provided by the embodiment of the present invention can quickly and accurately identify privileged operations by analyzing user-related variables and system-related variables, thereby effectively improving the efficiency and accuracy of vulnerability detection, thereby better ensuring the security of the distributed cloud system.

[0066] Specifically, in one embodiment, the above step S1, such as Figure 2 As shown, the specific steps include:

[0067] Step S21: extracting variables from the operation log.

[0068] Step S22: Filter out the user variable representing the user and other variables from the variables. Specifically, extract the runtime value of the variable from the log: if the value of the variable is the same as that of the given user name, it is considered that the variable represents the user.

[0069] Step S23: Determine the relationship between the user variable and other variables to obtain user-related variables.

[0070] Specifically, when judging the relationship, it can be done in two ways, one is to obtain the location of the variable through log analysis, and the other is to obtain the type of the variable through static analysis. Log analysis of the operation log can effectively discover user-related variables in the log instance. Because some user-related variables may not be recorded, or their recording statements may not be executed. Therefore, all other user-related variables in the program can be discovered through type-based analysis. There is also a third case: processing a field for uniquely indexing its containing objects: for example, in HBase, the field region is used as the index of RegionInfo. Therefore, RegionInfo is also considered a user-related type. Through this process, user-related variables can be obtained more comprehensively, and privileged operations can be identified more accurately in the future, improving the accuracy of vulnerability detection.

[0071] Specifically, in one embodiment, the above step S23, as Figure 3 As shown, the specific steps include:

[0072] Step S2311: Determine whether the current variable and the user variable or the user-related variable among the remaining variables are in the same running log.

[0073] Step S2312: If the current variable and the user variable or the user-related variable are in the same running log, the current variable is determined as the user-related variable.

[0074] Specifically, this process is used to discover user-related variables in logs. The system records the process when a user accesses their data or when user data is further segmented or moved. Therefore, when these variables appear in the same run log as user variables, this variable is a user-related variable. These variables usually represent data created directly by the user and can only be accessed by their owner. At the same time, if a variable is included in the same run log as another user-related variable, it means that the variable is derived from another user-related variable. These derived user-related variables are easily overlooked by developers and are often not properly protected, resulting in vulnerabilities. By obtaining user-related variables, it is convenient to quickly identify privileged operations later.

[0075] Specifically, in one embodiment, the above step S23, as Figure 4 As shown, the specific steps include:

[0076] Step S2321: Analyze the remaining variables and user variables to obtain their corresponding variable types.

[0077] Step S2322: Match the variable type of the current variable among the remaining variables with the variable type of the user variable.

[0078] Step S2323: If the variable type of the current variable is the same as the variable type of the user variable, the current variable is determined as a user-related variable.

[0079] Specifically, type-based analysis can be used for user-related variables with object types. For variables of primitive types, the set of variables to which they are propagated can be obtained based on their use-def chain (UD chain). By obtaining user-related variables, it is convenient to quickly identify privileged operations later.

[0080] Specifically, in one embodiment, the above step S3, as Figure 5 As shown, the specific steps include:

[0081] Step S31: traverse the cloud system code to obtain an error prompt point that terminates normal execution.

[0082] Step S32: searching for a first conditional statement related to the error prompt point based on the error prompt point.

[0083] Step S33: Obtain the corresponding instance field according to the first conditional statement, and use the instance field as a system-related variable. Specifically, the part of the program where the error prompt point is located will include statements that cause the exception. By checking, the first conditional statement directly controlled or dependent on the error prompt point can be obtained. The instance field is checked by the conditional statement and the instance field is a system-related variable, because the system state is usually stored in the instance field. The conditional statement can also test input conditions (for example, parameters or function returns), and these checked variables are not counted as system-related variables. By obtaining system-related variables, it is convenient to quickly identify privileged operations later.

[0084] Specifically, in one embodiment, the above step S4, such as Figure 6 As shown, the specific steps include:

[0085] Step S41: The conditional statement for testing the user variable is obtained according to the user variable and marked as a permission check interface. Specifically, the permission check is implemented by directly testing the user variable or calling the interface that wraps these user tests. Therefore, all conditional statements for testing user variables belong to permission checks. The permission check interface is identified by the summary function: if there is a permission check at the entry of a method, the method is considered to be a permission check interface.

[0086] In some cases, the interface only performs permission checks when the authorization service is enabled. When the security configuration is not enabled, the authorization object pc is empty and some security checks are skipped. This will cause some MPC vulnerabilities that can only be triggered when the security configuration is disabled. These vulnerabilities are usually classified as false positives in the prior art. This situation can be solved as follows: when the permission check interface call is protected by a null object check on its receiving object, mark the null object check as a permission check.

[0087] There are four permission check mechanisms in distributed systems, and the ways of calling permission check interfaces are different:

[0088] M1. Traditional mechanism for performing external requests and permission checks on the same node: ① The user sends a request to the server node, ② The server node calls the corresponding permission check interface and then returns the request result.

[0089] M2. In this mechanism, permission checks are performed on separate nodes: ① The user sends a request to the server node, ② The server node sends a permission check query to the authorization node (via RPC or web socket), ③ The server node receives a response (accept or reject) from the authorization node, ④ If the authorization is approved, the server node responds to the request and returns the result.

[0090] M3. Token-based authorization: ① The user requests a token from the authentication node, ② The node returns a token with authentication and authorization information, ③ The user sends a request and authorization token to the server node. ④ The server node checks permissions based on the token and user, and then responds to the request.

[0091] M4. This mechanism uses centralized nodes to check and schedule user requests: ① The authorization node processes the user request, ② If the permission is granted, the authorization node forwards the request to the server node, ③ The server node responds to the request and returns it to the authorization node, ④ The authorization node forwards the response to the user.

[0092] Although the calling methods are different in different mechanisms, all permission checking interfaces implement permission checking in a similar way, that is, by testing user variables.

[0093] Step S42: Filter access operations to user-related variables and system-related variables.

[0094] Step S43: The access operation is regarded as a privileged operation.

[0095] Specifically, accessing user-related variables or system-related variables is a privileged operation. More specifically, these operations of writing user-related variables or system-related variables, or leaking user-related variables are privileged operations. Access operations may damage user data or the entire system, and may also cause the leakage of sensitive information.

[0096] A write operation is a putField instruction on a user-related variable or a system-related variable. If the variable is a collection, calls to the interface for modifying the collection (by removing or adding elements, for example, insert and remove for collections) should be marked as write operations. User-related variables may contain sensitive information that is private to the owner. Therefore, statements that return user-related data in the public interface or write user-related data to IO are privileged operations because they may disclose sensitive information to the public.

[0097] Specifically, in one embodiment, the above step S5 is as follows: Figure 7 As shown, the specific steps include:

[0098] Step S51: parse the user parameters to obtain the user request.

[0099] Step S52: Determine the processing method of the user request. If the user request contains privileged operations in its corresponding processing program and no permission check is performed through the permission check interface, the user request is marked as a vulnerability. Specifically, the focus of distributed system analysis is how to effectively handle inter-component communication. Components communicate with each other through, for example, RPC, message events, or web sockets. In order to avoid the arduous task of analyzing complex communication mechanism implementations (in which dynamic features such as refection are used extensively), the target of the client request is parsed through user parameters, and the request is regarded as a direct call to its processing program. By analyzing in this way, different components of the system can be connected together, and system analysis can be performed based on a standard method.

[0100] At the same time, considering that the combined program of all components of the distributed system is large, analyzing it as a whole is too computationally intensive and inefficient. Therefore, user requests can be summarized for analysis through, for example, a summary function. When a request sent by a client has an unprotected access operation in its corresponding handler, the request is considered a privileged operation. When a privileged operation exists and no permission check is performed through the permission check interface, the user request is marked as a vulnerability for reporting. Since this process does not take into account inter-component requests, and in most cases, remote permission checks and privileged operations are performed directly on the server node. Through this optimization, each component can be analyzed separately, which significantly reduces the size of the program and improves detection efficiency.

[0101] Step S53: Analyze the user request in a data flow manner to obtain a program path and multiple nodes on the program path.

[0102] Step S54: Perform permission checks and privileged operation checks on multiple nodes on the program path. If there are nodes that have performed privileged operations and all nodes have not undergone permission checks through the permission check interface, the user request will be marked as a vulnerability. Specifically, the IFDS (inter-procedural, finite, distributed, subset) algorithm solves a large set of process check data flow problems as a generalized graph reachability problem. The algorithm operates on the so-called exploded graph. For each data flow fact at a program point in the inter-procedural call graph (ICFG) of the program, a node is introduced in the exploded graph. Each edge summarizes the transfer function semantics in data flow analysis. If there is a achievable path from the program entry in the decomposition graph to its representative node, the data flow fact holds at the program point. For context sensitivity, the return of the function needs to match its call point to make the path achievable.

[0103] For MPC vulnerability detection, the data flow fact is true or false, indicating whether a node is protected, that is, whether there is a path from the program entry to this point without permission check. The following equations (1)(2)(3) give the data flow function.

[0104] IN entry =true (I)

[0105]

[0106]

[0107] Through this analysis, the data flow facts are propagated forward along the ICFG of the program. At the entrance of the permission check interface, the data flow facts are initialized to "true" and are only set to "false" if they pass the permission check. When multiple program paths converge, the data flow facts along different paths are merged through the V operator. If the data flow result is true during privileged operations, an MPC vulnerability is reported. Through the above two methods, unauthorized access can be effectively prevented, which has a good trade-off effect on distributed systems, and has high accuracy and execution efficiency.

[0108] In this embodiment, a vulnerability detection device for a distributed cloud system is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0109] This embodiment provides a distributed cloud system vulnerability detection device, such as Figure 8 As shown, including:

[0110] The acquisition module 101 is used to obtain the operation log of the distributed cloud system and the user parameters in the distributed cloud system. For details, please refer to the relevant description of step S1 in the above method embodiment, which will not be repeated here.

[0111] The analysis module 102 is used to analyze the operation log to obtain user variables and user-related variables. For details, please refer to the relevant description of step S2 in the above method embodiment, which will not be repeated here.

[0112] The checking module 103 is used to perform an abnormality check on the cloud system code to obtain system-related variables. For details, please refer to the relevant description of step S3 in the above method embodiment, which will not be repeated here.

[0113] The determination module 104 is used to determine the permission check interface and the privileged operation based on the user variable, the user-related variable and the system-related variable. For details, please refer to the relevant description of step S4 in the above method embodiment, which will not be repeated here.

[0114] The vulnerability module 105 is used to analyze the distributed system according to the permission check interface, privileged operations and user parameters to obtain vulnerabilities. For details, please refer to the relevant description of step S5 in the above method embodiment, which will not be repeated here.

[0115] The vulnerability detection device of the distributed cloud system in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0116] The further functional description of each of the above modules is the same as that of the above corresponding embodiments and will not be repeated here.

[0117] According to an embodiment of the present invention, there is also provided an electronic device, such as Fig. 9 As shown, the electronic device may include a processor 901 and a memory 902, wherein the processor 901 and the memory 902 may be connected via a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0118] The processor 901 may be a central processing unit (CPU). The processor 901 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0119] The memory 902 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the methods in the method embodiments of the present invention. The processor 901 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 902, that is, implementing the methods in the above method embodiments.

[0120] The memory 902 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created by the processor 901, etc. In addition, the memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 902 may optionally include a memory remotely arranged relative to the processor 901, and these remote memories may be connected to the processor 901 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0121] One or more modules are stored in the memory 902 , and when executed by the processor 901 , the method in the above method embodiment is executed.

[0122] The specific details of the above electronic device can be understood by referring to the corresponding descriptions and effects in the above method embodiments, and will not be repeated here.

[0123] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0124] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A distributed cloud system vulnerability detection method, characterized in that: include: Obtain the operation logs, cloud system codes, and user parameters of the distributed cloud system; The operation log is analyzed to obtain user variables and user-related variables, including: extracting variables from the run log; Filter out user variables representing users and other variables from the variables; The relationship between the user variable and the other variables is judged to obtain user-related variables, including: Analyze the remaining variables and the user variable to obtain their corresponding variable types; Matching the variable type of the current variable among the remaining variables with the variable type of the user variable; If the variable type of the current variable is the same as the variable type of the user variable, determining the current variable as a user-related variable; Performing anomaly check on the cloud system code to obtain system-related variables; Determining a permission check interface and a privileged operation based on the user variable, the user-related variable, and the system-related variable includes: A conditional statement for testing a user variable is obtained according to the user variable and marked as a permission check interface; Screening access operations to the user-related variables and the system-related variables; treating the access operation as a privileged operation; The distributed cloud system is analyzed according to the permission check interface, the privileged operation and the user parameters to obtain vulnerabilities.

2. The distributed cloud system vulnerability detection method according to claim 1, characterized in that: The determining the relationship between the user variable and the other variables to obtain the user-related variables includes: Determine whether the current variable among the remaining variables and the user variable or the user-related variable are in the same running log; If the current variable and the user variable or the user-related variable are in the same running log, the current variable is determined as the user-related variable.

3. The distributed cloud system vulnerability detection method according to claim 1, characterized in that: The abnormality check on the cloud system code to obtain system-related variables includes: Traversing the cloud system code to obtain an error prompt point that terminates normal execution; Searching for a first conditional statement related to the error prompt point based on the error prompt point; The corresponding instance field is obtained according to the first conditional statement, and the instance field is used as a system-related variable.

4. The distributed cloud system vulnerability detection method according to claim 1, characterized in that: The analyzing the distributed cloud system according to the permission check interface, the privileged operation and the user parameter to obtain a vulnerability includes: Parsing the user parameters to obtain a user request; Determine the processing method of the user request, and if the user request has a privileged operation in its corresponding processing program and no permission check is performed through the permission check interface, mark the user request as a vulnerability; Analyze user requests through data streams to obtain program paths and multiple nodes on the program paths; A permission check and a privileged operation check are performed on multiple nodes on the program path. If there is a node that has performed a privileged operation and all nodes have not undergone a permission check through a permission check interface, the user request is marked as a vulnerability.

5. A vulnerability detection device for a distributed cloud system, characterized in that: include: An acquisition module is used to obtain the operation log of the distributed cloud system, the cloud system code, and the user parameters in the distributed cloud system; The analysis module is used to analyze the operation log to obtain user variables and user-related variables, including: extracting variables from the run log; Filter out user variables representing users and other variables from the variables; The relationship between the user variable and the other variables is judged to obtain user-related variables, including: Analyze the remaining variables and the user variable to obtain their corresponding variable types; Matching the variable type of the current variable among the remaining variables with the variable type of the user variable; If the variable type of the current variable is the same as the variable type of the user variable, determining the current variable as a user-related variable; A checking module, used for performing an abnormality check on the cloud system code to obtain system-related variables; A determination module, used to determine the permission check interface and the privileged operation based on the user variable, the user-related variable and the system-related variable, including: A conditional statement for testing a user variable is obtained according to the user variable and marked as a permission check interface; Screening access operations to the user-related variables and the system-related variables; treating the access operation as a privileged operation; A vulnerability module is used to analyze the distributed cloud system according to the permission check interface, the privileged operation and the user parameters to obtain vulnerabilities.

6. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the vulnerability detection method for a distributed cloud system according to any one of claims 1 to 4 by executing the computer instructions.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the distributed cloud system vulnerability detection method according to any one of claims 1 to 4.

Images