Network security vulnerability scanning method based on artificial intelligence

Abstract

The invention discloses a network security vulnerability scanning method based on artificial intelligence. The method comprises the steps that an SQL injection point list is generated, SQL injection statements are combined with the list and matched with vulnerability records in an online vulnerability library to conduct CVSS scoring, a multi-index AGA model is used for conducting iteration on the SQL injection statements in an SQL injection vulnerability set, and a final SQL injection vulnerability set is obtained. The invention belongs to the field of network security, solves the problems of premature convergence, evolutionary direction adjustment and diversity loss through the technical means, also realizes the improvement of the quality of SQL injection statements, and is helpful to discover more vulnerabilities.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically refers to a network security vulnerability scanning method based on artificial intelligence. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent. As an important part of the Internet, websites and servers are particularly important for scanning and repairing security vulnerabilities. Among network security vulnerabilities, SQL injection vulnerabilities, a typical problem, occupy a key position. Traditional network security vulnerability scanning methods mainly rely on preset rules, but this method has insufficient generalization performance and is often powerless when facing zero-day vulnerabilities. Among the vulnerability scanning methods involving artificial intelligence, some existing genetic algorithm network security vulnerability scanning methods also face the problems of premature convergence and difficulty in adjusting parameters, resulting in the inability to comprehensively search for network security vulnerabilities. Summary of the invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a network security vulnerability scanning method based on artificial intelligence, which focuses on SQL injection vulnerabilities, uses a multi-index AGA model, which is a model with global search capabilities, to iterate SQL injection statements in the SQL injection vulnerability set, solves the problem of insufficient generalization performance, improves the ability to cope with zero-day vulnerabilities, adjusts the mutation probability according to changes in population diversity, changes in the highest CVSS score, the number of uninjected offspring SQL injection statements, and the number of offspring generated in each batch, solves the problems of premature convergence, evolutionary direction adjustment and diversity loss, and also improves the quality of SQL injection statements, which is conducive to more comprehensive discovery of network security vulnerabilities. Adjusting the mutation probability adjustment coefficient according to the change in mutation probability helps prevent algorithm stagnation and parameter overshoot, increases the robustness of the present invention, and solves the problem of difficult parameter adjustment.

[0004] The technical solution adopted by the present invention is as follows: A network security vulnerability scanning method based on artificial intelligence provided by the present invention is applied to a website and a website server. The network security vulnerability scanning method based on artificial intelligence comprises the following steps:

[0005] Step S1: The website server lists all forms on the website that can submit input fields to generate a list of SQL injection points, and the website server establishes a connection with an online vulnerability database;

[0006] Step S2: The website server downloads the SQL injection data set, submits each SQL injection statement therein through each form in the SQL injection point list, combines the successfully injected SQL injection statements with the form using the online vulnerability library for CVSS scoring, generates SQL injection vulnerability records, and summarizes them into a SQL injection vulnerability set;

[0007] Step S3: The website server uses the multi-indicator AGA model to iterate the SQL injection statements in the SQL injection vulnerability set;

[0008] Step S4: Get the final SQL injection vulnerability set.

[0009] Further, in step S3, the website server uses the multi-indicator AGA model to iterate the SQL injection statements in the SQL injection vulnerability set, including the following steps:

[0010] Step S31: Setting encoding and mutation probability, mutation probability adjustment coefficient and number of offspring generated in each batch: Binary encode each SQL injection statement in the SQL injection vulnerability set to generate an SQL injection vector, combine the SQL injection vector with its corresponding CVSS score to generate an SQL injection vector set, calculate the population diversity by calculating the average of the average Hamming distance between each SQL injection vector and other SQL injection vectors in the SQL injection vector set, record the highest CVSS score in the SQL injection vector set, and the administrator sets the mutation probability, mutation probability adjustment coefficient and number of offspring generated in each batch;

[0011] Step S32: Generate descendant SQL injection vectors: perform roulette wheel selection based on the CVSS score, select two SQL injection vectors from the SQL injection vector set as parents, perform two-point crossover and bit flip mutation on them to generate descendant SQL injection vectors, and repeat this step until the number of descendant SQL injection vectors reaches the number of descendant vectors generated in each batch;

[0012] Step S33: decoding and updating: decoding the child SQL injection vector to restore it into a child SQL injection statement and submitting it through each form in the SQL injection point list, recording the number of child SQL injection statements that were not successfully injected in this step, combining the successfully injected child SQL injection statements with the form using the online vulnerability library for CVSS scoring, selecting the child SQL injection statements with a new high CVSS score and triggering a form that was not previously included in the SQL injection vulnerability set, adding them together with the corresponding CVSS score and form combination to the SQL injection vulnerability set, and adding their corresponding child SQL injection vectors together with the CVSS score combination to the SQL injection vector set;

[0013] Step S34: adjusting the mutation probability using a mutation probability adjustment formula;

[0014] Step S35: adjusting the mutation probability adjustment coefficient according to the change of the mutation probability, the adjustment formula is as follows:

[0015] ;

[0016] in Represents the mutation probability adjustment coefficient set by the administrator. Represents the adjusted mutation probability adjustment coefficient, represents the adjusted mutation probability, represents the mutation probability before adjustment;

[0017] Step S36: Repeat steps S32 to S35 until no child SQL injection statement that meets the conditions can be selected in step S33.

[0018] Further, in step S34, the process of adjusting the mutation probability using the mutation probability adjustment formula includes the following steps:

[0019] Step S341: The website server calculates the new population diversity and records the new highest CVSS score;

[0020] Step S342: The website server adjusts the mutation probability according to the change in population diversity, the change in the highest CVSS score, the number of unsuccessful child SQL injection statements, and the number of children generated in each batch. The mutation probability adjustment formula is as follows:

[0021] ;

[0022] in represents the adjusted mutation probability, represents the mutation probability before adjustment, represents the mutation probability adjustment coefficient, represents the LeakyReLU function, represents the population diversity after adjustment, represents the population diversity before adjustment, represents the new maximum CVSS score, Represents the highest CVSS score before. Represents the number of offspring generated in each batch, Represents the number of child SQL injection statements that were not successfully injected in step S33.

[0023] Furthermore, the online vulnerability library contains vulnerability records, each of which includes a vulnerability number, a vulnerability name, a vulnerability description, an exploit code, and a vulnerability CVSS score.

[0024] Further, in step S2, the process of combining the SQL injection statement and the form with the online vulnerability library for CVSS scoring includes the following steps:

[0025] Step S21: Match the name of the form corresponding to the SQL injection statement with the vulnerability description in the vulnerability record, and select all vulnerability records whose vulnerability descriptions contain the name of the form corresponding to the SQL injection statement;

[0026] Step S22: Calculate the Levenshtein distance between each SQL injection statement and the exploit code of the vulnerability record selected in step S21, and select the CVSS score of the vulnerability record with the smallest Levenshtein distance as its own CVSS score.

[0027] Further, in step S33, the process of combining the child SQL injection statement and the form with the online vulnerability library for CVSS scoring includes the following steps:

[0028] Step S3311: Match the name of the form corresponding to the child SQL injection statement with the vulnerability description in the vulnerability record, and select all vulnerability records whose vulnerability descriptions contain the name of the form corresponding to the child SQL injection statement;

[0029] Step S3312: Calculate the Levenshtein distance between the descendant SQL injection statements and the exploit code of the vulnerability record selected in step S331 one by one, and select the vulnerability CVSS score of the vulnerability record with the smallest Levenshtein distance as its own CVSS score.

[0030] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0031] (1) The multi-index AGA model, which has global search capabilities, is used to iterate the SQL injection statements in the SQL injection vulnerability set, which solves the problem of insufficient generalization performance and improves the ability to deal with zero-day vulnerabilities. The mutation probability is adjusted according to the changes in population diversity, the changes in the highest CVSS score, the number of unsuccessful offspring SQL injection statements, and the number of offspring generated in each batch. This solves the problems of premature convergence, evolutionary direction adjustment, and diversity loss, and also improves the quality of SQL injection statements, which helps to discover network security vulnerabilities more comprehensively.

[0032] (2) Use the Levenshtein distance to compare the SQL injection statement with the code in the vulnerability library, and select the record with the shortest distance as the CVSS score. This operation enables the method to be continuously improved as the vulnerability library is updated to adapt to new threats and risks, overcoming the technical bias that CVSS scoring must rely on manual expert scoring. Compared with traditional manual scoring, it also greatly reduces the labor and time costs, and does not rely on specific grammatical specifications.

[0033] (3) The original mutation probability adjustment formula of the present invention maintains the mutation failure rate at a level around 0.5, which helps maintain population diversity and allows the algorithm to explore new search spaces to prevent the algorithm from staying at a local optimal solution. This formula also reduces the mutation rate when the highest CVSS score increases, keeping it on the correct evolutionary trajectory. It responds to changes in population diversity and pioneeringly uses LeakyReLU to correct changes in population diversity, overcoming the technical bias of long-standing neglect of the possibility of using activation functions in formulas to improve performance. It achieves an increase in the mutation rate when population diversity decreases and a slight decrease in the mutation rate when population diversity increases. This helps balance the population structure, enables the algorithm to better utilize existing high-quality samples, and helps to more comprehensively discover network security vulnerabilities.

[0034] (4) Adjusting the mutation probability adjustment coefficient according to the change in mutation probability helps prevent algorithm stagnation and parameter overshoot, increases the robustness of the present invention, and solves the problem of difficulty in parameter adjustment. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flowchart for iterating SQL injection statements in the SQL injection vulnerability set using the multi-indicator AGA model for a website server;

[0036] Figure 2 This is a schematic diagram of the two-point crossover operation of the multi-index AGA model used in the present invention.

[0037] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0038] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0039] Embodiment 1, the present invention provides a network security vulnerability scanning method based on artificial intelligence, which is applied to a website and a website server. The network security vulnerability scanning method based on artificial intelligence includes the following steps:

[0040] Step S1: The website server lists all forms on the website that can submit input fields to generate a list of SQL injection points, and the website server establishes a connection with the tenable online vulnerability library;

[0041] Step S2: The website server downloads the SQLinjection dataset from Alibaba Tianchi, submits each SQL injection statement through each form in the SQL injection point list, combines the successfully injected SQL injection statements with the form, and uses the tenable online vulnerability library to perform CVSS scoring, generates SQL injection vulnerability records, and summarizes them into a SQL injection vulnerability set;

[0042] Step S3: The website server uses the multi-indicator AGA model to iterate the SQL injection statements in the SQL injection vulnerability set;

[0043] Step S4: Get the final SQL injection vulnerability set.

[0044] Example 2, see Figure 1 and Figure 2 This embodiment is based on the above embodiment. In step S3, the website server uses the multi-index AGA model to iterate the SQL injection statements in the SQL injection vulnerability set, including the following steps:

[0045] Step S31: Setting of encoding and mutation probability, mutation probability adjustment coefficient and number of offspring generated in each batch: the website server performs binary encoding on each SQL injection statement in the SQL injection vulnerability set to generate an SQL injection vector, combines the SQL injection vector with its corresponding CVSS score to generate an SQL injection vector set, imports the Levenshtein package to the website server, calculates the average Hamming distance between each SQL injection vector and other SQL injection vectors in the SQL injection vector set by the Levenshtein.hamming method, calculates the population diversity, records the highest CVSS score in the SQL injection vector set, and the administrator sets the mutation probability, mutation probability adjustment coefficient and number of offspring generated in each batch. In this embodiment, the population diversity is 5, the highest CVSS score is 6.4, the mutation probability is 0.1, the mutation probability adjustment coefficient is 0.5, and the number of offspring generated in each batch is 100;

[0046] Step S32: Generate descendant SQL injection vectors: The website server imports the DEAP package, uses the selRoulette method to perform roulette selection based on the CVSS score, selects two SQL injection vectors from the SQL injection vector set as parents, uses the cxTwoPoint method to perform two-point crossover and uses the mutFlipBit method to perform bit flip mutation to generate descendant SQL injection vectors, and repeats this step until the number of descendant SQL injection vectors reaches the number of descendant vectors generated in each batch;

[0047] Step S33: decoding and updating: decoding the child SQL injection vector to restore it into a child SQL injection statement and submitting it through each form in the SQL injection point list, recording the number of child SQL injection statements that were not successfully injected in this step, combining the successfully injected child SQL injection statements with the form and using the tenable online vulnerability library for CVSS scoring, selecting the child SQL injection statements with a new high CVSS score and triggering a form that was not previously included in the SQL injection vulnerability set, adding them together with the corresponding CVSS score and form combination to the SQL injection vulnerability set, and adding their corresponding child SQL injection vectors together with the CVSS score combination to the SQL injection vector set. In this embodiment, the number of child SQL injection statements that were not successfully injected is 50;

[0048] Step S34: adjusting the mutation probability using a mutation probability adjustment formula;

[0049] Step S35: Step S35: Adjust the mutation probability adjustment coefficient according to the change of the mutation probability. The adjustment formula is as follows:

[0050] ;

[0051] in Represents the mutation probability adjustment coefficient set by the administrator. Represents the adjusted mutation probability adjustment coefficient, represents the adjusted mutation probability, represents the mutation probability before adjustment. In this embodiment, is 0.1, is 0.11, so is 0.49;

[0052] Step S36: Repeat steps S32 to S35 until no child SQL injection statement that meets the conditions can be selected in step S33.

[0053] Embodiment 3: This embodiment is based on embodiment 2. In step S34, the process of adjusting the mutation probability using the mutation probability adjustment formula includes the following steps:

[0054] Step S341: The website server calculates the new population diversity and records the new highest CVSS score;

[0055] Step S342: The website server adjusts the mutation probability according to the change in population diversity, the change in the highest CVSS score, the number of unsuccessful child SQL injection statements, and the number of children generated in each batch. The mutation probability adjustment formula is as follows:

[0056] ;

[0057] in represents the adjusted mutation probability, represents the mutation probability before adjustment, represents the mutation probability adjustment coefficient, represents the LeakyReLU function, represents the population diversity after adjustment, represents the population diversity before adjustment, represents the new maximum CVSS score, Represents the highest CVSS score before. Represents the number of offspring generated in each batch, Represents the number of child SQL injection statements that were not successfully injected in step S33. In this embodiment, the new highest CVSS score is 7.0, the new population diversity is 4, and the new mutation probability is 0.11.

[0058] Embodiment 4: This embodiment is based on embodiment 1. The tenable online vulnerability database includes vulnerability records, and each vulnerability record includes a vulnerability number, a vulnerability name, a vulnerability description, an exploit code, and a vulnerability CVSS score.

[0059] Embodiment 5, based on Embodiment 4, in step S2, the process of combining SQL injection statements and forms with tenable online vulnerability library for CVSS scoring includes the following steps:

[0060] Step S21: Match the name of the form corresponding to the SQL injection statement with the vulnerability description in the vulnerability record, and select all vulnerability records whose vulnerability descriptions contain the name of the form corresponding to the SQL injection statement;

[0061] Step S22: The website server imports the Levenshtein package, and calculates the Levenshtein distance between the SQL injection statement and the exploit code of the vulnerability record selected in step S21 one by one through the Levenshtein.distance method, and selects the vulnerability CVSS score of the vulnerability record with the smallest Levenshtein distance as its own CVSS score.

[0062] Embodiment 6: This embodiment is based on Embodiment 2 and Embodiment 4. In step S33, the process of using the combination of the child SQL injection statement and the form to perform CVSS scoring using the online vulnerability library includes the following steps:

[0063] Step S3311: Match the name of the form corresponding to the child SQL injection statement with the vulnerability description in the vulnerability record, and select all vulnerability records whose vulnerability descriptions contain the name of the form corresponding to the child SQL injection statement;

[0064] Step S3312: The website server imports the Levenshtein package, and calculates the Levenshtein distance between the descendant SQL injection statements and the exploit code of the vulnerability record selected in step S3311 one by one through the Levenshtein.distance method, and selects the vulnerability CVSS score of the vulnerability record with the smallest Levenshtein distance as its own CVSS score.

[0065] Embodiment 7, based on Embodiment 2, this embodiment includes the following steps:

[0066] Step S311: Use the spilt method of the sqlparse library to segment each SQL injection statement in the SQL injection vulnerability set to obtain the segmented SQL injection statement;

[0067] Step S312: Use the encode method to convert the segmented SQL injection statement into a binary form to obtain an SQL injection vector.

[0068] Embodiment 8: This embodiment is based on embodiment 2. In step S33, the process of decoding the child SQL injection vector and restoring it into a child SQL injection statement includes the following steps:

[0069] Step S3321: using a decode method to convert the child SQL injection vector into a string form to obtain a word-partitioned child SQL injection statement;

[0070] Step S3322: Use the join method to connect the child SQL injection statements of the word segmentation into a child SQL injection statement.

[0071] Embodiment 9. This embodiment is based on embodiment 1. This embodiment runs in the Windows operating system environment. The experiment relies on the Anaconda3 environment, and uses DEAP as the multi-index AGA model framework. The website server uses Huawei RH1288 V3.

[0072] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. A network security vulnerability scanning method based on artificial intelligence, applied to websites and website servers, characterized in that: The network security vulnerability scanning method based on artificial intelligence includes the following steps: Step S1: The website server lists all forms on the website that can submit input fields to generate a list of SQL injection points; Step S2: The website server downloads the SQL injection data set, submits each SQL injection statement therein through each form in the SQL injection point list, combines the successfully injected SQL injection statements with the form using the online vulnerability library for CVSS scoring, generates SQL injection vulnerability records, and summarizes them into a SQL injection vulnerability set; Step S3: The website server uses the multi-indicator AGA model to iterate the SQL injection statements in the SQL injection vulnerability set; Step S4: Get the final SQL injection vulnerability set.

2. According to the artificial intelligence-based network security vulnerability scanning method of claim 1, it is characterized in that: In step S2, the process of combining the SQL injection statement and the form with the online vulnerability library for CVSS scoring includes the following steps: Step S21: Match the name of the form corresponding to the SQL injection statement with the vulnerability description in the vulnerability record, and select all vulnerability records whose vulnerability descriptions contain the name of the form corresponding to the SQL injection statement; Step S22: Calculate the Levenshtein distance between each SQL injection statement and the exploit code of the vulnerability record selected in step S21, and select the CVSS score of the vulnerability record with the smallest Levenshtein distance as its own CVSS score.

3. According to claim 2, a network security vulnerability scanning method based on artificial intelligence is characterized in that: In step S3, the website server uses the multi-indicator AGA model to iterate the SQL injection statements in the SQL injection vulnerability set, including the following steps: Step S31: Step S31: Setting of encoding and mutation probability, mutation probability adjustment coefficient and number of offspring generated in each batch: Binary encoding is performed on each SQL injection statement in the SQL injection vulnerability set to generate a SQL injection vector, the SQL injection vector is combined with its corresponding CVSS score to generate a SQL injection vector set, the population diversity is calculated by calculating the average of the average Hamming distance between each SQL injection vector and other SQL injection vectors in the SQL injection vector set, the highest CVSS score in the SQL injection vector set is recorded, and the administrator sets the mutation probability, mutation probability adjustment coefficient and number of offspring generated in each batch; Step S32: Generate descendant SQL injection vectors: perform roulette wheel selection based on the CVSS score, select two SQL injection vectors from the SQL injection vector set as parents, perform two-point crossover and bit flip mutation on them to generate descendant SQL injection vectors, and repeat this step until the number of descendant SQL injection vectors reaches the number of descendant vectors generated in each batch; Step S33: decoding and updating: decoding the child SQL injection vector to restore it into a child SQL injection statement and submitting it through each form in the SQL injection point list, recording the number of child SQL injection statements that were not successfully injected in this step, combining the successfully injected child SQL injection statements with the form using the online vulnerability library for CVSS scoring, selecting the child SQL injection statements with a new high CVSS score and triggering a form that was not previously included in the SQL injection vulnerability set, adding them together with the corresponding CVSS score and form combination to the SQL injection vulnerability set, and adding their corresponding child SQL injection vectors together with the CVSS score combination to the SQL injection vector set; Step S34: adjusting the mutation probability using a mutation probability adjustment formula; Step S35: adjusting the mutation probability adjustment coefficient according to the change of the mutation probability, the adjustment formula is as follows: ； in Represents the mutation probability adjustment coefficient set by the administrator. Represents the adjusted mutation probability adjustment coefficient, represents the mutation probability after adjustment, represents the mutation probability before adjustment; Step S36: Repeat steps S32 to S35 until no child SQL injection statement that meets the conditions can be selected in step S33.

4. According to claim 3, a network security vulnerability scanning method based on artificial intelligence is characterized in that: The online vulnerability library contains vulnerability records, each of which includes a vulnerability number, a vulnerability name, a vulnerability description, an exploit code, and a vulnerability CVSS score.

5. According to claim 4, a network security vulnerability scanning method based on artificial intelligence is characterized in that: In step S33, the process of combining the child SQL injection statement and the form with the online vulnerability library for CVSS scoring includes the following steps: Step S3311: Match the name of the form corresponding to the child SQL injection statement with the vulnerability description in the vulnerability record, and select all vulnerability records whose vulnerability descriptions contain the name of the form corresponding to the child SQL injection statement; Step S3312: Calculate the Levenshtein distance between the descendant SQL injection statements and the exploit code of the vulnerability record selected in step S331 one by one, and select the vulnerability CVSS score of the vulnerability record with the smallest Levenshtein distance as its own CVSS score.

6. The method for scanning network security vulnerabilities based on artificial intelligence according to claim 5, characterized in that: In step S34, the process of adjusting the mutation probability using the mutation probability adjustment formula includes the following steps: Step S341: The website server calculates the new population diversity and records the new highest CVSS score; Step S342: The website server adjusts the mutation probability according to the change in population diversity, the change in the highest CVSS score, the number of unsuccessful child SQL injection statements, and the number of children generated in each batch. The mutation probability adjustment formula is as follows: ； in represents the adjusted mutation probability, represents the mutation probability before adjustment, represents the mutation probability adjustment coefficient, represents the LeakyReLU function, represents the population diversity after adjustment, represents the population diversity before adjustment, represents the new maximum CVSS score, Represents the highest CVSS score before. Represents the number of offspring generated in each batch, Represents the number of child SQL injection statements that were not successfully injected in step S33.

Images