RCE vulnerability and threat identification method based on full-link tracking information

Abstract

The invention discloses an RCE vulnerability and threat identification method based on full-link tracking information, and the method comprises the following steps: S1, deploying a full-link tracking analysis system which is used for monitoring and recording a completed application program request and response process; s2, starting a target range environment, activating a target range simulation environment through a full-link tracking analysis system agent, and applying the target range simulation environment to a security test; s3, executing operation and data recording, wherein the operation and data recording comprises remote code execution of the RCE vulnerability target machine in the target range environment; s4, generating an automatic sample, wherein the automatic sample is used for generating a fine tuning sample of the large language recognition model; s5, a training file is written, the generated fine tuning sample is written into the training file, and preparation is made for fine tuning of the RCE large language recognition model; according to the scheme, RCE vulnerabilities and threats can be accurately identified in diversified programming language environments; according to the method, the accuracy and efficiency of identification are remarkably improved, and the possibility of false report and missing report is reduced at the same time.

Description

Technical Field

[0001] The present invention belongs to the technical field, and in particular relates to an RCE vulnerability and threat identification method based on full-link tracking information. Background Art

[0002] RCE (Remote Code or Command Execution) vulnerabilities are a serious cybersecurity threat that allow attackers to execute arbitrary code or commands on the victim's remote system. This vulnerability allows attackers to bypass the normal operating boundaries of the application and directly control the core functions of the target server or system. The consequences of the attack may include data leakage, system damage, malware installation, and even complete control of the target system. RCE vulnerabilities usually arise from the application's failure to implement strict permission control when validating user input or processing sensitive operations.

[0003] With the continuous advancement of network attack technology, RCE attacks have become more complex and difficult to prevent. Although existing security measures are constantly updated, they are often difficult to fully identify and defend against RCE attacks in a changing network environment. Therefore, developing more effective identification and defense methods is crucial to maintaining network security.

[0004] (1) Active vulnerability fuzz testing

[0005] One of the disadvantages of traditional vulnerability fuzz testing is that it is impossible to view the internal structure and code of the program. When problems are found, the possible causes can only be inferred based on the results, which requires a lot of effort and time, and cannot effectively locate the exact internal location and real cause of the vulnerability. The second disadvantage is that fuzz testing may fail to perform effective testing due to session failure caused by certain security measures of the application.

[0006] Active RCE vulnerability testing based on full-link tracking information can improve efficiency through automated testing, while more accurately locating the location and cause of the vulnerability. In the event that automated active fuzz testing fails, passive transaction processing and call tree monitoring can also promptly discover and identify RCE vulnerabilities in the application system and identify their specific locations in the system.

[0007] (2) Passive RCE threat identification

[0008] Although traditional traffic-based threat monitoring systems can detect RCE attack behaviors, they cannot accurately determine whether the target system has vulnerabilities and whether the attack will cause actual harm, resulting in certain false positives and missed reports. In contrast, RCE threat identification technology based on full-link tracking can comprehensively track the processing of requests in the system, including the initiation, processing, and response of requests. By analyzing the call tree of request processing, the key methods and functions called inside the code can be tracked, so that it can be found that external requests can reach risk functions or methods, thereby accurately identifying RCE threats. This method can not only determine whether there are vulnerabilities in the system, but also locate the exact internal location and cause of the vulnerability if there is a vulnerability, and fully display the entire process.

[0009] Therefore, the present invention provides an RCE vulnerability and threat identification method based on full-link tracking information to solve the problems raised by the above-mentioned background technology. Summary of the invention

[0010] In view of the problems raised by the above background technology, the purpose of the present invention is to provide an RCE vulnerability and threat identification method based on full-link tracking information, so as to solve the shortcomings of the prior art in RCE vulnerability detection and threat identification.

[0011] In order to achieve the above technical objectives, the technical solution adopted by the present invention is as follows:

[0012] A RCE vulnerability and threat identification method based on full-link tracking information includes the following steps:

[0013] S1: deploy a full-link tracking and analysis system, which is used to monitor and record the completed application request and response process;

[0014] S2: Start the range environment, activate the range simulation environment through the full-link tracking and analysis system agent, and use it for safety testing;

[0015] S3: Execute operations and data records, wherein the operations and data records include remote code execution on a target machine with an RCE vulnerability in a range environment;

[0016] S4: Automatic sample generation, where the automatic samples are used to generate fine-tuning samples for a large language recognition model;

[0017] S5: Write the training file and write the generated fine-tuning samples into the training file to prepare for fine-tuning the RCE large language recognition model.

[0018] It is further defined that S3 further includes the following specific steps:

[0019] S3.1: Based on the vulnerability data of the target range, use attack tools or manually load the corresponding attack payload and perform the test operation;

[0020] S3.2: Record the range path information in detail, including the path information, request parameters, RCE threat tags, and RCE vulnerability tags. The path information includes the URL, protocol headers, and IP addresses.

[0021] Among them, in the RCE threat mark, "0" indicates that there is no RCE vulnerability attack, and "1" indicates that there is an RCE vulnerability attack; in the RCE vulnerability mark, "0" indicates that there is no RCE vulnerability attack, and "1" indicates that there is an RCE vulnerability attack.

[0022] Further defined, said S4 also includes the following specific steps:

[0023] S4.1: Read the shooting range path information list;

[0024] S4.2: Through the full-link tracking and analysis system, query all transaction IDs and their URLs entering the shooting range website and create a transaction ID list;

[0025] S4.3: Traverse the transaction ID list.

[0026] It is further defined that S4.3 also includes:

[0027] S4.31: Call the transaction details API of the full-link application analysis platform to obtain detailed transaction processing information;

[0028] S4.32: Extract the call tree information of transaction processing, including request path, request parameters, application first response function and transaction processing characteristic key functions;

[0029] S4.34: According to the request path, query the RCE attack and RCE vulnerability mark in the range path information list;

[0030] S4.35: Generate a sample for fine-tuning a large language recognition model, wherein the sample includes: a request path, request parameters, an application first response function, a transaction processing characteristic key function, and a path RCE vulnerability marker.

[0031] It is further defined that S5 further includes the following specific steps:

[0032] S5.1: Sample data preparation, reading pre-generated fine-tuning samples and formatting the data into question-answer format to enhance the model's understanding and prediction capabilities;

[0033] Specifically, the sample questions and answers include:

[0034] Question: If you start with "Please determine whether the following transaction processing has RCE attacks or RCE vulnerabilities, the transaction processing information is as follows:", and then list the request path, request parameters, application first response function, and transaction processing characteristic key function information in detail;

[0035] Answer: The answer includes: request path, request parameters, whether there is an RCE vulnerability, whether there is an RCE attack, vulnerability details, and attack payload information;

[0036] S5.2: Model fine-tuning execution;

[0037] Specifically, the formatted question and answer samples are used to start the fine-tuning process of the large language model; the bottom-level parameters of the pre-trained model are frozen to keep the common features; the top-level parameters are then updated or added, and the fine-tuning will continue until the predetermined training steps or error threshold are reached;

[0038] S5.3: Model validation, evaluate the fine-tuned model using test samples;

[0039] Specifically, if the recognition rate of the model reaches or exceeds 80%, the model training is considered successful and can be used for practical applications; if the recognition rate does not meet the standard, further analysis of the reasons is required, and more samples need to be added or fine-tuning parameters need to be adjusted, and then fine-tuning should be performed again;

[0040] S5.4: Continuously optimize and iterate, and continuously optimize the model's fine-tuning strategy and sample selection based on test feedback.

[0041] It is further defined that the full-link tracking and analysis system of S1 includes a data collector, a web server and a data collection agent;

[0042] The data collector is responsible for collecting data from the entire application access process, including the initiation, processing and response of requests;

[0043] The web server provides a user interface and an API interface for accessing and managing the full-link analysis system, and is also used to process requests from the front end and interact with back-end components;

[0044] The data collection agent is deployed on each server or application instance, and is used to collect and transmit data to the data collector or Web server.

[0045] Further limitations also include active RCE vulnerability mining and passive RCE threat identification.

[0046] Further defined, the active RCE vulnerability mining includes the following steps:

[0047] S10: Vulnerability test preparation: according to the development language of the target application system, load the corresponding RCE attack payload or construct an abnormal request to perform fuzz testing on the system;

[0048] S11: Full-link tracking query, regularly query the full-link tracking data of the target application within a specific time range, and parse the transaction processing ID and request path information.

[0049] S12: Transaction analysis: Based on the transaction ID, use the full-link application analysis transaction details API to query the transaction details and extract key information from the transaction details data, including the request path, request parameters, and call tree information.

[0050] S13: Submit the large model analysis, submit the extracted transaction processing information to the RCE large language recognition model, and request the model to analyze whether there is an RCE vulnerability and its specific location;

[0051] S14: Vulnerability identification and location. The RCE large language recognition model analyzes the submitted information and identifies whether there is an RCE vulnerability in the request path. If a vulnerability is found, the model will provide vulnerability location information for the application system.

[0052] Specifically, the vulnerability location information includes the first entry function or method of the application system to process the request and the function or method in the dependent library that ultimately executes the RCE.

[0053] It is further defined that the passive RCE threat identification comprises the following steps:

[0054] S20: Real-time monitoring and query, real-time query of all transaction processing of the target application within the time range recorded by the full-link tracking and analysis system;

[0055] S21: Transaction analysis: Based on the transaction ID, use the full-link application analysis transaction details API to query the transaction details and extract key information from the transaction details data, including request path, request parameters, and call tree information.

[0056] S22: Information submission and inquiry, submitting the extracted transaction information to the RCE large language recognition model to inquire whether there is an RCE vulnerability exploitation attack and whether there is an RCE vulnerability;

[0057] S23: Attack and vulnerability judgment: The RCE large language recognition model analyzes the submitted information to determine whether there is an RCE remote code execution attack behavior and whether the target application has a corresponding RCE vulnerability;

[0058] S24: Security response measures: if only attack behavior is detected and the target application does not have a vulnerability, the security device will be linked to execute security protection measures, including blocking malicious requests, recording relevant logs, and notifying the system administrator;

[0059] If an attack is detected and a vulnerability exists in the target application, in addition to implementing the above security protection measures, you must submit the detailed location of the vulnerability, related functions and methods, and organize a technical team to evaluate and determine the possible damage.

[0060] Beneficial effects of the present invention:

[0061] 1. The present invention provides an RCE vulnerability and threat identification method based on full-link tracking information, which mainly constructs fine-tuning samples and trains the RCE large language recognition model to enable it to accurately identify RCE attack features and vulnerability information, and locate the exact location and true cause of the RCE vulnerability. At the same time, with the help of the RCE large language recognition model, combined with the full-link tracking and analysis system, in the two scenarios of active RCE vulnerability mining and passive RCE threat identification, it is judged whether there is a remote code execution vulnerability or threat based on the analysis results.

[0062] 2. The method of the present invention breaks through the limitations of traditional technologies and can accurately identify RCE vulnerabilities and threats in a variety of programming language environments; this method not only significantly improves the accuracy and efficiency of identification, but also reduces the possibility of false positives and false negatives. Through the application of the RCE large language recognition model, the present invention can provide deeper analysis and more accurate vulnerability positioning, while quickly adapting to and identifying emerging RCE attack patterns, and has strong adaptability and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The present invention can be further illustrated by the non-limiting examples given in the accompanying drawings;

[0064] Figure 1 It is a structural schematic diagram of an embodiment of an RCE vulnerability and threat identification method based on full-link tracking information of the present invention;

[0065] Figure 2 It is a structural schematic diagram of an embodiment of an RCE vulnerability and threat identification method based on full-link tracking information of the present invention. DETAILED DESCRIPTION

[0066] In order to enable those skilled in the art to better understand the present invention, the technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments. The technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention.

[0067] It should be noted that all directional indications in the embodiments of the present invention (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0068] In addition, the descriptions of "first", "second", etc. in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0069] This solution mainly constructs fine-tuning samples and trains the RCE large language recognition model, so that it can accurately identify RCE attack characteristics and vulnerability information, and locate the exact location and true cause of the RCE vulnerability; with the help of the RCE large language recognition model, combined with the full-link tracking and analysis system, in the two scenarios of active RCE vulnerability mining and passive RCE threat identification, it is judged whether there is a remote code execution vulnerability or threat based on the analysis results.

[0070] like Figure 1 As shown, an RCE vulnerability and threat identification method based on full-link tracking information of the present invention includes the following steps:

[0071] S1: deploy a full-link tracking and analysis system, which is used to monitor and record the completed application request and response process;

[0072] S2: Start the range environment, activate the range simulation environment through the full-link tracking and analysis system agent, and use it for safety testing;

[0073] S3: Execute operations and data records, wherein the operations and data records include remote code execution on a target machine with an RCE vulnerability in a range environment;

[0074] S4: Automatic sample generation, where the automatic samples are used to generate fine-tuning samples for a large language recognition model;

[0075] S5: Write the training file and write the generated fine-tuning samples into the training file to prepare for fine-tuning the RCE large language recognition model.

[0076] The basic decision principle of RCE large language recognition model fine-tuning is as follows:

[0077] In many programming languages, such as PHP, Java, and Python, there are some risk functions that, if used improperly, may cause serious security issues, especially remote code execution (RCE) vulnerabilities. Common examples of risk functions are as follows:

[0078] PHP: eval(), assert(), preg_replace(), call_user_func(), call_user_func_array(), array_map(), system, shell_exec, popen, passthru, proc_open

[0079] Java: ProcessBuilder.start(),Runtime.getRuntime().exec()

[0080] Python: eval, exec, subprocess, os.system, commands

[0081] The core goal of fine-tuning the RCE large language recognition model is to use the Fine-tuning technology to further train the pre-trained model, so that the model can deeply analyze the call tree in the full-link tracking data and accurately identify the risk functions related to remote code execution attacks. After training, the model can determine whether these functions are used to perform RCE attacks, thereby effectively identifying potential RCE vulnerabilities and ongoing attack behaviors.

[0082] Preferably, S3 further includes the following specific steps:

[0083] S3.1: Based on the vulnerability data of the target range, use attack tools or manually load the corresponding attack payload and perform the test operation;

[0084] S3.2: Record the range path information in detail, including the path information, request parameters, RCE threat tags, and RCE vulnerability tags. The path information includes the URL, protocol headers, and IP addresses.

[0085] Among them, in the RCE threat mark, "0" indicates that there is no RCE vulnerability attack, and "1" indicates that there is an RCE vulnerability attack; in the RCE vulnerability mark, "0" indicates that there is no RCE vulnerability attack, and "1" indicates that there is an RCE vulnerability attack.

[0086] Preferably, the S4 further comprises the following specific steps:

[0087] S4.1: Read the shooting range path information list;

[0088] S4.2: Through the full-link tracking and analysis system, query all transaction IDs and their URLs entering the shooting range website and create a transaction ID list;

[0089] S4.3: Traverse the transaction ID list.

[0090] Preferably, S4.3 also includes:

[0091] S4.31: Call the transaction details API of the full-link application analysis platform to obtain detailed transaction processing information;

[0092] S4.32: Extract the call tree information of transaction processing, including request path, request parameters, application first response function and transaction processing characteristic key functions;

[0093] S4.34: According to the request path, query the RCE attack and RCE vulnerability mark in the range path information list;

[0094] S4.35: Generate a sample for fine-tuning a large language recognition model, wherein the sample includes: a request path, request parameters, an application first response function, a transaction processing characteristic key function, and a path RCE vulnerability marker.

[0095] Preferably, the S5 further comprises the following specific steps:

[0096] S5.1: Sample data preparation, reading pre-generated fine-tuning samples and formatting the data into question-answer format to enhance the model's understanding and prediction capabilities;

[0097] Specifically, the sample questions and answers include:

[0098] Question: If you start with "Please determine whether the following transaction processing has RCE attacks or RCE vulnerabilities, the transaction processing information is as follows:", and then list the request path, request parameters, application first response function, and transaction processing characteristic key function information in detail;

[0099] Answer: The answer includes: request path, request parameters, whether there is an RCE vulnerability, whether there is an RCE attack, vulnerability details, and attack payload information;

[0100] S5.2: Model fine-tuning execution;

[0101] Specifically, the formatted question-answer samples are used to start the fine-tuning process of the large language model; the underlying parameters of the pre-trained model are frozen to keep the common features; the top-level parameters are then updated or added (to adapt to the new task), and the fine-tuning will continue until the predetermined training steps or error threshold are reached (to ensure the accuracy and efficiency of the model);

[0102] S5.3: Model validation, evaluate the fine-tuned model using test samples;

[0103] Specifically, if the recognition rate of the model reaches or exceeds 80%, the model training is considered successful and can be used for practical applications; if the recognition rate does not meet the standard, further analysis of the reasons is required, and more samples need to be added or fine-tuning parameters need to be adjusted, and then fine-tuning should be performed again;

[0104] S5.4: Continuous optimization and iteration: Based on test feedback, continuously optimize the model's fine-tuning strategy and sample selection. This ensures that the model can adapt to new data and scenarios and maintain high accuracy and robustness.

[0105] like Figure 2 As shown, preferably, the full-link tracking and analysis system of S1 includes a data collector, a web server and a data collection agent;

[0106] The data collector is responsible for collecting data on the complete application access process, including the initiation, processing and response of requests; in this way, by deeply analyzing the call tree of request processing, data such as key methods and functions called within the code can be obtained;

[0107] The web server provides a user interface and an API interface for accessing and managing the full-link analysis system, and is also used to process requests from the front end and interact with back-end components;

[0108] The data collection agent is deployed on each server or application instance to collect and transmit data to the data collector or Web server, which can ensure the real-time and integrity of the data.

[0109] Preferably, it also includes active RCE vulnerability mining and passive RCE threat identification.

[0110] Preferably, the active RCE vulnerability mining includes the following steps:

[0111] S10: Vulnerability test preparation: according to the development language of the target application system, load the corresponding RCE attack payload or construct an abnormal request to perform fuzz testing on the system;

[0112] S11: Full-link tracking query, regularly query the full-link tracking data of the target application within a specific time range, and parse the transaction processing ID and request path information.

[0113] S12: Transaction analysis: Based on the transaction ID, use the full-link application analysis transaction details API to query the transaction details and extract key information from the transaction details data, including the request path, request parameters, and call tree information.

[0114] S13: Submit the large model analysis, submit the extracted transaction processing information to the RCE large language recognition model, and request the model to analyze whether there is an RCE vulnerability and its specific location;

[0115] S14: Vulnerability identification and location. The RCE large language recognition model analyzes the submitted information and identifies whether there is an RCE vulnerability in the request path. If a vulnerability is found, the model will provide vulnerability location information for the application system.

[0116] Specifically, the vulnerability location information includes the first entry function or method of the application system to process the request and the function or method in the dependent library that ultimately executes the RCE.

[0117] Preferably, the passive RCE threat identification comprises the following steps:

[0118] S20: Real-time monitoring and query, real-time query of all transaction processing of the target application within the time range recorded by the full-link tracking and analysis system;

[0119] S21: Transaction analysis: Based on the transaction ID, use the full-link application analysis transaction details API to query the transaction details and extract key information from the transaction details data, including request path, request parameters, and call tree information.

[0120] S22: Information submission and inquiry, submitting the extracted transaction information to the RCE large language recognition model to inquire whether there is an RCE vulnerability exploitation attack and whether there is an RCE vulnerability;

[0121] S23: Attack and vulnerability judgment: The RCE large language recognition model analyzes the submitted information to determine whether there is an RCE remote code execution attack behavior and whether the target application has a corresponding RCE vulnerability;

[0122] S24: Security response measures: if only attack behavior is detected and the target application does not have a vulnerability, the security device will be linked to execute security protection measures, including blocking malicious requests, recording relevant logs, and notifying the system administrator;

[0123] If an attack is detected and a vulnerability exists in the target application, in addition to implementing the above security protection measures, you must submit the detailed location of the vulnerability, related functions and methods, and organize a technical team to evaluate and determine the possible damage.

[0124] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present invention. Therefore, all equivalent modifications or changes made by those with ordinary knowledge in the technical field without departing from the spirit and technical ideas disclosed by the present invention should still be covered by the claims of the present invention.

Claims

1. A RCE vulnerability and threat identification method based on full-link tracking information, characterized in that: The steps include: S1: deploy a full-link tracking and analysis system, which is used to monitor and record the completed application request and response process; S2: Start the range environment, activate the range simulation environment through the full-link tracking and analysis system agent, and use it for safety testing; S3: Execute operations and data records, wherein the operations and data records include remote code execution on a target machine with an RCE vulnerability in a range environment; S4: Automatic sample generation, where the automatic samples are used to generate fine-tuning samples for a large language recognition model; S5: Write the training file and write the generated fine-tuning samples into the training file to prepare for fine-tuning the RCE large language recognition model.

2. According to claim 1, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: The S3 also includes the following specific steps: S3.1: Based on the vulnerability data of the target range, use attack tools or manually load the corresponding attack payload and perform the test operation; S3.2: Record the range path information in detail, including the path information, request parameters, RCE threat tags, and RCE vulnerability tags. The path information includes the URL, protocol headers, and IP addresses. Among them, in the RCE threat mark, "0" indicates that there is no RCE vulnerability attack, and "1" indicates that there is an RCE vulnerability attack; in the RCE vulnerability mark, "0" indicates that there is no RCE vulnerability attack, and "1" indicates that there is an RCE vulnerability attack.

3. According to claim 1, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: The S4 further comprises the following specific steps: S4.1: Read the shooting range path information list; S4.2: Through the full-link tracking and analysis system, query all transaction IDs and their URLs entering the shooting range website and create a transaction ID list; S4.3: Traverse the transaction ID list.

4. According to claim 3, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: The S4.3 also includes: S4.31: Call the transaction details API of the full-link application analysis platform to obtain detailed transaction processing information; S4.32: Extract the call tree information of transaction processing, including request path, request parameters, application first response function and transaction processing characteristic key functions; S4.34: According to the request path, query the RCE attack and RCE vulnerability mark in the range path information list; S4.35: Generate a sample for fine-tuning a large language recognition model, wherein the sample includes: a request path, request parameters, an application first response function, a transaction processing characteristic key function, and a path RCE vulnerability marker.

5. According to claim 1, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: The S5 further comprises the following specific steps: S5.1: Sample data preparation, reading pre-generated fine-tuning samples and formatting the data into question-answer format to enhance the model's understanding and prediction capabilities; Specifically, the sample questions and answers include: Question: If you start with "Please determine whether the following transaction processing has RCE attacks or RCE vulnerabilities, the transaction processing information is as follows:", and then list the request path, request parameters, application first response function, and transaction processing characteristic key function information in detail; Answer: The answer includes: request path, request parameters, whether there is an RCE vulnerability, whether there is an RCE attack, vulnerability details, and attack payload information; S5.2: Model fine-tuning execution; Specifically, the formatted question and answer samples are used to start the fine-tuning process of the large language model; the bottom-level parameters of the pre-trained model are frozen to keep the common features; the top-level parameters are then updated or added, and the fine-tuning will continue until the predetermined training steps or error threshold are reached; S5.3: Model validation, evaluate the fine-tuned model using test samples; Specifically, if the recognition rate of the model reaches or exceeds 80%, the model training is considered successful and can be used for practical applications; if the recognition rate does not meet the standard, further analysis of the reasons is required, and more samples need to be added or fine-tuning parameters need to be adjusted, and then fine-tuning should be performed again; S5.4: Continuously optimize and iterate, and continuously optimize the model's fine-tuning strategy and sample selection based on test feedback.

6. According to claim 1, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: The full-link tracking and analysis system of S1 includes a data collector, a web server and a data collection agent; The data collector is responsible for collecting data from the entire application access process, including the initiation, processing and response of requests; The web server provides a user interface and an API interface for accessing and managing the full-link analysis system, and is also used to process requests from the front end and interact with back-end components; The data collection agent is deployed on each server or application instance, and is used to collect and transmit data to the data collector or Web server.

7. According to claim 1, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: It also includes active RCE vulnerability mining and passive RCE threat identification.

8. According to claim 7, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: The active RCE vulnerability mining includes the following steps: S10: Vulnerability test preparation: according to the development language of the target application system, load the corresponding RCE attack payload or construct an abnormal request to perform fuzz testing on the system; S11: Full-link tracking query, regularly query the full-link tracking data of the target application within a specific time range, and parse the transaction processing ID and request path information. S12: Transaction analysis: Based on the transaction ID, use the full-link application analysis transaction details API to query the transaction details and extract key information from the transaction details data, including the request path, request parameters, and call tree information. S13: Submit the large model analysis, submit the extracted transaction processing information to the RCE large language recognition model, and request the model to analyze whether there is an RCE vulnerability and its specific location; S14: Vulnerability identification and location. The RCE large language recognition model analyzes the submitted information and identifies whether there is an RCE vulnerability in the request path. If a vulnerability is found, the model will provide vulnerability location information for the application system. Specifically, the vulnerability location information includes the first entry function or method of the application system to process the request and the function or method in the dependent library that ultimately executes the RCE.

9. According to claim 7, a RCE vulnerability and threat identification method based on full-link tracking information is characterized in that: The passive RCE threat identification includes the following steps: S20: Real-time monitoring and query, real-time query of all transaction processing of the target application within the time range recorded by the full-link tracking and analysis system; S21: Transaction analysis: Based on the transaction ID, use the full-link application analysis transaction details API to query the transaction details and extract key information from the transaction details data, including request path, request parameters, and call tree information. S22: Information submission and inquiry, submitting the extracted transaction information to the RCE large language recognition model to inquire whether there is an RCE vulnerability exploitation attack and whether there is an RCE vulnerability; S23: Attack and vulnerability judgment: The RCE large language recognition model analyzes the submitted information to determine whether there is an RCE remote code execution attack behavior and whether the target application has a corresponding RCE vulnerability; S24: Security response measures: if only attack behavior is detected and the target application does not have a vulnerability, the security device will be linked to execute security protection measures, including blocking malicious requests, recording relevant logs, and notifying the system administrator; If an attack is detected and a vulnerability exists in the target application, in addition to implementing the above security protection measures, you must submit the detailed location of the vulnerability, related functions and methods, and organize a technical team to evaluate and determine the possible damage.

Images