Automated unauthorized vulnerability detection system and method

Abstract

An automated system and method for detecting privilege escalation vulnerabilities includes: a user behavior collection module, a user behavior graph analysis module, an attack test case generation module, and an execution and reporting module. Based on user behavior from functional testing, this invention achieves comprehensive system analysis, generates user group behavior graphs, and performs pruning, subgraph partitioning, functional point common point segmentation, and critical path discovery. This results in more efficient and accurate generation of test cases for privilege escalation vulnerabilities, filtering out a large number of useless test cases, automating test case execution, and using a page similarity calculation method to remove common subtrees to determine test execution results and provide feedback on detection results, greatly improving the efficiency and accuracy of privilege escalation vulnerability detection.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically an automated system and method for detecting privilege escalation vulnerabilities. Background Technology

[0002] Current methods for detecting privilege escalation vulnerabilities include white-box and black-box detection. White-box detection involves analyzing system files and documents to extract code semantics and comparing them with additional access control descriptions. Existing black-box detection methods rely on web crawlers and parameter manipulation, resulting in low testing accuracy. Both require significant additional workload. Summary of the Invention

[0003] To address the aforementioned shortcomings of existing technologies, this invention proposes an automated privilege escalation vulnerability detection system and method. Based on user behavior during functional testing, it achieves a comprehensive analysis of the system, generates a user group behavior graph, and performs pruning, subgraph partitioning, functional point common point segmentation, and critical path discovery. This results in more efficient and accurate generation of test cases for privilege escalation vulnerabilities, filtering out a large number of useless test cases, automating test case execution, and using a page similarity calculation method to remove common subtrees to determine test execution results and provide feedback on detection results. This significantly improves the efficiency and accuracy of privilege escalation vulnerability detection.

[0004] This invention is achieved through the following technical solution:

[0005] This invention relates to an automated privilege escalation vulnerability detection system, comprising: a user behavior collection module, a user behavior graph analysis module, an attack test case generation module, and an execution and reporting module. The user behavior collection module acquires normal user operations and traffic information on the system under test, organizing it into a user behavior flow set. The user behavior graph analysis module integrates the user behavior flow set to generate a user behavior graph, and performs preprocessing and analysis operations on the user behavior graph. The attack test case generation module extracts vulnerabilities based on graph features and generates test cases targeting privilege escalation vulnerability vulnerabilities, making offensive modifications. The execution and reporting module executes the attack test cases and analyzes the resulting pages generated by the attack test cases, drawing vulnerability detection conclusions and generating a complete detection report.

[0006] The normal operation refers to the operations performed by testers on the platform under test during the product development process, including but not limited to clicks and input operations; the normal operation is an ordered list of behaviors formed in a single session, i.e., the user behavior flow.

[0007] The aforementioned user behavior flow set integration refers to extracting common subtrees of pages from page nodes in the user behavior flow, clustering page nodes based on the removal of common subtrees, and clustering user behaviors, so that multiple user behavior flows can form a complete user behavior graph with a large number of duplicate and interfering edges. Interfering edges refer to edges provided by the developer that are unrelated to the normal business process relationship.

[0008] The user behavior graph refers to a graph topology data structure constructed for a user role in a platform under test. It consists of three components: accessible pages, executable actions, and page navigation behaviors. This graph describes the actual permissions and capabilities of a user under normal operation. In this graph topology, nodes represent accessible pages of the system under test, with executable user actions as node attributes, and edges representing user behaviors that cause page navigation.

[0009] The preprocessing and analysis include: extraction of jump edges and behaviors in common subtrees, pruning of direct jump edges based on common subtrees, subgraph segmentation, preprocessing behavior of re-clustering nodes within subgraphs, and analysis behavior of node differences, edge differences, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below the threshold.

[0010] The vulnerability extraction based on graph features refers to the features found in common trigger cases of vertical and horizontal overriding, including node differences and edge differences between different user groups, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links that occur frequently or have in-degree and out-degree below the threshold.

[0011] This invention relates to an automated method for detecting privilege escalation vulnerabilities based on the aforementioned system. The method involves monitoring the operational behavior of functional testers on the target system and obtaining corresponding traffic data after execution. Based on user behavior and traffic, a user behavior graph is generated and preprocessed and analyzed to obtain a user graph group. Based on the user graph group, privilege escalation vulnerabilities are discovered and maliciously modified to obtain test cases. The test cases are then automatically executed, and the attack results are obtained and a system vulnerability report is generated.

[0012] Technical effect

[0013] This invention effectively abstracts user behavior in web applications into visual and analyzable user behavior graphs based on different permission groups by extracting vulnerabilities for privilege escalation based on user behavior graph features and abstracting user behavior graphs from common subtrees. For these user behavior graphs, developers, testers, and operators can access system visualization and analysis information. This method, as a system foundation, can also be extended to system rationality analysis and other business logic vulnerability discovery. In test ranges such as OpenCart, osCommerce, BWAPP, OWASP Juice Shop, The Bodgeit Store, WackoPicko, and DVWA, the node clustering accuracy reaches 100%, filtering 87.32% of requests while maintaining a false negative rate of only 5.4%, significantly improving test case accuracy and detection efficiency. Furthermore, the automated extraction of key long-chain vulnerabilities provides a foundation for testing long-chain business logic vulnerabilities, eliminating the need for manual collection. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the system of the present invention.

[0015] Figure 2 This is a flowchart of the present invention;

[0016] Figure 3 Flowchart for the user behavior and traffic collection module;

[0017] Figure 4 Flowchart of user behavior graph preprocessing and analysis techniques;

[0018] Figure 5 Technical flowchart for generating attack test cases;

[0019] Figure 6 The flowchart shows the page node clustering method based on page similarity matching by removing common subtrees.

[0020] Figure 7 This is a schematic diagram illustrating the effect of an example. Detailed Implementation

[0021] like Figure 1As shown, this invention relates to an automated privilege escalation vulnerability detection system, comprising: a user behavior collection module, a user behavior graph analysis module, an attack case generation module, and an execution and reporting module. The user behavior collection module acquires normal user operations and traffic information on the system under test, organizing it into a user behavior flow set. The user behavior graph analysis module integrates the user behavior flow set to generate a user behavior graph, and performs preprocessing and analysis operations on the user behavior graph. The attack case generation module extracts vulnerabilities based on graph features and generates test cases targeting privilege escalation vulnerability vulnerabilities, making offensive modifications. The execution and reporting module executes the attack cases and analyzes the resulting pages generated by the attack cases, drawing vulnerability detection conclusions and generating a complete detection report.

[0022] like Figure 3 As shown, the user behavior collection module includes a user behavior monitoring unit, a parsing unit, and a storage unit. The user behavior monitoring unit acquires user actions and corresponding traffic by monitoring the browser. The parsing unit is used to parse the relationship between actions and traffic and output the results to the test monitoring software. The storage unit stores the collected user behavior links in a serialized manner based on the PKL file format through user annotations for easy subsequent use.

[0023] The normal operation includes, but is not limited to, clicking, inputting, and other operations on the platform under test.

[0024] The aforementioned monitoring refers to monitoring methods based on browser plugins or testing software. Specifically, the browser plugin approach uses browser plugins to locate parameters such as user operation type, location, and time, and then combines this with HTTP message monitoring to align these parameters according to time, thereby acquiring user behavior and operations. The testing software monitoring method is not limited to simultaneously collecting user behavior and traffic using the internal browser driver of tools such as PlayWright.

[0025] like Figure 3 As shown, the alignment refers to the following: Since browser plugins can only monitor user actions, tools such as Burp Suite are needed to monitor request and response times. Then, based on the time of the monitored user actions and request / response times, the actions are aligned with the user's behavior. Due to the time difference, user actions need to be slowed down.

[0026] like Figure 4As shown, the user behavior graph analysis module includes a user behavior graph generation unit and a user behavior graph preprocessing and analysis unit. The user behavior graph generation unit organizes and clusters the acquired user behavior flow set into a behavior graph. The user behavior graph preprocessing and analysis unit performs pruning and simplification on the unprocessed user behavior graph, divides it into behavior subgraphs, and extracts node differences, edge differences, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below the threshold. The user behavior graph generation technology and preprocessing and analysis technology have been described in detail in the technical effects section.

[0027] like Figure 5 As shown, the attack case generation module includes a vulnerability extraction unit and a test case generation unit. The vulnerability extraction unit, based on the user behavior graph analysis results, further processes the extracted results according to node differences, edge differences, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions containing relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below thresholds. This processing generates test targets that can be generated by the test case generation unit, including long business chains (including high-frequency behavior chain extraction and business behavior chain extraction), behavior containing information in request responses, edge redirects, and node URL redirects. The test case generation unit modifies the behavior flow and message parameters offensively according to the attack method to generate test case behaviors or behavior chains.

[0028] The aforementioned behavior of request and response containing information refers to the following: the request and response contain key-value pairs that are suspected of having their unique codes tampered with. The keys include {token, username, ID, id, identity, No, num, mail}, while the values ​​must meet certain specific format requirements (phone number, email address) or meet the requirement of a mixed length of English letters, numbers, and symbols exceeding 6.

[0029] The aforementioned malicious modifications refer to: Modifications to message parameters involve replacing the values ​​of key-value pairs with uniquely tampered code (the replacement source being the data message from the same position included during initial execution), cookies, or tokens (data message parameters obtained in real-time during simultaneous login of two accounts). Modifications to long business chains involve altering the order of behavior flows, including skipping critical page nodes and grafting dual-account login parameters. Skipping critical page nodes means traversing from non-starting nodes in the long chain, selecting a node, reaching the previous node, executing one of the non-edge behavior lists, and then directly jumping to the child node of its child node via the URL. Grafting dual-account login parameters means simultaneously executing two behavior flows, replacing all non-cookie parameters of the other account's parameters with parameters from one account.

[0030] like Figure 2 As shown, this embodiment illustrates an automated privilege escalation vulnerability detection method based on the aforementioned system, comprising:

[0031] Step 1: Use the PlayWright codegen feature or a browser plugin and HTTP packet monitoring software to collect user behavior information and corresponding traffic. Monitoring includes: popping up the built-in browser, collecting user clicks and input behaviors within the browser, extracting these behaviors into a sequence of executable actions, and storing them. Then, automatically execute the collected user behavior once, while simultaneously intercepting the corresponding data packets.

[0032] The PlayWright codegen includes: based on the open-source PlayWright component, using Python's built-in subprocess method to create a subprocess to run playwright codegen-o.

[0033] UA_module / UA_record / filename--device CONFIG_DICT["device"]–targetpython CONFIG_DICT["url"], where the simulated device includes mobile devices or computer devices, depending on the user configuration, and url represents the target web application that initiates user information collection and sets the first page.

[0034] The collection of user behavior in the browser refers to: performing code analysis on the behavior files generated by PlayWright to extract specific user operation information, or directly obtaining user operation information through the browser. The specific information extracted includes the location of clicked or entered elements, clicked content, entered content, URL changes, etc., to facilitate subsequent execution by the executor after parsing the operation.

[0035] like Figure 3 As shown, the code analysis refers to the following: Since Playwright's monitoring function only adds monitoring modules when simulating user behavior, and this is not simultaneous with user behavior monitoring, Playwright's codegen function is first used to monitor user behavior and generate Python code. Therefore, the generated Python code needs to be parsed. After parsing, user behavior is simulated based on the parsed locator, action, and fill parameters. During simulation, request monitoring modules, response monitoring modules, and HTML file monitoring modules for page redirects are added (the simulation execution time interval needs to be reduced to ensure that requests, responses, and pages can all be dynamically loaded completely). This is based on Playwright's monitoring methods, including the page, user behavior within the page, and their corresponding requests and responses.

[0036] The interception of data packets after simulating user operation refers to adding a callback function in the browser context when the browser sends a request. This callback function is called every time a request is sent to obtain the request and response data for that request, until the simulated normal user operation is completed.

[0037] The URL change information extraction refers to: when the simulated user re-executes the operation, a callback function is added in the browser context. When the URL changes and the page redirects, the page redirection information is detected, and the dynamic HTML file of the page is collected 1.5 seconds after the page redirection.

[0038] Step 2: Preprocess and analyze the user behavior stream set obtained in Step 1, specifically including:

[0039] 2.1 Extract a certain amount of common subtrees with the same path from the page nodes of the user behavior flow. By parsing the behavior flow set of each user and using a page node clustering algorithm based on page similarity matching of common subtrees and an edge and behavior matching algorithm, integrate the user behavior flow set into a user behavior flow graph.

[0040] The page node clustering based on page similarity matching without common subtrees refers to the inclusion of the concept of common subtrees in the similarity matching technology in this invention. Common web applications need to maintain a consistent product style and possess a certain level of fast navigation capability, which leads to common modules appearing in HTML files, represented as a common HTML DOM tree in file analysis. To exclude the influence of small DOM trees that lack directory functionality or common attributes, filtering is performed based on the size of the common subtree when extracting it, filtering objects whose common subtree size is below a threshold. Based on the above, the common subtree matching used in this invention is as follows: First, it is determined whether the domain and the front-end route are the same. If the parameter key-value sets are the same, it is considered a match (parameter matching excludes route parameters, token parameters, etc., which should not appear in the GET request parameter area). Otherwise, the similarity calculation of the HTML files without common subtrees is used to determine whether the node matches if it exceeds a threshold.

[0041] The aforementioned common subtree volume refers to a method for calculating the volume of HTML subtree nodes, designed for the tree structure in HTML page code. Because the focus is on efficiently extracting menu-type common subtrees while relatively ignoring the specific content of the page, this invention assigns breadth weights to the child nodes of subtrees in the page's DOM tree when calculating volume. Simultaneously, this breadth weight decays at a rate of 0.7 as the depth of the DOM subtree gradually increases. Finally, based on the calculation results, subtrees with a volume greater than 7 are considered by this invention to be a worthwhile common page module (subtree) to extract.

[0042] 2.2 Based on the common subtree, interference edges and return edges are discovered and removed, and root nodes are extracted. Subgraph partitioning is performed based on the number of root nodes.

[0043] The removal of interfering edges refers to the following: Common web application page navigation methods often provide users with quick navigation for ease of operation, which generally results in page navigation across subgraphs. These navigation structures appear in the common subtree of the page. Therefore, quick navigation triggered from the common subtree that includes other reachable paths will be removed from the graph (if other reachable paths formed by quick navigation are also achieved by other nodes through this common subtree, then no pruning will be performed). Page navigation edges triggered from the common subtree of non-root nodes will also be removed.

[0044] The removal of return edges refers to the following: After some common business operations are completed, the user will jump back to the parent node, root node, child root node, or business starting node. These edges, which have no business significance, will form redundant edges and cycles that interfere with the analysis and affect the extraction of edge nodes. Therefore, they need to be removed. Here, we need to remove all edges whose endpoints are the root node, child root node, or parent node, where the starting node of the edge has no other out-degree.

[0045] The subgraph partitioning mentioned refers to subgraph extraction based on the Girvan-Newman algorithm for extracting sub-module regions in web applications. For a simplified graph that has already undergone pruning of interfering and returning edges, the Girvan-Newman algorithm is first used for subgraph discovery. If a node is directly connected to only one other node (an isolated node), then the child nodes of that node pair need to be forcibly added to the subgraph of its parent node. Similarly, if all the neighbors of a node belong to the same node, that node will be forcibly added to that subgraph. These two correction strategies effectively correct unreasonable results from the betweenness-based partitioning of Girvan-Newman. Compared to directly merging isolated nodes onto their parent nodes, this method more effectively preserves graph features and reduces the probability of Girvan-Newman errors. Furthermore, since sub-regions in web application design are necessarily systematic, it is necessary to exclude cases where the number of subgraph nodes is too small. When the number of nodes is less than 4, the total number of subgraph nodes is reduced, and the Girvan-Newman algorithm is called again for correction until the total number of nodes in each subgraph is greater than or equal to four.

[0046] The root node refers to a page node with directory capabilities and a large out-degree in the user behavior graph or its subgraph. The criterion for judgment is whether the node has an out-degree greater than 50% of the number of nodes in its child nodes before removing interfering edges.

[0047] 2.3 For the extracted non-starting nodes, i.e., the common subtrees in the new subgraph where the homepage of the non-web application is located, the discovery and pruning of interfering edges and return edges are re-executed to generate a simplified user behavior graph.

[0048] 2.4 Analyze the simplified user behavior graph to extract vulnerabilities related to privilege escalation.

[0049] 2.5 Extraction of privilege escalation vulnerabilities based on user behavior graph features, including node differences and edge differences between user groups, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below the threshold.

[0050] The user behaviors with relevant information in the aforementioned nodes refer to the analysis of sensitive parameters containing user information commonly found in current solutions, including username, suspected unique identifier, mobile phone number, email address, and postal code.

[0051] The edge nodes located in each user behavior graph subgraph refer to nodes that, because they have no child nodes, do not have page navigation functionality. Therefore, the services they can provide are limited to static information provision or system function provision. Providing static information is not within the scope of privilege escalation vulnerability detection, while system function behavior is a sensitive point for privilege escalation vulnerabilities.

[0052] The boundary page nodes between subgraphs refer to the fact that, since the sub-regions of a web application are non-overlapping, the resulting subgraphs are also non-overlapping. Here, the boundary page nodes between subgraphs are directly connected pairs of points in the subgraphs, with the root node as the endpoint. If there is a difference in nodes between subgraphs in a user behavior group graph, and the boundary page nodes between the subgraphs are reachable, then the reachability detection of the nodes in that subgraph can be represented by the overall reachability of the root node.

[0053] The aforementioned user behavior functions and long links with high frequency of occurrence or in-degree and out-degree below the threshold refer to: links that are repeatedly triggered multiple times in the collected user behaviors, and these links are characterized by being uninterrupted, repeating more than three times, having a link length of three or more, having non-redirecting user behaviors, and having the same user behavior list. These links exhibit repeatability, link stability, contextual relevance, and functionality in user behavior. This situation can also be analyzed from the user behavior graph, namely, long links with in-degree and out-degree below the threshold. The characteristics of such links are that the links are long and, except for the starting node (after pruning), their out-degree and in-degree are extremely low. In other words, the business process leads to page redirection, user behavior has strong stability, and contextual relevance, and therefore they are considered weak points in the functional chain.

[0054] Step 3: Further analyze the five vulnerabilities extracted from the user behavior graph group to extract the content to be tested for privilege escalation vulnerabilities, and perform offensive tampering on the content to be tested according to the privilege escalation vulnerability triggering method to form test cases.

[0055] Step 4: The test cases generated in Step 3 are handed over to the executor for execution. Each time the executor executes an attack case, it will simulate the user behavior information collected in Step 1. When it executes a parameter that needs to be tampered with, it will intercept the data packet after simulating the user operation, replace the corresponding parameter value with the attack parameter in the attack phrase, and then release the data packet.

[0056] The executor refers to: reading formatted user behavior information, determining the user operation type based on different user actions, and using PlayWright to execute operations such as clicking a button or entering information in an input box; and executing corresponding attacks based on the test case attack type. The attack result feedback is divided into two parts: first, message result analysis, used for behavioral attack result analysis, analyzing keywords and similarity in the feedback messages; second, page analysis, used for node reachability and edge behavioral attack result analysis, analyzing the page's HTML file, and calculating similarity based on messages after removing common subtrees to determine the attack result. A report is generated based on the attack results.

[0057] The interception of data packets after simulating user operations refers to using PlayWright's built-in interface context.route to intercept and process data packets. This involves modifying the original normal data into attack data within the attack phrase. Specifically, the intercepted data is separated according to different types such as POST / GET. Based on the parameter type, GET parameters and parameters of types such as application / json, application / x-www-form-urlencoded, and multipart / form-data in POST are parsed. After parsing, the corresponding parameter keys are found and their values ​​are modified. Finally, the processed data packets are released.

[0058] The report refers to: basic information including the platform under test, time, and location; result statistics report; and individual test case report (including the type of attack execution, login node input information, automated execution behavior, attack behavior (tampered parameter key-value pairs), attack result, and proof of attack result).

[0059] Through specific experiments, the capabilities of this invention were tested on existing common vulnerability testing platforms. The test ranges included osCommerce, BWAPP, OWASP Juice Shop, The Bodgeit Store, WackoPicko, DVWA, etc., involving backend code in PHP, NodeJS, Java, etc. The diversity of the test ranges ensured the usability of this invention.

[0060] As shown in Table 1, the page similarity matching method after removing the common subtree used in this embodiment achieved 100% location clustering accuracy in these 5 target ranges.

[0061] Table 1

[0062]

[0063] This embodiment filters out a large number of non-target ports based on the functional nodes obtained from the analysis of edge nodes and sensitive parameters of the subgraph. On average, it filters 87.32% of ports in the test range. Existing commercial privilege escalation testing software such as APPScan lacks interface filtering capabilities, meaning it tests 7.32 times the number of web application locations compared to this system. Furthermore, the port filtering results of this invention have an average false negative rate of only 5.42%, and the detection accuracy is 23.07% higher than some commercial software. Moreover, this embodiment also found 5 vulnerabilities in the test range that were not included in the test range's vulnerability list.

[0064] This embodiment utilizes methods of collecting and executing user actions and constructing user behavior graphs to effectively identify vulnerabilities after comprehensive analysis, improving the accuracy of test cases. It filters out a large number of common request responses that are not excluded in traditional privilege escalation vulnerabilities and includes them in test cases. With a port filtering rate as high as 87.32%, the average false negative rate for ports is only 5.42%, significantly improving detection efficiency. It automatically executes attack cases and, through methods such as... Figure 4 A new type of page similarity judgment and request-response similarity is used to determine whether a vulnerability exists.

[0065] In summary, this invention analyzes sensitive parameters in system-collected traffic packets to discover suspected unique identifiers of privilege escalation vulnerabilities, thereby generating test cases. The vulnerability type, detection process, detection results, and judgment criteria are output in a report for security personnel to patch the vulnerabilities. It enables the reuse of test traffic for privilege escalation vulnerability detection with high automation, and extends traditional automated detection of single-point privilege escalation vulnerabilities to context-based chain-like level privilege escalation vulnerability detection.

[0066] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. An automated privilege escalation vulnerability detection system, characterized in that, include: The system comprises a user behavior collection module, a user behavior graph analysis module, an attack test case generation module, and an execution and reporting module. Specifically: the user behavior collection module acquires normal user operations and traffic information within the system under test, organizing it into a user behavior flow set; the user behavior graph analysis module integrates the user behavior flow set to generate a user behavior graph, and performs preprocessing and analysis on the graph; the attack test case generation module extracts vulnerabilities based on graph features and generates test cases targeting privilege escalation vulnerabilities, making offensive modifications; the execution and reporting module executes the attack test cases, analyzes the resulting pages, draws vulnerability detection conclusions, and generates a complete detection report. The aforementioned user behavior flow set integration refers to extracting common subtrees of pages from page nodes in the user behavior flow, clustering page nodes based on the removal of common subtrees, and clustering user behaviors, so that multiple user behavior flows can form a complete user behavior graph with a large number of duplicate and interfering edges. Interfering edges refer to edges provided by the developer that are unrelated to the normal business process. The user behavior graph refers to a graph topology data structure constructed for a user role in a platform under test, consisting of user-accessible pages, executable operations, and page navigation behaviors. It is used to describe the actual permissions and capabilities of a user under normal operation. The nodes in this graph topology are user-accessible pages of the system under test, which include executable user behavior operations as node attributes, and the edges are user behaviors that cause page navigation. The aforementioned offensive modification refers to: performing offensive tampering on the traffic contained in the privilege escalation vulnerability; The vulnerability extraction based on graph features refers to the features found in common trigger cases of vertical and horizontal escalation, including node differences and edge differences between different user groups, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links that occur frequently or have in-degree and out-degree values ​​lower than the specified values.

2. The automated privilege escalation vulnerability detection system according to claim 1, characterized in that, The preprocessing and analysis include: extraction of jump edges and behaviors in common subtrees, pruning of direct jump edges based on common subtrees, subgraph segmentation, preprocessing behavior of re-clustering nodes within subgraphs, and analysis behavior of node differences, edge differences, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below the threshold.

3. The automated privilege escalation vulnerability detection system according to claim 1, characterized in that, The user behavior collection module includes a user behavior monitoring unit, a parsing unit, and a storage unit. The user behavior monitoring unit acquires user actions and corresponding traffic by monitoring the browser. The parsing unit parses the relationship between actions and traffic and outputs the results to the testing monitoring software. The storage unit stores the collected user behavior links in a serialized format based on PKL file format using user annotations for easy subsequent use.

4. The automated privilege escalation vulnerability detection system according to claim 1, characterized in that, The user behavior graph analysis module includes a user behavior graph generation unit and a user behavior graph preprocessing and analysis unit. The user behavior graph generation unit is used to organize and cluster the acquired user behavior flow set into a behavior graph. The user behavior graph preprocessing and analysis unit performs pruning and simplification on the unprocessed user behavior graph, divides it into behavior subgraphs, and extracts node differences, edge differences, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below the threshold. The user behavior graph generation technology and preprocessing and analysis technology have been described in detail in the technical effects section.

5. The automated privilege escalation vulnerability detection system according to claim 1, characterized in that, The attack case generation module includes a vulnerability extraction unit and a test case generation unit. The vulnerability extraction unit, based on the user behavior graph analysis results, further processes the extraction results according to the differences between nodes and edges between user groups, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below the threshold, to generate the test target generated by the test case generation unit. This includes long business chains, behavior containing information in request and response, edge jumps, and node URL jumps. The test case generation unit modifies the behavior flow and message parameters offensively according to the attack method to generate test case behaviors or behavior chains. The aforementioned long business chain includes: high-frequency behavior chain extraction and business behavior chain extraction; The aforementioned behavior of request and response containing information refers to the following: the request and response contain key-value pairs that are suspected of having their unique codes tampered with. The keys include {token, username, ID, id, identity, No, num, mail}, while the values ​​must be in the format of a mobile phone number or email address, or have a length exceeding 6 characters that is a mixture of English letters, numbers, and symbols.

6. The automated privilege escalation vulnerability detection system according to claim 1, characterized in that, The aforementioned offensive modifications, specifically targeting message parameters, involve replacing the values ​​of key-value pairs with uniquely tampered code. The replacement source is the data message, cookie, or real-time data message parameters (i.e., tokens) obtained during the initial execution of the data message at the same location. Offensive modifications targeting long business chains involve altering the order of the behavior flow, including skipping key page nodes and grafting dual-account login parameters. Skipping key page nodes means traversing and selecting a node from the non-starting nodes in the long chain, then reaching the previous node and executing one of the non-edge behavior lists, and then directly jumping to the child node of its child node via the URL. Grafting dual-account login parameters means executing two behavior flows simultaneously, replacing all non-cookie parameters of the other account with the parameters of one account.

7. An automated method for detecting privilege escalation vulnerabilities in a system according to any one of claims 1-6, characterized in that, By monitoring the operational behavior of functional testers on the target system and obtaining the corresponding traffic data, user behavior graphs are generated based on user behavior and traffic. After preprocessing and analysis, user graph groups are obtained. Based on the user graph groups, privilege escalation vulnerabilities are discovered and maliciously modified to obtain test cases. The test cases are then automatically executed, and the attack results are obtained and a system vulnerability report is generated.

8. The method for detecting privilege escalation vulnerabilities according to claim 7, characterized in that, specifically... include: Step 1: Use the PlayWright codegen function or browser plugin and HTTP packet monitoring software to collect user behavior information and corresponding traffic. Specifically: pop up the built-in browser, collect the user's click and input behavior in the browser, extract the behavior into a sequence of subsequent executable operations and store it; then initialize and automatically execute the collected user behavior once, while intercepting the corresponding data packets. Step 2: Preprocess and analyze the user behavior stream set obtained in Step 1, specifically... include: 2.1 Extract a certain amount of common subtrees with the same path from the page nodes of the user behavior flow. By parsing the behavior flow set of each user and using a page node clustering algorithm based on page similarity matching of common subtrees and an edge and behavior matching algorithm, integrate the user behavior flow set into a user behavior flow graph. 2.2 Based on the common subtree, interference edges and return edges are discovered and removed, and root nodes are extracted. Subgraphs are partitioned based on the number of root nodes. 2.3 For the extracted non-starting nodes, i.e., the common subtrees in the new subgraph where the homepage of the non-web application is located, the discovery and pruning of interfering edges and return edges are re-executed to generate a simplified user behavior graph; 2.4 Analyze the simplified user behavior graph to extract vulnerabilities related to privilege escalation. 2.5 Extraction of vulnerabilities for unauthorized access based on user behavior graph features, including node differences and edge differences between user groups, user behaviors at different operation positions on nodes, edge nodes in each user behavior graph subgraph, boundary page nodes between subgraphs, user behavior functions with relevant information in the above nodes, and long links with high frequency or in-degree and out-degree below the threshold. Step 3: Further analyze the five vulnerabilities extracted from the user behavior graph group to extract the content to be tested for privilege escalation vulnerabilities, and perform offensive tampering on the content to be tested according to the privilege escalation vulnerability triggering method to form test cases; Step 4: The test cases generated in Step 3 are handed over to the executor for execution. Each time the executor executes an attack case, it will simulate the user behavior information collected in Step 1. When it reaches the point where it needs to tamper with the message parameters, it will intercept the data packet after simulating the user operation, replace the corresponding parameter values ​​with the attack parameters in the attack phrase, and then release the data packet.

9. The method for detecting privilege escalation vulnerabilities according to claim 7, characterized in that, The report includes: basic information, result statistics report, attack execution type, login node input information, automated execution behavior, attack behavior, i.e., tampered parameter key-value pairs, attack result, and proof of attack result.

Images