Application logic vulnerability detection method

Abstract

The invention discloses an application logic vulnerability detection method, which comprises the following steps of: statically analyzing a source code of an application program, and constructing a business flow chart of the application program based on each business module of the application program and a calling relationship among the business modules; the method comprises the following steps of: extracting flow structure features of a business flow chart of an application program by adopting an artificial intelligence technology based on deep learning, capturing deep semantic association between nodes and edges in the business flow chart, and mining global context association information of the business flow chart, so as to intelligently identify whether the application program has security vulnerabilities or not. In this way, the accuracy and efficiency of application logic vulnerability detection can be effectively improved, and the probability of false report and missing report is reduced.

Description

Technical Field

[0001] The present application relates to the field of intelligent detection, and more specifically, to an application logic vulnerability detection method. Background Art

[0002] With the development of information technology, software systems have become increasingly complex, and their security has received more and more attention. Logical vulnerabilities in applications refer to unexpected behavior patterns caused by design or implementation defects. Such vulnerabilities are often exploited by malicious users to perform unauthorized operations, such as data tampering, privilege escalation, etc., thus posing a serious threat to system security.

[0003] At present, the security testing of applications mainly relies on code review, dynamic testing (such as penetration testing) and static analysis. Code review mainly relies on manual inspection of the code line by line. Although it has high accuracy, it is inefficient and easily affected by human factors. Although dynamic testing can find problems at runtime, it takes a long time and is difficult to cover all possible attack paths, and the detection effect of logical vulnerabilities is limited. Static code analysis identifies potential security issues by scanning the source code without executing the code. It has the advantages of high automation and fast detection speed. However, although the traditional static analysis method can improve efficiency to a certain extent, it is often difficult to accurately capture complex business logic errors and global context association information in the source code because it mainly relies on rule matching for vulnerability detection, and is prone to false positives and false negatives.

[0004] Therefore, an optimized application logic vulnerability detection method is expected. Summary of the invention

[0005] In order to solve the above technical problems, this application is proposed. The embodiment of the present application provides an application logic vulnerability detection method, which constructs a business process diagram of the application based on the various business modules of the application and the calling relationship between them by statically analyzing the source code of the application, and uses artificial intelligence technology based on deep learning to extract process structure features of the business process diagram of the application, capture the deep semantic associations between nodes and edges in the business process diagram, and mine the global context association information of the business process diagram, so as to intelligently identify whether the application has security vulnerabilities. In this way, the accuracy and efficiency of application logic vulnerability detection can be effectively improved, and the probability of false positives and false negatives can be reduced.

[0006] According to one aspect of the present application, a method for detecting application logic vulnerabilities is provided, which includes:

[0007] Get the source code of the instrumented application;

[0008] Based on the source code of the detected application, construct a business process diagram of the detected application;

[0009] Extracting process structure features from the business process diagram of the detected application to obtain a business process structure feature diagram of the application;

[0010] Performing feature decoupling and feature association optimization on the application business process structure feature graph to obtain a sequence of application business process optimization local structure feature vectors;

[0011] Based on the global context semantic association features of the sequence of local structural feature vectors optimized by the application business process, it is determined whether there is a security vulnerability.

[0012] Compared with the prior art, the present application provides an application logic vulnerability detection method, which constructs a business process diagram of the application based on the various business modules of the application and their calling relationships by statically analyzing the source code of the application, and uses artificial intelligence technology based on deep learning to extract process structure features of the business process diagram of the application, captures the deep semantic associations between nodes and edges in the business process diagram, and mines the global context association information of the business process diagram, so as to intelligently identify whether the application has security vulnerabilities. In this way, the accuracy and efficiency of application logic vulnerability detection can be effectively improved, and the probability of false positives and false negatives can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0014] Figure 1 is a flow chart of an application logic vulnerability detection method according to an embodiment of the present application;

[0015] Figure 2 A data flow diagram of an application logic vulnerability detection method according to an embodiment of the present application;

[0016] Figure 3 is a flowchart of sub-step S4 of the application logic vulnerability detection method according to an embodiment of the present application;

[0017] Figure 4 This is a flowchart of sub-step S5 of the application logic vulnerability detection method according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0019] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0020] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0021] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0022] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0023] At present, the security testing of applications mainly relies on code review, dynamic testing (such as penetration testing) and static analysis. Code review mainly relies on manual inspection of the code line by line. Although it has high accuracy, it is inefficient and easily affected by human factors. Although dynamic testing can find problems at runtime, it takes a long time and is difficult to cover all possible attack paths, and the detection effect of logical vulnerabilities is limited. Static code analysis identifies potential security issues by scanning the source code without executing the code. It has the advantages of high automation and fast detection speed. However, although the traditional static analysis method can improve efficiency to a certain extent, it is often difficult to accurately capture complex business logic errors and global context association information in the source code because it mainly relies on rule matching for vulnerability detection, and is prone to false positives and false negatives. Therefore, an optimized application logic vulnerability detection method is expected.

[0024] In the technical solution of the present application, a method for detecting application logic vulnerabilities is proposed. Figure 1 The present invention is a flowchart of an application logic vulnerability detection method according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of the application logic vulnerability detection method according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to the application logic vulnerability detection method of the embodiment of the present application, the steps include: S1, obtaining the source code of the detected application; S2, constructing the business process diagram of the detected application based on the source code of the detected application; S3, extracting the process structure features of the business process diagram of the detected application to obtain the application business process structure feature diagram; S4, performing feature decoupling and feature association optimization on the application business process structure feature diagram to obtain a sequence of application business process optimization local structure feature vectors; S5, determining whether there is a security vulnerability based on the global context semantic association features of the sequence of the application business process optimization local structure feature vectors.

[0025] In particular, the S1 obtains the source code of the detected application. It should be understood that the source code is the most basic and direct form of expression of the application, which contains all the logic, structure and data processing methods of the program. By performing semantic analysis on the source code, the operating mechanism of the application can be accurately understood, including its business logic, data processing flow, interaction relationship between modules, etc., which helps to identify potential security vulnerabilities therein.

[0026] In particular, S2 constructs a business process diagram of the detected application based on the source code of the detected application. In order to better understand the business logic and data processing flow of the application, in the technical solution of the present application, a business process diagram is further constructed based on the source code of the detected application, so as to more clearly display the calling relationship and data flow between various business modules. That is, by analyzing the function calls, data flows and interactions between modules in the source code, the business logic of the application is abstracted into a directed graph, in which the nodes represent the various operations or modules in the business process, and the edges represent the calling relationship or data flow between modules. In this way, complex business logic can be converted into a visual graphical representation, thereby providing more intuitive basic data for subsequent vulnerability detection.

[0027] In particular, the S3 extracts the process structure features of the business process diagram of the detected application to obtain the application business process structure feature diagram. In a specific example of the present application, the business process diagram of the detected application is input into the GRCNN model to obtain the application business process structure feature diagram. In order to adapt to the graph structure data form of the business process diagram and effectively extract the structural information of the business process from it, the present application adopts the GRCNN (Graph Convolutional Neural Network) model to process the business process diagram of the detected application. The GRCNN model is a deep learning model specifically for graph structure data, which can effectively identify the nodes and edges in the flowchart, such as the start node, end node, conditional judgment node, loop node and arrows, lines and other connection relationships between each node in the flowchart, and can capture the complex associations between nodes and edges through graph convolution operations, and encode each node and its related edges into a feature vector with rich semantic information, and then combine them into an application business process structure feature diagram.

[0028] In particular, the step S4 performs feature decoupling and feature association optimization on the application business process structure feature graph to obtain a sequence of application business process optimization local structure feature vectors. In particular, in a specific example of the present application, Figure 3 As shown, S4 includes: S41, feature decoupling the application business process structure feature graph to obtain a sequence of application business process local structure feature vectors; S42, inputting the sequence of application business process local structure feature vectors into a feature association optimization network based on intra-distribution correlation awareness to obtain a sequence of application business process optimized local structure feature vectors.

[0029] Specifically, the S41 performs feature decoupling on the application business process structure feature graph to obtain a sequence of local structure feature vectors of the application business process. Considering that the application business process structure feature graph contains a large number of node features and edge features, there may be redundancy and correlation between these features. In order to further extract and optimize the feature representation of the application business process structure, the present application uses feature decoupling technology to process the application business process structure feature graph, decomposing it into a sequence of local structure feature vectors of the application business process, thereby effectively separating the features of each node and edge of the business process graph, which helps to analyze and understand the local structural features in the business process in more detail. It is worth mentioning that feature decoupling refers to the process of decomposing a complex feature into multiple simpler and more independent features, and its purpose is to decompose complex features into a set of simpler basic features that are independent of each other or loosely coupled. Feature decoupling is an important concept in machine learning and deep learning because it can improve the interpretability, robustness and performance of the model.

[0030] Specifically, in S42, the sequence of local structural feature vectors of the application business process is input into a feature association optimization network based on distribution-internal association perception to obtain a sequence of optimized local structural feature vectors of the application business process. Since the local structural feature vectors of each application business process are feature representations of nodes or edges in the business process graph, there is an inherent correlation therein. In order to effectively mine and utilize this correlation to optimize the representation of each local structural feature vector, so that it more accurately reflects its actual significance in the business process, thereby improving the accuracy of subsequent analysis, the present application introduces a feature association optimization network based on distribution-internal association perception to optimize the sequence of local structural feature vectors of the application business process. Specifically, the network first quantifies the similarity or difference between any two local structural feature vectors of the application business process by calculating the semantic association between them, so as to understand the semantic structure within the sequence and generate a set of semantic association score vectors. Then, the aggregate information of the set of semantic association score vectors is used as the overall context information to calculate the association optimization factor of each local structural feature vector of the application business process, and quantitatively describe the consistency or deviation between the local structural features of each business process and the overall semantic structure of the sequence, so as to serve as a guide for feature association optimization. Furthermore, after normalizing the associated optimization factors, they are used as weight coefficients to perform weighted optimization on the sequence of local structural feature vectors of the application business process to obtain a sequence of application business process optimized local structural feature vectors, thereby improving the accuracy and relevance of feature representation.

[0031] In an embodiment of the present application, the sequence of local structure feature vectors of the application business process is input into a feature association optimization network based on distributional intra-correlation awareness to obtain a sequence of local structure feature vectors of the application business process optimization, including: calculating the semantic association score vector between any two local structure feature vectors of the application business process in the sequence of local structure feature vectors of the application business process to obtain a sequence of local structure semantic association score vectors of the application business process; based on the sequence of local structure semantic association score vectors of the application business process, calculating a global representation vector of sequence endogenous correlation; based on the global representation vector of sequence endogenous correlation, calculating the association optimization factor of each local structure feature vector of the application business process in the sequence of local structure feature vectors of the application business process to obtain a sequence of association optimization factors; inputting the sequence of association optimization factors into a Softmax activation function to obtain a sequence of association optimization weight factors; using each association optimization weight factor in the sequence of association optimization weight factors as a weight, weighting each local structure feature vector of the application business process in the sequence of local structure feature vectors of the application business process to obtain a sequence of local structure feature vectors of the application business process optimization.

[0032] Among them, the process of calculating the semantic association score vector between any two application business process local structure feature vectors in the sequence of application business process local structure feature vectors to obtain a sequence of application business process local structure semantic association score vectors includes: cascading any two application business process local structure feature vectors in the sequence of application business process local structure feature vectors and multiplying them by a weight coefficient matrix, and then dot-adding them with a bias vector to obtain the application business process local structure semantic association score vector.

[0033] More specifically, based on the sequence of local structure semantic association score vectors of the application business process, the process of calculating the global representation vector of the sequence intrinsic correlation includes: calculating the mean vector of the sequence of local structure semantic association score vectors of the application business process to obtain the global representation vector of the sequence intrinsic correlation.

[0034] More specifically, based on the global representation vector of the sequence's intrinsic correlation, the process of calculating the association optimization factor of each application business process local structure feature vector in the sequence of the application business process local structure feature vector to obtain a sequence of association optimization factors includes: multiplying the application business process local structure feature vector and the global representation vector of the sequence's intrinsic correlation by different weight coefficient vectors and then performing an addition operation to obtain a semantic association coefficient; adding a bias parameter to the semantic association coefficient and then passing it through a sigmoid activation function to obtain the association optimization factor.

[0035] In summary, in the above embodiment, the sequence of the local structure feature vectors of the application business process is input into the feature association optimization network based on distribution intra-correlation perception to obtain the sequence of the local structure feature vectors of the application business process optimization, including: processing the sequence of the local structure feature vectors of the application business process with the following semantic feature association optimization formula to obtain the sequence of the local structure feature vectors of the application business process optimization, wherein the semantic feature association optimization formula is:

[0036] X={x1,x2,...,x m}

[0037] r h =W h [x i ;x j ]+b h

[0038]

[0039] G i =Softmax[Sigmoid(M m R+H m x i +b m )]

[0040] {x′ i}={G i ·x i}

[0041] Where X represents the sequence of local structural feature vectors of the application business process, x1, x2, x i 、x j and x m denote the first, second, i-th, j-th and m-th local structure feature vectors of the application business process in the sequence of the local structure feature vectors of the application business process, respectively. The value of m is the number of feature vectors in the sequence of the local structure feature vectors of the application business process. [·,·] denotes a cascade operation. W h is the weight coefficient matrix, b h is the bias vector, r h is the hth application business process local structure semantic association score vector in the sequence of application business process local structure semantic association score vectors, the value of T is the number of vectors in the sequence of application business process local structure semantic association score vectors, R is the global representation vector of the endogenous correlation of the sequence, M m and H m Represent different weight coefficient vectors, bm is the bias parameter, Sigmoid is the sigmoid activation function, Softmax is the normalized exponential function, G i is the i-th correlation optimization factor, x′ i Represents the local structural feature vector of the i-th application business process optimization.

[0042] It is worth mentioning that in other specific examples of the present application, the application business process structure feature graph can also be feature decoupled and feature association optimized in other ways to obtain a sequence of application business process optimization local structure feature vectors, for example: first, use independent component analysis (ICA), principal component analysis (PCA), autoencoder or variational autoencoder (VAE) and other technologies to decompose the business process structure feature graph into multiple independent or loosely coupled features; wherein these decoupled features represent simpler basic features in the business process, such as activities, data flows, and decision points. Then, use correlation analysis, information gain, or mutual information and other techniques to quantify the correlation between features, and reorganize and group the features according to the correlation to optimize the correlation between features. Subsequently, the optimized feature association structure is represented as a sequence of application business process optimization local structure feature vectors to obtain a sequence of application business process optimization local structure feature vectors.

[0043] In particular, the S5 determines whether there is a security vulnerability based on the global context semantic association features of the sequence of local structure feature vectors optimized by the application business process. In particular, in a specific example of the present application, Figure 4 As shown, S5 includes: S51, performing global context semantic association encoding on the sequence of local structure feature vectors optimized for the application business process to obtain an application business process context semantic encoding feature vector; S52, inputting the application business process context semantic encoding feature vector into a classifier-based security vulnerability detection module to obtain a detection result, wherein the detection result is used to indicate whether there is a security vulnerability.

[0044] Specifically, the S51 performs global context semantic association encoding on the sequence of local structural feature vectors of the application business process optimization to obtain the application business process context semantic encoding feature vector. In a specific example of the present application, the sequence of local structural feature vectors of the application business process optimization is input into the application business process global context semantic association encoder based on the converter structure to obtain the application business process context semantic encoding feature vector. In order to achieve a complete understanding of the entire business process, it is necessary to comprehensively consider the overall context association information of the business process diagram. To this end, the present application further adopts the application business process global context semantic association encoder based on the converter structure to associate the sequence of local structural feature vectors of the application business process optimization. It should be known to those of ordinary skill in the art that the transformer structure is a deep learning model based on the self-attention mechanism, which can effectively capture the long-distance dependencies between the elements in the sequence and realize the extraction of global context information, so as to effectively mine the global associations between the local structural features in the business process diagram and generate a feature representation of the comprehensive global context information, i.e., the application business process context semantic encoding feature vector.

[0045] Specifically, in S52, the application business process context semantic encoding feature vector is input into a security vulnerability detection module based on a classifier to obtain a detection result, and the detection result is used to indicate whether there is a security vulnerability. In a specific example of the present application, first, the application business process context semantic encoding feature vector is fully connected encoded using multiple fully connected layers of the classifier to obtain an encoded classification feature vector; and then the encoded classification feature vector is passed through the Softmax classification function of the classifier to obtain the detection result.

[0046] That is, in the technical solution of the present application, the labels of the classifier include the existence of a security vulnerability (first label), and the absence of a security vulnerability (second label), wherein the classifier determines to which classification label the semantic encoding feature vector of the application business process context belongs through a soft maximum function. It is worth noting that the first label p1 and the second label p2 here do not contain artificially set concepts. In fact, during the training process, the computer model does not have the concept of "whether there is a security vulnerability". It only has two classification labels and the probability of the output feature under these two classification labels, that is, the sum of p1 and p2 is one. Therefore, the classification result of whether there is a security vulnerability is actually converted from the classification label to a binary classification class probability distribution that conforms to the laws of nature. In essence, the physical meaning of the natural probability distribution of the label is used, rather than the linguistic text meaning of "whether there is a security vulnerability".

[0047] It is worth mentioning that a classifier refers to a machine learning model or algorithm that is used to classify input data into different categories or labels. Classifiers are part of supervised learning and perform classification tasks by learning the mapping relationship from input data to output categories. A fully connected layer is a common type of layer in a neural network. In a fully connected layer, each neuron is connected to all neurons in the previous layer, and each connection has a weight. This means that each neuron in a fully connected layer receives inputs from all neurons in the previous layer, and sums these inputs by weights before passing the result to the next layer. The Softmax classification function is a commonly used activation function for multi-classification problems. It converts each element of the input vector into a probability value between 0 and 1, and the sum of these probability values ​​is equal to 1. The Softmax function is often used in the output layer of a neural network, especially for multi-classification problems, because it can map the network output to the probability distribution of each category. During the training process, the output of the Softmax function can be used to calculate the loss function and update the network parameters through the back-propagation algorithm. It is worth noting that the output of the Softmax function does not change the relative size relationship between the elements, but only normalizes them. Therefore, the Softmax function does not change the characteristics of the input vector, but only converts it into a probability distribution form.

[0048] Preferably, in the technical solution of the present application, the sequence of local structural feature vectors of the application business process represents the node feature vector or edge feature vector of the business process graph of the detected application. When the sequence of local structural feature vectors of the application business process is input into the feature association optimization network based on the sequence intrinsic correlation measurement, the feature association optimization network based on the sequence intrinsic correlation measurement improves the feature expression semantic association accuracy of each node feature vector or edge feature vector by quantitatively measuring the semantic association between each application business process local structural feature vector in the sequence of local structural feature vectors of the application business process, but this will also cause each application business process optimization local structural feature vector in the sequence of the application business process optimization local structural feature vector to have feature expression information overflow. Therefore, when the sequence of local structural feature vectors of the application business process optimization is input into the application business process global context semantic association encoder based on the converter structure, the semantic aggregation key information will be lost due to the feature expression information overflow of each application business process optimization local structural feature vector in the sequence of the application business process optimization local structural feature vector, affecting the expression effect of the application business process context semantic encoding feature vector.

[0049] Based on this, in the preferred example, when the application business process context semantic encoding feature vector is input into the classifier-based security vulnerability detection module to obtain the detection result, the application business process context semantic encoding feature vector is optimized. Specifically, the optimization process includes the following steps:

[0050] Calculate the sum of the absolute values ​​of each eigenvalue of the application business process context semantic coding feature vector to obtain a first application business process context semantic coding feature and a modulation value, and calculate the square root of the sum of the squares of each eigenvalue of the application business process context semantic coding feature vector to obtain a second application business process context semantic coding feature and a modulation value;

[0051] After performing dot-wise subtraction on the application business process context semantic coding feature vector and the second application business process context semantic coding feature and modulation value, perform dot-wise multiplication on the number of eigenvalues ​​of the application business process context semantic coding feature vector and the reciprocal of the first application business process context semantic coding feature and modulation value, and take the reciprocal of each eigenvalue to obtain the first application business process context semantic coding feature phase conversion vector;

[0052] After performing dot-wise subtraction on the application business process context semantic coding feature vector and the first application business process context semantic coding feature and modulation value, perform dot-wise multiplication on the square root of the number of eigenvalues ​​of the application business process context semantic coding feature vector and the reciprocal of the second application business process context semantic coding feature and modulation value, and take the reciprocal of each eigenvalue to obtain the second application business process context semantic coding feature phase conversion vector;

[0053] The first application business process context semantic encoding feature phase transformation vector is point-subtracted from the second application business process context semantic encoding feature phase transformation vector and the point product vector of the weighted hyperparameter to obtain an optimized application business process context semantic encoding feature vector. Finally, the optimized application business process context semantic encoding feature vector is input into a classifier-based security vulnerability detection module to obtain a detection result.

[0054] Here, the optimized representation of the semantic encoding feature vector of the application business process context, denoted as V, is:

[0055]

[0056] v i ∈V∈R n

[0057] Where V is the semantic encoding feature vector of the application business process context, R represents a real number set, and v i represents the feature value of the ith position of the semantic coding feature vector of the application business process context, n represents the number of feature values ​​of the semantic coding feature vector of the application business process context, α represents the semantic coding feature and modulation value of the first application business process context, β represents the semantic coding feature and modulation value of the second application business process context, ⊙ represents the point multiplication by position, Indicates positional subtraction, [·] ⊙-1 is the inverse of each eigenvalue in the vector, V1 represents the first application business process context semantic encoding feature phase transition vector, V2 represents the second application business process context semantic encoding feature phase transition vector, ω represents the weighted hyperparameter, and V' represents the optimized application business process context semantic encoding feature vector.

[0058] Therefore, in the preferred example, the difference of the difference and modulation representation of the eigenvalue of the application business process context semantic encoding feature vector relative to the feature set of the vector as a whole of the application business process context semantic encoding feature vector is used as the semantic change intensity information, and a phase-like transformation corresponding to the position-based intensity modulation is performed through different and modulation representations, so that the aggregation enhancement of the semantic change phase perception can enhance the axial aggregation receptive field along the feature aggregation direction by performing a spatial translation operation based on alternating stacking under the scale equalization of the vector set of the application business process context semantic encoding feature vector, thereby improving the perception effect of the aggregated semantics of the application business process context semantic encoding feature vector on the detailed semantic changes, thereby improving the accuracy of the detection result obtained by inputting the application business process context semantic encoding feature vector into the classifier-based security vulnerability detection module.

[0059] It is worth mentioning that in other specific examples of the present application, other methods can be used to optimize the global contextual semantic association features of the sequence of local structural feature vectors based on the application business process to determine whether there is a security vulnerability. For example: first, use natural language processing (NLP) technology, such as word embedding, topic modeling or graph neural network, to extract global semantic association features from the sequence; use machine learning or deep learning models to classify the global semantic association features to determine whether there is a security vulnerability.

[0060] In summary, the application logic vulnerability detection method according to the embodiment of the present application is explained, which constructs the business process diagram of the application based on the various business modules of the application and their calling relationships by statically analyzing the source code of the application, and uses artificial intelligence technology based on deep learning to extract process structure features of the business process diagram of the application, captures the deep semantic associations between nodes and edges in the business process diagram, and mines the global context association information of the business process diagram, so as to intelligently identify whether the application has security vulnerabilities. In this way, the accuracy and efficiency of application logic vulnerability detection can be effectively improved, and the probability of false positives and false negatives can be reduced.

[0061] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting application logic vulnerabilities, characterized in that: include: Get the source code of the instrumented application; Based on the source code of the detected application, construct a business process diagram of the detected application; Extracting process structure features from the business process diagram of the detected application to obtain a business process structure feature diagram of the application; Performing feature decoupling and feature association optimization on the application business process structure feature graph to obtain a sequence of application business process optimization local structure feature vectors; Based on the global context semantic association features of the sequence of local structural feature vectors optimized by the application business process, it is determined whether there is a security vulnerability.

2. The application logic vulnerability detection method according to claim 1, characterized in that: Extracting process structure features from the business process graph of the detected application to obtain a business process structure feature graph of the application, including: The business process diagram of the detected application is input into the GRCNN model to obtain the business process structure feature diagram of the application.

3. The application logic vulnerability detection method according to claim 2, characterized in that: Performing feature decoupling and feature association optimization on the application business process structure feature graph to obtain a sequence of application business process optimization local structure feature vectors, including: Decoupling the application business process structure feature graph to obtain a sequence of application business process local structure feature vectors; The sequence of the local structural feature vectors of the application business process is input into a feature association optimization network based on intra-distribution association awareness to obtain the sequence of the optimized local structural feature vectors of the application business process.

4. The application logic vulnerability detection method according to claim 3 is characterized in that: Inputting the sequence of local structural feature vectors of the application business process into a feature association optimization network based on intra-distribution association perception to obtain the sequence of optimized local structural feature vectors of the application business process, including: Calculating the semantic association score vector between any two application business process local structure feature vectors in the sequence of application business process local structure feature vectors to obtain a sequence of application business process local structure semantic association score vectors; Based on the sequence of semantic association score vectors of the local structure of the application business process, calculating a global representation vector of the sequence endogenous correlation; Based on the sequence endogenous correlation global representation vector, calculating the correlation optimization factor of each application business process local structure feature vector in the sequence of application business process local structure feature vectors to obtain a sequence of correlation optimization factors; Inputting the sequence of association optimization factors into a Softmax activation function to obtain a sequence of association optimization weight factors; Using each associated optimization weight factor in the sequence of associated optimization weight factors as a weight, each application business process local structure feature vector in the sequence of application business process local structure feature vectors is weighted to obtain the sequence of application business process optimized local structure feature vectors.

5. The application logic vulnerability detection method according to claim 4, characterized in that: Calculating the semantic association score vector between any two application business process local structure feature vectors in the sequence of application business process local structure feature vectors to obtain a sequence of application business process local structure semantic association score vectors, including: Any two application business process local structure feature vectors in the sequence of the application business process local structure feature vectors are cascaded and multiplied by a weight coefficient matrix, and then dotted with a bias vector to obtain the application business process local structure semantic association score vector.

6. The application logic vulnerability detection method according to claim 5, characterized in that: Based on the sequence of semantic association score vectors of the local structure of the application business process, a global representation vector of the endogenous correlation of the sequence is calculated, including: The mean vector of the sequence of semantic association score vectors of the local structure of the application business process is calculated to obtain a global representation vector of the endogenous correlation of the sequence.

7. The application logic vulnerability detection method according to claim 6, characterized in that: Based on the sequence endogenous correlation global representation vector, calculating the associated optimization factor of each application business process local structure feature vector in the sequence of application business process local structure feature vectors to obtain a sequence of associated optimization factors, including: The application business process local structure feature vector and the sequence endogenous correlation global representation vector are multiplied by different weight coefficient vectors respectively and then added to obtain a semantic correlation coefficient; The semantic relevance coefficient is added with a bias parameter and then passed through a sigmod activation function to obtain the relevance optimization factor.

8. The application logic vulnerability detection method according to claim 7, characterized in that: Determining whether there is a security vulnerability based on the global context semantic association features of the sequence of local structural feature vectors optimized by the business process of the application, including: Performing global context semantic association coding on the sequence of the application business process optimization local structure feature vectors to obtain an application business process context semantic coding feature vector; The application business process context semantic encoding feature vector is input into a classifier-based security vulnerability detection module to obtain a detection result, and the detection result is used to indicate whether there is a security vulnerability.

9. The application logic vulnerability detection method according to claim 8, characterized in that: Performing global context semantic association coding on the sequence of the application business process optimization local structure feature vectors to obtain the application business process context semantic coding feature vector, including: The sequence of the application business process optimization local structure feature vectors is input into the application business process global context semantic association encoder based on the converter structure to obtain the application business process context semantic encoding feature vector.

Images