Network application endogenous security component identification method and related component

Abstract

The invention discloses a network application endogenous security component identification method and device, equipment and a storage medium, and relates to the technical field of network information security. The method comprises the following steps: acquiring feature information corresponding to each detection type preset for endogenous security; the detection type comprises any one or more of a programming language, a three-party component, a development framework, a content management system, a project structure, a preset target component and a database; obtaining a to-be-detected network application file, and calling an identification component corresponding to each detection type from a pre-constructed rule identification engine; and based on the feature information corresponding to the detection types, performing component identification on the to-be-detected network application file by using identification components corresponding to the detection types to obtain a first endogenous security component identification result corresponding to the to-be-detected network application file. The method can cover the range related to endogenous safety transformation, meets the requirements of subsequent endogenous safety transformation, and improves the accuracy and efficiency of component recognition.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a method, device, equipment, storage medium and program product for identifying intrinsic security components of network applications. Background Art

[0002] Intrinsic security is a network security concept that aims to improve security through the design of the system itself, making it more resistant to unknown threats. Future market products will gradually need to have built-in security features when they leave the factory. For existing web applications, if you want to obtain intrinsic security features, you need to perform intrinsic security transformation. Before the transformation, you need to first identify the existing components in the web application that are related to the intrinsic security transformation in order to perform accurate transformation. Software Composition Analysis (SCA) is a technology used to identify, analyze, and manage components used in software so that administrators can understand the components contained in the software and the known vulnerabilities and security issues of these components.

[0003] In the prior art, application component identification relies on the application's package manager file. However, it is impossible to identify self-developed or small applications that do not use a package manager. In addition, the information dimensions identified based on the package manager file component identification are relatively small and cannot meet the needs of subsequent endogenous security transformation. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and storage medium for identifying endogenous security components of network applications, which can cover the scope of endogenous security transformation, meet the needs of subsequent endogenous security transformation, and improve the accuracy and efficiency of component identification. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a method for identifying endogenous security components of a network application, comprising:

[0006] Obtaining feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database;

[0007] Obtain the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine;

[0008] Based on the characteristic information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0009] Optionally, the acquiring of feature information corresponding to each detection type preset for intrinsic security includes:

[0010] Monitor the Internet and collect first target information according to monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems;

[0011] Acquire second target information generated based on experience; the second target information includes project structure, preset target components, and parameter information corresponding to the database;

[0012] Characteristic information corresponding to each detection type is obtained based on the first target information and the second target information.

[0013] Optionally, before calling the recognition component corresponding to each of the detection types from the pre-built rule recognition engine, the method further includes:

[0014] Preprocessing the network application file to be detected to determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions;

[0015] If the detection condition is met, the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine is executed.

[0016] Optionally, after obtaining the intrinsic security component identification result corresponding to the network application file to be detected, the method further includes:

[0017] The hash value of the network application file to be detected and the intrinsic security component identification result are associated and stored, so that when a new network application file to be detected is received, it is first queried whether a corresponding intrinsic security component identification result already exists.

[0018] Optionally, based on the feature information corresponding to the detection type, using the identification components corresponding to each detection type to perform component identification on the to-be-detected network application file, includes:

[0019] Based on the first characteristic information corresponding to the project structure, a project structure identification component is used to identify whether the network application file to be detected uses a package manager, and determine the project development type corresponding to the network application file to be detected; the project development type includes front-end engineering, back-end engineering and mixed engineering; the first characteristic information includes front-end and back-end package manager file name information, front-end and back-end separation characteristic information, and front-end and back-end mixed characteristic information;

[0020] Based on the second characteristic information corresponding to the programming language, using the programming language identification component to identify the development language and language version corresponding to the network application file to be detected; the second characteristic information includes language characteristics corresponding to different versions of the programming language;

[0021] Based on the third feature information corresponding to the development framework, using the development framework identification component to identify the type of development framework used by the network application file to be detected; the third feature information includes framework fingerprint features corresponding to different development frameworks;

[0022] Based on the fourth characteristic information corresponding to the database, a database identification component is used to identify the database type and database-related connection information used by the network application file to be detected; the fourth characteristic information includes database characteristic information related to the intrinsic security transformation;

[0023] Based on the fifth characteristic information corresponding to the third-party component, the third-party component used by the network application file to be detected is identified by using the third-party component identification component; the fifth characteristic information includes component fingerprint characteristics corresponding to various types of third-party components;

[0024] Based on the sixth characteristic information corresponding to the content management system, using the content management system identification component to identify whether the network application file to be detected is constructed based on the content management system; the sixth characteristic information includes system fingerprint characteristics corresponding to various content management systems;

[0025] Based on the seventh characteristic information corresponding to the preset target component, a preset target component identification component is used to identify whether the network application file to be detected contains the preset target component; the seventh characteristic information contains component characteristics of the preset target component related to the intrinsic security transformation.

[0026] Optionally, the method for identifying endogenous security components of network applications further includes:

[0027] Obtaining component identification instructions; the component identification instructions include a first identification instruction based on the rule identification engine, and a second identification instruction based on the rule identification engine and the intelligent analysis engine;

[0028] If the component identification instruction is the second identification instruction, using the intelligent analysis engine to perform component identification on the to-be-detected network application file to obtain a second intrinsically safe component identification result;

[0029] Based on the first intrinsic security component identification result and the second intrinsic security component identification result, a final intrinsic security component identification result of the network application file to be detected is obtained.

[0030] Optionally, the intelligent analysis engine includes a programming language syntax parser and a component analysis model; the programming language syntax parser is used to identify the network application file to be detected to identify the programming language, and the component analysis model is used to identify third-party components, development frameworks, content management systems, project structures, preset target components, and databases;

[0031] The component analysis model is obtained after being pre-trained with feature information corresponding to the detection type.

[0032] In a second aspect, the present application discloses a network application endogenous security component identification device, comprising:

[0033] A feature information acquisition module is used to obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database;

[0034] A file acquisition module, used to acquire the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine;

[0035] The component identification module is used to perform component identification on the network application file to be detected based on the feature information corresponding to the detection type and respectively use the identification components corresponding to each detection type to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0036] In a third aspect, the present application discloses an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] The processor is used to execute the computer program to implement the aforementioned method for identifying endogenous security components of network applications.

[0039] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned method for identifying intrinsic security components of network applications.

[0040] In a fifth aspect, the present application discloses a computer program product, including computer instructions; wherein when the computer instructions are executed by a processor, the aforementioned method for identifying intrinsic security components of network applications is implemented.

[0041] In this application, the characteristic information corresponding to each detection type preset for endogenous security is obtained; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; the network application file to be detected is obtained, and the identification component corresponding to each detection type is called from the pre-built rule recognition engine; based on the characteristic information corresponding to the detection type, the identification component corresponding to each detection type is used to identify the components of the network application file to be detected, so as to obtain the first endogenous security component identification result corresponding to the network application file to be detected. It can be seen that the component identification of the application from the aspects of programming language, third-party component, development framework, content management system, project structure, preset target component, and database has a wider range of application components, which can cover the scope involved in the endogenous security transformation to meet the needs of subsequent endogenous security transformation; and by obtaining the characteristic information of each detection type, the identification component pre-built for each detection type is used to identify the components under the corresponding detection type, so as to improve the accuracy and efficiency of identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0043] FIG1 is a flow chart of a method for identifying endogenous security components of a network application provided by the present application;

[0044] Figure 2 A specific project structure identification component identification method flow chart provided for this application;

[0045] FIG3 is a flowchart of a specific method for identifying endogenous security components of network applications provided by the present application;

[0046] FIG4 is a flowchart of a specific method for identifying endogenous security components of network applications provided by the present application;

[0047] FIG5 is a schematic diagram of the structure of a specific network application intrinsic security component identification system provided by the present application;

[0048] Figure 6 A schematic diagram of the structure of a network application intrinsic security component identification device provided in this application;

[0049] Figure 7 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] In the prior art, application component identification relies on the application's package manager file. However, it is not possible to identify self-developed or small applications that do not use a package manager. In addition, the information dimensions identified based on the package manager file component identification method are relatively small and cannot meet the needs of subsequent endogenous security transformation. In order to overcome the above technical problems, this application proposes a method for identifying endogenous security components of network applications, which can cover the scope of endogenous security transformation, meet the needs of subsequent endogenous security transformation, and improve the accuracy and efficiency of component identification.

[0052] The present application embodiment discloses a method for identifying endogenous security components of a network application. Referring to FIG1 , the method may include the following steps:

[0053] Step S11: Obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party components, development framework, content management system, project structure, preset target components, and database.

[0054] That is, we analyze the components from seven aspects: programming language, third-party components, development framework, content management system (CMS), project structure, preset target components, and database. It is understandable that the intrinsic security transformation involves these seven aspects, so it is necessary to obtain data from these aspects. For example, we can use the characteristic information of the development framework to analyze the type of open framework used in the application.

[0055] In some embodiments, the acquisition of feature information corresponding to each detection type preset for intrinsic security may include: monitoring the Internet, and collecting first target information according to the monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems; it can be understood that according to the configured monitoring rules, information and version update information about programming languages, third-party components, development frameworks, and content management systems are pulled and continuously monitored from the Internet, and specifically for programming languages, update features of different versions are obtained, and update features include language features, such as updated keywords; for third-party components, development frameworks, and content management systems, keyword features, version update features, version packages, and hash values ​​of files relative to the root path are obtained. If the monitored update is included in the configured monitoring rules, automatic updates are directly supported. If not in the configured monitoring rules, a prompt is generated so that the administrator can manually determine whether an update is required; for example, if the language feature update of the programming language is monitored, feature information is directly generated based on the language feature, and if it is other features, it is determined by the administrator; it should be noted that the above feature information is continuously updated, that is, feature updates are obtained in a timely manner by real-time monitoring of the Internet.

[0056] At the same time, obtain the second target information generated based on experience; the second target information includes the project structure, preset target components, and parameter information corresponding to the database; based on the first target information and the second target information, obtain the feature information corresponding to each detection type. It is understandable that the project structure, preset target components, and database-related components cannot be directly obtained from the Internet. They can be summarized by engineers with relevant experience and will be updated in time when new features are discovered later. Specifically, the project structure information needs to include common front-end and back-end package manager file name information, front-end and back-end separation, and front-end and back-end hybrid feature information; the database component needs to include database feature information involved in the intrinsic security transformation; the preset target component includes some random features that affect the intrinsic security transformation and information that requires special attention. The acquired feature information is stored in the data warehouse so that it can be read from the warehouse during identification.

[0057] Step S12: Obtain the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine.

[0058] Obtain network application files that need to be identified for inherent security components of network applications as network application files to be detected. In some embodiments, before calling the identification component corresponding to each of the detection types from the pre-built rule recognition engine, it may also include: pre-processing the network application files to be detected to determine whether the network application files to be detected meet the detection conditions; the detection conditions include type conditions and file size conditions; if the detection conditions are met, then executing the operation of calling the identification component corresponding to each of the detection types from the pre-built rule recognition engine. That is, a check is performed on the form of the network application. If the uploaded file package does not meet the acceptable type or the compressed package file is too large, a failure will be directly returned without subsequent processing. The pre-processing module will decompress the compressed package to the specified directory for subsequent analysis.

[0059] Step S13: Based on the feature information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0060] That is, the programming language identification component, third-party component identification component, development framework identification component, content management system identification component, project structure identification component, preset target component identification component, and database identification component are managed through the rule identification engine. Each component obtains the characteristic information of the detection type corresponding to the component from the data warehouse, and performs component identification for the detection type.

[0061] Among them, for project structure identification, specifically based on the first feature information corresponding to the project structure, the project structure identification component is used to identify whether the network application file to be detected uses a package manager, and the project development type corresponding to the network application file to be detected is determined; the project development type includes front-end engineering, back-end engineering and mixed engineering; the first feature information includes front-end and back-end package manager file name information, front-end and back-end separation feature information, and front-end and back-end mixed feature information; specifically, the use of the project structure identification component to identify whether the network application file to be detected uses a package manager includes: querying whether there are files generated by the package manager, and judging whether the network application file to be detected uses a package manager.

[0062] It is understandable that the project structure identification component can be used to determine whether a package manager is used in the project. It mainly scans the project for files generated by common package managers and verifies the file format. For example, Web applications developed using JAVA usually use the Maven package manager to manage the project's dependency packages, which will generate a pom.xml file in the project directory, which contains basic project information, project environment information, dependency information, and third-party component information, etc. Similarly, the pip package manager is generally used in Python projects, and the Composer package manager is generally used in PHP projects. Secondly, it can be used to determine whether the project is a front-end project, a back-end project, or a hybrid project. If it is a hybrid project, it will further determine whether the project is a front-end and back-end separation development model or a front-end and back-end integrated development model. The project development type involves the subsequent implementation process of endogenous security transformation.

[0063] The above project structure identification component identification process is as follows Figure 2As shown, first determine whether there is a front-end package manager file. If there is a front-end package manager file, further determine whether there is a back-end package manager file. If there is a back-end package manager file, it is determined to be a front-end and back-end separation project. If there is no back-end package manager file, then determine whether there are back-end files with suffixes such as go / java / py. If there are back-end files such as go / java / py, it is determined to be a front-end and back-end separation project. If there are no back-end files such as go / java / py, it is determined to be a front-end project. If there is no front-end package manager, then determine whether there is a back-end package manager. If there are back-end package manager files, then further determine whether there are front-end template parsing class feature files. If there are front-end template parsing class feature files, it is determined to be a front-end and back-end integrated project. If there are no front-end template parsing class feature files, it is determined to be a back-end project. If there are no front-end package manager files and no back-end package manager files, then determine whether there are front-end and back-end integrated files with suffixes such as jsp. If there are front-end and back-end integrated files with suffixes such as jsp, it is determined to be a front-end and back-end integrated project. If there are no front-end and back-end integrated files with suffixes such as jsp, then determine whether there are back-end files with suffixes such as go / java / py. If there are no back-end files with suffixes such as go / java / py, then determine whether there are back-end files with suffixes such as go / java / py. o / java / py, then determine whether there are front-end files with suffixes such as html / vue. If there are front-end files with suffixes such as html / vue, it is determined to be a front-end project, otherwise it is determined to be an illegal project; if there are no front-end and back-end integrated files with suffixes such as jsp and there are back-end files with suffixes such as go / java / py, then further determine whether there are front-end template parsing class feature files. If there are front-end template parsing class feature files, it is determined to be a front-end and back-end integrated project. If there are no front-end template parsing class feature files, then determine whether there are front-end files such as html / vue. If there are no front-end files such as html / vue, it is determined to be a back-end project, otherwise it is a front-end and back-end separated project.

[0064] Among them, for programming language identification, based on the second characteristic information corresponding to the programming language, a programming language identification component is used to identify the development language and language version corresponding to the network application file to be detected; the second characteristic information includes language characteristics corresponding to different versions of programming languages. Specifically, the use of the programming language identification component to identify the development language and language version corresponding to the network application file to be detected includes: determining the development language corresponding to the network application file to be detected by the file suffix; determining the language version corresponding to the network application file to be detected according to the language characteristics.

[0065] It is understandable that the programming language identification component is mainly used to determine the development language and related versions of the project, because the subsequent endogenous security transformation of the web application layer is mainly to heterogeneously process the programming language, and transform the programming language through instruction labeling, randomization, fingerprinting, etc. The heterogeneous methods of different versions of programming languages ​​may be inconsistent to prevent high-risk vulnerabilities such as RCE (Remote Code Execution). When the project uses a package manager, the package management file can be directly analyzed and read for identification, and different package manager files need to be parsed. When the package manager is not used, the development language can be directly determined by the file suffix, and the language version needs to be determined by the language characteristics. The language characteristics of different versions of different programming languages ​​are stored in the data warehouse. When determining the specific version, first configure a default version that is more popular in its field for the scanned programming language, such as 8 in JAVA and 7.4 in PHP, etc. Then scan from high to low according to the version characteristics of each programming language. When the use of new features is scanned, update the programming language version value until the feature scan is completed.

[0066] Among them, for development framework identification, based on the third feature information corresponding to the development framework, the development framework identification component is used to identify the type of development framework used by the network application file to be detected; the third feature information includes the framework fingerprint features corresponding to different development frameworks. Specifically, the use of the development framework identification component to identify the type of development framework used by the network application file to be detected includes: by introducing the relevant files of the development framework locally, comparing the relevant files according to the framework fingerprint features to identify the type of development framework used by the network application file to be detected; the framework fingerprint features include the keyword features, version features and version packages of the framework.

[0067] It is understandable that the software framework identification component is mainly used to determine the development framework used in the Web application, which affects the selection of the subsequent endogenous security transformation tool suite. Taking the Java framework as an example, there are multiple frameworks such as SSM, MyBatis, Spring, Hibernate, etc. Since each framework has a different development style, its code structure also has certain differences. In the MyBatis framework, SQL statements are mainly concentrated in XML files; while in the database access interface using JDBC, SQL statements are distributed in multiple files. Since the SQL statement heterogeneous processing tool handles MyBatis and JDBC differently, it needs to be handled by the corresponding tool according to different software frameworks. When the project uses a package manager, you can directly parse and identify different package manager files. When the package manager is not used, it is necessary to perform feature scanning on the application source code; for the Web front-end framework, the programmer will download the js and css files of the external framework or directly reference them remotely, and use the script tag in the HTML file to introduce them, parse the name and content of the introduced file, and avoid the files written by the programmer himself disrupting the analysis; for the Web back-end framework, each back-end language has its own characteristics, but the basic idea is similar. When the package manager is not used, if the framework is used, the relevant files of the framework need to be imported locally, such as the Java project needs to introduce the relevant jar package into the project folder, the PHP project needs to introduce the relevant PHP files into the local folder, and so on. Therefore, the framework fingerprint features are obtained from the data warehouse for determination.

[0068] Among them, for database identification, based on the fourth characteristic information corresponding to the database, a database identification component is used to identify the database type and database-related connection information used by the network application file to be detected; the fourth characteristic information includes database characteristic information related to the intrinsic security transformation. Specifically, the use of the database identification component to identify the database type and database-related connection information used by the network application file to be detected includes: parsing the target subfile in the network application file to be detected to obtain the database type and database-related connection information used by the network application file to be detected; or, performing regular matching on the source code of the network application file to be detected according to the database characteristic information to determine the database type and database-related connection information used by the network application file to be detected.

[0069] It is understandable that the database identification component mainly analyzes and determines the database type used in the Web application and some mechanism identification that affects the intrinsic security transformation, because even for the same framework, the mimetic adaptation methods corresponding to different databases are different. Specifically, the database type and related connection information (database connection IP, port, user, password and database name) are identified. Based on the framework used, this information will have a standard configuration process. For example, the JAVA Springboot framework will configure this information in the application.yml file or application.properties file. Although the specific names of the files will be different, the general file suffix names are basically the same. Other programming language frameworks will also be declared in the relevant configuration files in the yaml format, so they can be obtained by parsing different files. For applications that do not use this file, the predefined rule configuration will be used from the database features in the data warehouse for pattern matching. On the one hand, the regular feature pattern uses database configuration parameters, database operation statements, and SQL keywords to match the database type and related connection information; on the other hand, it will match the special components in the database according to the relevant rules to provide reference information for the subsequent database intrinsic security transformation. Specifically, the module will scan the application source code and the SQL scripts involved in the source code to determine whether the application has configured the database read-write separation mechanism at the application layer, and whether logical code blocks such as stored procedures, triggers, and scheduled tasks are written in the code or script.

[0070] Among them, for the third-party component identification, based on the fifth characteristic information corresponding to the third-party component, the third-party component used by the network application file to be detected is identified by using the third-party component identification component; the fifth characteristic information includes component fingerprint features corresponding to various types of third-party components. Specifically, the third-party component used by the network application file to be detected is identified by using the third-party component identification component, including: comparing the network application file to be detected according to the component fingerprint feature to identify the type of the third-party component used by the network application file to be detected; the component fingerprint feature includes the keyword feature, version feature and version package of the component.

[0071] It is understandable that the third-party component identification component is mainly used to analyze and determine the third-party components used in Web applications, which is similar to the software framework identification module, but the role of this module for subsequent endogenous security transformation is different. When the application references third-party libraries written in Python, PHP, JS, etc., when the requested web page contains keywords contained in third-party libraries such as JS scripts, endogenous security transformation is still required, otherwise, it may not be executed normally. Based on the framework, the scope of use of third-party components or library dependencies is wider. Furthermore, the framework is also a type of third-party component. Therefore, a detection logic similar to that of the software framework is adopted. When using a package manager, the relevant third-party components and dependencies are parsed from different types of package manager files. When the package manager is not used, the fingerprint features of different components in the data warehouse are used for matching analysis.

[0072] Among them, for content management system (CMS) identification, based on the sixth characteristic information corresponding to the content management system, the content management system identification component is used to identify whether the network application file to be detected is built based on the content management system; the sixth characteristic information includes system fingerprint characteristics corresponding to various content management systems. Specifically, the use of the content management system identification component to identify whether the network application file to be detected is built based on the content management system includes: comparing the network application file to be detected according to the system fingerprint characteristics to determine whether the network application file to be detected is built based on the content management system; the system fingerprint characteristics include keyword characteristics, version characteristics and version packages of the content management system.

[0073] It is understandable that the CMS identification component mainly analyzes whether the web application is a mature CMS system on the market or a secondary development project based on the system, because in addition to the applications written by programmers themselves, the CMS content management system is a website management system based on efficient, powerful technology and complete functions. It has strong scalability, high modularity, and can freely shield functional models that are not used temporarily. The endogenous security transformation is based on the mature adaptation method of the popular and common CMS on the market. Therefore, CMS application identification will greatly reduce the subsequent workload. The identification process is mainly to obtain CMS fingerprint features from the data warehouse. CMS fingerprint features include CMS keyword features, version features, version and file relative to the root path hash value, and perform fingerprint traversal on the application to determine whether it is an existing CMS.

[0074] Among them, for the identification of the preset target component, based on the seventh characteristic information corresponding to the preset target component, the preset target component identification component is used to identify whether the network application file to be detected contains the preset target component; the seventh characteristic information contains the component characteristics of the preset target component related to the intrinsic security transformation. Specifically, the use of the preset target component identification component to identify whether the network application file to be detected contains the preset target component includes: comparing the network application file to be detected according to the component characteristics of the preset target component to determine whether the network application file to be detected contains the preset target component.

[0075] It is understandable that the preset target component identification component mainly analyzes and determines the random component fragments that may affect the intrinsic security transformation. The preset target components include but are not limited to the scheduled tasks involved in the application code, the storage form of uploaded files in the application, distributed user session sharing, user login method identification, website random data identification, application external link requests, verification code functions, etc. These have a greater impact in the subsequent transformation process and need to be identified and fed back. The identification process is to obtain rule features from the data warehouse, match the file content, and record the identified fragments or code blocks.

[0076] In some embodiments, after obtaining the intrinsic security component identification result corresponding to the network application file to be detected, it also includes: associating the hash value of the network application file to be detected and the intrinsic security component identification result and storing them in the data warehouse, so that when a new network application file to be detected is received, it is first queried whether the corresponding intrinsic security component identification result already exists. That is, according to the hash value of the file, the analysis information is obtained from the data warehouse, and the recognition efficiency can be improved when analyzing the same project application package. In addition, the hash value stored in the data warehouse and the hash value generation algorithm at runtime can be replaced, that is, the use of hash values ​​is only a means to ensure the uniqueness of data, and other methods that can achieve uniqueness verification are also acceptable.

[0077] As can be seen from the above, in this embodiment, characteristic information corresponding to each detection type preset for endogenous security is obtained; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; the network application file to be detected is obtained, and the identification component corresponding to each detection type is called from the pre-built rule recognition engine; based on the characteristic information corresponding to the detection type, the identification component corresponding to each detection type is used to perform component identification on the network application file to be detected, so as to obtain the first endogenous security component identification result corresponding to the network application file to be detected. It can be seen that the component identification of the application from the aspects of programming language, third-party component, development framework, content management system, project structure, preset target component, and database has a wider range of application components, which can cover the scope involved in the endogenous security transformation to meet the needs of subsequent endogenous security transformation; and by obtaining the characteristic information of each detection type, the identification component pre-built for each detection type is used to perform component identification under the corresponding detection type, so as to improve the accuracy and efficiency of identification.

[0078] The present application embodiment discloses a specific method for identifying endogenous security components of network applications. Referring to FIG3 , the method may include the following steps:

[0079] Step S21: Obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database.

[0080] Step S22: Obtain the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine.

[0081] Step S23: Based on the feature information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0082] Step S24: Utilize the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result.

[0083] Specifically, before using the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result, it also includes: obtaining a component identification instruction; the component identification instruction includes a first identification instruction based on the rule identification engine, and a second identification instruction based on the rule identification engine and the intelligent analysis engine; if the component identification instruction is the second identification instruction, then using the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result.

[0084] For example, as shown in Figure 4, when the user needs a basic operation mode, the first identification instruction is issued, and the rule analysis engine is used for component identification; when the user needs a high-precision operation mode, the second identification instruction is issued, that is, the rule analysis engine combined with the intelligent analysis engine is used for component identification. The intelligent analysis engine contains a programming language syntax parser and a component analysis model; the programming language syntax parser contains parsers for different languages ​​(such as JAVA, GO, Python, PHP, Ruby, etc.), which is mainly used to solve the deficiency of the rule recognition engine in determining the programming language based on the file suffix name, because there may be malicious files, and the content does not match the file suffix. At this time, the programming language parser can perform normal identification, while the identification using rules is not accurate, affecting the analysis effect. The component analysis model is a machine learning model trained based on different types of feature data in the data warehouse, which can assist in the determination of component features in web applications.

[0085] Step S25: Based on the first intrinsic security component identification result and the second intrinsic security component identification result, a final intrinsic security component identification result of the network application file to be detected is obtained.

[0086] Specifically, the first intrinsic security component identification result and the second intrinsic security component identification result are scanned and compared. Considering that the results of rule identification may have a variety of false positives, such as the programming language category determined by only using the file suffix, and the random factors in the special component identification may identify the comment code block, etc. Therefore, when the two results are inconsistent, the result of the intelligent analysis engine is the main one, and the results of both are recorded for manual analysis and verification by the administrator. If an analysis error occurs, the model can be adjusted.

[0087] Among them, the specific process of the above steps S21 to S23 can refer to the corresponding content disclosed in the above embodiments, and will not be repeated here.

[0088] As can be seen from the above, in this embodiment, the intelligent analysis engine is used to identify the components of the network application file to be detected to obtain the second intrinsic security component identification result, and based on the first intrinsic security component identification result and the second intrinsic security component identification result, the final intrinsic security component identification result of the network application file to be detected is obtained. By introducing the intelligent analysis engine and comparing and analyzing the output results with the traditional rule recognition engine, the accuracy of component analysis can be further improved, and a reference basis can be provided for correcting the model when the results are inconsistent.

[0089] Correspondingly, an embodiment of the present application also discloses a system for identifying endogenous security components of network applications, as shown in FIG5 , the system includes: a monitoring and acquisition module, a data warehouse, a preprocessing module, an intelligent analysis engine, a rule recognition engine, and a result output module.

[0090] The above-mentioned monitoring and collection module is used to monitor the Internet and collect the first target information according to the monitoring rules for intrinsic security; the first target information includes parameter information corresponding to the programming language, third-party components, development framework, and content management system.

[0091] The above-mentioned data warehouse is used to store the feature information corresponding to each detection type and the data records of the system operation. The feature information consists of two parts. One part is the information and version update information of programming languages, third-party components, development frameworks, CMS applications obtained by the monitoring and acquisition module from the Internet; the other part is the input information about the project structure, special components and database components. At the same time, the feature information will be input into the intelligent analysis engine as a data source for model training and model parsing. The data records of the system operation are mainly for the final results of the user's scanning analysis, which is convenient for the rapid analysis of the same project files.

[0092] The above-mentioned preprocessing module is used to preprocess the network application file to be detected to determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions; if the detection conditions are met, the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine is executed.

[0093] The above-mentioned rule recognition engine needs to read the feature information in the data warehouse and call different internal components to perform rule recognition analysis, including project structure recognition component, programming language recognition component, software framework recognition component, database recognition component, third-party component recognition component, CMS application recognition component, and special component recognition component.

[0094] The above-mentioned result output module is responsible for summarizing and outputting the intrinsic security component analysis results of the web application in XML, JSON and other formats according to the SBOM (Software Bill of Materials) standard, and the module will record the results in the data warehouse.

[0095] The system operation process is divided into the preparation phase and the operation phase. Among them, the preparation phase can be completed in an offline environment, which mainly involves the data initialization of the data warehouse and the training of the component analysis model. The data source of the data initialization comes from the information collection of the monitoring and acquisition module and the summary of the rule features. Therefore, first configure the monitoring and acquisition targets, such as software warehouses, official websites and other release channels. After completing the parsing and collection rules of the configuration targets, start the module. The module will collect information according to the rules, complete the analysis and related hash value calculations locally, and then store them in the data warehouse. On the other hand, based on past experience and summary, engineers format the relevant identification rule features and enter them into the data warehouse for model training and the call of the rule recognition engine. Finally, the machine learning algorithm is used to train the rule features and related files to obtain the component analysis model for the intelligent analysis engine to call.

[0096] The complete system is started normally during the operation phase. The user uploads the Web application package that requires intrinsic security component analysis to the system, and the system performs analysis inside the server. First, the preprocessing module is used to make a compliance judgment. When the package does not meet the parsable conditions or does not meet the parsing conditions, a prompt message is returned and the process ends. After passing the compliance judgment, the module calculates the hash value of the application package and internal files, retrieves the records in the data warehouse, and directly calls the data warehouse content when there are existing records, without secondary analysis, to improve operation efficiency. When there is no scan record of related application packages and files, the system enters the internal analysis mode and performs scan analysis according to the currently configured operation mode; when using the basic operation mode, because there is no dependency between the analysis module and the analysis file, the system directly runs all analysis components in the rule recognition engine concurrently, which can maximize the use of server resources and improve the efficiency of scanning and analysis. After the analysis is completed, the results are output and the data warehouse content is updated at the same time; when using the high-precision operation mode, the system concurrently runs the intelligent analysis engine and the rule recognition engine for target analysis. After the scan is completed, the results of the two are compared and analyzed. If the results are consistent, they are output and recorded in the data warehouse; if the results are inconsistent, the intelligent analysis engine results are mainly output, and the differences are recorded in the database for subsequent analysis by the administrator. In addition, during the operation of the system, the monitoring and collection module works continuously and independently, which is not reflected in the process. The module will continuously monitor the update status of the collection target, and update the data warehouse content according to the rules when an update occurs, or notify the administrator to perform manual analysis.

[0097] Correspondingly, the present application embodiment also discloses a network application endogenous security component identification device, see Figure 6 As shown, the device comprises:

[0098] The feature information acquisition module 11 is used to obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database;

[0099] A file acquisition module 12, used to acquire the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine;

[0100] The component identification module 13 is used to perform component identification on the network application file to be detected based on the feature information corresponding to the detection type and respectively use the identification components corresponding to each detection type to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0101] As can be seen from the above, in this embodiment, characteristic information corresponding to each detection type preset for endogenous security is obtained; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; the network application file to be detected is obtained, and the identification component corresponding to each detection type is called from the pre-built rule recognition engine; based on the characteristic information corresponding to the detection type, the identification component corresponding to each detection type is used to perform component identification on the network application file to be detected, so as to obtain the first endogenous security component identification result corresponding to the network application file to be detected. It can be seen that the component identification of the application from the aspects of programming language, third-party component, development framework, content management system, project structure, preset target component, and database has a wider range of application components, which can cover the scope involved in the endogenous security transformation to meet the needs of subsequent endogenous security transformation; and, by obtaining the characteristic information of each detection type, the identification component pre-built for each detection type is used to perform component identification under the corresponding detection type, so as to improve the accuracy and efficiency of component identification.

[0102] In some specific embodiments, the feature information acquisition module 11 may specifically include:

[0103] A first target information acquisition unit is used to monitor the Internet and collect first target information according to monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems;

[0104] A second target information acquisition unit, used to acquire second target information generated based on experience; the second target information includes project structure, preset target components, and parameter information corresponding to the database;

[0105] A feature information determination unit is used to obtain feature information corresponding to each detection type based on the first target information and the second target information.

[0106] In some specific embodiments, the network application endogenous security component identification device may specifically include:

[0107] A preprocessing unit, before calling the recognition component corresponding to each detection type from the pre-built rule recognition engine, is used to preprocess the network application file to be detected to determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions;

[0108] The execution unit is used to execute the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine if the detection condition is met.

[0109] In some specific embodiments, the network application endogenous security component identification device may specifically include:

[0110] The storage unit is used to associate and store the hash value of the network application file to be detected and the intrinsic security component identification result after obtaining the intrinsic security component identification result corresponding to the network application file to be detected, so that when a new network application file to be detected is received, it is first queried whether the corresponding intrinsic security component identification result already exists.

[0111] In some specific embodiments, the component identification module 13 may specifically include:

[0112] A first component identification unit is used to identify whether the network application file to be detected uses a package manager based on the first feature information corresponding to the project structure, and to determine the project development type corresponding to the network application file to be detected by using a project structure identification component; the project development type includes front-end engineering, back-end engineering and mixed engineering; the first feature information includes front-end and back-end package manager file name information, front-end and back-end separation feature information, and front-end and back-end mixed feature information;

[0113] A second component identification unit is used to identify the development language and language version corresponding to the network application file to be detected by using a programming language identification component based on second feature information corresponding to the programming language; the second feature information includes language characteristics corresponding to different versions of programming languages;

[0114] A third component identification unit is used to identify the type of development framework used by the network application file to be detected by using a development framework identification component based on third feature information corresponding to the development framework; the third feature information includes framework fingerprint features corresponding to different development frameworks;

[0115] a fourth component identification unit, configured to identify the database type and database-related connection information used by the network application file to be detected by using a database identification component based on fourth characteristic information corresponding to the database; the fourth characteristic information includes database characteristic information related to the intrinsic security transformation;

[0116] A fifth component identification unit, configured to identify the third-party components used by the network application file to be detected by using the third-party component identification component based on the fifth feature information corresponding to the third-party components; the fifth feature information includes component fingerprint features corresponding to various types of third-party components;

[0117] a sixth component identification unit, configured to identify whether the network application file to be detected is constructed based on the content management system by using the content management system identification component based on the sixth feature information corresponding to the content management system; the sixth feature information includes system fingerprint features corresponding to various content management systems;

[0118] The seventh component identification unit is used to identify whether the network application file to be detected contains the preset target component based on the seventh characteristic information corresponding to the preset target component using the preset target component identification component; the seventh characteristic information contains the component characteristics of the preset target component related to the intrinsic security transformation.

[0119] In some specific embodiments, the network application endogenous security component identification device may specifically include:

[0120] An instruction acquisition unit, used to acquire a component recognition instruction; the component recognition instruction includes a first recognition instruction based on the rule recognition engine, and a second recognition instruction based on the rule recognition engine and the intelligent analysis engine;

[0121] an intelligent identification unit, configured to, if the component identification instruction is the second identification instruction, use the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result;

[0122] The intrinsic security component identification result determining unit is used to obtain a final intrinsic security component identification result of the network application file to be detected based on the first intrinsic security component identification result and the second intrinsic security component identification result.

[0123] In some specific embodiments, the intelligent analysis engine includes a programming language syntax parser and a component analysis model; the programming language syntax parser is used to identify the programming language of the network application file to be detected, and the component analysis model is used to identify third-party components, development frameworks, content management systems, project structures, preset target components, and databases; the component analysis model is obtained after being pre-trained with feature information corresponding to the detection type.

[0124] Furthermore, the present application also discloses an electronic device, see Figure 7 As shown, the contents in the drawings should not be considered as any limitation on the scope of use of the present application.

[0125] Figure 7 The present invention provides a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the method for identifying endogenous security components of network applications disclosed in any of the aforementioned embodiments.

[0126] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0127] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222, and data 223 including feature information, etc. The storage method can be temporary storage or permanent storage.

[0128] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the method for identifying the inherent security components of network applications executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0129] Furthermore, an embodiment of the present application also discloses a computer storage medium, in which computer executable instructions are stored. When the computer executable instructions are loaded and executed by a processor, the steps of the method for identifying intrinsic security components of network applications disclosed in any of the aforementioned embodiments are implemented.

[0130] Furthermore, an embodiment of the present application also discloses a computer program product, which includes computer instructions. When the computer instructions are loaded and executed by a processor, the steps of the method for identifying intrinsic security components of network applications disclosed in any of the aforementioned embodiments are implemented.

[0131] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0132] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0133] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0134] The above is a detailed introduction to a method, device, equipment and storage medium for identifying intrinsic security components of network applications provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a person skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for identifying endogenous security components of network applications, characterized in that: include: Obtaining feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; Obtain the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine; Based on the feature information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

2. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: The obtaining of feature information corresponding to each detection type preset for intrinsic security includes: Monitor the Internet and collect first target information according to monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems; Acquire second target information generated based on experience; the second target information includes project structure, preset target components, and parameter information corresponding to the database; Characteristic information corresponding to each detection type is obtained based on the first target information and the second target information.

3. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: Before calling the recognition component corresponding to each detection type from the pre-built rule recognition engine, the method further includes: Preprocessing the network application file to be detected to determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions; If the detection condition is met, the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine is executed.

4. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: After obtaining the intrinsic security component identification result corresponding to the network application file to be detected, the method further includes: The hash value of the network application file to be detected and the intrinsic security component identification result are associated and stored, so that when a new network application file to be detected is received, it is first queried whether a corresponding intrinsic security component identification result already exists.

5. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: The step of performing component identification on the to-be-detected network application file based on the feature information corresponding to the detection type and using the identification components corresponding to each detection type includes: Based on the first characteristic information corresponding to the project structure, a project structure identification component is used to identify whether the network application file to be detected uses a package manager, and determine the project development type corresponding to the network application file to be detected; the project development type includes front-end engineering, back-end engineering and mixed engineering; the first characteristic information includes front-end and back-end package manager file name information, front-end and back-end separation characteristic information, and front-end and back-end mixed characteristic information; Based on the second characteristic information corresponding to the programming language, using the programming language identification component to identify the development language and language version corresponding to the network application file to be detected; the second characteristic information includes language characteristics corresponding to different versions of the programming language; Based on the third feature information corresponding to the development framework, using the development framework identification component to identify the type of development framework used by the network application file to be detected; the third feature information includes framework fingerprint features corresponding to different development frameworks; Based on the fourth characteristic information corresponding to the database, a database identification component is used to identify the database type and database-related connection information used by the network application file to be detected; the fourth characteristic information includes database characteristic information related to the intrinsic security transformation; Based on the fifth characteristic information corresponding to the third-party component, the third-party component used by the network application file to be detected is identified by using the third-party component identification component; the fifth characteristic information includes component fingerprint characteristics corresponding to various types of third-party components; Based on the sixth characteristic information corresponding to the content management system, using the content management system identification component to identify whether the network application file to be detected is constructed based on the content management system; the sixth characteristic information includes system fingerprint characteristics corresponding to various content management systems; Based on the seventh characteristic information corresponding to the preset target component, a preset target component identification component is used to identify whether the network application file to be detected contains the preset target component; the seventh characteristic information contains component characteristics of the preset target component related to the intrinsic security transformation.

6. The method for identifying endogenous security components of network applications according to any one of claims 1 to 5, characterized in that: Also includes: Obtaining component identification instructions; the component identification instructions include a first identification instruction based on the rule identification engine, and a second identification instruction based on the rule identification engine and the intelligent analysis engine; If the component identification instruction is the second identification instruction, using the intelligent analysis engine to perform component identification on the to-be-detected network application file to obtain a second intrinsically safe component identification result; Based on the first intrinsic security component identification result and the second intrinsic security component identification result, a final intrinsic security component identification result of the network application file to be detected is obtained.

7. The method for identifying endogenous security components of network applications according to claim 6, characterized in that: The intelligent analysis engine includes a programming language syntax parser and a component analysis model; the programming language syntax parser is used to identify the network application file to be detected to identify the programming language, and the component analysis model is used to identify the third-party components, development framework, content management system, project structure, preset target components, and database; The component analysis model is obtained after being pre-trained with feature information corresponding to the detection type.

8. A device for identifying endogenous security components of network applications, characterized in that: include: A feature information acquisition module is used to obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; A file acquisition module, used to acquire the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine; The component identification module is used to perform component identification on the network application file to be detected based on the feature information corresponding to the detection type and respectively use the identification components corresponding to each detection type to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

9. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the method for identifying endogenous security components of network applications as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the method for identifying endogenous security components of network applications as described in any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein when the computer programs are executed by a processor, the method for identifying endogenous security components of network applications as described in any one of claims 1 to 7 is implemented.

Images