An automated business logic vulnerability mining method

Abstract

This invention discloses an automated method for discovering business logic vulnerabilities, relating to the field of internet applications. This invention provides an application logic vulnerability auditing system, including an AI-based black-box auditing system and an intelligent code analysis-based white-box auditing system, covering the vast majority of logic vulnerabilities on the market. The AI-based black-box auditing system audits the target application from a user's perspective, while the intelligent code analysis-based white-box auditing system performs static auditing of the application's source code. This invention supports automated detection of business logic vulnerabilities, covering a much wider range of vulnerabilities than existing solutions; its detection efficiency is extremely high, from initial detection to report generation, far exceeding that of manual detection; and by combining black-box and white-box source code detection technologies, it further expands the scope of vulnerability detection.

Description

Technical Field

[0001] This invention relates to the field of Internet applications, and in particular to an automated method for discovering vulnerabilities in business logic. Background Technology

[0002] Web applications can be broadly defined as online service programs with publicly accessible portals, serving various users. Common forms include website portals, various management systems, and even most mini-programs / apps. These applications target different user groups depending on the scenario, and may include various user groups. Among legitimate users, there is a high possibility of hackers and other malicious actors. Furthermore, due to the high concurrency and large traffic characteristics of the internet, a security vulnerability in an application can potentially cause significant losses in a very short time. Therefore, any company involved will conduct rigorous security scans before deploying an application into production to identify vulnerabilities as early as possible.

[0003] Application vulnerabilities differ from system software vulnerabilities (such as buffer overflows and memory leaks) in that attackers can directly interact with the target website. Based on their characteristics, application vulnerabilities can be further divided into business logic vulnerabilities and non-business logic vulnerabilities. Non-business logic vulnerabilities generally refer to well-known vulnerabilities caused by defects in application-related development components, such as SQL injection, XSS, and CSRF vulnerabilities. Business logic vulnerabilities, on the other hand, refer to vulnerabilities caused by implementation defects in specific business function logic code, such as privilege escalation vulnerabilities and payment tampering vulnerabilities.

[0004] Discovering business logic vulnerabilities is more difficult than discovering other application vulnerabilities. This is because business logic vulnerabilities are often highly related to specific functional logic, and different applications often have different complex functions. Therefore, discovering functional logic vulnerabilities requires not only familiarity with the application development process but also an understanding of the functional scenario requirements of different applications. Currently, there are many automated scanning tools for application vulnerabilities on the market, but they often cannot cover or can only cover a small portion of logic vulnerabilities. Many enterprises can only rely on manual detection of logic vulnerabilities, which is costly, making technical upgrades a pressing need.

[0005] Therefore, those skilled in the art are dedicated to developing an automated method for discovering business logic vulnerabilities, and to upgrading the technology of automated application vulnerability scanning tools. Summary of the Invention

[0006] In view of the above-mentioned deficiencies of the prior art, the technical problem to be solved by the present invention is that automated scanning tools for application vulnerabilities cannot cover or can only cover a small part of logical vulnerabilities; and relying on manual detection of logical vulnerabilities is costly.

[0007] To achieve the above objectives, this invention provides an automated method for discovering business logic vulnerabilities, comprising the following steps:

[0008] Step 1: The AI-based black-box auditing system audits the target application from the user's perspective;

[0009] Step 2: The white-box auditing system based on intelligent code analysis performs static auditing on the application source code.

[0010] Furthermore, the black-box auditing system simulates stateful interaction between the user and the target application, fully triggering its functional logic and collecting the business processes and data packets throughout the process. Then, it extracts semantic information fragments from the HTML page as input to the neural network for page function recognition, accurately identifying the business flow type, page form type, and data packet parameter type. Subsequently, based on the business and form types, it automatically fills in the form and automatically interacts with the application, thereby realizing business flow modeling and form filling of the target system.

[0011] Furthermore, the vulnerability assessment module of the black-box auditing system performs risk point testing based on behavior analysis, variable analysis, headers analysis, and response judgment, checks for logical vulnerabilities, and generates a detection report.

[0012] Furthermore, the permission analysis module of the white-box auditing system searches for sensitive data access slices in the code, performs backward taint analysis, extracts permission-related code, and detects whether there are permission-related vulnerabilities.

[0013] Furthermore, the control flow analysis module of the white-box auditing system uses symbolic execution and taint analysis techniques to identify payment-related vulnerabilities based on specific taint rules.

[0014] Furthermore, the bidirectional data flow analysis module of the white-box auditing system uses an intermediate language to perform bidirectional data flow analysis and identify file upload vulnerabilities according to specific rules.

[0015] Further, step 1 includes the following steps:

[0016] Step 1.1: The black-box auditing module receives the metadata information of the target and begins automated detection;

[0017] Step 1.2: The business flow modeling process automatically interacts with the target application, comprehensively explores its functional logic, constructs a business flow model, and corresponds it to massive data packets;

[0018] Step 1.3: Based on the previously collected business flow and data packet information, the neural network module extracts semantic fragments from each page, standardizes the data, and then inputs it into the neural network model for classification, identifying the specific function type of each business flow, the form type of the corresponding page, and the parameter type of the corresponding data packet.

[0019] Step 1.4: The automated form filling module automatically fills and submits the form based on the previously identified form type information, triggering various functions. If automatic filling fails, the system will decide whether to wait for manual processing based on the configuration.

[0020] Step 1.5: The vulnerability assessment module selects potential logical vulnerabilities under different types of business based on the previously identified business flow model and conducts targeted detection, ultimately providing a detection report of logical vulnerabilities.

[0021] Furthermore, step 2 includes the following steps:

[0022] Step 2.1: The white-box auditing module accepts the target application's source code or binary program as input, identifies the language and platform information, and begins the detection process.

[0023] Step 2.2: The permission analysis module finds data access slices in the code and performs backward taint analysis on possible sensitive data access segments to extract permission context and check for unauthorized access vulnerabilities.

[0024] Step 2.3: The control flow analysis module performs path traversal on the program based on symbolic execution, and then uses taint analysis to detect the correctness of payment-related processes and check for payment tampering vulnerabilities.

[0025] Step 2.4: The bidirectional data stream analysis module converts the target code into intermediate language, and then performs bidirectional data stream analysis based on the characteristics of file upload vulnerabilities to check for the existence of file upload vulnerabilities.

[0026] Step 2.5: The white-box auditing module summarizes the detection results and provides a detection report on logical vulnerabilities.

[0027] Furthermore, the black-box auditing system supports the detection of 21 logical vulnerabilities, including SMS bombing, reuse of SMS verification codes, unbound SMS verification codes, SMS verification codes returned to the front end, image verification codes returned to the front end, overly simple verification code mechanisms, controllable verification code length, identifiable verification codes, SMS verification codes that can be brute-forced, reused verification codes, replay vulnerabilities, bypassable login authentication, controllable SMS content, secure email verification codes, lack of image verification code functionality, front-end controllable verification code generation mechanism, bypassable image verification code mechanism, bypassable SMS verification code mechanism, no need to enter the original password when changing the password, session tokens should not be written to the URL, and user password reset.

[0028] Furthermore, the white-box auditing system supports the detection of five types of logical vulnerabilities: horizontal / vertical privilege escalation vulnerabilities, unauthorized access, payment tampering vulnerabilities, and file upload vulnerabilities.

[0029] In a preferred embodiment of the present invention, automated application vulnerability scanning tools on the market cannot cover, or can only cover, a small portion of logical vulnerabilities. Existing application vulnerability scanning tools simply scan relevant information of the target application, extract application features, and then compare them with a vulnerability signature database to discover vulnerabilities in the target application. This method can only detect known, common vulnerabilities, and cannot detect unknown, application-specific vulnerabilities. In fact, logical vulnerabilities are often caused by programmers' negligence in writing business logic; such vulnerabilities cannot be compared using a signature database. Traditional application vulnerability scanning tools do not consider the application's business flow relationships, making it difficult to detect application logical vulnerabilities. The present invention provides an application logic vulnerability auditing system, including an AI-based black-box auditing system and an intelligent code analysis-based white-box auditing system, supporting the detection of 26 common functional logic vulnerabilities, covering the vast majority of logical vulnerabilities on the market. The AI-based black-box auditing system audits the target application as a user, automatically interacting with the target application by simulating user behavior. The system saves user session states, accesses the full functionality of the target application, and intelligently identifies the relationship between user forms and backend HTTP data packets. It establishes a business flow model that interconnects specific business processes with massive amounts of backend data packets. Using this model, the system can analyze and understand the application's business flow, thereby identifying potential logical vulnerabilities within the application's complex business processes. During automated form filling, the system can attempt to automatically process different types of forms on the page based on the results of request and parameter identification, such as automatically logging in, registering, and resetting passwords to fully trigger application functions. For cases that cannot be handled, such as CAPTCHAs, a manual handling interface is provided. By simulating user behavior, the system can discover hidden logical vulnerabilities within these behaviors. The white-box auditing system based on intelligent code analysis extracts the permission context of sensitive data operations in the code using program slicing and backward taint analysis techniques, supporting the parsing of data access logic in common ORM frameworks. Its control flow analysis module traverses the program's execution path based on symbolic execution and then uses taint analysis to determine whether tainted variables can reach the vulnerability point. This approach allows analysis of sensitive permission operations in the program, thereby determining whether the application has logical vulnerabilities at the source code level.

[0030] Business logic vulnerabilities are often highly related to specific functional logic, and different applications often have different complex functions. Therefore, discovering functional logic vulnerabilities requires not only familiarity with the application development process but also an understanding of the functional scenario requirements of different applications. Many enterprises can only rely on manual detection of logic vulnerabilities, which is costly. The application logic vulnerability auditing system provided by this invention can achieve full-process automation, eliminating the need for testers to have knowledge of logic vulnerabilities. The black-box auditing system can simulate user behavior to automatically interact with the target application and extract semantic information fragments from HTML pages as neural network inputs for page function recognition. The request and parameter recognition module based on neural networks can accurately identify page functions, page form types (such as login, registration), and request parameter types, thereby improving the coverage of the crawler. Then, based on the recognition results, automated form filling is performed, and finally, risk point testing is achieved based on behavior analysis, variable analysis, header analysis, and response judgment. Behavioral analysis is used to determine if there are skippable intermediate steps in the business process, or if execution can be out of order; variable analysis mutates key parameters (identified by previous modules) according to different vulnerability rules; headers analysis mutates the payload by adding, deleting, or modifying request header content; response judgment intelligently determines whether the attack was successful by comparing differences in response packets. The white-box auditing system based on intelligent code analysis extracts the permission context of sensitive data operations in the code using program slicing and backward taint analysis techniques, then traverses the program's execution path based on symbolic execution, and then uses taint analysis to determine whether tainted variables can reach the vulnerability point. Finally, through bidirectional data flow analysis, the key logic code is converted into low-level intermediate language to determine if a vulnerable path exists. This analysis method produces a very low false positive rate, reducing the time required for subsequent manual verification.

[0031] Compared with the prior art, the present invention has the following obvious substantive features and significant advantages:

[0032] 1. This invention supports automated detection of up to 26 types of business logic vulnerabilities, covering a much wider range of vulnerabilities than existing solutions; it has extremely high detection efficiency, from initial detection to report generation, far exceeding the efficiency of manual detection; it combines black-box detection and white-box source code detection technologies, further expanding the scope of vulnerability detection.

[0033] 2. This invention differs from traditional web crawling methods by employing stateful automated interaction to perform a complete business flow modeling of the target application; it uses artificial intelligence technology to identify business flow types and related parameters, making it more intelligent than rule matching.

[0034] The following will further explain the concept, specific structure, and technical effects of the present invention in conjunction with the accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of a black-box auditing process according to a preferred embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of a white-box audit process according to a preferred embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of a neural network module according to a preferred embodiment of the present invention. Detailed Implementation

[0038] The following description, with reference to the accompanying drawings, illustrates several preferred embodiments of the present invention to make its technical content clearer and easier to understand. The present invention can be embodied in many different forms, and the scope of protection of the present invention is not limited to the embodiments mentioned herein.

[0039] In the accompanying drawings, components with the same structure are indicated by the same numerical designation, and components with similar structures or functions are indicated by similar numerical designations. The dimensions and thicknesses of each component shown in the drawings are arbitrary, and the present invention does not limit the dimensions and thicknesses of each component. To make the illustrations clearer, the thickness of some components has been appropriately exaggerated in the drawings.

[0040] An automated method for discovering business logic vulnerabilities includes the following steps:

[0041] Step 1, as follows Figure 1 As shown, the black-box auditing module receives the metadata information of the target and begins automated detection;

[0042] Step 2: The business flow modeling process automatically interacts with the target application, fully explores its functional logic, constructs a business flow model, and corresponds it to massive data packets;

[0043] Step 3, as follows Figure 3 As shown, the neural network module extracts semantic fragments from each page based on the previously collected business flow and data packet information. After data standardization, the data is input into the neural network model for classification, identifying the specific function type of each business flow, the form type of the corresponding page, and the parameter type of the corresponding data packet.

[0044] Step 4: The automated form filling module automatically fills and submits the form based on the previously identified form type information, triggering various functions. If automatic filling fails, the system will decide whether to wait for manual processing based on the configuration.

[0045] Step 5: The vulnerability assessment module selects potential logical vulnerabilities under different types of business based on the previously identified business flow model and performs targeted detection, ultimately providing a detection report containing up to 21 logical vulnerabilities.

[0046] Step 6, as follows Figure 2 As shown, the white-box auditing module accepts the target application's source code or binary program as input, identifies the language type, platform information, etc., and begins the detection process.

[0047] Step 7: The permission analysis module finds data access slices in the code and performs backward taint analysis on possible sensitive data access segments to extract permission context and check for unauthorized access vulnerabilities.

[0048] Step 8: The control flow analysis module performs path traversal of the program based on symbolic execution, and then uses taint analysis to detect the correctness of payment-related processes and check for payment tampering vulnerabilities.

[0049] Step 9: The bidirectional data stream analysis module converts the target code into intermediate language, and then performs bidirectional data stream analysis based on the characteristics of file upload vulnerabilities to check for the existence of file upload vulnerabilities.

[0050] Step 10: The white-box auditing module summarizes the detection results from the above steps and provides a detection report containing up to 5 logical vulnerabilities.

[0051] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. An automated method for discovering business logic vulnerabilities, characterized in that, Includes the following steps: Step 1: The AI-based black-box auditing system audits the target application from the user's perspective; Step 2: A white-box auditing system based on intelligent code analysis performs static auditing on the application source code; Step 1 includes the following steps: Step 1.1: The black-box auditing module receives the metadata information of the target and begins automated detection; Step 1.2: The business flow modeling process automatically interacts with the target application, comprehensively explores its functional logic, constructs a business flow model, and corresponds it to massive data packets; Step 1.3: Based on the previously collected business flow and data packet information, the neural network module extracts semantic fragments from each page, standardizes the data, and then inputs it into the neural network model for classification, identifying the specific function type of each business flow, the form type of the corresponding page, and the parameter type of the corresponding data packet. Step 1.4: The automated form filling module automatically fills and submits the form based on the previously identified form type information, triggering various functions. If automatic filling fails, the system will decide whether to wait for manual processing based on the configuration. Step 1.5: The vulnerability assessment module selects potential logical vulnerabilities under different types of business based on the previously identified business flow model and performs targeted detection, ultimately providing a detection report of logical vulnerabilities. Step 2 includes the following steps: Step 2.1: The white-box auditing module accepts the target application's source code or binary program as input, identifies the language and platform information, and begins the detection process. Step 2.2: The permission analysis module finds data access slices in the code and performs backward taint analysis on possible sensitive data access segments to extract permission context and check for unauthorized access vulnerabilities. Step 2.3: The control flow analysis module performs path traversal on the program based on symbolic execution, and then uses taint analysis to detect the correctness of payment-related processes and check for payment tampering vulnerabilities. Step 2.4: The bidirectional data stream analysis module converts the target code into intermediate language, and then performs bidirectional data stream analysis based on the characteristics of file upload vulnerabilities to check for the existence of file upload vulnerabilities. Step 2.5: The white-box auditing module summarizes the detection results and provides a detection report on logical vulnerabilities.

2. The automated business logic vulnerability discovery method as described in claim 1, characterized in that, The black-box auditing system simulates stateful interaction between users and target applications, fully triggering their functional logic and collecting business processes and data packets throughout the process. Then, it extracts semantic information fragments from the HTML page as input to the neural network for page function recognition, accurately identifying business flow types, page form types, and data packet parameter types. Subsequently, based on the business and form types, it automatically fills in the forms and interacts with the application automatically, realizing business flow modeling and form filling of the target system.

3. The automated business logic vulnerability discovery method as described in claim 1, characterized in that, The vulnerability assessment module of the black-box auditing system performs risk point testing based on behavior analysis, variable analysis, headers analysis, and response judgment, checks for logical vulnerabilities, and generates a detection report.

4. The automated business logic vulnerability discovery method as described in claim 1, characterized in that, The permission analysis module of the white-box auditing system searches for sensitive data access slices in the code, performs backward taint analysis, extracts permission-related code, and detects whether there are permission-related vulnerabilities.

5. The automated business logic vulnerability mining method as described in claim 1, characterized in that, The white-box auditing system's control flow analysis module uses symbolic execution and taint analysis techniques to identify payment-related vulnerabilities based on specific taint rules.

6. The automated business logic vulnerability mining method as described in claim 1, characterized in that, The bidirectional data flow analysis module of the white-box auditing system uses intermediate language to perform bidirectional data flow analysis and identifies file upload vulnerabilities according to rules.

7. The automated business logic vulnerability discovery method as described in claim 1, characterized in that, The black-box auditing system supports the detection of 21 logical vulnerabilities, including: SMS bombing, reuse of SMS verification codes, unbound SMS verification codes, SMS verification codes returned to the front end, image verification codes returned to the front end, overly simplistic verification code mechanisms, controllable verification code length, identifiable verification codes, brute-force attacks on SMS verification codes, reuse of verification codes, replay vulnerabilities, bypassable login authentication, controllable SMS content, secure email verification codes, lack of image verification code functionality, front-end controllable verification code generation mechanism, bypassable image verification code mechanism, bypassable SMS verification code mechanism, no need to enter the original password when changing the password, session tokens should not be written to the URL, and user password reset.

8. The automated business logic vulnerability discovery method as described in claim 1, characterized in that, The white-box auditing system supports the detection of five types of logical vulnerabilities: horizontal / vertical privilege escalation vulnerabilities, unauthorized access, payment tampering vulnerabilities, and file upload vulnerabilities.

Images