A method for identifying endogenous security components of network applications and related components

Abstract

The present application discloses a method, device, equipment and storage medium for identifying endogenous security components of network applications, and relates to the field of network information security technology. The method includes: obtaining feature information corresponding to each detection type preset for endogenous security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; obtaining the network application file to be detected, and calling the identification component corresponding to each of the detection types from the pre-built rule recognition engine; based on the feature information corresponding to the detection type, using the identification component corresponding to each of the detection types to perform component identification on the network application file to be detected, so as to obtain the first endogenous security component identification result corresponding to the network application file to be detected. It can cover the scope involved in endogenous security transformation, meet the needs of subsequent endogenous security transformation, and improve the accuracy and efficiency of component identification.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a method, device, equipment, storage medium and program product for identifying intrinsic security components of network applications. Background Art

[0002] Intrinsic security is a network security concept that aims to improve security through the system's inherent design, making it more resilient to unknown threats. Future products will gradually need to have security features built into them from the factory. For existing web applications, if they want to achieve intrinsic security, they must undergo intrinsic security retrofits. Before retrofitting, it's necessary to identify the components within the web application that are relevant to intrinsic security retrofits so that precise modifications can be made. Software Composition Analysis (SCA) is a technology used to identify, analyze, and manage the components used in software, allowing administrators to understand the components included in the software and their known vulnerabilities and security issues.

[0003] In the existing technology, application component identification relies on the application's package manager file. However, it is impossible to identify self-developed or small applications that do not use a package manager. In addition, the information dimensions identified based on the package manager file component identification method are relatively small and cannot meet the needs of subsequent endogenous security transformation. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment, and storage medium for identifying inherent security components in network applications, which can cover the scope of inherent security modification, meet the needs of subsequent inherent security modification, and improve the accuracy and efficiency of component identification. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a method for identifying inherent security components of network applications, comprising:

[0006] Obtaining feature information corresponding to each detection type preset for intrinsic security; the detection type may include any one or more of programming language, third-party components, development framework, content management system, project structure, preset target components, and database;

[0007] Obtain the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine;

[0008] Based on the feature information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0009] Optionally, obtaining feature information corresponding to each detection type preset for intrinsic security includes:

[0010] Monitor the Internet and collect first target information based on monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems;

[0011] Acquire second target information generated based on experience; the second target information includes project structure, preset target components, and parameter information corresponding to the database;

[0012] Feature information corresponding to each detection type is obtained based on the first target information and the second target information.

[0013] Optionally, before calling the recognition component corresponding to each detection type from the pre-built rule recognition engine, the method further includes:

[0014] Preprocessing the network application file to be detected to determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions;

[0015] If the detection condition is met, the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine is executed.

[0016] Optionally, after obtaining the intrinsic security component identification result corresponding to the network application file to be detected, the method further includes:

[0017] The hash value of the network application file to be detected and the intrinsic security component identification result are associated and stored, so that when a new network application file to be detected is received, it is first checked whether a corresponding intrinsic security component identification result already exists.

[0018] Optionally, the performing component identification on the to-be-detected network application file based on the feature information corresponding to the detection type and using the identification components corresponding to each detection type respectively includes:

[0019] Based on the first characteristic information corresponding to the project structure, using the project structure identification component to identify whether the network application file to be detected uses a package manager, and determining the project development type corresponding to the network application file to be detected; the project development type includes front-end project, back-end project, and hybrid project; the first characteristic information includes front-end and back-end package manager file name information, front-end and back-end separation characteristic information, and front-end and back-end hybrid characteristic information;

[0020] Based on second characteristic information corresponding to the programming language, using a programming language identification component to identify the development language and language version corresponding to the network application file to be detected; the second characteristic information includes language characteristics corresponding to different versions of the programming language;

[0021] Based on the third feature information corresponding to the development framework, using the development framework identification component to identify the type of development framework used by the network application file to be detected; the third feature information includes framework fingerprint features corresponding to different development frameworks;

[0022] Based on fourth characteristic information corresponding to the database, using a database identification component to identify the database type and database-related connection information used by the network application file to be detected; the fourth characteristic information includes database characteristic information related to intrinsic security transformation;

[0023] Based on the fifth characteristic information corresponding to the third-party components, using the third-party component identification component, identifying the third-party components used by the network application file to be detected; the fifth characteristic information includes component fingerprint features corresponding to various types of third-party components;

[0024] Based on sixth characteristic information corresponding to the content management system, using a content management system identification component to identify whether the network application file to be detected is constructed based on the content management system; the sixth characteristic information includes system fingerprint characteristics corresponding to various content management systems;

[0025] Based on the seventh characteristic information corresponding to the preset target component, a preset target component identification component is used to identify whether the network application file to be detected contains the preset target component; the seventh characteristic information includes component characteristics of the preset target component related to intrinsic security transformation.

[0026] Optionally, the method for identifying intrinsic security components of network applications further includes:

[0027] Obtaining a component identification instruction; the component identification instruction includes a first identification instruction based on the rule identification engine, and a second identification instruction based on the rule identification engine and the intelligent analysis engine;

[0028] If the component identification instruction is the second identification instruction, using the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result;

[0029] Based on the first intrinsic security component identification result and the second intrinsic security component identification result, a final intrinsic security component identification result of the network application file to be detected is obtained.

[0030] Optionally, the intelligent analysis engine includes a programming language syntax parser and a component analysis model; the programming language syntax parser is used to identify the programming language of the network application file to be detected, and the component analysis model is used to identify third-party components, development frameworks, content management systems, project structures, preset target components, and databases;

[0031] The component analysis model is obtained after being pre-trained with feature information corresponding to the detection type.

[0032] In a second aspect, the present application discloses a device for identifying endogenous security components of network applications, comprising:

[0033] A feature information acquisition module is used to obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party components, development framework, content management system, project structure, preset target components, and database;

[0034] A file acquisition module is used to acquire the network application file to be detected and call the recognition component corresponding to each detection type from the pre-built rule recognition engine;

[0035] The component identification module is used to perform component identification on the network application file to be detected based on the feature information corresponding to the detection type and respectively use the identification components corresponding to each detection type to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0036] In a third aspect, the present application discloses an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] A processor is used to execute the computer program to implement the aforementioned method for identifying endogenous security components of network applications.

[0039] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned method for identifying intrinsic security components of network applications.

[0040] In a fifth aspect, the present application discloses a computer program product, comprising computer instructions; wherein when the computer instructions are executed by a processor, the aforementioned method for identifying intrinsic security components of network applications is implemented.

[0041] In this application, feature information corresponding to each detection type preset for endogenous security is obtained; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; the network application file to be detected is obtained, and the identification component corresponding to each detection type is called from the pre-built rule recognition engine; based on the feature information corresponding to the detection type, the identification component corresponding to each detection type is used to perform component identification on the network application file to be detected, so as to obtain the first endogenous security component identification result corresponding to the network application file to be detected. It can be seen that the component identification of the application from the aspects of programming language, third-party component, development framework, content management system, project structure, preset target component, and database has a wider range of application components and can cover the scope involved in endogenous security transformation to meet the needs of subsequent endogenous security transformation; and by obtaining the feature information of each detection type, the recognition component pre-built for each detection type is used to perform component identification under the corresponding detection type, thereby improving the accuracy and efficiency of identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 A flow chart of a method for identifying intrinsic security components of network applications provided in this application;

[0044] Figure 2 A flowchart of a specific project structure identification component identification method provided for this application;

[0045] Figure 3 A flowchart of a specific method for identifying intrinsic security components of network applications provided in this application;

[0046] Figure 4 A flowchart of a specific method for identifying intrinsic security components of network applications provided in this application;

[0047] Figure 5 A schematic diagram of the structure of a specific network application intrinsic security component identification system provided in this application;

[0048] Figure 6 A schematic diagram of the structure of a device for identifying intrinsic security components of network applications provided in this application;

[0049] Figure 7This is a structural diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0051] The existing technology relies on the application's package manager files to identify application components. However, this method cannot identify self-developed or small applications that do not use a package manager. In addition, the information dimensions identified by the package manager file component identification method are relatively small and cannot meet the needs of subsequent endogenous security modifications. To overcome the above technical problems, this application proposes a method for identifying endogenous security components in network applications, which can cover the scope of endogenous security modifications, meet the needs of subsequent endogenous security modifications, and improve the accuracy and efficiency of component identification.

[0052] This application embodiment discloses a method for identifying endogenous security components of network applications. Figure 1 As shown, the method may include the following steps:

[0053] Step S11: Obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party components, development framework, content management system, project structure, preset target components, and database.

[0054] Specifically, we analyze seven aspects: programming language, third-party components, development framework, content management system (CMS), project structure, pre-defined target components, and database. As you can see, intrinsic security transformation involves all seven aspects, so data on these aspects is necessary. For example, we can use the characteristic information of the development framework to analyze the type of open framework used in the application.

[0055] In some embodiments, obtaining feature information corresponding to each detection type preset for intrinsic security may include: monitoring the internet and collecting first target information according to the monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems; it is understood that according to the configured monitoring rules, information and version update information about programming languages, third-party components, development frameworks, and content management systems are pulled from the internet and continuously monitored. Specifically for programming languages, update characteristics of different versions are obtained, including language characteristics, such as updated keywords; for third-party components, development frameworks, and content management systems, keyword characteristics, version update characteristics, version packages, and hash values ​​of files relative to the root path are obtained. If the monitored update is included in the configured monitoring rules, automatic update is directly supported. If it is not included in the configured monitoring rules, a prompt is generated so that the administrator can manually determine whether an update is required. For example, if a language characteristic update of a programming language is monitored, feature information is directly generated based on the language characteristic; if it is other characteristics, the administrator will make the determination; it should be noted that the above feature information is continuously updated, that is, feature updates are obtained in a timely manner through real-time monitoring of the internet.

[0056] At the same time, obtain the second target information generated based on experience; the second target information includes the project structure, preset target components, and parameter information corresponding to the database; based on the first target information and the second target information, obtain the feature information corresponding to each detection type. It is understandable that the project structure, preset target components, and database-related components cannot be directly obtained from the Internet. They can be summarized by engineers with relevant experience and will be updated in a timely manner when new features are discovered later. Specifically, the project structure information needs to include common front-end and back-end package manager file name information, front-end and back-end separation, and front-end and back-end hybrid feature information; the database component needs to include database feature information involved in the endogenous security transformation; the preset target component includes some random features that affect the endogenous security transformation and information that requires special attention. The acquired feature information is stored in the data warehouse so that it can be read from the warehouse during identification.

[0057] Step S12: obtaining the network application file to be detected, and calling the recognition component corresponding to each detection type from the pre-built rule recognition engine.

[0058] Obtain a network application file that needs to be identified as an intrinsic security component of the network application as a network application file to be detected. In some embodiments, before calling the identification component corresponding to each of the detection types from the pre-built rule recognition engine, it may also include: pre-processing the network application file to be detected to determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions; if the detection conditions are met, then executing the operation of calling the identification component corresponding to each of the detection types from the pre-built rule recognition engine. That is, a check is performed on the form of the network application. If the uploaded file package does not meet the acceptable type or the compressed package file is too large, a failure will be directly returned without subsequent processing. The compressed package will be decompressed to the specified directory using the pre-processing module for subsequent analysis.

[0059] Step S13: Based on the feature information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0060] The programming language identification component, third-party component identification component, development framework identification component, content management system identification component, project structure identification component, preset target component identification component, and database identification component are managed by the rule identification engine. Each component obtains the feature information of the detection type corresponding to the component from the data warehouse and performs component identification for the detection type.

[0061] Among them, for project structure identification, specifically based on the first feature information corresponding to the project structure, the project structure identification component is used to identify whether the network application file to be detected uses a package manager, and determine the project development type corresponding to the network application file to be detected; the project development type includes front-end projects, back-end projects and mixed projects; the first feature information includes front-end and back-end package manager file name information, front-end and back-end separation feature information, and front-end and back-end mixed feature information; specifically, the use of the project structure identification component to identify whether the network application file to be detected uses a package manager includes: querying whether there are files generated by the package manager, and judging whether the network application file to be detected uses a package manager.

[0062] It is understandable that the project structure identification component can first be used to determine whether a package manager is used in the project. It mainly scans the project for files generated by commonly used package managers and verifies the file format. For example, Web applications developed using JAVA usually use the Maven package manager to manage the project's dependency packages, which will generate a pom.xml file in the project directory. The file contains basic project information, project environment information, dependency information, and third-party component information, etc. Similarly, Python projects generally use the pip package manager, and PHP projects generally use the Composer package manager. Secondly, it can be used to determine whether the project is a front-end project, a back-end project, or a hybrid project. If it is a hybrid project, it will further determine whether the project is a front-end and back-end separation development model or a front-end and back-end integrated development model. The project development type involves the subsequent implementation process of the endogenous security transformation.

[0063] The above project structure identification component identification process is as follows Figure 2As shown, first determine whether there is a front-end package manager file. If there is a front-end package manager file, then further determine whether there is a back-end package manager file. If there is a back-end package manager file, it is determined to be a front-end and back-end separation project. If there is no back-end package manager file, then determine whether there are back-end files with suffixes such as go / java / py. If there are back-end files such as go / java / py, then it is determined to be a front-end and back-end separation project. If there are no back-end files such as go / java / py, then it is determined to be a front-end project. If there is no front-end package manager, then determine whether there is a back-end package manager. If there are back-end package manager files, then further determine whether there are front-end template parsing class feature files. If there are front-end template parsing class feature files, then it is determined to be a front-end and back-end integrated project. If there are no front-end template parsing class feature files, then it is determined to be a back-end project. If there are no front-end package manager files and no back-end package manager files, then determine whether there are front-end and back-end integrated files with suffixes such as jsp. If there are front-end and back-end integrated files with suffixes such as jsp, then it is determined to be a front-end and back-end integrated project. If there are no front-end and back-end integrated files with suffixes such as jsp, then determine whether there are back-end files with suffixes such as go / java / py. If there are no back-end integrated files with suffixes such as g o / java / py, then determine whether there are front-end files with suffixes such as html / vue. If there are front-end files with suffixes such as html / vue, then determine whether it is a front-end project, otherwise it is determined to be an illegal project; if there are no front-end and back-end integrated files with suffixes such as jsp and there are back-end files with suffixes such as go / java / py, then further determine whether there are front-end template parsing class feature files. If there are front-end template parsing class feature files, then determine whether it is a front-end and back-end integrated project. If there are no front-end template parsing class feature files, then determine whether there are front-end files such as html / vue. If there are no front-end files such as html / vue, then determine it to be a back-end project, otherwise it is a front-end and back-end separated project.

[0064] Specifically, with respect to programming language identification, a programming language identification component is used to identify the development language and language version corresponding to the network application file to be detected based on second characteristic information corresponding to the programming language; the second characteristic information includes language characteristics corresponding to different versions of the programming language. Specifically, identifying the development language and language version corresponding to the network application file to be detected using the programming language identification component includes: determining the development language corresponding to the network application file to be detected by using the file suffix; and determining the language version corresponding to the network application file to be detected based on the language characteristics.

[0065] Understandably, the programming language identification component is primarily used to determine the project's development language and associated version. Subsequent inherent security improvements at the web application layer primarily involve heterogeneous programming language processing. This involves transforming the programming language through methods such as instruction tagging, randomization, and fingerprinting. Different versions of programming languages ​​may use different heterogeneous methods to mitigate high-risk vulnerabilities such as Remote Code Execution (RCE). When a project uses a package manager, the package manager files can be directly analyzed and read for identification, requiring parsing specific package manager files. When a package manager is not used, the development language can be directly determined by the file extension, while the language version is determined by language features. Language features for different programming language versions are stored in the data warehouse. To determine the specific version, a default version is first configured for each scanned programming language, which is relatively popular in its field. For example, the default configuration for Java is 8, and for PHP is 7.4. Then, the version of each programming language is scanned in descending order based on its version features. When a new feature is detected, the language version value is updated until the feature scan is complete.

[0066] Specifically, with respect to development framework identification, a development framework identification component is used to identify the type of development framework used by the network application file to be detected, based on the third feature information corresponding to the development framework; the third feature information includes framework fingerprint features corresponding to different development frameworks. Specifically, using the development framework identification component to identify the type of development framework used by the network application file to be detected includes: importing the relevant files of the development framework locally, and comparing the relevant files based on the framework fingerprint features to identify the type of development framework used by the network application file to be detected; the framework fingerprint features include the framework's keyword features, version features, and version package.

[0067] Understandably, the software framework identification component primarily identifies the development framework used in web applications, which influences the subsequent selection of intrinsic security retrofit toolkits. Taking Java frameworks as an example, there are multiple frameworks, including SSM, MyBatis, Spring, and Hibernate. Because each framework has a different development style, their code structures also differ to some extent. In the MyBatis framework, SQL statements are primarily concentrated in XML files; whereas, in database access interfaces using JDBC, SQL statements are distributed across multiple files. Because SQL statement heterogeneity processing tools handle MyBatis and JDBC differently, they must be handled by the corresponding tool based on the specific software framework. When a project uses a package manager, parsing and identification can be performed directly on the files of different package managers. When a package manager is not used, feature scanning is required for the application source code. For Web front-end frameworks, programmers will download or directly reference the js and css files of external frameworks remotely, and use script tags in HTML files to introduce them, parse the names and contents of the introduced files, and avoid the files written by the programmers themselves from disrupting the analysis. For Web back-end frameworks, each back-end language has its own characteristics, but the basic ideas are similar. When a package manager is not used, if a framework is used, the relevant files of the framework need to be imported locally. For example, Java projects need to introduce relevant jar packages into the project folder, and PHP projects need to introduce relevant PHP files into the local folder, etc. Therefore, the framework fingerprint features are obtained from the data warehouse for determination.

[0068] Specifically, with respect to database identification, based on the fourth characteristic information corresponding to the database, a database identification component is used to identify the database type and database-related connection information used by the network application file to be detected; the fourth characteristic information includes database characteristic information related to intrinsic security modification. Specifically, the use of the database identification component to identify the database type and database-related connection information used by the network application file to be detected includes: parsing the target subfile in the network application file to be detected to obtain the database type and database-related connection information used by the network application file to be detected; or performing regular expression matching on the source code of the network application file to be detected based on the database characteristic information to determine the database type and database-related connection information used by the network application file to be detected.

[0069] Understandably, the database identification component primarily analyzes and determines the database type used in web applications and identifies mechanisms that influence inherent security modifications. This is because even within the same framework, different databases may have different mimetic adaptation methods. Specifically, it identifies the database type and related connection information (database connection IP, port, user, password, and database name). This information follows a standard configuration process based on the framework used. For example, the Java Spring Boot framework configures this information in the application.yml or application.properties file. While the specific file names may vary, the general file extension remains consistent. Other programming language frameworks also declare this information in the relevant YAML-formatted configuration files, allowing for easy parsing of the different files. For applications that do not use this file, a predefined rule configuration is used to perform pattern matching on database features in the data warehouse. This regular feature pattern matches the database type and related connection information using database configuration parameters, database operation statements, and SQL keywords. Furthermore, it matches specific components within the database according to the relevant rules, providing reference information for subsequent database inherent security modifications. Specifically, the module scans the application source code and the SQL scripts involved in the source code to determine whether the application has configured a database read-write separation mechanism at the application layer, and whether logical code blocks such as stored procedures, triggers, and scheduled tasks are written in the code or scripts.

[0070] Specifically, with respect to third-party component identification, the third-party components used in the network application file to be detected are identified using a third-party component identification component based on the fifth characteristic information corresponding to the third-party components; the fifth characteristic information includes component fingerprint characteristics corresponding to various types of third-party components. Specifically, the third-party component identification component identification method includes: comparing the network application file to be detected based on the component fingerprint characteristics to identify the type of third-party component used in the network application file to be detected; the component fingerprint characteristics include the component's keyword characteristics, version characteristics, and version package.

[0071] It is understandable that the third-party component identification component primarily analyzes and identifies third-party components used in web applications, similar to the software framework identification module. However, this module has a different role in subsequent intrinsic security modifications. For applications referencing third-party libraries written in Python, PHP, JS, etc., when the requested web page contains keywords contained in third-party libraries, such as JS scripts, intrinsic security modifications are still required; otherwise, normal execution may not occur. Based on the framework, third-party components or library dependencies are used in a wider range of applications. Furthermore, frameworks are also a type of third-party component, so similar detection logic is used as for software frameworks. When using a package manager, relevant third-party components and dependencies are parsed from different types of package manager files. When not using a package manager, the fingerprint features of different components in the data warehouse are used for matching analysis.

[0072] Regarding content management system (CMS) identification, the content management system identification component is used to identify whether the network application file to be detected is built based on the content management system based on the sixth characteristic information corresponding to the content management system. The sixth characteristic information includes system fingerprint characteristics corresponding to various content management systems. Specifically, using the content management system identification component to identify whether the network application file to be detected is built based on the content management system includes: comparing the network application file to be detected based on the system fingerprint characteristics to determine whether the network application file to be detected is built based on the content management system. The system fingerprint characteristics include keyword characteristics, version characteristics, and version package characteristics of the content management system.

[0073] It is understandable that the CMS identification component is primarily used to analyze whether a web application is a mature CMS system on the market or a secondary development project based on that system. This is because, in addition to applications written by programmers themselves, the CMS content management system is a website management system based on efficient, powerful technology and complete functions. It has strong scalability, a high degree of modularity, and can freely block functional models that are not currently used. The inherent security transformation is based on the mature adaptation methods of popular and common CMS on the market. Therefore, CMS application identification will significantly reduce the subsequent workload. The identification process mainly obtains CMS fingerprint features from the data warehouse. CMS fingerprint features include CMS keyword features, version features, version, and the hash value of the file relative to the root path. The fingerprint traversal of the application is performed to determine whether it is an existing CMS.

[0074] Regarding the identification of the preset target component, based on the seventh characteristic information corresponding to the preset target component, a preset target component identification component is used to identify whether the network application file to be detected contains the preset target component; the seventh characteristic information includes a component characteristic of the preset target component related to the intrinsic security modification. Specifically, the identification of whether the network application file to be detected contains the preset target component using the preset target component identification component includes: comparing the network application file to be detected based on the component characteristic of the preset target component to determine whether the network application file to be detected contains the preset target component.

[0075] It is understood that the preset target component identification component primarily analyzes and identifies random component fragments that may affect intrinsic security modifications. Preset target components include, but are not limited to, scheduled tasks involved in application code, storage formats for uploaded files in the application, distributed user session sharing, user login method identification, website random data identification, application external link requests, and verification code functions. These have a significant impact on the subsequent modification process and require identification and feedback. The identification process obtains rule features from the data warehouse, performs file content matching, and records the identified fragments or code blocks.

[0076] In some embodiments, after obtaining the intrinsic security component identification result corresponding to the network application file to be detected, the method further includes: associating the hash value of the network application file to be detected and the intrinsic security component identification result and storing them in a data warehouse, so that when a new network application file to be detected is received, it is first checked whether a corresponding intrinsic security component identification result already exists. That is, based on the hash value of the file, analysis information is obtained from the data warehouse, which can improve the identification efficiency when analyzing the same project application package. In addition, the hash value stored in the data warehouse and the hash value generation algorithm at runtime can be replaced. That is, the use of hash values ​​is only a means to ensure the uniqueness of data, and other methods that can achieve uniqueness verification are also acceptable.

[0077] As can be seen from the above, in this embodiment, feature information corresponding to each detection type preset for intrinsic security is obtained; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; the network application file to be detected is obtained, and the identification component corresponding to each detection type is called from the pre-built rule recognition engine; based on the feature information corresponding to the detection type, the identification component corresponding to each detection type is used to perform component identification on the network application file to be detected, so as to obtain the first intrinsic security component identification result corresponding to the network application file to be detected. It can be seen that the component identification of the application from the aspects of programming language, third-party component, development framework, content management system, project structure, preset target component, and database has a wider range of application components and can cover the scope involved in intrinsic security transformation to meet the needs of subsequent intrinsic security transformation; and by obtaining the feature information of each detection type, the recognition component pre-built for each detection type is used to perform component identification under the corresponding detection type, thereby improving the accuracy and efficiency of identification.

[0078] This application embodiment discloses a specific method for identifying endogenous security components of network applications. Figure 3 As shown, the method may include the following steps:

[0079] Step S21: Obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party components, development framework, content management system, project structure, preset target components, and database.

[0080] Step S22: obtaining the network application file to be detected, and calling the recognition component corresponding to each detection type from the pre-built rule recognition engine.

[0081] Step S23: Based on the feature information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0082] Step S24: Utilize the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result.

[0083] Specifically, before using the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result, it also includes: obtaining a component identification instruction; the component identification instruction includes a first identification instruction based on the rule identification engine, and a second identification instruction based on the rule identification engine and the intelligent analysis engine; if the component identification instruction is the second identification instruction, then using the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result.

[0084] For example Figure 4 As shown, when the user requires a basic operating mode, a first identification instruction is issued, and a rule analysis engine is used for component identification. When the user requires a high-precision operating mode, a second identification instruction is issued, which uses a rule analysis engine combined with an intelligent analysis engine for component identification. The intelligent analysis engine internally includes a programming language syntax parser and a component analysis model. The programming language syntax parser includes parsers for different languages ​​(such as JAVA, GO, Python, PHP, Ruby, etc.), and is primarily used to address the shortcomings of the rule recognition engine in determining programming languages ​​based on file extensions. This is because malicious files may exist, and their content may not match the file extension. In this case, the programming language parser can perform normal identification, while rule-based identification is inaccurate, affecting the analysis effect. The component analysis model is a machine learning model trained based on different types of feature data in the data warehouse. It can assist in determining component features in web applications.

[0085] Step S25: Based on the first intrinsic security component identification result and the second intrinsic security component identification result, a final intrinsic security component identification result of the network application file to be detected is obtained.

[0086] Specifically, the first and second intrinsic security component identification results are scanned and compared. Considering that rule-based identification results can contain a variety of false positives, such as when determining programming language categories based solely on file suffixes, or when random factors in special component identification can lead to the identification of comment-like code blocks, in the event of discrepancies between the two results, the intelligent analysis engine's results are used as the primary basis. Both results are recorded for manual analysis and verification by administrators. If any analysis errors are found, adjustments can be made to the model.

[0087] Among them, regarding the specific process of the above steps S21 to S23, reference can be made to the corresponding content disclosed in the above embodiments, and no further details will be given here.

[0088] As can be seen above, in this embodiment, the intelligent analysis engine is used to perform component identification on the network application file to be tested to obtain a second intrinsic security component identification result. Based on the first and second intrinsic security component identification results, a final intrinsic security component identification result for the network application file to be tested is obtained. By introducing an intelligent analysis engine and comparing the output results with those of a traditional rule-based recognition engine, the accuracy of component analysis is further improved and a reference for correcting the model when inconsistent results occur.

[0089] Correspondingly, the present application embodiment also discloses a network application endogenous security component identification system, see Figure 5 As shown, the system includes: a monitoring and acquisition module, a data warehouse, a preprocessing module, an intelligent analysis engine, a rule recognition engine, and a result output module.

[0090] The above-mentioned monitoring and collection module is used to monitor the Internet and collect first target information based on monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems.

[0091] The aforementioned data warehouse is used to store feature information corresponding to each detection type and system operation data records. Feature information consists of two parts: one is information about programming languages, third-party components, development frameworks, CMS applications, and version updates obtained from the internet by the monitoring and acquisition module; the other is input information about project structure, special components, and database components. Simultaneously, this feature information is input as a data source into the intelligent analysis engine for model training and analysis. System operation data records primarily record the final results of user scan analysis, facilitating rapid analysis of identical project files.

[0092] The above-mentioned preprocessing module is used to preprocess the network application file to be detected and determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions; if the detection conditions are met, the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine is executed.

[0093] The above-mentioned rule recognition engine needs to read the feature information in the data warehouse and call different internal components to perform rule recognition and analysis, including project structure recognition component, programming language recognition component, software framework recognition component, database recognition component, third-party component recognition component, CMS application recognition component, and special component recognition component.

[0094] The above-mentioned result output module is responsible for summarizing and outputting the results of the intrinsic security component analysis of the web application in XML, JSON and other formats according to the SBOM (Software Bill of Materials) standard. At the same time, the module will record the results in the data warehouse.

[0095] The system operation process is divided into a preparation phase and an operation phase. The preparation phase can be completed offline and primarily involves initializing data in the data warehouse and training the component analysis model. The data initialization source is information collected by the monitoring and acquisition module and the summary of rule features. Therefore, the monitoring and acquisition targets are first configured, such as release channels like software repositories and official websites. After parsing the configured targets and collecting rules, the module is started. The module collects information according to the rules, performs local analysis, and calculates the relevant hash values ​​before storing it in the data warehouse. Based on previous experience and summaries, engineers format the relevant recognition rule features and enter them into the data warehouse for model training and call-up by the rule recognition engine. Finally, a machine learning algorithm is used to train the rule features and related files to generate a component analysis model for call-up by the intelligent analysis engine.

[0096] During the operational phase, the entire system is started normally. Users upload web application packages requiring intrinsic security component analysis to the system, which then performs internal parsing on the server. The preprocessing module first performs a compliance check. If the package does not meet the parsable criteria or the parsing conditions are not met, a prompt message is returned, terminating the process. Once compliance is verified, the module calculates the hash values ​​of the application package and internal files, searches the data warehouse for records, and directly calls the data warehouse content if existing records exist, eliminating the need for secondary analysis and improving operational efficiency. When there are no scan records for related application packages and files, the system enters internal analysis mode and performs scan analysis based on the currently configured operating mode. When using the basic operating mode, because there is no dependency between the analysis module and the analysis file, the system directly runs all analysis components in the rule recognition engine concurrently, which can maximize the use of server resources and improve the efficiency of scanning and analysis. After the analysis is completed, the results are output and the data warehouse content is updated. When using the high-precision operating mode, the system concurrently runs the intelligent analysis engine and the rule recognition engine to analyze the target. After the scan is completed, the results of the two are compared and analyzed. If the results are consistent, they are output and recorded in the data warehouse. If the results are inconsistent, the intelligent analysis engine results are mainly output, and the differences are recorded in the database for the administrator's subsequent analysis. In addition, during the operation of the system, the monitoring and collection module works continuously and independently, which is not reflected in the process. This module will continuously monitor the update status of the collection target. When an update occurs, the data warehouse content will be updated according to the rules or the administrator will be notified to perform manual analysis.

[0097] Correspondingly, the embodiment of the present application also discloses a device for identifying endogenous security components of network applications, see Figure 6 As shown, the device includes:

[0098] A feature information acquisition module 11 is used to acquire feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database;

[0099] The file acquisition module 12 is used to obtain the network application file to be detected and call the recognition component corresponding to each detection type from the pre-built rule recognition engine;

[0100] The component identification module 13 is configured to perform component identification on the network application file to be detected based on the feature information corresponding to the detection type and using the identification components corresponding to each detection type to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

[0101] As can be seen from the above, in this embodiment, feature information corresponding to each detection type preset for intrinsic security is obtained; the detection type includes any one or more of programming language, third-party component, development framework, content management system, project structure, preset target component, and database; the network application file to be detected is obtained, and the identification component corresponding to each detection type is called from the pre-built rule recognition engine; based on the feature information corresponding to the detection type, the identification component corresponding to each detection type is used to perform component identification on the network application file to be detected, so as to obtain the first intrinsic security component identification result corresponding to the network application file to be detected. It can be seen that the component identification of the application from the aspects of programming language, third-party component, development framework, content management system, project structure, preset target component, and database has a wider range of application components and can cover the scope involved in intrinsic security transformation to meet the needs of subsequent intrinsic security transformation; and by obtaining the feature information of each detection type, the component identification under the corresponding detection type is performed using the identification component pre-built for each detection type, thereby improving the accuracy and efficiency of component identification.

[0102] In some specific embodiments, the feature information acquisition module 11 may specifically include:

[0103] A first target information acquisition unit is configured to monitor the Internet and collect first target information according to monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems;

[0104] A second target information acquisition unit is configured to acquire second target information generated based on experience; the second target information includes a project structure, preset target components, and parameter information corresponding to the database;

[0105] A feature information determining unit is configured to obtain feature information corresponding to each detection type based on the first target information and the second target information.

[0106] In some specific embodiments, the network application endogenous security component identification device may specifically include:

[0107] a preprocessing unit, configured to preprocess the network application file to be detected before calling the recognition component corresponding to each detection type from the pre-built rule recognition engine, and determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions;

[0108] The execution unit is configured to execute the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine if the detection condition is met.

[0109] In some specific embodiments, the network application endogenous security component identification device may specifically include:

[0110] The storage unit is configured to associate and store the hash value of the network application file to be detected and the intrinsic security component identification result after obtaining the intrinsic security component identification result corresponding to the network application file to be detected, so that when a new network application file to be detected is received, it is first checked whether the corresponding intrinsic security component identification result already exists.

[0111] In some specific embodiments, the component identification module 13 may specifically include:

[0112] a first component identification unit configured to identify, based on first feature information corresponding to the project structure, whether the network application file to be detected uses a package manager using a project structure identification component, and to determine a project development type corresponding to the network application file to be detected; the project development types include front-end projects, back-end projects, and hybrid projects; the first feature information includes front-end and back-end package manager file name information, front-end and back-end separation feature information, and front-end and back-end hybrid feature information;

[0113] a second component identification unit configured to identify, using a programming language identification component, a development language and a language version corresponding to the network application file to be detected based on second characteristic information corresponding to the programming language; the second characteristic information including language characteristics corresponding to different versions of the programming language;

[0114] a third component identification unit, configured to identify the type of development framework used by the network application file to be detected using a development framework identification component based on third feature information corresponding to the development framework; the third feature information includes framework fingerprint features corresponding to different development frameworks;

[0115] a fourth component identification unit, configured to identify, using a database identification component, a database type and database-related connection information used by the network application file to be detected based on fourth characteristic information corresponding to the database; the fourth characteristic information includes database characteristic information related to intrinsic security transformation;

[0116] a fifth component identification unit, configured to identify the third-party components used by the network application file to be detected by using the third-party component identification component based on fifth feature information corresponding to the third-party components; the fifth feature information including component fingerprint features corresponding to various types of third-party components;

[0117] a sixth component identification unit, configured to identify, based on sixth characteristic information corresponding to the content management system, using a content management system identification component, whether the network application file to be detected is constructed based on the content management system; the sixth characteristic information includes system fingerprint characteristics corresponding to various content management systems;

[0118] The seventh component identification unit is used to identify whether the network application file to be detected contains the preset target component based on the seventh characteristic information corresponding to the preset target component using the preset target component identification component; the seventh characteristic information includes the component characteristics of the preset target component related to the intrinsic security transformation.

[0119] In some specific embodiments, the network application endogenous security component identification device may specifically include:

[0120] An instruction acquisition unit, configured to acquire a component identification instruction; the component identification instruction includes a first identification instruction based on the rule identification engine, and a second identification instruction based on the rule identification engine and the intelligent analysis engine;

[0121] an intelligent identification unit, configured to, if the component identification instruction is the second identification instruction, use the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsically secure component identification result;

[0122] The intrinsic security component identification result determining unit is configured to obtain a final intrinsic security component identification result of the network application file to be detected based on the first intrinsic security component identification result and the second intrinsic security component identification result.

[0123] In some specific embodiments, the intelligent analysis engine includes a programming language syntax parser and a component analysis model; the programming language syntax parser is used to identify the network application file to be detected to identify the programming language, and the component analysis model is used to identify third-party components, development frameworks, content management systems, project structures, preset target components, and databases; the component analysis model is obtained after being pre-trained with feature information corresponding to the detection type.

[0124] Furthermore, the present application also discloses an electronic device, see Figure 7 The contents in the drawings should not be considered as any limitation on the scope of use of the present application.

[0125] Figure 7 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the method for identifying inherent security components in network applications disclosed in any of the aforementioned embodiments.

[0126] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0127] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223 including feature information, etc. The storage method can be temporary storage or permanent storage.

[0128] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, so as to enable the processor 21 to calculate and process the massive amount of data 223 in the memory 22. The operating system 221 can be Windows Server, NetWare, Unix, Linux, etc. In addition to including a computer program capable of implementing the method for identifying inherent security components of network applications executed by the electronic device 20 as disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0129] Furthermore, an embodiment of the present application also discloses a computer storage medium, in which computer executable instructions are stored. When the computer executable instructions are loaded and executed by a processor, the steps of the method for identifying intrinsic security components of network applications disclosed in any of the aforementioned embodiments are implemented.

[0130] Furthermore, an embodiment of the present application also discloses a computer program product, which includes computer instructions. When the computer instructions are loaded and executed by a processor, the steps of the method for identifying endogenous security components of network applications disclosed in any of the aforementioned embodiments are implemented.

[0131] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0132] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0133] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0134] The above is a detailed introduction to the method, device, equipment and storage medium for identifying intrinsic security components of network applications provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for identifying inherent security components of network applications, characterized by: include: Obtaining feature information corresponding to each detection type preset for intrinsic security; the detection type may include any one or more of programming language, third-party components, development framework, content management system, project structure, preset target components, and database; Obtain the network application file to be detected, and call the recognition component corresponding to each detection type from the pre-built rule recognition engine; Based on the feature information corresponding to the detection type, the identification components corresponding to each detection type are used to perform component identification on the network application file to be detected, so as to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

2. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: The obtaining of feature information corresponding to each detection type preset for intrinsic security includes: Monitor the Internet and collect first target information based on monitoring rules for intrinsic security; the first target information includes parameter information corresponding to programming languages, third-party components, development frameworks, and content management systems; Acquire second target information generated based on experience; the second target information includes project structure, preset target components, and parameter information corresponding to the database; Feature information corresponding to each detection type is obtained based on the first target information and the second target information.

3. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: Before calling the recognition component corresponding to each detection type from the pre-built rule recognition engine, the method further includes: Preprocessing the network application file to be detected to determine whether the network application file to be detected meets the detection conditions; the detection conditions include type conditions and file size conditions; If the detection condition is met, the operation of calling the recognition component corresponding to each detection type from the pre-built rule recognition engine is executed.

4. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: After obtaining the intrinsic security component identification result corresponding to the network application file to be detected, the method further includes: The hash value of the network application file to be detected and the intrinsic security component identification result are associated and stored, so that when a new network application file to be detected is received, it is first checked whether a corresponding intrinsic security component identification result already exists.

5. The method for identifying endogenous security components of network applications according to claim 1, characterized in that: The performing component identification on the to-be-detected network application file based on the feature information corresponding to the detection type and using the identification components corresponding to each detection type includes: Based on the first characteristic information corresponding to the project structure, using the project structure identification component to identify whether the network application file to be detected uses a package manager, and determining the project development type corresponding to the network application file to be detected; the project development type includes front-end project, back-end project, and hybrid project; the first characteristic information includes front-end and back-end package manager file name information, front-end and back-end separation characteristic information, and front-end and back-end hybrid characteristic information; Based on second characteristic information corresponding to the programming language, using a programming language identification component to identify the development language and language version corresponding to the network application file to be detected; the second characteristic information includes language characteristics corresponding to different versions of the programming language; Based on the third feature information corresponding to the development framework, using the development framework identification component to identify the type of development framework used by the network application file to be detected; the third feature information includes framework fingerprint features corresponding to different development frameworks; Based on fourth characteristic information corresponding to the database, using a database identification component to identify the database type and database-related connection information used by the network application file to be detected; the fourth characteristic information includes database characteristic information related to intrinsic security transformation; Based on the fifth characteristic information corresponding to the third-party components, using the third-party component identification component, identifying the third-party components used by the network application file to be detected; the fifth characteristic information includes component fingerprint features corresponding to various types of third-party components; Based on sixth characteristic information corresponding to the content management system, using a content management system identification component to identify whether the network application file to be detected is constructed based on the content management system; the sixth characteristic information includes system fingerprint characteristics corresponding to various content management systems; Based on the seventh characteristic information corresponding to the preset target component, a preset target component identification component is used to identify whether the network application file to be detected contains the preset target component; the seventh characteristic information includes component characteristics of the preset target component related to intrinsic security transformation.

6. The method for identifying endogenous security components of network applications according to any one of claims 1 to 5, characterized in that: Also includes: Obtaining a component identification instruction; the component identification instruction includes a first identification instruction based on the rule identification engine, and a second identification instruction based on the rule identification engine and the intelligent analysis engine; If the component identification instruction is the second identification instruction, using the intelligent analysis engine to perform component identification on the network application file to be detected to obtain a second intrinsic security component identification result; Based on the first intrinsic security component identification result and the second intrinsic security component identification result, a final intrinsic security component identification result of the network application file to be detected is obtained.

7. The method for identifying endogenous security components of network applications according to claim 6, characterized in that: The intelligent analysis engine includes a programming language syntax parser and a component analysis model; the programming language syntax parser is used to identify the programming language of the network application file to be detected, and the component analysis model is used to identify three-party components, development frameworks, content management systems, project structures, preset target components, and databases; The component analysis model is obtained after being pre-trained with feature information corresponding to the detection type.

8. A device for identifying endogenous security components of network applications, characterized in that: include: A feature information acquisition module is used to obtain feature information corresponding to each detection type preset for intrinsic security; the detection type includes any one or more of programming language, third-party components, development framework, content management system, project structure, preset target components, and database; A file acquisition module is used to acquire the network application file to be detected and call the recognition component corresponding to each detection type from the pre-built rule recognition engine; The component identification module is used to perform component identification on the network application file to be detected based on the feature information corresponding to the detection type and respectively use the identification components corresponding to each detection type to obtain a first intrinsic security component identification result corresponding to the network application file to be detected.

9. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method for identifying intrinsic security components of network applications as claimed in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the method for identifying endogenous security components of network applications as described in any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that Used to store computer programs; wherein when the computer programs are executed by a processor, the method for identifying endogenous security components of network applications as described in any one of claims 1 to 7 is implemented.

Images