Industrial internet platform security testing method

Abstract

The application provides an industrial internet platform security testing method, comprising: selecting a web security vulnerability scanning tool and an edge node device security vulnerability scanning tool suitable for an industrial internet platform, configuring scanning parameters and a network environment; performing web security vulnerability scanning, comprehensively scanning a target website, and identifying existing security vulnerabilities; performing edge node device security vulnerability scanning, sending a probe data packet to a target edge node device, and identifying potential vulnerabilities; analyzing the results of the web security vulnerability scanning and the edge node device security vulnerability scanning, manually verifying the authenticity and exploitability of the discovered vulnerabilities; obtaining source code of the industrial internet platform, selecting a source code component analysis tool, generating a tested project fingerprint, and uploading the tested project fingerprint to a scanning tool; performing source code component analysis, identifying third-party components in the code, and verifying the license compatibility of the components; generating a security testing report containing the web security vulnerabilities, the edge node device vulnerabilities, and the source code component analysis results, and proposing corresponding repair suggestions.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to an industrial internet platform security testing method. BACKGROUND

[0002] During the security testing of an industrial internet platform of a large petrochemical enterprise, a difficult problem was found. The platform adopts a multi-layer distributed architecture and contains hundreds of edge node devices distributed in production bases across the country. When performing edge node device vulnerability scanning, due to network delay and firewall restrictions, many probe data packets cannot reach the target host or cannot receive responses, resulting in incomplete scanning results. At the same time, the platform's Web application uses a complex microservice architecture and uses a large number of self-developed components, making it difficult for traditional Web security vulnerability scanning tools to effectively identify potential vulnerabilities in these components. During source code component analysis, it was found that the platform uses some closed-source industrial software components, and their source code cannot be obtained for analysis, and there is also a lack of relevant vulnerability information library. These factors result in incomplete coverage of security testing, which may miss some important security risks. How to design a more effective security testing scheme in such a complex industrial internet environment to comprehensively evaluate the security status of the platform has become a technical problem to be solved. SUMMARY

[0003] The present application provides an industrial internet platform security testing method, mainly comprising:

[0004] Obtain the website address, IP information and edge node device information of the industrial internet platform, and determine the test range of Web security vulnerability scanning and edge node device security vulnerability scanning;

[0005] Select Web security vulnerability scanning tools and edge node device security vulnerability scanning tools suitable for the industrial internet platform, and configure scanning parameters and network environment;

[0006] Perform Web security vulnerability scanning to comprehensively scan the target website and identify existing security vulnerabilities;

[0007] Perform edge node device security vulnerability scanning, send probe data packets to the target edge node device, and identify potential vulnerabilities;

[0008] Analyze the results of Web security vulnerability scanning and edge node device security vulnerability scanning, and manually verify the authenticity and exploitability of the discovered vulnerabilities;

[0009] Obtain the source code of the industrial internet platform, select a source code component analysis tool, generate a fingerprint of the tested project and upload it to the scanning tool;

[0010] Performing source code component analysis, identifying third-party components in the code, verifying license compatibility of the components;

[0011] Generating a security test report containing the results of Web security vulnerabilities, edge node device vulnerabilities and source code component analysis, and proposing corresponding repair suggestions.

[0012] The technical scheme provided by the embodiment of the present application can include the following beneficial effects:

[0013] The present application discloses an industrial internet platform security testing method. The method first acquires the website and edge node device information of the platform, determines the test range, and selects the applicable Web and edge node device security vulnerability scanning tools. Then, Web security vulnerability scanning and edge node device security vulnerability scanning are performed to identify existing security vulnerabilities. At the same time, the platform source code is obtained, component analysis is performed, third-party components are identified and license compatibility is verified. Finally, the present application comprehensively analyzes the results of Web security vulnerabilities, edge node device vulnerabilities and source code component analysis, generates a comprehensive security test report, and proposes targeted repair suggestions. This multi-dimensional and all-round security testing method can well solve the problem of the lack of systematic security testing methods in the industry, and can comprehensively evaluate the security status of the industrial internet platform, effectively identify potential risks, and provide important support for the safe operation of the platform. BRIEF DESCRIPTION OF DRAWINGS

[0014] Fig. 1 A flowchart of an industrial internet platform security testing method of the present application.

[0015] Fig. 2 A schematic diagram of an industrial internet platform security testing method of the present application.

[0016] Fig. 3 Another schematic diagram of an industrial internet platform security testing method of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be described in detail below in combination with the drawings and specific embodiments.

[0018] As Figs. 1-3 , the industrial internet platform security testing method of the present embodiment can specifically include:

[0019] S101, acquire the website address, IP information and edge node device information of the industrial internet platform, and determine the test range of the web security vulnerability scanning and edge node device security vulnerability scanning. Among them, the web security vulnerability scanning mainly faces the application security, the edge node device security vulnerability scanning mainly faces the edge device security, and the source code component analysis is mainly used for identifying the security of third-party components at each level of the platform.

[0020] Specifically, according to the domain name information of the industrial internet platform, the IP address of the website is obtained through DNS resolution, the obtained IP address is scanned by using a port scanning tool, and the open port information is obtained. According to the open port information, the type and version of the web server used by the website are determined. Through fingerprint identification technology, the development language, framework and middleware used by the website are obtained. According to the URL of the website, the page URL information of the website is obtained by using the crawler technology. The obtained URL is analyzed to determine the target URL range of the web security vulnerability scanning. According to the IP address of the edge node device, the device type and version of the host are obtained through Modbus, OPC and other industrial control protocols. Through Nmap and other industrial control device scanning tools, the specific ports opened by the edge node device are scanned and determined. According to the device type and open port information of the edge node device, the target range of the edge node device security vulnerability scanning is determined.

[0021] Exemplary.

[0022] S102, select the web security vulnerability scanning tool and edge node device security vulnerability scanning tool suitable for the industrial internet platform, and configure the scanning parameters and network environment.

[0023] According to the characteristics and needs of the industrial internet platform, tools suitable for web security vulnerability scanning, such as Acunetix, Nessus, etc., and tools suitable for edge node device security vulnerability scanning, such as Nmap, OpenVAS, etc., are selected. By analyzing the network architecture and composition of the industrial internet platform, the target systems and hosts that need to be scanned are determined, and their IP addresses, ports, protocols, and other network parameter information are obtained. Network packet capture tools such as Wireshark are used to monitor the traffic of the target system, determine its open network services and communication protocols, and obtain potential vulnerability attack surfaces. In an isolated test environment, configure the scanning strategy of the vulnerability scanning tool according to the type and characteristics of the edge node device, set the scanning depth, breadth, rate, and other parameters. If the target is a web application system, use web security vulnerability scanning tools to perform comprehensive scanning, focusing on common web security vulnerabilities such as SQL injection, XSS, file inclusion, etc.; if the target is an edge node device, use edge node device security vulnerability scanning tools for customized scanning, focusing on vulnerabilities specific to PLC, HMI, RTU, and other devices. Monitor the running status of the scanning tool and network traffic changes in real time during the scanning process, and if abnormal traffic or system response delay is found, adjust the scanning rate and intensity in time to avoid causing significant impact on the target system. After scanning is completed, the scanning results are summarized and analyzed to identify existing security vulnerabilities, obtain detailed information such as vulnerability type, risk level, cause, etc. According to the actual situation of the vulnerability, further verify the authenticity and exploitability of the vulnerability through vulnerability exploitation tools, and judge the actual risk of the vulnerability to the system. Based on the results of vulnerability scanning and verification, a complete vulnerability analysis report is formed, and targeted vulnerability repair and protection suggestions are proposed, such as closing unnecessary ports, updating patches, reinforcing configurations, etc., for subsequent rectification.

[0024] Exemplary.

[0025] S103, performing web security vulnerability scanning, performing comprehensive scanning on the target website, and identifying existing security vulnerabilities.

[0026] According to the URL and IP information of the target website, the domain name, subdomain name, IP address and other basic information of the website are obtained through network scanning tools, and the authenticity and validity of these information are verified. Web fingerprint identification technology is adopted to analyze the HTTP response header, web content and other characteristics of the website to determine the type of web server, version number, development language, framework and other information used by the website. According to the business function and URL structure of the website, the crawler tool is used to automatically traverse the links of the website to obtain the page URL list of the website, and by parsing the page content, the forms, parameters and other information in the page are extracted. According to the known web security vulnerability feature library, the rule matching based method is adopted to detect the security of the URL, parameter, Cookie and other information of the website to determine whether there are common web security vulnerabilities such as SQL injection, XSS cross-site scripting, CSRF cross-site request forgery. If a suspected vulnerability is detected in the previous step, a specific Pay load is automatically constructed and sent according to the type of the vulnerability, and the authenticity and exploitability of the vulnerability are further verified by analyzing the response content of the website. If the website has a file upload function, a specially constructed file is uploaded and the uploaded file path is accessed to detect whether there is a file upload vulnerability and obtain the file system path information of the website. According to the framework and middleware used by the website, the corresponding known vulnerability information is obtained from the vulnerability library, and by sending a customized request, it is detected whether the website has security risks of these known vulnerabilities. The Web security vulnerability mining technology based on intelligent algorithm is adopted to automatically generate abnormal test cases by learning the normal request and response mode of the website to discover potential logic vulnerabilities and business security risks of the website. The various web security vulnerabilities discovered in the scanning process are summarized and classified, and combined with the severity and impact range of the vulnerabilities, a website security test report is generated, and corresponding vulnerability repair suggestions and solutions are given.

[0027] Exemplary.

[0028] S104, perform edge node device security vulnerability scanning, send a probe data packet to the target edge node device, and identify potential vulnerabilities.

[0029] The host to be tested is connected with the test machine through a wired connection, and a wired local area network is configured. Then, according to the IP address, port and other information of the edge node device, a detection data packet is constructed using the TCP / IP protocol, the constructed detection data packet is sent to the target edge node device through the network, the detection data packet is listened to and received on the target edge node device, the received detection data packet is parsed, the request information contained therein is extracted, the request operation is simulated on the edge node device according to the request information, the response data of the request is obtained, the response data is analyzed, and it is judged whether the response data contains abnormal or sensitive information. If it contains, it indicates that there may be a vulnerability. According to the analysis result, the suspected vulnerability point is determined, and the potential vulnerability list is generated. By querying the vulnerability library, the detailed information of the potential vulnerability is obtained, including vulnerability description, hazard level, etc. Combined with the actual situation of the edge node device, the high-risk vulnerabilities that need to be focused on are screened out, and the final vulnerability scanning result report is formed

[0030] Exemplary.

[0031] S105, analyze the results of the Web security vulnerability scanning and the edge node device security vulnerability scanning, and manually verify the authenticity and exploitability of the discovered vulnerabilities.

[0032] According to the results of the Web security vulnerability scanning and the edge node device security vulnerability scanning, the list of discovered vulnerabilities and their detailed information, including vulnerability description, impact range, exploitation method, etc. are obtained. Using a vulnerability risk assessment method, the risk of each vulnerability in the vulnerability list is assessed, and the risk level of the vulnerability is obtained. According to the risk level of the vulnerability, the verification priority of the vulnerability is determined, and the higher the risk level, the higher the priority. By building a test environment that is the same or similar to the target system, simulating the real network topology and system configuration, and providing a basis for vulnerability verification. According to the exploitation method of the vulnerability, try to reproduce and exploit the high-priority vulnerability in the test environment, and judge whether the vulnerability exists. If the vulnerability can be successfully exploited, the sensitive information of the target system or the control permission of the system is obtained through the vulnerability exploitation, and the vulnerability is further determined. If the vulnerability cannot be directly exploited, analyze the cause of the vulnerability, identify the prerequisites for exploiting the vulnerability, and try to bypass the restrictions to achieve vulnerability exploitation by constructing specific exploitation environment and exploitation code. According to the results of vulnerability verification, update the information of the vulnerability list, mark the verified vulnerabilities as real and exploitable or unexploitable, and update the detailed description of the vulnerability. For the vulnerabilities confirmed to be real and exploitable, according to their severity and impact range, formulate corresponding repair scheme and emergency plan, and notify relevant personnel to repair and prevent in time.

[0033] Exemplary.

[0034] S106, obtain the source code of the industrial internet platform, select a source code component analysis tool, generate a fingerprint of the project to be tested, and upload it to the scanning tool.

[0035] Obtain the source code of the industrial internet platform. Extract the specified project, branch, module, or file by accessing the enterprise's version control system, such as Git or SVN. Select a source code component analysis tool. According to the language, framework, and dependency management of the source code, filter out the analysis tools that support these technology stacks. Precondition, verify the consistency of the code and the product. By compiling the source code and running basic functional tests, ensure that the code is up-to-date and in a runnable state. Generate the fingerprint of the project under test. Use the source code component analysis tool to scan the source code and generate a unique identifier or fingerprint of the code. Upload to the scanning tool. Upload the generated project fingerprint to the server of the analysis tool through the network, so as to conduct in-depth component analysis. Configure the analysis tool. According to the project settings and requirements, adjust the scanning parameters of the analysis tool, such as scanning depth, excluded directory, or custom rules. Perform automatic scanning. Start the analysis tool to automatically scan the source code, identify third-party components, and match them with known components in the database. Generate a detailed report. The analysis tool processes the scanning data and generates a detailed report containing component lists, version information, dependency relationships, known vulnerabilities, and license status. Show the analysis results. Use visualization methods such as icons or graphs to display the results of the source code component analysis, making it easier to understand and operate.

[0036] Exemplary.

[0037] S107, perform source code component analysis, identify third-party components in the code, and verify the license compatibility of the components.

[0038] According to the project requirements, determine the scope of the source code that needs to be analyzed, including project name, version, branch, etc. Use the source code scanning tool to scan the source code and get the file list and file content of the source code. Analyze the file list and file content of the source code to identify the programming languages and build tools used in the source code. According to the identified programming languages and build tools, select the appropriate source code component analysis tool. Input the file list and file content of the source code into the selected source code component analysis tool for analysis. The source code component analysis tool compares with the known open source component feature library to identify the open source components contained in the source code and their version information. Obtain the license information of the identified open source components and compare it with the project license requirements to determine if there is a license compatibility issue. If there is a license compatibility issue, output the specific information of the license incompatible components, including component name, version, license type, etc., and prompt further processing. According to the results of the source code component analysis, generate a source code component analysis report, including the list of open source components used, version, license information, and potential license compatibility risks, etc., to provide a basis for subsequent source code management

[0039] Exemplary.

[0040] S108, generating a security test report containing the results of the web security vulnerability scanning, edge node device vulnerability scanning and source code component analysis, and proposing corresponding repair suggestions.

[0041] According to the results of the web security vulnerability scanning, edge node device security vulnerability scanning and source code component analysis, the discovered vulnerabilities and their detailed information are obtained, including vulnerability description, impact range, exploitation method, etc. A vulnerability assessment algorithm is adopted to calculate the risk score of each vulnerability through factors such as the severity of the vulnerability, the impact range, the exploitation difficulty, etc. The priority of the vulnerability is obtained. If the vulnerability score exceeds the preset high-risk threshold, the vulnerability is determined as a high-risk vulnerability and is included in the key repair suggestion; if the score is lower than the threshold but higher than the low-risk threshold, it is determined as a medium-risk vulnerability and is included in the regular repair suggestion. According to the system component where the vulnerability is located, the general repair scheme of the vulnerability type is matched from the vulnerability knowledge base as the basis for the repair suggestion. Combined with the actual architecture and running environment of the target system, the general repair scheme is customized and adjusted to obtain targeted detailed repair steps. Through asset importance assessment, the business value of different assets is determined, and higher repair priority is given to the vulnerabilities related to high-value assets. The vulnerability details, risk analysis, repair suggestions, etc. are summarized into a security test report, and are sorted by severity and priority. Data visualization technology is used to generate intuitive charts such as vulnerability distribution chart, high-medium-low risk proportion chart, etc. and insert into the security test report. Through interface integration with the business system, the security test report is pushed to the asset responsible person, and a work order process is triggered to track the vulnerability repair progress and ensure that the rectification is completed according to the plan

[0042] Exemplary.

[0043] The specific embodiments of the present application are described above. It should be understood that the present application is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essential content of the present application. In the case of no conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A security testing method for an industrial internet platform, characterized in that, The method includes: Obtain the website address, IP information, and edge node device information of the industrial internet platform to determine the test scope for web security vulnerability scanning and edge node device security vulnerability scanning; Select a web security vulnerability scanning tool and an edge node device security vulnerability scanning tool suitable for the industrial internet platform, and configure the scanning parameters and network environment; Perform a web security vulnerability scan to scan the target website and identify existing security vulnerabilities; Perform security vulnerability scanning on edge node devices, send probe data packets to target edge node devices, and identify potential vulnerabilities; Analyze the results of web security vulnerability scans and edge node device security vulnerability scans, and manually verify the authenticity and exploitability of the discovered vulnerabilities; Obtain the source code of the industrial internet platform, select the source code component analysis tool, generate the fingerprint of the project under test, and upload it to the scanning tool; Perform source code component analysis to identify third-party components in the code and verify the license compatibility of the components; Generate a security test report that includes web security vulnerabilities, edge node device vulnerabilities, and source code composition analysis results, and propose corresponding remediation suggestions; The selection of web security vulnerability scanning tools and edge node device security vulnerability scanning tools suitable for industrial internet platforms, and the configuration of scanning parameters and network environment, include: Based on the characteristics and needs of the industrial internet platform, select tools suitable for web security vulnerability scanning and tools suitable for edge node device security vulnerability scanning; By analyzing the network architecture and composition of the industrial internet platform, the target systems and hosts that need to be scanned for vulnerabilities are identified, and their network parameter information is obtained. Network packet capture tools are used to monitor the traffic of the target system, determine its open network services and communication protocols, and obtain potential vulnerability attack surfaces; In an isolated testing environment, the scanning strategy of the vulnerability scanning tool is configured according to the type and characteristics of the edge node devices, and the scanning depth, breadth and rate are set. If the target is a web application system, use a web security vulnerability scanning tool to scan it, focusing on web security vulnerabilities; If the target is an edge node device, a customized scan is performed using an edge node device security vulnerability scanning tool, focusing on device-specific vulnerabilities. During the scanning process, the operating status of the scanning tool and changes in network traffic are monitored in real time. If abnormal traffic or system response delays are detected, the scanning rate and intensity are adjusted in a timely manner to avoid affecting the target system. After the scan is completed, the scan results are summarized and analyzed to identify various security vulnerabilities and obtain detailed information about them. Based on the actual situation of the vulnerability, the authenticity and exploitability of the vulnerability are further verified by vulnerability exploitation tools to determine the actual risk of the vulnerability to the system. Based on the results of vulnerability scanning and verification, a complete vulnerability analysis report is generated, and targeted vulnerability remediation and protection suggestions are proposed for subsequent remediation.

2. The method according to claim 1, characterized in that, The acquisition of the website address, IP information, and edge node device information of the industrial internet platform, and the determination of the test scope for web security vulnerability scanning and edge node device security vulnerability scanning, include: Based on the domain name information of the industrial internet platform, the IP address of the website is obtained through DNS resolution. A port scanning tool is used to scan the obtained IP address to obtain the open port information. Based on the open port information, the type and version of the web server used by the website are determined. Based on the website's URL, web crawling technology is used to traverse and obtain the website's page URL information. The obtained URLs are analyzed to determine the target URL range for web security vulnerability scanning based on the IP address of the edge node device. Obtain the host's device type and version using industrial control protocols such as Modbus and OPC; Using industrial control equipment scanning tools, specific open ports of edge node devices are scanned and identified. Based on the device type and open port information of the edge node devices, the target scope for security vulnerability scanning of the edge node devices is determined.

3. The method according to claim 1, characterized in that, The aforementioned web security vulnerability scan involves scanning the target website to identify existing security vulnerabilities, including: Based on the target website's URL and IP information, use network scanning tools to obtain basic information about the website and verify the authenticity and validity of the information; By analyzing the characteristics of a website, we can determine the type, version number, development language, and framework used by the website. Based on the website's business functions and URL structure, use a web crawler to automatically traverse the website's links, obtain a list of the website's page URLs, and extract the forms and parameters from the pages by parsing the page content. Based on a known database of web security vulnerabilities, a rule-based matching method is used to perform security checks on websites to determine whether web security vulnerabilities exist. If a suspected vulnerability is detected in the previous step, a targeted payload is automatically constructed and sent according to the vulnerability type. The authenticity and exploitability of the vulnerability are verified by analyzing the website's response content. If the website has a file upload function, then by uploading a specially crafted file and accessing the uploaded file path, we can detect whether there is a file upload vulnerability and obtain the website's file system path information. Based on the framework and middleware used by the website, obtain the corresponding known vulnerability information from the vulnerability database, and detect whether the website has security risks due to these known vulnerabilities by sending customized requests; By learning the normal request and response patterns of a website, abnormal test cases are automatically generated to discover potential logical vulnerabilities and business security risks of the website. The website security test report is generated by summarizing and classifying various web security vulnerabilities discovered during the scanning process, taking into account the severity and scope of the vulnerabilities, and providing corresponding vulnerability remediation suggestions and solutions.

4. The method according to claim 1, characterized in that, The process of performing security vulnerability scanning on edge node devices involves sending probe data packets to the target edge node device to identify potential vulnerabilities, including: Based on the IP address and port information of the edge node device, a probe data packet is constructed using the TCP / IP protocol and sent to the target edge node device over the network. The target edge node device listens for and receives the probe data packet. The received probe data packet is parsed to extract the request information contained within. Based on the request information, a request operation is simulated on the edge node device to obtain the request response data. The response data is analyzed to determine whether it contains abnormal or sensitive information. If it does, it indicates that a vulnerability may exist. Based on the analysis results, suspected vulnerability points are identified, and a list of potential vulnerabilities is generated. By querying the vulnerability database, detailed information on potential vulnerabilities is obtained, including vulnerability descriptions and severity levels. Combining the actual situation of the edge node device, high-risk vulnerabilities that require special attention are selected, and a final vulnerability scanning result report is generated.

5. The method according to claim 1, characterized in that, The analysis of the results of web security vulnerability scans and edge node device security vulnerability scans involves manually verifying the authenticity and exploitability of the discovered vulnerabilities, including: Based on the results of web security vulnerability scanning and edge node device security vulnerability scanning, obtain a list of discovered vulnerabilities and their detailed information, including vulnerability descriptions, scope of impact, and exploitation methods; A vulnerability risk assessment method is used to assess the risk of each vulnerability in the vulnerability list and obtain the vulnerability risk level. Based on the risk level of the vulnerability, determine the verification priority of the vulnerability, with higher risk level vulnerabilities having higher priority. By building a test environment that is the same as or similar to the target system, we can simulate the real network topology and system configuration, thus providing a foundation for vulnerability verification. Based on the exploitation method, attempt to reproduce and exploit high-priority vulnerabilities in the test environment to determine whether the vulnerabilities actually exist. If the vulnerability can be successfully exploited, sensitive information of the target system or system control privileges can be obtained through the exploit, further determining the severity of the vulnerability; If the vulnerability cannot be directly exploited, analyze the cause of the vulnerability, identify the prerequisites for exploitation, and attempt to bypass the restrictions to achieve exploitation by constructing a specific exploitation environment and exploit code. Based on the results of vulnerability verification, update the vulnerability list information, mark verified vulnerabilities as truly exploitable or unexploitable, and update the detailed description of the vulnerabilities. For vulnerabilities that have been confirmed as genuinely exploitable, develop corresponding remediation plans and contingency plans based on their severity and scope of impact, and notify relevant personnel to remediate and prevent them in a timely manner.

6. The method according to claim 1, characterized in that, The process of acquiring the source code of the industrial internet platform, selecting a source code component analysis tool, generating a fingerprint of the project under test, and uploading it to a scanning tool includes: Obtain the source code of the industrial internet platform; By accessing the enterprise's version control system, you can extract specified projects, branches, modules, or files. Choose a source code composition analysis tool; Based on the language, framework, and dependency management methods of the source code, we selected analysis tools that support the technology stack. Pre-defined conditions verify the consistency between the code and the product; Ensure the code is up-to-date and runnable by compiling the source code and running basic functional tests; Generate the fingerprint of the item being tested using tools; Use source code composition analysis tools to scan the source code and generate unique identifiers or fingerprints for the code; Upload to the scanning tool; The generated project fingerprint is uploaded to the analysis tool's server via the network for in-depth component analysis; Configure analysis tools; Adjust the scanning parameters of the analysis tool, such as scan depth and exclusion categories or custom rules, according to project settings and requirements; Perform an automatic scan; Launch the analysis tool to automatically scan the source code, identify third-party components, and match them with known components in the database; Generate a detailed report; The analysis tool processes the scan data and generates a detailed report that includes a list of ingredients, version information, dependencies, known vulnerabilities, and license status. Present the analysis results; The results of source code component analysis are presented through visualizations such as icons or graphs, making them easier to understand and operate.

7. The method according to claim 1, characterized in that, The process of performing source code component analysis, identifying third-party components in the code, and verifying the license compatibility of the components includes: Based on project requirements, determine the scope of source code to be analyzed, including project name, version, and branch; The source code is scanned using a source code scanning tool to obtain a list of source code files and their contents; By analyzing the file list and file content of the source code, the programming language and build tools used in the source code can be identified; Based on the identified programming language and build tools, a suitable source code composition analysis tool is selected. The file list and file content of the source code are input into the selected source code composition analysis tool for analysis. The source code composition analysis tool identifies the open-source components contained in the source code and their version information by comparing them with a known open-source component feature library. It obtains the license information of the identified open-source components and compares it with the project license requirements to determine if there are any license incompatibilities. If license incompatibilities are found, the tool outputs specific information about the license incompatibilities and prompts for further processing. Based on the results of the source code composition analysis, a source code composition analysis report is generated, including a list of open-source components used, their versions and license information, and potential license incompatibilities, providing a basis for subsequent source code management.

8. The method according to claim 1, characterized in that, The system generates a security test report containing web security vulnerabilities, edge node device vulnerabilities, and source code composition analysis results, and proposes corresponding remediation suggestions, including: Based on the results of web security vulnerability scanning, edge node device security vulnerability scanning, and source code composition analysis, the discovered vulnerabilities and their detailed information are obtained. The risk score of each vulnerability is calculated, and the vulnerability priority is obtained. If the vulnerability score exceeds the preset high-risk threshold, the vulnerability is judged as a high-risk vulnerability and included in the key remediation recommendations. If the score is below the threshold but above the low-risk threshold, it is judged as a medium-risk vulnerability and included in the routine remediation recommendations. Based on the system component where the vulnerability is located, a general remediation solution for the current vulnerability type is matched from the vulnerability knowledge base as the basis for the remediation recommendations. Combined with the actual architecture and operating environment of the target system, the general remediation solution is customized to obtain targeted and detailed remediation steps. Through asset importance assessment, the business value of different assets is determined, and vulnerabilities related to high-value assets are given higher remediation priority. Vulnerability details, risk analysis, and remediation recommendations are summarized into a security test report and sorted by severity and priority. Data visualization technology is used to generate intuitive charts such as vulnerability distribution maps and high, medium, and low-risk ratio maps, which are inserted into the security test report. Through interface integration with business systems, the security test report is pushed to the asset owner and triggers the work order process to track the vulnerability remediation progress and ensure that the rectification is completed as planned.

Images