Vulnerability Verification System Based on Dynamic Business Component Analysis

Abstract

This application discloses a vulnerability verification system based on dynamic business component analysis. It monitors the operating data of business components in real time by embedding monitoring components in business components, and uses deep learning-based artificial intelligence technology to semantically encode the real-time operating data of business components, extracting the semantic feature expression of the operating data at each time point, and then mining the global operating mode of business components by optimizing the contextual semantic association and aggregating semantic information in the global time domain of the operating data, thereby realizing intelligent identification and warning prompts of potential security vulnerabilities in business components. In this way, it is possible to combine the dynamic operating characteristics of business components to more effectively discover and handle potential security threats in software systems, thereby improving the security and stability of business systems.

Description

Technical Field

[0001] The present application relates to the field of intelligent detection, and more specifically, to a vulnerability verification system based on dynamic business component analysis. Background Art

[0002] With the rapid development of information technology, various business systems are becoming increasingly complex, and the interactions between their internal components are becoming increasingly frequent and intensive. While this high degree of integration and complexity improves system efficiency and functional diversity, it also significantly increases the security risks faced by these systems. As the basic building blocks of these complex systems, the security of business components is directly related to the stable operation and data security of the entire system.

[0003] Traditional software security testing methods mainly focus on static code analysis or matching based on known vulnerability libraries. Although they can discover security vulnerabilities in software to a certain extent, they mainly rely on manually defined rule sets and limited test cases, making it difficult to effectively respond to new attack methods and the ever-changing threat environment.

[0004] Furthermore, modern business systems often need to process large amounts of real-time data and complex user interactions, making the operational behavior of business components highly dynamic and uncertain. Traditional security detection mechanisms often lack the ability to understand the contextual information of business components during runtime. This leads to significant limitations in dynamic, real-time business scenarios, making it difficult to effectively identify and predict potential security risks.

[0005] Therefore, an optimized vulnerability verification system based on dynamic business component analysis is expected. Summary of the Invention

[0006] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a vulnerability verification system based on dynamic business component analysis, which monitors the operation data of the business component in real time by embedding a monitoring component in the business component, and uses artificial intelligence technology based on deep learning to semantically encode the real-time operation data of the business component, extract the semantic feature expression of the operation data at each time point, and then perform contextual semantic association optimization and semantic information aggregation on the operation data in the global time domain to mine the global operation mode of the business component, thereby realizing intelligent identification and alarm prompts of potential security vulnerabilities in the business component. In this way, it is possible to combine the dynamic operation characteristics of the business component to more effectively discover and handle potential security threats in the software system, thereby improving the security and stability of the business system.

[0007] According to one aspect of the present application, a vulnerability verification system based on dynamic business component analysis is provided, which includes:

[0008] Monitoring component embedding module, used to embed monitoring components in business components;

[0009] A business component operation monitoring module is used to collect a time queue of the operation data of the business component through the monitoring component;

[0010] a vulnerability detection module, configured to perform vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, wherein the vulnerability detection result is used to indicate whether there is a potential security vulnerability;

[0011] An alarm module is configured to generate an alarm prompt in response to the vulnerability detection result indicating the existence of a potential security vulnerability;

[0012] The vulnerability detection module includes:

[0013] An operation data semantic encoding unit, configured to semantically encode each operation data in the time queue of the operation data to obtain a time queue of the semantic encoding feature vector of the operation data;

[0014] a semantic association optimization unit, configured to perform semantic association optimization on the time queue of the semantically encoded feature vectors of the operating data to obtain a time queue of the semantically optimized encoded feature vectors of the operating data;

[0015] A feature aggregation unit, configured to input the time queue of the semantically optimized encoded feature vector of the operation data into a node feature integration module guided by feature intensity attenuation to obtain a time series significant aggregation representation vector of the business component operation mode;

[0016] The vulnerability detection result generating unit is used to determine the vulnerability detection result based on the time series significant aggregation representation vector of the business component operation mode.

[0017] Compared with the existing technology, the vulnerability verification system provided by this application is based on dynamic business component analysis. It monitors the operation data of business components in real time by embedding monitoring components in business components, and uses artificial intelligence technology based on deep learning to semantically encode the real-time operation data of business components, extracting the semantic feature expression of the operation data at each time point, and then mining the global operation mode of business components by optimizing the contextual semantic association and aggregating semantic information in the global time domain of the operation data, thereby realizing intelligent identification and warning prompts of potential security vulnerabilities in business components. In this way, it is possible to combine the dynamic operation characteristics of business components to more effectively discover and handle potential security threats in software systems, thereby improving the security and stability of business systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and other purposes, features, and advantages of the present application will become more apparent through a more detailed description of the embodiments of the present application in conjunction with the accompanying drawings. The accompanying drawings are intended to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the drawings, the same reference numerals generally represent the same components or steps.

[0019] Figure 1 is a block diagram of a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application;

[0020] Figure 2 Schematic diagram of data flow of a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application;

[0021] Figure 3 This is a block diagram of a vulnerability detection module in a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described herein.

[0023] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0024] Although the present application makes various references to certain modules in the system according to embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are illustrative only, and different aspects of the system and method can use different modules.

[0025] Flowcharts are used in this application to illustrate the operations performed by the systems according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the various steps may be processed in reverse order or simultaneously, as needed. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0026] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described herein.

[0027] Traditional software security testing methods primarily focus on static code analysis or matching against known vulnerability libraries. While these methods can detect security vulnerabilities in software to a certain extent, their reliance on manually defined rule sets and limited test cases makes them ineffective in addressing new attack vectors and the ever-changing threat landscape. Furthermore, modern business systems often need to process large amounts of real-time data and complex user interactions, which makes the operational behavior of business components highly dynamic and uncertain. Traditional security detection mechanisms often lack the ability to understand the behavioral context of business components at runtime, presenting significant limitations when faced with dynamic, real-time business scenarios, making them unable to effectively identify and predict potential security risks. Therefore, an optimized vulnerability verification system based on dynamic business component analysis is desired.

[0028] In the technical solution of this application, a vulnerability verification system based on dynamic business component analysis is proposed. Figure 1 4 is a block diagram of a vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of vulnerability verification system based on dynamic business component analysis according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to an embodiment of the present application, a vulnerability verification system 300 based on dynamic business component analysis includes: a monitoring component embedding module 310, which is used to embed a monitoring component in a business component; a business component operation monitoring module 320, which is used to collect a time queue of the operation data of the business component through the monitoring component; a vulnerability detection module 330, which is used to perform vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, and the vulnerability detection result is used to indicate whether there is a potential security vulnerability; an alarm module 340, which is used to generate an alarm prompt in response to the vulnerability detection result indicating the existence of a potential security vulnerability.

[0029] In particular, the monitoring component embedding module 310 and the business component operation monitoring module 320 are used to embed a monitoring component in a business component; and to collect a time queue of the operation data of the business component through the monitoring component. . The operation data of a business component refers to the data generated by each business component when performing its specific function in the business system, which is the result or intermediate state of the execution of the business logic, including but not limited to log information, performance indicators, abnormal events, etc., which comprehensively reflects the operation status, input and output, processing process and interaction with other components of the business component. In the technical solution of the present application, in order to better understand the operation behavior of the business component, a monitoring component is embedded in the business component to collect its operation data in real time to obtain a time queue of the operation data of the business component.

[0030] In particular, the vulnerability detection module 330 is used to perform vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, and the vulnerability detection result is used to indicate whether there is a potential security vulnerability. In particular, in a specific example of the present application, if Figure 3 As shown, the vulnerability detection module 330 includes: an operation data semantic encoding unit 331, which is used to semantically encode each operation data in the time queue of the operation data to obtain a time queue of the operation data semantic encoding feature vector; a semantic association optimization unit 332, which is used to perform semantic association optimization on the time queue of the operation data semantic encoding feature vector to obtain a time queue of the operation data semantic optimization encoding feature vector; a feature aggregation unit 333, which is used to input the time queue of the operation data semantic optimization encoding feature vector into a node feature integration module guided by feature intensity attenuation to obtain a business component operation mode time series significant aggregation representation vector; a vulnerability detection result generation unit 334, which is used to determine the vulnerability detection result based on the business component operation mode time series significant aggregation representation vector.

[0031] Specifically, the operation data semantic encoding unit 331 is used to semantically encode each operation data in the time queue of the operation data to obtain a time queue of the semantic encoding feature vector of the operation data. In order to deeply understand the semantic meaning of the operation data of the business component, in the technical solution of the present application, a pre-trained natural language processing model is further used to semantically encode each operation data in the time queue of the operation data. Through word embedding technology and context-aware mechanism, the semantic feature expression of the operation data at each time point is extracted, and the key information of the business component at different operation stages is captured. The original structured or semi-structured operation data is converted into a vector form with rich semantic information to obtain a time queue of the semantic encoding feature vector of the operation data, thereby fully reflecting the operation status and behavior information of the business component at a specific time point, and providing strong data support for subsequent security vulnerability detection. In an embodiment of the present application, the BERT model is used as a pre-trained natural language processing model to realize the semantic encoding of the operation data.

[0032] Specifically, the semantic association optimization unit 332 is used to perform semantic association optimization on the time queue of the semantically encoded feature vectors of the operating data to obtain the time queue of the semantically optimized encoded feature vectors of the operating data. In a specific example of the present application, the time queue of the semantically encoded feature vectors of the operating data is input into a feature association optimization module based on the quantification of the intrinsic correlation of the sequence to obtain the time queue of the semantically optimized encoded feature vectors of the operating data. Taking into account that the operating data of business components often have complex internal connections and dependencies in the time series, in order to further reveal the intrinsic connections of the operating data of business components and thereby optimize the expressive power of features, the present application introduces a feature association optimization module based on the quantification of the intrinsic correlation of the sequence to process the time queue of the semantically encoded feature vectors of the operating data. Specifically, the feature association optimization module first quantifies the similarity or difference between any two semantically encoded feature vectors of the operating data by calculating the semantic association between them, so as to understand the semantic structure within the sequence and generate a set of semantic association score vectors. Next, using the aggregated information of the set of semantic association score vectors as the overall contextual information, the association optimization factor of each semantically encoded feature vector of the operational data is calculated. This quantifies the consistency or deviation between the semantic features describing the operational data at each time point and the overall semantic structure of the sequence, thereby serving as a guide for feature association optimization. Furthermore, after normalizing the association optimization factor, it is used as a weight coefficient to perform weighted optimization on the time queue of the original semantically encoded feature vectors of the operational data. This suppresses redundant information, enhances the expression of key features, and improves the representativeness and discriminability of the features, thereby obtaining a time queue of semantically optimized feature vectors of the operational data.

[0033] In an embodiment of the present application, semantic association optimization is performed on the time queue of the operation data semantic coding feature vector to obtain a time queue of the operation data semantic optimized coding feature vector, including: calculating the semantic association score vector between any two operation data semantic coding feature vectors in the time queue of the operation data semantic coding feature vector to obtain a time queue of the operation data semantic association score vectors; calculating the mean vector of the time queue of the operation data semantic association score vectors to obtain a global representation vector of sequence intrinsic correlation; based on the global representation vector of sequence intrinsic correlation, calculating the association optimization factor of each operation data semantic coding feature vector in the time queue of the operation data semantic coding feature vector to obtain a time queue of association optimization factors; inputting the time queue of association optimization factors into the Softmax activation function to obtain a time queue of association optimization weight factors; using each association optimization weight factor in the time queue of the association optimization weight factors as a weight, weighting each operation data semantic coding feature vector in the time queue of the operation data semantic coding feature vector to obtain the time queue of the operation data semantic optimized coding feature vector.

[0034] Among them, the process of calculating the semantic association score vector between any two operating data semantic encoding feature vectors in the time queue of the operating data semantic encoding feature vector to obtain the time queue of the operating data semantic association score vector includes: cascading any two operating data semantic encoding feature vectors in the time queue of the operating data semantic encoding feature vector, multiplying them by the weight coefficient matrix, and then dot-adding them with the bias vector to obtain the operating data semantic association score vector.

[0035] More specifically, based on the global representation vector of the sequence's intrinsic correlation, the process of calculating the association optimization factor of each operating data semantic encoding feature vector in the time queue of the operating data semantic encoding feature vector to obtain the time queue of the association optimization factor includes: multiplying the operating data semantic encoding feature vector and the global representation vector of the sequence's intrinsic correlation by different weight coefficient vectors and then performing an addition operation to obtain a semantic association coefficient; adding a bias parameter to the semantic association coefficient and then passing it through a sigmoid activation function to obtain the association optimization factor.

[0036] In summary, in the above embodiment, performing semantic association optimization on the time queue of the semantically encoded feature vector of the operating data to obtain the time queue of the semantically optimized encoded feature vector of the operating data includes: processing the time queue of the semantically encoded feature vector of the operating data using the following semantic feature association optimization formula to obtain the time queue of the semantically optimized encoded feature vector of the operating data, wherein the semantic feature association optimization formula is:

[0037] F={f1,f2,...,f n}

[0038] r h =W h [f i ;f j ]+b h

[0039]

[0040] G i =Softmax[Sigmoid(M m R+H m f i +b m )]

[0041] {x i}={G i ·f i}

[0042] Wherein, F represents the time queue of the semantic encoding feature vector of the running data, f1, f2, f i 、f j and f n represent the first, second, i-th, j-th and n-th semantic encoding feature vectors of the running data in the time queue of the semantic encoding feature vector of the running data respectively, the value of n is the number of feature vectors in the time queue of the semantic encoding feature vector of the running data, [·,·] represents the cascade operation, W h is the weight coefficient matrix, b h is the bias vector, r h is the hth running data semantic association score vector in the time queue of the semantic association score vector, the value of T is the number of vectors in the time queue of the semantic association score vector, R is the global representation vector of the sequence endogenous correlation, M m and H m Represent different weight coefficient vectors, b m is the bias parameter, Sigmoid is the sigmoid activation function, Softmax is the normalized exponential function, G i is the i-th correlation optimization factor, x i Represents the semantic optimization encoding feature vector of the i-th running data.

[0043] Specifically, the feature aggregation unit 333 is used to input the time queue of the semantically optimized coding feature vector of the operating data into the node feature integration module guided by feature intensity attenuation to obtain the time series significant aggregation representation vector of the business component operating mode. The time queue of the semantically optimized coding feature vector of the operating data is further integrated to obtain the global operating mode information of the business component. In the technical solution of the present application, considering that the behavioral characteristics of the business components in different operating stages usually have different contributions to the vulnerability analysis results, a node feature integration module guided by feature intensity attenuation is introduced to process the time queue of the semantically optimized coding feature vector of the operating data. By introducing the time decay effect, the importance of data at different time points can be reasonably evaluated, and the older data points can be "forgotten" to a certain extent, thereby avoiding the excessive accumulation effect of historical operating data and more accurately reflecting the current operating mode of the business component. Specifically, the module first calculates the feature significance description factor based on the mean and variance of each semantically optimized coding feature vector of the operating data to quantitatively represent the feature importance. Next, a feature significance attenuation factor is constructed based on the distance span between each operation data semantic optimization encoding feature vector and the current operation data semantic optimization encoding feature vector (the end of the time series), and its feature significance description factor is modulated based on this, so that the operation data information that is closer to the current moment in the feature space is given a higher weight, thereby more accurately reflecting the relative importance of the operation data features at each time point in the overall sequence. Then, the modulated description factor is further filtered using an activation function and a gating mechanism, and the time queue of the operation data semantic optimization encoding feature vector is weighted and summed using the filtered description factor as the weight to obtain a global business component operation mode time series significant aggregation representation vector.

[0044] In an embodiment of the present application, the time queue of the operation data semantic optimization coding feature vector is input into a node feature integration module guided by feature intensity attenuation to obtain a time series significant aggregation representation vector of the business component operation mode, including: calculating the feature significance description factor of each operation data semantic optimization coding feature vector in the time queue of the operation data semantic optimization coding feature vector; taking the last operation data semantic optimization coding feature vector in the time queue of the operation data semantic optimization coding feature vector as the current operation data semantic optimization coding feature vector, and based on the comparison of each other operation data semantic optimization coding feature vector in the time queue of the operation data semantic optimization coding feature vector with the current operation data semantic optimization coding feature vector. The distance span between the data semantic optimization coding feature vectors is used to construct the feature significance attenuation factor of each other operation data semantic optimization coding feature vector; the product between the feature significance attenuation factor of each other operation data semantic optimization coding feature vector and its feature significance description factor is calculated to obtain the time queue of the feature significance attenuation description factor; the time queue of the feature significance attenuation description factor is input into the gated mask module to obtain the time queue of the feature significance attenuation weight factor; based on the time queue of the feature significance attenuation weight factor, the weighted sum of the time queue of the operation data semantic optimization coding feature vector is calculated to obtain the temporal significance aggregation representation vector of the business component operation mode.

[0045] Among them, the process of calculating the feature significance description factor of each running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector includes: calculating the expected value of the fourth power of the difference between each eigenvalue in the running data semantic optimization coding feature vector and its feature mean, and dividing the expected value by the square of the feature variance of the running data semantic optimization coding feature vector to obtain the feature significance description factor.

[0046] More specifically, the last running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector is used as the current running data semantic optimization coding feature vector, and based on the distance span between the other running data semantic optimization coding feature vectors in the time queue of the running data semantic optimization coding feature vector and the current running data semantic optimization coding feature vector, the process of constructing the feature significance attenuation factors of the other running data semantic optimization coding feature vectors includes: calculating the difference between the maximum eigenvalue of the current running data semantic optimization coding feature vector and the maximum eigenvalue of the other running data semantic optimization coding feature vectors in the time queue of the running data semantic optimization coding feature vector, and then dividing the difference by the number of eigenvectors between the two to obtain the feature significance attenuation factors of the other running data semantic optimization coding feature vectors.

[0047] In summary, in the above embodiment, the time queue of the semantically optimized encoded feature vector of the operating data is input into the node feature integration module based on feature intensity attenuation guidance to obtain the temporal significant aggregation representation vector of the business component operating mode, including: processing the time queue of the semantically optimized encoded feature vector of the operating data using the following feature significance attenuation guidance fusion formula to obtain the temporal significant aggregation representation vector of the business component operating mode, wherein the feature significance attenuation guidance fusion formula is:

[0048] X={x1,x2,...,x k ,.,x n}

[0049]

[0050]

[0051]

[0052] Ws i =mask(w i )

[0053]

[0054]

[0055] Wherein, X represents the time queue of the semantic optimization coding feature vector of the operation data, the value of n is the number of feature vectors in the time queue of the semantic optimization coding feature vector of the operation data, x1, x2, x i 、x k and x n Respectively represent the first, second, i-th, k-th and current running data semantic optimization encoding feature vectors in the time queue of the running data semantic optimization encoding feature vector, max(·) represents the maximum eigenvalue of the feature vector, x i (j) represents the jth eigenvalue of the semantic optimization encoding feature vector of the i-th running data, μ i and σ i 4 Respectively represent the feature mean and feature variance square of the i-th running data semantic optimization encoding feature vector, E{[x i (j)-μ i ] 4} represents the fourth-order central moment of the i-th semantic optimization coding feature vector of the running data, that is, the expected value of the fourth power of the difference between each eigenvalue in the i-th semantic optimization coding feature vector and its eigenvalue mean, i∈「0,n-1],τ irepresents the feature significance attenuation factor of the i-th running data semantic optimization encoding feature vector, k i represents the descriptive factor of the i-th feature significance attenuation, w i represents the descriptive factor of the ith normalized feature significance attenuation, ws i represents the i-th feature significance attenuation weight factor, θ is the preset threshold, mask(·) represents mask processing, X a A time series significant aggregation representation vector representing the operation mode of the business component.

[0056] Specifically, the vulnerability detection result generating unit 334 is used to determine the vulnerability detection result based on the time series significant aggregation representation vector of the business component operation mode. In a specific example of the present application, the time series significant aggregation representation vector of the business component operation mode is input into a vulnerability detection module based on a classifier to obtain the vulnerability detection result. That is, the operation mode of the business component is intelligently analyzed by the trained classifier model to identify potential security vulnerabilities. The classifier performs feature learning and classification judgment on the time series significant aggregation representation vector of the business component operation mode by combining the classification mapping rules learned during the training process, and can effectively identify whether the business component has potential security vulnerabilities and output the corresponding vulnerability detection results. When the vulnerability detection result indicates the existence of a potential security vulnerability, an alarm prompt will be automatically generated to promptly notify relevant personnel to take corresponding security measures.

[0057] In a preferred example, it is considered that the time queue of the semantically encoded feature vector of the operation data is used to represent the time queue of the semantically embedded encoding features of the operation data of the monitored business component. When the time queue of the semantically encoded feature vector of the operation data is input into the feature association optimization module based on the quantification of the intrinsic correlation of the sequence, the feature association optimization module based on the quantification of the intrinsic correlation of the sequence performs feature expression optimization by quantifying the semantic association between each encoding feature vector in the time queue of the semantically encoded feature vector of the operation data. However, this will also cause feature information expression redundancy between each operation data semantically optimized encoding feature vector in the time queue of the semantically optimized encoding feature vector of the operation data. Therefore, when the time queue of the semantically optimized encoding feature vector of the operation data is subjected to node feature integration guided by significance attenuation, since the redundancy of feature information expression will introduce temporal semantic aggregation offset, it is expected to further improve the semantic temporal aggregation regression comprehensibility of the temporal significant aggregation representation vector of the operation mode of the business component, thereby improving the accuracy of the vulnerability detection result obtained by inputting it into the vulnerability detection module based on the classifier.

[0058] Preferably, inputting the business component operation mode time series significant aggregation representation vector into a classifier-based vulnerability detection module to obtain a vulnerability detection result includes:

[0059] Calculating the sum of the absolute values ​​of each eigenvalue of the business component operation mode timing significant aggregation representation vector to obtain a first business component operation mode timing significant aggregation and modulation value, and calculating the square root of the sum of the squares of each eigenvalue of the business component operation mode timing significant aggregation representation vector to obtain a second business component operation mode timing significant aggregation and modulation value;

[0060] After performing a dot-wise subtraction on the business component operation mode timing significant aggregation representation vector and the second business component operation mode timing significant aggregation and modulation value, the dot-wise multiplication is performed with the number of eigenvalues ​​of the business component operation mode timing significant aggregation representation vector and the reciprocal of the first business component operation mode timing significant aggregation and modulation value, and the reciprocal of each eigenvalue is taken to obtain the first business component operation mode timing significant aggregation phase transition vector;

[0061] After performing a dot-wise subtraction on the service component operation mode timing significant aggregation representation vector and the first service component operation mode timing significant aggregation and modulation value, the dot-wise multiplication is performed with the square root of the number of eigenvalues ​​of the service component operation mode timing significant aggregation representation vector and the inverse of the second service component operation mode timing significant aggregation and modulation value, and the inverse of each eigenvalue is taken to obtain the second service component operation mode timing significant aggregation phase transition vector;

[0062] Perform the dot product vector of the first business component operation mode timing significant aggregation phase transition vector and the weighted hyperparameter on the second business component operation mode timing significant aggregation phase transition vector to obtain an optimized business component operation mode timing significant aggregation representation vector;

[0063] The optimized business component operation mode time series significant aggregation representation vector is input into a classifier-based vulnerability detection module to obtain a vulnerability detection result.

[0064] Here, the optimized representation of the significant aggregation representation vector V of the time series of the business component operation mode is:

[0065]

[0066]

[0067]

[0068]

[0069] v i ∈V∈R n

[0070] Where V is the time series significant aggregation representation vector of the business component operation mode, R represents a real number set, and v i represents the eigenvalue of the ith position of the time series significant aggregation representation vector of the business component operation mode, n represents the number of eigenvalues ​​of the time series significant aggregation representation vector of the business component operation mode, α represents the time series significant aggregation and modulation value of the first business component operation mode, β represents the time series significant aggregation and modulation value of the second business component operation mode, ⊙ represents the point product by position, Indicates positional subtraction, (·) ⊙-1 Represents the inverse of each eigenvalue of the calculated eigenvector, V1 represents the timing significant aggregation phase transition vector of the first business component operation mode, V2 represents the timing significant aggregation phase transition vector of the second business component operation mode, ω represents the weighted hyperparameter, and V' represents the optimized business component operation mode timing significant aggregation representation vector.

[0071] Based on this, the present application uses the difference of the characteristic value of the business component operation mode time series significant aggregation representation vector relative to the feature set of the vector as a whole of the business component operation mode time series significant aggregation representation vector and the difference of the modulation representation as the semantic change intensity information, and performs a phase-like transformation corresponding to the position-based intensity modulation through different modulation representation forms, so as to perform a spatial translation operation based on alternating stacking under the scale balance of the vector set of the business component operation mode time series significant aggregation representation vector, so that the aggregation enhancement of the semantic change phase perception can improve the axial aggregation receptive field along the feature aggregation direction, thereby improving the perception effect of the aggregation semantics of the business component operation mode time series significant aggregation representation vector on the detailed temporal semantic changes, so as to improve the expression effect of the business component operation mode time series significant aggregation representation vector. In this way, the semantic time domain aggregation regression comprehensibility of the business component operation mode time series significant aggregation representation vector is improved, thereby improving the accuracy of the vulnerability detection result obtained by inputting the business component operation mode time series significant aggregation representation vector into the vulnerability detection module based on the classifier.

[0072] In particular, the alarm module 340 is configured to generate an alarm in response to the vulnerability detection result indicating the presence of a potential security vulnerability. By providing timely alarms for potential security vulnerabilities, potential security threats in the software system can be effectively discovered and addressed, thereby improving the security and stability of the business system.

[0073] As described above, the vulnerability verification system 300 based on dynamic business component analysis according to the embodiment of the present application can be implemented in various wireless terminals, such as a server having a vulnerability verification algorithm based on dynamic business component analysis. In one possible implementation, the vulnerability verification system 300 based on dynamic business component analysis according to the embodiment of the present application can be integrated into the wireless terminal as a software module and / or hardware module. For example, the vulnerability verification system 300 based on dynamic business component analysis can be a software module in the operating system of the wireless terminal, or can be an application developed for the wireless terminal; of course, the vulnerability verification system 300 based on dynamic business component analysis can also be one of the many hardware modules of the wireless terminal.

[0074] Alternatively, in another example, the vulnerability verification system 300 based on dynamic business component analysis and the wireless terminal may also be separate devices, and the vulnerability verification system 300 based on dynamic business component analysis may be connected to the wireless terminal through a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0075] While various embodiments of the present disclosure have been described above, the above descriptions are illustrative, non-exhaustive, and not intended to be limiting of the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to existing technologies, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A vulnerability verification system based on dynamic business component analysis, characterized in that: include: Monitoring component embedding module, used to embed monitoring components in business components; A business component operation monitoring module is used to collect a time queue of the operation data of the business component through the monitoring component; a vulnerability detection module, configured to perform vulnerability detection on the time queue of the operation data to obtain a vulnerability detection result, wherein the vulnerability detection result is used to indicate whether there is a potential security vulnerability; An alarm module is configured to generate an alarm prompt in response to the vulnerability detection result indicating the existence of a potential security vulnerability; The vulnerability detection module includes: An operation data semantic encoding unit, configured to semantically encode each operation data in the time queue of the operation data to obtain a time queue of the semantic encoding feature vector of the operation data; a semantic association optimization unit, configured to perform semantic association optimization on the time queue of the semantically encoded feature vectors of the operating data to obtain a time queue of the semantically optimized encoded feature vectors of the operating data; A feature aggregation unit, configured to input the time queue of the semantically optimized encoded feature vector of the operation data into a node feature integration module guided by feature intensity attenuation to obtain a time series significant aggregation representation vector of the business component operation mode; a vulnerability detection result generating unit, configured to determine the vulnerability detection result based on the time series significant aggregation representation vector of the business component operation mode; The feature aggregation unit includes: A feature significance calculation subunit, configured to calculate a feature significance description factor of each running data semantically optimized encoding feature vector in the time queue of the running data semantically optimized encoding feature vector; a feature significance attenuation factor calculation subunit, configured to use the last running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector as the current running data semantic optimization coding feature vector, and construct feature significance attenuation factors of each of the other running data semantic optimization coding feature vectors based on the distance span between each of the other running data semantic optimization coding feature vectors in the time queue of the running data semantic optimization coding feature vector and the current running data semantic optimization coding feature vector; a saliency modulation subunit, configured to calculate the product of the feature saliency attenuation factor of each of the other semantically optimized encoding feature vectors of the running data and its feature saliency description factor to obtain a time queue of the feature saliency attenuation description factor; a weighting subunit, configured to input the time queue of the feature significance decay description factor into a gated mask module to obtain a time queue of the feature significance decay weight factor; The weight applying subunit is used to calculate the weighted sum of the time queue of the semantic optimization encoding feature vector of the operation data based on the time queue of the feature significance attenuation weight factor to obtain the temporal significance aggregation representation vector of the business component operation mode.

2. The vulnerability verification system based on dynamic business component analysis according to claim 1 is characterized in that: The semantic association optimization unit is used to: The time queue of the semantically encoded feature vectors of the operating data is input into a feature association optimization module based on sequence intrinsic correlation quantification to obtain the time queue of the semantically optimized encoded feature vectors of the operating data.

3. The vulnerability verification system based on dynamic business component analysis according to claim 2 is characterized in that: The semantic association optimization unit includes: a semantic association calculation subunit, configured to calculate a semantic association score vector between any two running data semantic encoding feature vectors in the time queue of the running data semantic encoding feature vectors to obtain a time queue of the running data semantic association score vectors; a global correlation representation subunit, configured to calculate a mean vector of a time queue of the semantic association score vector of the running data to obtain a global representation vector of the sequence endogenous correlation; an association optimization factor calculation subunit, configured to calculate, based on the sequence endogenous correlation global representation vector, an association optimization factor of each operation data semantic encoding feature vector in the time queue of the operation data semantic encoding feature vector to obtain a time queue of association optimization factors; The weighting subunit is used to input the time queue of the associated optimization factor into Activation function to obtain the time queue of associated optimization weight factors; The optimization subunit is used to use each associated optimization weight factor in the time queue of the associated optimization weight factor as a weight, and to weight each operating data semantic coding feature vector in the time queue of the operating data semantic coding feature vector to obtain the time queue of the operating data semantic optimization coding feature vector.

4. The vulnerability verification system based on dynamic business component analysis according to claim 3 is characterized in that: The semantic association calculation subunit is used to: Any two operation data semantic encoding feature vectors in the time queue of the operation data semantic encoding feature vector are cascaded and multiplied by the weight coefficient matrix, and then added with the bias vector to obtain the operation data semantic association score vector.

5. The vulnerability verification system based on dynamic business component analysis according to claim 4 is characterized in that: The associated optimization factor calculation subunit is used to: Multiplying the running data semantic encoding feature vector and the sequence endogenous correlation global representation vector by different weight coefficient vectors respectively and then performing an addition operation to obtain a semantic correlation coefficient; The semantic relevance coefficient is added with a bias parameter and then passed through a sigmoid activation function to obtain the relevance optimization factor.

6. The vulnerability verification system based on dynamic business component analysis according to claim 5 is characterized in that: The feature significance calculation subunit is used to: The expected value of the fourth power of the difference between each eigenvalue in the semantically optimized coding feature vector of the running data and its eigenvalue mean is calculated, and the expected value is divided by the square of the eigenvariance of the semantically optimized coding feature vector of the running data to obtain the feature significance description factor.

7. The vulnerability verification system based on dynamic business component analysis according to claim 6 is characterized in that: The feature significance attenuation factor calculation subunit is used to: Calculate the difference between the maximum eigenvalue of the current running data semantic optimization coding feature vector and the maximum eigenvalue of each other running data semantic optimization coding feature vector in the time queue of the running data semantic optimization coding feature vector, and then divide the difference by the number of eigenvectors between the two to obtain the feature significance attenuation factor of each other running data semantic optimization coding feature vector.

8. The vulnerability verification system based on dynamic business component analysis according to claim 7 is characterized in that: The vulnerability detection result generating unit is used to: The business component operation mode time series significant aggregation representation vector is input into a classifier-based vulnerability detection module to obtain the vulnerability detection result.

Images