Automatic unauthorized vulnerability detection system and method

Abstract

The invention discloses an automatic unauthorized vulnerability detection system and method, and the system comprises a user behavior collection module, a user behavior graph analysis module, an attack case generation module, and an execution and report module. A user group behavior graph is generated, pruning, subgraph division, function point and common point segmentation and key path discovery are executed, test cases for unauthorized vulnerabilities are more efficiently and accurately generated, a large number of useless test cases are filtered, the cases are automatically executed, and the test efficiency is improved. And a test execution result is judged by utilizing a page similarity calculation method without a common subtree, and a detection result is fed back, so that the efficiency and the accuracy of detecting the unauthorized vulnerability are greatly improved.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, in particular to an automated unauthorized vulnerability detection system and method. Background Art

[0002] The current detection methods for unauthorized access vulnerabilities include white-box and black-box detection. White-box detection is a solution that analyzes system files and documents to extract code semantics and compares them with additional descriptions of access control. The existing black-box detection solution is to use crawlers and parameter tampering for detection, which has low test accuracy. This requires a lot of additional work. Summary of the invention

[0003] In view of the above-mentioned deficiencies in the prior art, the present invention proposes an automated unauthorized vulnerability detection system and method, which realizes the overall analysis of the system based on the user behavior of functional testing, generates a user group behavior graph and performs pruning, subgraph division, function point common point segmentation, and critical path discovery, so as to more efficiently and accurately generate test cases for unauthorized vulnerabilities, filter a large number of useless test cases, automatically execute the test cases, and use the page similarity calculation method without common subtrees to judge the test execution results and feedback the detection results, thereby greatly improving the efficiency and accuracy of unauthorized vulnerability detection.

[0004] The present invention is achieved through the following technical solutions:

[0005] The present invention relates to an automated unauthorized vulnerability detection system, comprising: a user behavior collection module, a user behavior graph analysis module, an attack case generation module, and an execution and reporting module, wherein: the user behavior collection module obtains normal operation and flow information of users in a system to be tested, and organizes the information into a user behavior flow set; the user behavior graph analysis module integrates the user behavior flow set to generate a user behavior graph, and performs preprocessing and analysis operations on the user behavior graph; the attack case generation module extracts vulnerability points according to graph features and generates test cases for unauthorized vulnerability points, and performs offensive modifications; the execution and reporting module specifically executes the attack case and analyzes the result page generated by the attack case, draws a vulnerability detection conclusion, and generates a complete detection report.

[0006] The normal operations are the operations performed by testers in the platform to be tested during the product development process, including but not limited to click and input operations; the ordered behavior list formed by normal operations in a single session is the user behavior flow.

[0007] The user behavior flow set integration refers to the extraction of page common subtrees, page node clustering based on common subtree removal, and user behavior clustering for page nodes in the user behavior flow, so that multiple user behavior flows form a complete user behavior graph but with a large number of repeated and interfering edges, where interfering edges refer to edges provided by developers that are irrelevant to normal business processes.

[0008] The user behavior graph is a graph topology data structure composed of user accessible pages, executable operations, and page jump behaviors for a user role in a certain platform to be tested, which is used to describe the actual authority capabilities of the user under normal operation. The points in the graph topology are user accessible pages of the system to be tested, which contain executable user behavior operations as node attributes, and the edges are user behaviors that cause page jumps.

[0009] The preprocessing and analysis include: extraction of jump edges and behaviors of common subtrees, pruning of direct jump edges based on common subtrees, subgraph segmentation, preprocessing behaviors of node re-clustering within subgraphs, and node differences between user groups, edge differences, user behaviors at different operation positions on nodes, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and analysis behaviors of extracting long links with high occurrence frequency or with in-degree and out-degree below a threshold.

[0010] The extraction of vulnerabilities based on graph features refers to: including the features possessed by common triggering cases of vertical and horizontal authority overrides, including node differences and edge differences between different user groups, user behaviors at different operation positions on nodes, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high occurrence frequency or in-degree and out-degree below a threshold.

[0011] The present invention relates to an automated unauthorized logic vulnerability detection method based on the above system, which obtains corresponding traffic data by monitoring the operation behavior of function testers in the target system and executing it, generates a user behavior graph according to user behavior and traffic, and performs preprocessing and analysis to obtain a user graph group, then finds unauthorized vulnerabilities according to the user graph group and performs offensive tampering to obtain test cases, automatically executes the test cases, obtains attack result feedback, and generates a system vulnerability report. Technical Effects

[0012] The present invention effectively abstracts the user behavior of a Web application into a visible and analyzable user behavior graph group based on different permission groups through the extraction of unauthorized vulnerability points based on user behavior graph features and the technology of abstracting the user behavior graph of a Web application based on common subtree extraction. For the user behavior group graph, developers, testers and operators provide a system visualization analysis information source. As a system basis, the method can also be extended to system rationality analysis and other business logic vulnerability mining businesses. The node clustering accuracy can reach 100% in the test ranges such as OpenCart, osCommerce, BWAPP, OWASPJuice Shop, The Bodgeit Store, WackoPicko, DVWA, etc., and 87.32% of requests can be filtered, while the false negative rate is still only 5.4%, which greatly improves the accuracy of the test case and improves the detection efficiency. At the same time, through the automatic extraction of key long links, a basis can be provided for the business logic vulnerability test of the long link without manual collection. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 Schematic diagram of the system of the present invention

[0014] Figure 2 It is a flow chart of the present invention;

[0015] Figure 3 Flowchart of the user behavior and traffic collection module;

[0016] Figure 4 Provide a technical flow chart for user behavior graph preprocessing and analysis;

[0017] Figure 5 Generate module technical flow charts for attack use cases;

[0018] Figure 6 The flowchart of the page node clustering method based on page similarity matching without common subtrees;

[0019] Figure 7 It is a schematic diagram of the effect of the embodiment. DETAILED DESCRIPTION

[0020] like Figure 1As shown, the present invention relates to an automated unauthorized vulnerability detection system, comprising: a user behavior collection module, a user behavior graph analysis module, an attack case generation module, and an execution and reporting module, wherein: the user behavior collection module obtains the normal operation and flow information of the user in the system to be tested, and organizes it into a user behavior flow set; the user behavior graph analysis module integrates the user behavior flow set to generate a user behavior graph, and performs preprocessing and analysis operations on the user behavior graph; the attack case generation module extracts vulnerabilities according to graph features and generates test cases for unauthorized vulnerability vulnerabilities, and performs offensive modifications; the execution and reporting module specifically executes the attack case and analyzes the result page generated by the attack case, draws a vulnerability detection conclusion and generates a complete detection report.

[0021] like Figure 3 As shown, the user behavior collection module includes: a user behavior monitoring unit, a parsing unit and a storage unit, wherein: the user behavior monitoring unit obtains the user's operations and corresponding traffic in the browser by monitoring, the parsing unit is used to parse the relationship between the operation and the traffic and output the test monitoring software results, and the storage unit is to serialize and store the above-collected user behavior link bundles based on the PKL file format through user annotation for subsequent use.

[0022] The normal operation includes but is not limited to: clicking, inputting and other operations on the platform to be tested.

[0023] The monitoring refers to: a monitoring method based on a browser plug-in or a test software, wherein: the browser plug-in solution is to locate the user's operation type, location, time and other parameters in the form of a browser plug-in, and then cooperate with the monitoring of http messages to align them according to time to achieve user behavior and user operation acquisition; the test software monitoring method is not limited to the simultaneous collection of user behavior and traffic achieved by the internal browser driver of tools such as PlayWright.

[0024] like Figure 3 As shown, the alignment means: since the monitoring function of the browser plug-in can only monitor user behavior, tools such as BurpSuite are needed to monitor the request response. Then, according to the monitored user operation and request response time, the behavior and user operation are aligned. Due to the difference in time, the user operation is required to slow down the user behavior.

[0025] like Figure 4As shown, the user behavior graph analysis module includes: a user behavior graph generation unit, a user behavior graph preprocessing and analysis unit, wherein: the user behavior graph generation unit is used to organize and cluster the acquired user behavior flow set into a behavior graph, and the user behavior graph preprocessing and analysis unit is to perform edge pruning and edge simplification on the user behavior graph that has not been preprocessed, and divide the behavior subgraphs, extract the node differences and edge differences between user groups, user behaviors at different operation positions on the nodes, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high occurrence frequency or in-degree and out-degree below the threshold. The user behavior graph generation technology and preprocessing and analysis technology have been described in detail in the technical effects.

[0026] like Figure 5 As shown, the attack case generation module includes: a vulnerability extraction unit and a test case generation unit, wherein: the vulnerability extraction unit is based on the user behavior graph analysis results, according to the node differences, edge differences, user behaviors at different operation positions on the nodes between user groups, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency of occurrence or in-degree and out-degree below the threshold, further processed to generate the target to be tested that can be generated by the test case generation unit, including business long chains (including high-frequency behavior chain extraction, business behavior chain extraction), request response containing information behavior, edge jump and node URL jump. The test case generation unit is to modify the behavior flow and message parameters offensively according to the attack method to generate test case behavior or behavior chain.

[0027] The behavior of requesting and responding to include information refers to: the request and response contain key-value pairs that are suspected of being tampered with by the unique code, and the key includes {token, username, ID, id, identity, No, num, mail}, and the value needs to be in a specific format (mobile phone number, email address) or meet the mixed length of English, numbers, and symbols exceeding 6.

[0028] The offensive modification refers to: the offensive modification of message parameters is to replace the key-value pairs of the unique code tampering with the value (the replacement source is the data message at the same position contained in the first execution), cookie or token (the data message parameters obtained in real time by executing the login of two accounts at the same time), and the offensive modification of the long business chain is the tampering of the behavior flow sequence, including skipping key page nodes and dual account login parameter grafting. Skipping key page nodes refers to traversing and selecting a node from the non-starting nodes in the long chain, and then reaching the previous node and executing one of the non-edge behaviors in the list, and then directly jumping to the child node of its child node through the URL. Dual account login parameter grafting refers to the simultaneous execution of two behavior flows, replacing all non-cookie parameters of the parameters of one account with the parameters of the other account.

[0029] like Figure 2 As shown, the present embodiment is an automated unauthorized vulnerability detection method based on the above system, including:

[0030] Step 1: Use PlayWright codegen function or browser plug-in and http message monitoring software to collect user behavior information and corresponding traffic. Monitoring includes: popping up the built-in browser, collecting the user's click and input behavior in the browser, and extracting the behavior into a subsequent executable operation sequence and storing it. Then initialize and automatically execute the collected user behavior once, and intercept the corresponding data packets.

[0031] The PlayWright codegen includes: based on the open source PlayWright component, using Python's subprocess built-in method to open a subprocess to run playwright codegen-o UA_module / UA_record / filename--device CONFIG_DICT["device"]--targetpython CONFIG_DICT["url"], where the simulated device includes a mobile device or a computer device, which is related to the user configuration. The url represents the first page set by the target Web application that starts user information collection.

[0032] The collection of user behavior in the browser refers to: performing code analysis on the behavior file generated by PlayWright to extract specific user operation information, or directly obtaining user operation information through the browser. The specific extracted information includes the location of the clicked or input element, the clicked content, the input content, the URL conversion and other information, so as to facilitate the subsequent executor to parse the operation and execute it.

[0033] like Figure 3As shown, the code analysis means: since the monitoring function of Playwright is to simulate the execution of user behavior in order to add a monitoring module, and it is not the same as the user behavior monitoring, the codegen function of Playwright is first used to monitor the user behavior and generate Python code. Therefore, it is necessary to parse the generated Python code, and then simulate the execution of user behavior according to the parsed locator, action, and fill parameters. During the simulation execution, a request monitoring module, a response monitoring module, and a page HTML file monitoring module for page jumps are added (the time interval of the simulation execution needs to be reduced to ensure that the request response and the page can complete the dynamic loading completely). Based on the monitoring method of Playwright, the page, the user behavior in the page, and its corresponding request and response.

[0034] The interception of the data packet after the simulated user operation at this time means: when the browser sends a request, a callback function is added to the browser context, and the callback function is called each time a request is sent to obtain the request and response data of this request until the simulated user normal operation is completed.

[0035] The URL change information extraction means: when simulating a user to re-execute an operation, a callback function is added to the browser context, when the URL changes, the page jump information is found when the page jumps, and after the page jumps, wait 1.5 seconds to collect the page dynamic Html file.

[0036] Step 2: Preprocess and analyze the user behavior flow set obtained in step 1, including:

[0037] 2.1 Extract a certain amount of common subtrees with the same path from the page nodes of the user behavior flow, and integrate the user behavior flow set into a user behavior flow graph by parsing the behavior flow set of each user and using the page node clustering algorithm based on the page similarity matching of the removed common subtrees and the edge and behavior matching algorithm;

[0038] The page node clustering based on the page similarity matching without common subtrees refers to: the concept of common subtrees is added to the similarity matching technology in the present invention. Common Web applications need to ensure that the style of the product is consistent and have a certain fast navigation capability, which leads to the appearance of common modules in the html file, which is manifested as the html common sub (DOM) tree in the file analysis. In order to exclude the influence of some small DOM trees that do not have directory functions or public attributes, it is necessary to filter based on the volume of the common subtree when extracting the common subtree, and filter the objects whose volume of the common subtree is lower than the threshold. Based on the above content, the common subtree matching used in the present invention is as follows: first, it is determined whether the domain and the front-end routing are the same. If the parameter key value sets are the same, it is considered to be matched (parameters such as routing parameters and token parameters that should not appear in the get request parameter area should be eliminated in the parameter matching), otherwise it is determined whether the node matches by calculating whether the similarity of the html file without the common subtree is greater than the threshold.

[0039] The common subtree volume refers to: a volume calculation method suitable for html subtree nodes designed for the tree structure in the html page code. Since it is necessary to efficiently extract the common subtree of the menu class and relatively ignore the specific content of the page, the present invention provides a breadth weight for the subnodes of the subtree in the page DOM tree when calculating the volume. At the same time, the breadth weight gradually increases according to the depth of the DOM subtree, and the breadth weight has a decay rate of 0.7. Finally, according to the calculation result, the subtree with a volume greater than 7 is considered by the present invention to be a page common module (subtree) worth extracting.

[0040] 2.2 Based on the common subtree, the interference edges and return edges are discovered and pruned, the root nodes are extracted, and the subgraph is divided based on the number of root nodes.

[0041] The pruning of interference edges refers to: common Web application page jump methods, some of which provide users with quick jumps for the convenience of user operations, which generally result in page jumps across subgraphs. These jump structures will appear in the page common subtree, so the reachable quick jumps triggered from the common subtree, which contain other paths, will be pruned in the graph (if other reachable paths are composed of quick jumps, and other nodes reach the node through this common subtree, no pruning will be performed), and the behavior page jump edges triggered from the non-root node common subtree will also be pruned.

[0042] The pruning of return edges means that some common businesses will jump back to the parent node, root node, sub-root node, and business starting node after the end. These edges that have no business significance will form redundant edges and loops that interfere with the analysis and affect the extraction of edge nodes. Therefore, they need to be pruned. Here, all edges whose end points are root nodes, sub-root nodes, and parent nodes need to be pruned, and the starting node of the edge has no other out-degree.

[0043] The subgraph partitioning refers to: subgraph extraction is the extraction of submodule areas of Web applications based on the Girvan-Newman algorithm. The simplified graph that has completed the pruning of interference edges and return edges is firstly subjected to the Girvan-Newman algorithm subgraph discovery. If a node is directly connected to only one node (isolated point), the child nodes in the node pair need to be forced to be added to the subgraph where its parent node is located. At the same time, if the neighbors of a node all belong to the same node, the node will be forced to be added to the subgraph. Through the above two correction strategies, the unreasonable correction of the Girvan-Newma-based betweenness partitioning results can be effectively made. Compared with directly synthesizing isolated points to parent nodes, this method can more effectively retain graph features and reduce the probability of Girvan-Newman errors. At the same time, since the sub-areas must be systematic in the design of Web applications, it is necessary to exclude the situation where the number of subgraph nodes is too small. When the number of nodes is less than 4, the total number of subgraphs will be reduced and the Girvan-Newman algorithm will be called again. After correction, the total number of nodes in each subgraph is greater than or equal to four.

[0044] The root node refers to: a page node with directory capabilities and a large out-degree in the user behavior graph or its subgraph. The judgment criterion is whether the node has an out-degree greater than 50% of the number of subgraph nodes in its subnodes before cutting off the interference edges.

[0045] 2.3 For the extracted non-starting nodes, that is, the common subtree in the new subgraph where the homepages of non-Web applications are located, the discovery and pruning of interference edges and return edges are re-executed to generate a simplified user behavior graph.

[0046] 2.4 Analyze the simplified user behavior graph to extract the unauthorized vulnerability points.

[0047] 2.5 Extraction of unauthorized access vulnerability points based on user behavior graph features, including node differences and edge differences between user groups, user behaviors at different operation locations on nodes, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high occurrence frequency or in-degree and out-degree below the threshold.

[0048] The user behavior with relevant information in the above-mentioned nodes refers to: the analysis of sensitive parameters containing user information commonly seen in current solutions, including user name, suspected unique identifier, mobile phone, email address, and postal code.

[0049] The edge nodes in each user behavior graph subgraph refer to: edge nodes do not have page navigation functions because they do not have child nodes, so the services they can provide only include static information provision or system function provision. Static information provision services are not within the scope of unauthorized vulnerability detection, while system function behavior is a sensitive point for unauthorized vulnerability.

[0050] The boundary page nodes between subgraphs refer to: since the sub-areas of the Web application are non-overlapping, the divided subgraphs are also non-overlapping. The boundary page nodes between subgraphs here are directly connected point pairs in the subgraphs with the end point being the root node. If there is a node difference in a subgraph between the user behavior group graphs, when detecting the reachability of the boundary page nodes between subgraphs, the node reachability detection in the subgraph can be replaced by the overall reachability of the root node.

[0051] The user behavior functions and long links with high frequency of occurrence or in-degree and out-degree below the threshold refer to: the links are repeatedly triggered in the collected user behaviors, and the links have the characteristics of uninterrupted, more than three repetitions, greater than or equal to three link lengths, non-jump user behaviors, and the same user behavior list. These links have repeatability, link stability, context relevance, and functionality in user behavior. This situation can also be analyzed from the user behavior graph, that is, long links with in-degree and out-degree below the threshold. The characteristics of this link are that the link is long and except for the starting node (after pruning), its out-degree and in-degree are extremely low, that is, the business process causes page jumps, user behavior has strong stability, and context relevance, so it is considered to be a vulnerable point in the function chain.

[0052] Step 3: Further analyze the five vulnerabilities extracted from the user behavior graph group to extract the unauthorized vulnerability content to be tested, and conduct offensive tampering of the content to be tested according to the unauthorized vulnerability triggering method to form a test case.

[0053] Step 4: Submit the test case generated in step 3 to the executor for execution. Each time the executor executes an attack case, it will simulate the execution of the user behavior information collected in step 1. When the execution reaches the point where the parameter needs to be tampered with, it will intercept the data packet after the simulated user operation, replace the corresponding parameter value with the attack parameter in the attack phrase, and then release the data packet.

[0054] The executor is: read the formatted user behavior information, judge the user operation type according to different user operations, use PlayWright to execute operations such as clicking a button and inputting in a certain input box; perform corresponding attack according to the test case attack type. After the attack is completed, the result feedback is divided into two parts. The first is the message result analysis, which is used for behavior attack result analysis, and the keyword analysis and similarity analysis of the feedback message; the second is page analysis, which is used for node reachability and edge behavior attack result analysis, analyzes the page html file, and calculates the similarity based on the message after the common subtree is removed to judge the attack result. Report based on the attack result.

[0055] The interception of the data packet after simulating the user operation at this time refers to: using the built-in interface context.route of PlayWright to intercept and process the data packet, that is, tampering the original normal data with the attack data in the attack phrase, specifically separating the intercepted data according to different types such as POST / GET, parsing the GET parameters, application / json, application / x-www-form-urlencoded, multipart / form-data and other types of parameters in POST according to the type of parameter transmission, finding the corresponding parameter key after parsing to tamper with its value, and then releasing the processed data packet.

[0056] The report refers to: basic information including the platform to be tested, time, location, etc., result statistics report, single test case report (including the type of attack execution, input information of the login node executed, automated execution behavior, attack behavior (modified parameter key-value pairs), attack results, and proof of attack results).

[0057] After specific experiments, the capability test was carried out in the existing common vulnerability testing platform. The test target fields include osCommerce, BWAPP, OWASPJuice Shop, The Bodgeit Store, WackoPicko, DVWA, etc., involving backend codes such as PHP, NodeJS, and Java. The diversity of the target fields ensures the availability of the present invention.

[0058] As shown in Table 1, the page similarity matching method after common subtree removal used in this embodiment achieved 100% stronghold clustering accuracy in these five target areas.

[0059] Table 1

[0060] This embodiment filters out a large number of non-target ports based on the edge nodes of the subgraph and the functional nodes obtained by sensitive parameter analysis, filtering an average of 87.32% of the ports in the test range. The current commercial unauthorized open source testing software such as APPScan does not have an interface filtering function, which means that it will test 7.32 times the number of Web application locations tested by this system. On this basis, the average false negative rate of the port filtering results of the present invention is only 5.42%, and the detection accuracy is improved by 23.07% relative to some commercial software. In addition, this embodiment also found 5 vulnerabilities in the range that were not included in the range vulnerability list.

[0061] This embodiment uses the method of collecting and executing user operations and constructing user behavior graph groups to effectively discover vulnerabilities after overall analysis, improve the accuracy of test cases, filter a large number of public request responses that are not excluded in traditional unauthorized vulnerabilities and put them into test cases. Under the condition of up to 87.32% port filtering, the average port false negative rate is only 5.42%, which greatly improves the detection efficiency. Automatically execute attack cases and pass such as Figure 4 The new page similarity judgment and request response similarity are used to determine whether there is a vulnerability.

[0062] In summary, the present invention collects traffic packets based on the system to perform sensitive parameter analysis, discovers suspected unique identifiers of unauthorized vulnerabilities, and generates test cases. The vulnerability type, detection process, detection results, and judgment basis are output to the report for security personnel to repair the vulnerability. The test traffic reuse and high automation of unauthorized vulnerability detection can be achieved, and the single-point unauthorized vulnerability detection of traditional automated detection is extended to chained unauthorized horizontal unauthorized vulnerability detection with context.

[0063] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. An automated unauthorized vulnerability detection system, characterized in that: include: User behavior collection module, user behavior graph analysis module, attack case generation module, execution and reporting module, among which: the user behavior collection module obtains the normal operation and flow information of the user in the system to be tested, and organizes it into a user behavior flow set; the user behavior graph analysis module integrates the user behavior flow set to generate a user behavior graph, and performs preprocessing and analysis operations on the user behavior graph; the attack case generation module extracts vulnerabilities based on graph features and generates test cases for unauthorized vulnerability vulnerabilities, and performs offensive modifications; the execution and reporting module specifically executes the attack case and analyzes the result page generated by the attack case, draws a vulnerability detection conclusion and generates a complete detection report; The user behavior flow set integration refers to extracting common subtrees from page nodes in the user behavior flow, clustering page nodes based on common subtree removal, and clustering user behaviors, so that multiple user behavior flows form a complete user behavior graph with a large number of repeated and interfering edges, where interfering edges refer to edges provided by developers that are irrelevant to normal business processes; The user behavior graph refers to: for a user role in a certain platform under test, a graph topology data structure consisting of user-accessible pages, executable operations, and page jump behaviors is constructed to describe the actual authority capabilities of the user under normal operation. The points in the graph topology are user-accessible pages of the system under test, which contain executable user behavior operations as node attributes, and the edges are user behaviors that cause page jumps; The offensive modification refers to: offensive tampering of the traffic contained in the unauthorized vulnerability point to target unauthorized access.

2. The automated unauthorized vulnerability detection system according to claim 1, characterized in that: The preprocessing and analysis include: extraction of jump edges and behaviors of common subtrees, pruning of direct jump edges based on common subtrees, subgraph segmentation, preprocessing behaviors of node re-clustering within subgraphs, and node differences between user groups, edge differences, user behaviors at different operation positions on nodes, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and analysis behaviors of extracting long links with high occurrence frequency or with in-degree and out-degree below a threshold.

3. The automated unauthorized vulnerability detection system according to claim 1, characterized in that: The extraction of vulnerabilities based on graph features refers to: including the features possessed by common triggering cases of vertical and horizontal authority overrides, including node differences and edge differences between different user groups, user behaviors at different operation positions on nodes, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high occurrence frequency or in-degree and out-degree below the value.

4. The automated unauthorized vulnerability detection system according to claim 1, characterized in that: The user behavior collection module includes: a user behavior monitoring unit, a parsing unit and a storage unit, wherein: the user behavior monitoring unit obtains the user's operations and corresponding traffic in the browser by monitoring, the parsing unit is used to parse the relationship between the operation and the traffic and output the test monitoring software results, and the storage unit is to store the above-collected user behavior link bundles in a class serialized form based on the PKL file format through user annotation for subsequent use.

5. The automated unauthorized vulnerability detection system according to claim 1, characterized in that: The user behavior graph analysis module includes: a user behavior graph generation unit, a user behavior graph preprocessing and analysis unit, wherein: the user behavior graph generation unit is used to organize and cluster the acquired user behavior flow set into a behavior graph, the user behavior graph preprocessing and analysis unit is to perform edge pruning and edge simplification on the user behavior graph that has not been preprocessed, and divide the behavior subgraphs, extract the node differences and edge differences between user groups, the user behaviors at different operation positions on the nodes, the edge nodes located in each user behavior graph subgraph, the boundary page nodes between subgraphs, the user behavior functions with relevant information in the above nodes and the long links with high occurrence frequency or in-degree and out-degree below the threshold, the user behavior graph generation technology and preprocessing and analysis technology have been described in detail in the technical effects.

6. The automated unauthorized vulnerability detection system according to claim 1, characterized in that: The attack case generation module includes: a vulnerability extraction unit and a test case generation unit, wherein: the vulnerability extraction unit is based on the user behavior graph analysis results, according to the node differences, edge differences, user behaviors at different operation positions on the nodes between user groups, edge nodes located in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high occurrence frequency or in-degree and out-degree below the threshold, further processed to generate the target to be tested generated by the test case generation unit, including business long chains (including high-frequency behavior chain extraction, business behavior chain extraction), request response containing information behavior, edge jump and node URL jump; the test case generation unit is to modify the behavior process and message parameters offensively according to the attack method to generate test case behavior or behavior chain; The behavior of requesting and responding to include information refers to: the request and response contain key-value pairs that are suspected of being tampered with by the unique code, and the key includes {token, username, ID, id, identity, No, num, mail}, and the value needs to be in a specific format (mobile phone number, email address) or meet the mixed length of English, numbers, and symbols exceeding 6.

7. The automated unauthorized vulnerability detection system according to claim 1, characterized in that: The offensive modifications are specifically as follows: the offensive modification of message parameters is to replace the key-value pairs of the unique code tampering with the value (the replacement source is the data message at the same position contained in the first execution), cookie or token (the data message parameters obtained in real time by executing the login of two accounts at the same time); the offensive modification of the long business chain is the tampering of the behavior flow sequence, including skipping key page nodes and dual account login parameter grafting. Skipping key page nodes means traversing and selecting a node from the non-starting nodes in the long chain, and then reaching the previous node and executing one of the non-edge behaviors in the list, and then directly jumping to the child node of its child node through the URL. Dual account login parameter grafting means executing two behavior flows at the same time, replacing all non-cookie parameters of the parameters of one account with the parameters of the other account.

8. An automated unauthorized vulnerability detection method according to any one of claims 1 to 7, characterized in that: By monitoring the operation behavior of the target system and executing it, the tester obtains the corresponding traffic data. According to the user behavior and traffic, a user behavior graph is generated, and preprocessing and analysis are performed to obtain a user graph group. According to the user graph group, unauthorized vulnerabilities are discovered and offensive tampering is performed to obtain test cases. After the test cases are automatically executed, feedback on the attack results is obtained and a system vulnerability report is generated.

9. The method for detecting unauthorized vulnerabilities according to claim 8, wherein: include: Step 1: Use PlayWright codegen function or browser plug-in and http message monitoring software to collect user behavior information and corresponding traffic. Specifically, pop up the built-in browser, collect the user's click and input behavior in the browser, and extract the behavior into a subsequent executable operation sequence and store it; then initialize and automatically execute the collected user behavior once, and intercept the corresponding data packets; Step 2: Preprocess and analyze the user behavior flow set obtained in step 1. include: 2.1 Extract a certain amount of common subtrees with the same path from the page nodes of the user behavior flow, and integrate the user behavior flow set into a user behavior flow graph by parsing the behavior flow set of each user and using the page node clustering algorithm based on the page similarity matching of the removed common subtrees and the edge and behavior matching algorithm; 2.2 Discover and prune interference edges and return edges based on the common subtree, extract root nodes, and divide the subgraph based on the number of root nodes; 2.3 For the extracted non-starting nodes, that is, the common subtree in the new subgraph where the homepage of the non-Web application is located, re-execute the discovery and pruning of interference edges and return edges to generate a simplified user behavior graph; 2.4 Analyze the simplified user behavior graph to extract the vulnerability points of unauthorized access; 2.5 Extraction of unauthorized vulnerability points based on user behavior graph features, including node differences and edge differences between user groups, user behaviors at different operation locations on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high occurrence frequency or in-degree and out-degree below the threshold; Step 3: Further analyze the five vulnerabilities extracted from the user behavior graph group to extract the unauthorized vulnerability content to be tested, and conduct offensive tampering of the content to be tested according to the unauthorized vulnerability triggering method to form a test case; Step 4: Submit the test case generated in step 3 to the executor for execution. Each time the executor executes an attack case, it will simulate the execution of the user behavior information collected in step 1. When the execution reaches the point where the parameter needs to be tampered with, it will intercept the data packet after the simulated user operation, replace the corresponding parameter value with the attack parameter in the attack phrase, and then release the data packet.

10. The method for detecting unauthorized vulnerabilities according to claim 8, wherein: The report includes: basic information, result statistics report, type of attack execution, login node input information of execution, automated execution behavior, attack behavior, i.e. tampered parameter key-value pairs, attack results, and proof of attack results.

Images