Vulnerability verification system based on dynamic business component analysis

Abstract

The invention discloses a vulnerability verification system based on dynamic business component analysis, which monitors operation data of a business component in real time by embedding a monitoring component in the business component, and performs semantic coding on the real-time operation data of the business component by adopting an artificial intelligence technology based on deep learning. According to the method, the semantic feature expression of the operation data at each time point is extracted, and then context semantic association optimization and semantic information aggregation under the global time domain are carried out on the operation data, so that the global operation mode of the service component is mined, and intelligent identification and alarm prompt of potential security vulnerabilities of the service component are realized. Therefore, potential security threats in a software system can be more effectively discovered and processed in combination with the dynamic operation characteristics of the service component, and the security and stability of the service system are improved.

Description

Technical Field

[0001] The present application relates to the field of intelligent detection, and more specifically, to a vulnerability verification system based on dynamic business component analysis. Background Art

[0002] With the rapid development of information technology, various business systems are becoming increasingly complex, and the interactions between their internal components are becoming more frequent and close. This high degree of integration and complexity improves system efficiency and functional diversity, but also significantly increases the security risks faced by the system. As the basic unit of these complex systems, the security of business components is directly related to the stable operation and data security of the entire system.

[0003] Traditional software security testing methods mainly focus on static code analysis or matching based on known vulnerability libraries. Although they can discover security vulnerabilities in software to a certain extent, they mainly rely on manually defined rule sets and limited test cases, making it difficult to effectively respond to new attack methods and the ever-changing threat environment.

[0004] In addition, modern business systems often need to process large amounts of real-time data and complex user interactions, which makes the operation of business components highly dynamic and uncertain. Traditional security detection mechanisms often lack the ability to understand the behavioral context information of business components during operation, and have obvious limitations when facing dynamic and real-time changing business scenarios, making it impossible to effectively identify and predict potential security risks.

[0005] Therefore, an optimized vulnerability verification system based on dynamic business component analysis is expected. Summary of the invention

[0006] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a vulnerability verification system based on dynamic business component analysis, which monitors the operation data of the business component in real time by embedding a monitoring component in the business component, and uses artificial intelligence technology based on deep learning to semantically encode the real-time operation data of the business component, extract the semantic feature expression of the operation data at each time point, and then optimize the contextual semantic association and semantic information aggregation of the operation data in the global time domain to dig out the global operation mode of the business component, thereby realizing intelligent identification and alarm prompts of potential security vulnerabilities of the business component. In this way, it is possible to combine the dynamic operation characteristics of the business component to more effectively discover and handle potential security threats in the software system, and improve the security and stability of the business system.

[0007] According to one aspect of the present application, a vulnerability verification system based on dynamic business component analysis is provided, which includes:

[0008] Monitoring component embedding module, used to embed monitoring components in business components;

[0009] A business component operation monitoring module, used for collecting a time queue of operation data of the business component through the monitoring component;

[0010] A vulnerability detection module, used for performing vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, wherein the vulnerability detection result is used to indicate whether there is a potential security vulnerability;

[0011] An alarm module, configured to generate an alarm prompt in response to the vulnerability detection result indicating that there is a potential security vulnerability;

[0012] Wherein, the vulnerability detection module includes:

[0013] An operation data semantic encoding unit, used for respectively performing semantic encoding on each operation data in the time queue of the operation data to obtain a time queue of the operation data semantic encoding feature vector;

[0014] A semantic association optimization unit, used for performing semantic association optimization on the time queue of the semantically encoded feature vector of the operating data to obtain a time queue of the semantically optimized encoded feature vector of the operating data;

[0015] A feature aggregation unit, used for inputting the time queue of the semantic optimization encoding feature vector of the operation data into a node feature integration module guided by feature intensity attenuation to obtain a time series significant aggregation representation vector of the business component operation mode;

[0016] The vulnerability detection result generating unit is used to determine the vulnerability detection result based on the time series significant aggregation representation vector of the business component operation mode.

[0017] Compared with the prior art, the vulnerability verification system based on dynamic business component analysis provided by the present application monitors the operation data of the business component in real time by embedding a monitoring component in the business component, and uses artificial intelligence technology based on deep learning to semantically encode the real-time operation data of the business component, extract the semantic feature expression of the operation data at each time point, and then optimize the contextual semantic association and aggregate semantic information of the operation data in the global time domain to dig out the global operation mode of the business component, thereby realizing intelligent identification and warning prompts of potential security vulnerabilities of the business component. In this way, it is possible to combine the dynamic operation characteristics of the business component to more effectively discover and handle potential security threats in the software system, and improve the security and stability of the business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0019] Figure 1 is a block diagram of a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application;

[0020] Figure 2 A data flow diagram of a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application;

[0021] Figure 3 It is a block diagram of a vulnerability detection module in a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0023] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0024] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0025] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0026] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0027] Traditional software security testing methods mainly focus on static code analysis or matching based on known vulnerability libraries. Although they can discover security vulnerabilities in software to a certain extent, they are difficult to effectively respond to new attack methods and changing threat environments because they mainly rely on manually defined rule sets and limited test cases. In addition, modern business systems often need to process large amounts of real-time data and complex user interactions, which makes the operating behavior of business components highly dynamic and uncertain. Traditional security detection mechanisms often lack the ability to understand the behavioral context information of business components at runtime, and have obvious limitations when facing dynamic and real-time changing business scenarios, making it impossible to effectively identify and predict potential security risks. Therefore, an optimized vulnerability verification system based on dynamic business component analysis is expected.

[0028] In the technical solution of the present application, a vulnerability verification system based on dynamic business component analysis is proposed. Figure 1 It is a block diagram of a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application. Figure 2 FIG. 1 is a data flow diagram of a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to an embodiment of the present application, a vulnerability verification system 300 based on dynamic business component analysis includes: a monitoring component embedding module 310, used to embed a monitoring component in a business component; a business component operation monitoring module 320, used to collect a time queue of operation data of the business component through the monitoring component; a vulnerability detection module 330, used to perform vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, and the vulnerability detection result is used to indicate whether there is a potential security vulnerability; an alarm module 340, used to generate an alarm prompt in response to the vulnerability detection result indicating the existence of a potential security vulnerability.

[0029] In particular, the monitoring component embedding module 310 and the business component operation monitoring module 320 are used to embed the monitoring component in the business component; and to collect the time queue of the operation data of the business component through the monitoring component. . Among them, the operation data of the business component refers to the data generated by each business component when performing its specific function in the business system, which is the result or intermediate state of the execution of the business logic, including but not limited to log information, performance indicators, abnormal events, etc., which comprehensively reflects the operation status, input and output, processing process and interaction with other components of the business component. In the technical solution of the present application, in order to better understand the operation behavior of the business component, the monitoring component is embedded in the business component to collect its operation data in real time to obtain the time queue of the operation data of the business component.

[0030] In particular, the vulnerability detection module 330 is used to perform vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, and the vulnerability detection result is used to indicate whether there is a potential security vulnerability. In particular, in a specific example of the present application, Figure 3 As shown, the vulnerability detection module 330 includes: an operation data semantic encoding unit 331, which is used to semantically encode each operation data in the time queue of the operation data to obtain a time queue of the semantically encoded feature vector of the operation data; a semantic association optimization unit 332, which is used to perform semantic association optimization on the time queue of the semantically encoded feature vector of the operation data to obtain a time queue of the semantically optimized encoded feature vector of the operation data; a feature aggregation unit 333, which is used to input the time queue of the semantically optimized encoded feature vector of the operation data into a node feature integration module guided by feature intensity attenuation to obtain a time series significant aggregation representation vector of the business component operation mode; a vulnerability detection result generation unit 334, which is used to determine the vulnerability detection result based on the time series significant aggregation representation vector of the business component operation mode.

[0031] Specifically, the operation data semantic encoding unit 331 is used to semantically encode each operation data in the time queue of the operation data to obtain a time queue of the semantic encoding feature vector of the operation data. In order to deeply understand the semantic meaning of the operation data of the business component, in the technical solution of the present application, a pre-trained natural language processing model is further used to semantically encode each operation data in the time queue of the operation data. Through word embedding technology and context-aware mechanism, the semantic feature expression of the operation data at each time point is extracted, and the key information of the business component at different operation stages is captured. The original structured or semi-structured operation data is converted into a vector form with rich semantic information to obtain a time queue of the semantic encoding feature vector of the operation data, thereby fully reflecting the operation status and behavior information of the business component at a specific time point, and providing strong data support for subsequent security vulnerability detection. In an embodiment of the present application, the BERT model is used as a pre-trained natural language processing model to realize the semantic encoding of the operation data.

[0032] Specifically, the semantic association optimization unit 332 is used to perform semantic association optimization on the time queue of the semantically encoded feature vectors of the operating data to obtain the time queue of the semantically optimized encoded feature vectors of the operating data. In a specific example of the present application, the time queue of the semantically encoded feature vectors of the operating data is input into a feature association optimization module based on the quantification of the intrinsic correlation of the sequence to obtain the time queue of the semantically optimized encoded feature vectors of the operating data. Taking into account that the operating data of business components often have complex internal connections and dependencies in the time series, in order to further reveal the intrinsic connections of the operating data of business components and thereby optimize the expressive power of features, the present application introduces a feature association optimization module based on the quantification of the intrinsic correlation of the sequence to process the time queue of the semantically encoded feature vectors of the operating data. Specifically, the feature association optimization module first quantifies the similarity or difference between any two semantically encoded feature vectors of the operating data by calculating the semantic association between them, so as to understand the semantic structure within the sequence and generate a set of semantic association score vectors. Next, the aggregate information of the set of semantic association score vectors is used as the overall context information to calculate the association optimization factor of each operation data semantic encoding feature vector, and quantify the consistency or deviation between the semantic features of the operation data at each time point and the overall semantic structure of the sequence, so as to serve as a guide for feature association optimization. Furthermore, after the association optimization factor is normalized, it is used as a weight coefficient to perform weighted optimization on the original time queue of the operation data semantic encoding feature vector, thereby suppressing redundant information, enhancing the expression of key features, and improving the representativeness and discrimination of features, so as to obtain the time queue of the operation data semantic optimization encoding feature vector.

[0033] In an embodiment of the present application, semantic association optimization is performed on the time queue of the operation data semantic encoding feature vectors to obtain the time queue of the operation data semantic optimized encoding feature vectors, including: calculating the semantic association score vector between any two operation data semantic encoding feature vectors in the time queue of the operation data semantic encoding feature vectors to obtain the time queue of the operation data semantic association score vectors; calculating the mean vector of the time queue of the operation data semantic association score vectors to obtain a global representation vector of sequence intrinsic correlation; based on the global representation vector of sequence intrinsic correlation, calculating the association optimization factor of each operation data semantic encoding feature vector in the time queue of the operation data semantic encoding feature vectors to obtain a time queue of association optimization factors; inputting the time queue of association optimization factors into the Softmax activation function to obtain a time queue of association optimization weight factors; using each association optimization weight factor in the time queue of the association optimization weight factors as a weight, weighting each operation data semantic encoding feature vector in the time queue of the operation data semantic encoding feature vectors respectively to obtain the time queue of the operation data semantic optimized encoding feature vectors.

[0034] Among them, the process of calculating the semantic association score vector between any two operation data semantic encoding feature vectors in the time queue of the operation data semantic encoding feature vector to obtain the time queue of the operation data semantic association score vector includes: cascading any two operation data semantic encoding feature vectors in the time queue of the operation data semantic encoding feature vector, multiplying them by the weight coefficient matrix, and then dot-adding them with the bias vector to obtain the operation data semantic association score vector.

[0035] More specifically, based on the global representation vector of the sequence's intrinsic correlation, the process of calculating the association optimization factor of each operating data semantic encoding feature vector in the time queue of the operating data semantic encoding feature vector to obtain the time queue of the association optimization factor includes: multiplying the operating data semantic encoding feature vector and the global representation vector of the sequence's intrinsic correlation by different weight coefficient vectors and then performing an addition operation to obtain a semantic association coefficient; adding a bias parameter to the semantic association coefficient and then passing it through a sigmoid activation function to obtain the association optimization factor.

[0036] In summary, in the above embodiment, the time queue of the semantically encoded feature vector of the running data is semantically optimized to obtain the time queue of the semantically optimized encoded feature vector of the running data, including: processing the time queue of the semantically encoded feature vector of the running data with the following semantic feature association optimization formula to obtain the time queue of the semantically optimized encoded feature vector of the running data, wherein the semantic feature association optimization formula is:

[0037] F = {f1, f2, ..., f n}

[0038] r h =W h [f i ;f j ]+b h

[0039]

[0040] G i =Softmax[Sigmoid(M m R+H m f i +b m )]

[0041] {x i}={G i ·f i}

[0042] Wherein, F represents the time queue of the semantic encoding feature vector of the running data, f1, f2, f i 、f j and f n represents the first, second, i-th, j-th and n-th operation data semantic encoding feature vectors in the time queue of the operation data semantic encoding feature vectors respectively, the value of n is the number of feature vectors in the time queue of the operation data semantic encoding feature vectors, [·,·] represents a cascade operation, and W h is the weight coefficient matrix, b h is the bias vector, r h is the hth running data semantic association score vector in the time queue of the semantic association score vector, the value of T is the number of vectors in the time queue of the semantic association score vector, R is the global representation vector of the sequence endogenous correlation, M m and H m Represent different weight coefficient vectors, b m is the bias parameter, Sigmoid is the sigmoid activation function, Softmax is the normalized exponential function, G i is the i-th correlation optimization factor, x i Represents the semantic optimization encoding feature vector of the i-th running data.

[0043] Specifically, the feature aggregation unit 333 is used to input the time queue of the semantic optimization encoding feature vector of the operation data into the node feature integration module guided by feature intensity attenuation to obtain the time series significant aggregation representation vector of the business component operation mode. The time queue of the semantic optimization encoding feature vector of the operation data is further integrated to obtain the global operation mode information of the business component. In the technical solution of the present application, considering that the behavioral characteristics of the business components at different operation stages usually have different contributions to the vulnerability analysis results, a node feature integration module guided by feature intensity attenuation is introduced to process the time queue of the semantic optimization encoding feature vector of the operation data. By introducing the time decay effect, the importance of data at different time points can be reasonably evaluated, and the older data points can be "forgotten" to a certain extent, thereby avoiding the excessive accumulation effect of historical operation data and more accurately reflecting the current operation mode of the business component. Specifically, the module first calculates the feature significance description factor based on the mean and variance of each semantic optimization encoding feature vector of the operation data to quantitatively represent the feature importance. Next, a feature significance attenuation factor is constructed based on the distance span between each operation data semantic optimization coding feature vector and the current operation data semantic optimization coding feature vector (the end of the time series), and its feature significance description factor is modulated to make the operation data information closer to the current moment in the feature space obtain a higher weight, thereby more accurately reflecting the relative importance of the operation data features at each time point in the overall sequence. Then, the modulated description factor is further screened using the activation function and the gating mechanism, and the time queue of the operation data semantic optimization coding feature vector is weighted and summed using the screened description factor as the weight to obtain a global business component operation mode time series significant aggregation representation vector.

[0044] In an embodiment of the present application, the time queue of the operation data semantic optimization coding feature vector is input into a node feature integration module guided by feature intensity attenuation to obtain a time series significant aggregation representation vector of the business component operation mode, including: calculating the feature significance description factor of each operation data semantic optimization coding feature vector in the time queue of the operation data semantic optimization coding feature vector; taking the last operation data semantic optimization coding feature vector in the time queue of the operation data semantic optimization coding feature vector as the current operation data semantic optimization coding feature vector, and based on the comparison of each other operation data semantic optimization coding feature vector in the time queue of the operation data semantic optimization coding feature vector with the current operation data semantic optimization coding feature vector. The distance span between the data semantic optimization coding feature vectors is used to construct the feature significance attenuation factor of each other operation data semantic optimization coding feature vector; the product between the feature significance attenuation factor of each other operation data semantic optimization coding feature vector and its feature significance description factor is calculated to obtain the time queue of the feature significance attenuation description factor; the time queue of the feature significance attenuation description factor is input into the gated mask module to obtain the time queue of the feature significance attenuation weight factor; based on the time queue of the feature significance attenuation weight factor, the weighted sum of the time queue of the operation data semantic optimization coding feature vector is calculated to obtain the temporal significant aggregation representation vector of the business component operation mode.

[0045] Among them, the process of calculating the feature significance description factor of each operation data semantic optimization encoding feature vector in the time queue of the operation data semantic optimization encoding feature vector includes: calculating the expected value of the fourth power of the difference between each eigenvalue in the operation data semantic optimization encoding feature vector and its feature mean, and dividing the expected value by the square of the feature variance of the operation data semantic optimization encoding feature vector to obtain the feature significance description factor.

[0046] More specifically, the process of taking the last running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector as the current running data semantic optimization coding feature vector and constructing the feature significance attenuation factors of the other running data semantic optimization coding feature vectors based on the distance span between the other running data semantic optimization coding feature vectors in the time queue of the running data semantic optimization coding feature vector and the current running data semantic optimization coding feature vector includes: calculating the difference between the maximum eigenvalue of the current running data semantic optimization coding feature vector and the maximum eigenvalue of the other running data semantic optimization coding feature vectors in the time queue of the running data semantic optimization coding feature vector, and then dividing the difference by the number of feature vectors between the two to obtain the feature significance attenuation factors of the other running data semantic optimization coding feature vectors.

[0047] In summary, in the above embodiment, the time queue of the semantically optimized encoded feature vector of the operating data is input into the node feature integration module guided by feature intensity attenuation to obtain the time series significant aggregation representation vector of the business component operating mode, including: processing the time queue of the semantically optimized encoded feature vector of the operating data with the following feature significance attenuation guided fusion formula to obtain the time series significant aggregation representation vector of the business component operating mode, wherein the feature significance attenuation guided fusion formula is:

[0048] X={x1,x2,...,x k ,.,x n}

[0049]

[0050]

[0051]

[0052] W i =mask(w i )

[0053]

[0054]

[0055] Wherein, X represents the time queue of the semantic optimization encoding feature vector of the operation data, the value of n is the number of feature vectors in the time queue of the semantic optimization encoding feature vector of the operation data, and x1, x2, x i 、x k and x n denote the first, second, ith, kth and current semantically optimized encoding feature vectors of the running data in the time queue of the semantically optimized encoding feature vector of the running data, max(·) denotes the maximum eigenvalue of the feature vector, x i (j) represents the jth eigenvalue of the i-th running data semantic optimization encoding feature vector, μ i and σ i 4 denote the feature mean and the square of the feature variance of the semantic optimization encoding feature vector of the i-th running data, respectively, E{[x i (j)-μ i ] 4} represents the fourth-order central moment of the i-th operation data semantic optimization encoding feature vector, that is, the expected value of the fourth power of the difference between each eigenvalue in the i-th operation data semantic optimization encoding feature vector and its eigenvalue mean, i∈「0,n-1], τ irepresents the feature significance attenuation factor of the i-th running data semantic optimization encoding feature vector, k i represents the descriptive factor of the i-th feature significance attenuation, w i represents the descriptive factor of the ith normalized feature significance attenuation, ws i represents the i-th feature significance attenuation weight factor, θ is the preset threshold, mask(·) represents mask processing, X a A time series significant aggregation representation vector representing the operation mode of the business component is represented.

[0056] Specifically, the vulnerability detection result generating unit 334 is used to determine the vulnerability detection result based on the time series significant aggregation representation vector of the business component operation mode. In a specific example of the present application, the time series significant aggregation representation vector of the business component operation mode is input into a classifier-based vulnerability detection module to obtain the vulnerability detection result. That is, the operation mode of the business component is intelligently analyzed through the trained classifier model to identify potential security vulnerabilities. The classifier performs feature learning and classification judgment on the time series significant aggregation representation vector of the business component operation mode by combining the classification mapping rules learned during the training process, and can effectively identify whether the business component has potential security vulnerabilities and output the corresponding vulnerability detection results. When the vulnerability detection result indicates the existence of a potential security vulnerability, an alarm prompt will be automatically generated to promptly notify relevant personnel to take corresponding security measures.

[0057] In a preferred example, it is considered that the time queue of the semantically encoded feature vector of the operation data is used to represent the time queue of the semantically embedded encoding features of the operation data of the monitored business component. When the time queue of the semantically encoded feature vector of the operation data is input into the feature association optimization module based on the quantification of the intrinsic correlation of the sequence, the feature association optimization module based on the quantification of the intrinsic correlation of the sequence optimizes the feature expression by quantifying the semantic association between each encoding feature vector in the time queue of the semantically encoded feature vector of the operation data, but this will also cause the redundancy of the feature information expression between each semantically optimized encoding feature vector of the operation data in the time queue of the semantically optimized encoding feature vector of the operation data. Therefore, when the time queue of the semantically optimized encoding feature vector of the operation data is integrated based on the significance attenuation guidance of the node features, since the redundancy of the feature information expression will introduce the temporal semantic aggregation offset, it is expected to further improve the semantic temporal aggregation regression comprehensibility of the temporal significant aggregation representation vector of the operation mode of the business component, thereby improving the accuracy of the vulnerability detection result obtained by inputting it into the vulnerability detection module based on the classifier.

[0058] Preferably, inputting the business component operation mode time series significant aggregation representation vector into a classifier-based vulnerability detection module to obtain a vulnerability detection result includes:

[0059] Calculate the sum of the absolute values ​​of each eigenvalue of the timing significant aggregation representation vector of the business component operation mode to obtain a first business component operation mode timing significant aggregation and modulation value, and calculate the square root of the sum of the squares of each eigenvalue of the timing significant aggregation representation vector of the business component operation mode to obtain a second business component operation mode timing significant aggregation and modulation value;

[0060] After performing dot-wise subtraction on the business component operation mode timing significant aggregation representation vector and the second business component operation mode timing significant aggregation and modulation value, perform dot-wise multiplication on the number of eigenvalues ​​of the business component operation mode timing significant aggregation representation vector and the reciprocal of the first business component operation mode timing significant aggregation and modulation value, and take the reciprocal of each eigenvalue to obtain the first business component operation mode timing significant aggregation phase transition vector;

[0061] After performing dot-wise subtraction on the service component operation mode timing significant aggregation representation vector and the first service component operation mode timing significant aggregation and modulation value, perform dot-wise multiplication on the square root of the number of eigenvalues ​​of the service component operation mode timing significant aggregation representation vector and the reciprocal of the second service component operation mode timing significant aggregation and modulation value, and take the reciprocal of each eigenvalue to obtain the second service component operation mode timing significant aggregation phase transition vector;

[0062] Subtract the dot product vector of the second business component operation mode timing significant aggregation phase transition vector and the weighted hyperparameter from the first business component operation mode timing significant aggregation phase transition vector to obtain an optimized business component operation mode timing significant aggregation representation vector;

[0063] The optimized business component operation mode time sequence significant aggregation representation vector is input into a classifier-based vulnerability detection module to obtain a vulnerability detection result.

[0064] Here, the optimized representation of the business component operation mode time series significant aggregation representation vector V is:

[0065]

[0066]

[0067]

[0068]

[0069] v i ∈V∈R n

[0070] Where V is the time series significant aggregation representation vector of the business component operation mode, R represents a real number set, and v i represents the eigenvalue of the ith position of the time series significant aggregation representation vector of the business component operation mode, n represents the number of eigenvalues ​​of the time series significant aggregation representation vector of the business component operation mode, α represents the time series significant aggregation and modulation value of the first business component operation mode, β represents the time series significant aggregation and modulation value of the second business component operation mode, ⊙ represents the point multiplication by position, Indicates positional subtraction, (·) ⊙-1 Represents the inverse of each eigenvalue of the calculated eigenvector, V1 represents the timing significant aggregation phase transition vector of the first business component operation mode, V2 represents the timing significant aggregation phase transition vector of the second business component operation mode, ω represents the weighted hyperparameter, and V' represents the optimized business component operation mode timing significant aggregation representation vector.

[0071] Based on this, the present application uses the difference of the characteristic value of the business component operation mode time series significant aggregation representation vector relative to the feature set of the vector as a whole of the business component operation mode time series significant aggregation representation vector and the difference of the modulation representation as the semantic change intensity information, and performs a phase-like transformation corresponding to the position-based intensity modulation through different and modulation representation forms, so as to perform a spatial translation operation based on alternating stacking under the scale balance of the vector set of the business component operation mode time series significant aggregation representation vector, so that the aggregation enhancement of the semantic change phase perception can improve the axial aggregation receptive field along the feature aggregation direction, thereby improving the aggregation semantics of the business component operation mode time series significant aggregation representation vector for the perception effect of the detailed temporal semantic changes, so as to improve the expression effect of the business component operation mode time series significant aggregation representation vector. In this way, the semantic time domain aggregation regression comprehensibility of the business component operation mode time series significant aggregation representation vector is improved, thereby improving the accuracy of the vulnerability detection result obtained by inputting the business component operation mode time series significant aggregation representation vector into the classifier-based vulnerability detection module.

[0072] In particular, the alarm module 340 is used to generate an alarm prompt in response to the vulnerability detection result indicating the existence of a potential security vulnerability. By providing timely alarm prompts for potential security vulnerabilities, potential security threats in the software system can be effectively discovered and processed, thereby improving the security and stability of the business system.

[0073] As described above, the vulnerability verification system 300 based on dynamic business component analysis according to the embodiment of the present application can be implemented in various wireless terminals, such as a server with a vulnerability verification algorithm based on dynamic business component analysis. In a possible implementation, the vulnerability verification system 300 based on dynamic business component analysis according to the embodiment of the present application can be integrated into the wireless terminal as a software module and / or a hardware module. For example, the vulnerability verification system 300 based on dynamic business component analysis can be a software module in the operating system of the wireless terminal, or can be an application developed for the wireless terminal; of course, the vulnerability verification system 300 based on dynamic business component analysis can also be one of the many hardware modules of the wireless terminal.

[0074] Alternatively, in another example, the vulnerability verification system 300 based on dynamic business component analysis and the wireless terminal may also be separate devices, and the vulnerability verification system 300 based on dynamic business component analysis may be connected to the wireless terminal via a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0075] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A vulnerability verification system based on dynamic business component analysis, characterized in that: include: Monitoring component embedding module, used to embed monitoring components in business components; A business component operation monitoring module, used for collecting a time queue of operation data of the business component through the monitoring component; A vulnerability detection module, used for performing vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, wherein the vulnerability detection result is used to indicate whether there is a potential security vulnerability; An alarm module, configured to generate an alarm prompt in response to the vulnerability detection result indicating that there is a potential security vulnerability; Wherein, the vulnerability detection module includes: An operation data semantic encoding unit, used for respectively performing semantic encoding on each operation data in the time queue of the operation data to obtain a time queue of the operation data semantic encoding feature vector; A semantic association optimization unit, used for performing semantic association optimization on the time queue of the semantically encoded feature vector of the operating data to obtain a time queue of the semantically optimized encoded feature vector of the operating data; A feature aggregation unit, used for inputting the time queue of the semantic optimization encoding feature vector of the operation data into a node feature integration module guided by feature intensity attenuation to obtain a time series significant aggregation representation vector of the business component operation mode; The vulnerability detection result generating unit is used to determine the vulnerability detection result based on the time series significant aggregation representation vector of the business component operation mode.

2. The vulnerability verification system based on dynamic business component analysis according to claim 1 is characterized in that: The semantic association optimization unit is used to: The time queue of the semantically encoded feature vectors of the operating data is input into a feature association optimization module based on the quantization of the intrinsic correlation of the sequence to obtain the time queue of the semantically optimized encoded feature vectors of the operating data.

3. The vulnerability verification system based on dynamic business component analysis according to claim 2 is characterized in that: The semantic association optimization unit comprises: A semantic association calculation subunit, used for calculating a semantic association score vector between any two operation data semantic encoding feature vectors in the time queue of the operation data semantic encoding feature vectors to obtain a time queue of the operation data semantic association score vectors; A global correlation representation subunit, used for calculating a mean vector of a time queue of the semantic association score vector of the running data to obtain a global representation vector of the sequence endogenous correlation; An association optimization factor calculation subunit, used for calculating the association optimization factor of each operation data semantic encoding feature vector in the time queue of the operation data semantic encoding feature vector based on the sequence endogenous correlation global representation vector to obtain the time queue of the association optimization factor; A weighting subunit, used for inputting the time queue of the associated optimization factor into a Softmax activation function to obtain a time queue of the associated optimization weight factor; The optimization subunit is used to use each associated optimization weight factor in the time queue of the associated optimization weight factor as a weight, and weight each operation data semantic encoding feature vector in the time queue of the operation data semantic encoding feature vector to obtain the time queue of the operation data semantic optimization encoding feature vector.

4. The vulnerability verification system based on dynamic business component analysis according to claim 3 is characterized in that: The semantic association calculation subunit is used to: Any two operation data semantic encoding feature vectors in the time queue of the operation data semantic encoding feature vector are cascaded and multiplied by a weight coefficient matrix, and then dotted with a bias vector to obtain the operation data semantic association score vector.

5. The vulnerability verification system based on dynamic business component analysis according to claim 4 is characterized in that: The associated optimization factor calculation subunit is used to: The operation data semantic encoding feature vector and the sequence endogenous correlation global representation vector are multiplied by different weight coefficient vectors respectively and then added to obtain a semantic correlation coefficient; The semantic association coefficient is added with a bias parameter and then passed through a sigmoid activation function to obtain the association optimization factor.

6. The vulnerability verification system based on dynamic business component analysis according to claim 5 is characterized in that: The feature aggregation unit comprises: A feature significance calculation subunit, used to calculate a feature significance description factor of each operation data semantic optimization encoding feature vector in the time queue of the operation data semantic optimization encoding feature vector; A feature significance attenuation factor calculation subunit is used to use the last running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector as the current running data semantic optimization coding feature vector, and based on the distance span between each other running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector and the current running data semantic optimization coding feature vector, construct the feature significance attenuation factor of each other running data semantic optimization coding feature vector; A saliency modulation subunit, used for calculating the product between the feature saliency attenuation factor of each other operation data semantic optimization encoding feature vector and its feature saliency description factor to obtain a time queue of the feature saliency attenuation description factor; A weighting subunit, configured to input the time queue of the feature significance decay description factor into a gated mask module to obtain a time queue of the feature significance decay weight factor; The weight applying subunit is used to calculate the weighted sum of the time queue of the operation data semantic optimization encoding feature vector based on the time queue of the feature significance attenuation weight factor to obtain the time series significant aggregation representation vector of the business component operation mode.

7. The vulnerability verification system based on dynamic business component analysis according to claim 6 is characterized in that: The feature significance calculation subunit is used to: The expected value of the fourth power of the difference between each eigenvalue in the semantically optimized encoded feature vector of the running data and its eigenmean is calculated, and the expected value is divided by the square of the eigenvariance of the semantically optimized encoded feature vector of the running data to obtain the eigensignificance description factor.

8. The vulnerability verification system based on dynamic business component analysis according to claim 7 is characterized in that: The feature significance attenuation factor calculation subunit is used to: Calculate the difference between the maximum eigenvalue of the current running data semantic optimization coding feature vector and the maximum eigenvalue of each other running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector, and then divide the difference by the number of feature vectors between the two to obtain the feature significance attenuation factor of each other running data semantic optimization coding feature vector.

9. The vulnerability verification system based on dynamic business component analysis according to claim 8, characterized in that: The vulnerability detection result generating unit is used to: The business component operation mode time sequence significant aggregation representation vector is input into a classifier-based vulnerability detection module to obtain the vulnerability detection result.

Images