Application program security test system based on multi-dimensional risk analysis

Abstract

The invention discloses an application program security test system based on multi-dimensional risk analysis, and belongs to the technical field of computer science, the system comprises a risk identification module, a security execution module, a repair module, a knowledge graph module and a monitoring and reporting module, the risk identification module captures security threats and risks in an application, and performs preliminary assessment and classification; the security execution module deeply explores and verifies security vulnerabilities through automatic and manual penetration testing; the repair module records vulnerability details and plans and tracks a repair process; the knowledge graph module presents vulnerabilities, attack techniques and protection measures in a graphical manner, and enhances security cognition; and the monitoring and reporting module continuously monitors the security state of the application and generates a security report, so that the security of the application program is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer science and technology, and specifically is an application security testing system based on multi-dimensional risk analysis. Background Art

[0002] With the rapid development of information technology, applications have become an indispensable part of modern life and work. However, the complexity and diversity of applications have also brought severe security challenges. Security threats such as hacker attacks, data leaks, and malware are emerging in an endless stream, posing a serious threat to user privacy and corporate data security. Therefore, security testing of applications to promptly discover and fix potential security vulnerabilities has become an important means to ensure application security.

[0003] For example, the patent with publication number CN114650168A discloses an application security testing method, including: S1, installing an operating system in a computer; S2, configuring a packet capture tool in the operating system; S3, traversing all network data exchange functions of the application to be tested in the operating system; S4, using the packet capture tool to capture the corresponding network data packets used to implement all network data exchange functions; S5, judging whether the application is safe based on the network data packets. This technical solution can perform application security testing on domestic operating systems.

[0004] For example, the patent with the authorization announcement number CN103562923B discloses application security testing, including: a server hosting an application under test (AUT), an observer configured to monitor instructions executed by the AUT, and a computing device communicatively coupled to the AUT and the observer through a common communication channel. The computing device can be configured to send an application request to the AUT, wherein the application request is configured to expose potential vulnerabilities of the AUT. The computing device can receive an application response from the AUT according to the programming of the AUT. The computing device can send a service request to the observer, and receive a service response from the observer, which contains information corresponding to instructions executed by the AUT due to the application request, information about the AUT, or information about the server hosting the AUT.

[0005] The above existing technologies all have the following problems: 1) limited testing scope; 2) poor scalability and flexibility; 3) lack of repair and tracking mechanism; 4) lack of automation and intelligence. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention proposes an application security testing system based on multi-dimensional risk analysis. The system includes: a risk identification module, a security execution module, a repair module, a knowledge graph module, and a monitoring and reporting module. The risk identification module captures security threats and risks in the application, and preliminarily evaluates and classifies them; the security execution module deeply discovers and verifies security vulnerabilities through automated and manual penetration testing; the repair module records vulnerability details, plans and tracks the repair process; the knowledge graph module graphically presents vulnerabilities, attack methods and protection measures to enhance security awareness; the monitoring and reporting module continuously monitors the application security status and generates security reports, thereby improving the security of the application.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] An application security testing system based on multi-dimensional risk analysis, comprising: a risk identification module, a security execution module, a repair module, a knowledge graph module, and a monitoring and reporting module;

[0009] The risk identification module is used to identify security threats and risks in the application and to perform preliminary assessment and classification of the risks;

[0010] The security execution module is used to perform specific test operations to discover and verify security vulnerabilities;

[0011] The repair module is responsible for recording vulnerability information, formulating a repair plan, and tracking the repair progress;

[0012] The knowledge graph module is used to display the information of vulnerabilities, attack methods and protection measures in a graphical manner by constructing a security knowledge graph;

[0013] The monitoring and reporting module is used to monitor the security status of the application and generate a security report.

[0014] Specifically, the specific execution steps of the risk identification module include:

[0015] A1: Integrate API interfaces and information capture methods to collect multi-source security data in real time, combine external threat intelligence from network security communities, security announcements, and vulnerability databases, and fuse them to obtain risk basic data X = {x1,...,x n}, and use machine learning algorithms to train X={x1,...,x n} for preprocessing, where x n represents the nth risk basic data, and n represents the number of risk basic data;

[0016] A2: Integrate the static code structure and dynamic runtime data of the application to dynamically build the flowchart of the application based on the risk basic data X = {x1,...,x n}, use the flowchart analysis method to identify the risk points of the application and the corresponding risk data.

[0017] Specifically, the specific execution steps of the risk identification module also include:

[0018] A3: Use the pre-trained deep learning classification model to classify the identified risk data according to the preset risk type and generate classification labels B = {b1,...,b m}, and obtain the classified risk data Y = {y1,...,y m}, where b m Represents the classification label of the mth classification risk data, y m represents the mth classified risk data, and m represents the number of classified risk data;

[0019] A4: Use the risk assessment model to classify risk data Y = {y1,...,y m} to conduct risk quantitative assessment and use fuzzy comprehensive evaluation method to calculate the risk value R = {r1,...,r m}, and sort the classified risk data in descending order according to the risk value to generate a risk priority list;

[0020] A5: Establish a monitoring mechanism to track application status and external environment changes in real time, and dynamically adjust risk priority ranking.

[0021] Specifically, the specific steps of A2 include:

[0022] A2.1: Prepare static code analysis tools, dynamic runtime data capture tools, and data preprocessing tools, run static code analysis tools to obtain source code control flow information, capture dynamic data when the application is running, and integrate static and dynamic data to obtain a fused data set;

[0023] A2.2: Based on the fused data set, a control flow graph and a data flow graph are constructed and merged into a dynamic flow graph containing control flow and data flow information. The flow graph is dynamically updated according to the runtime data captured in real time.

[0024] A2.3: Risk basic data X = {x1,...,x n}Match with the dynamic flowchart to find risk points, and use the path analysis method to identify risk points and their context to obtain risk data.

[0025] Specifically, the specific steps of A4 include:

[0026] A4.1: Determine the objectives and scope of risk assessment, receive classified risk data Y = {y1,...,y m}, and decompose the risk assessment problem into different components, forming a hierarchical structure including the goal layer, the criterion layer and the solution layer;

[0027] A4.2: Classify the risk data Y = {y1,...,y m}In the input hierarchical structure, use the 1-9 scaling method to compare the elements at the same level and construct a judgment matrix Use the eigenvalue decomposition method to calculate the largest eigenvalue λ of M max , according to λ max Calculate the consistency ratio κ of the judgment matrix, the formula is:

[0028]

[0029] Among them, a ij represents the judgment matrix element, β represents the complexity factor, and β∈[0,1], η represents the average random consistency index, which is a constant obtained by looking up the table according to the order n of the judgment matrix, δ represents the expert confidence, and δ∈[0,1], n represents the order of the judgment matrix;

[0030] A4.3: Adjust the judgment matrix according to the consistency ratio κ;

[0031] If κ≤0.1, the elements in the eigenvector of the judgment matrix can be used as weights;

[0032] If κ>0.1, the judgment matrix is ​​readjusted.

[0033] Specifically, the specific steps of A4 also include:

[0034] A4.4: Calculate the maximum eigenvalue of the adjusted judgment matrix and its corresponding eigenvector W, and normalize W to obtain a normalized weight vector. At the same time, the normalized weight vectors of different levels are combined to obtain a weight matrix.

[0035] A4.5: Set the risk level to low risk, medium risk, high risk, and extremely high risk, determine the membership function for each criterion layer element, and construct a fuzzy judgment matrix based on the membership function and the actual value of the criterion layer element;

[0036] A4.6: Perform a synthetic operation on the fuzzy judgment matrix and the weight matrix to obtain the comprehensive risk value of each classified risk data;

[0037] A4.7: According to the comprehensive risk value, the classified risk data are sorted in descending order to generate a risk priority list, and the risk data with the highest risk value are listed as the priority objects.

[0038] Specifically, the security execution module adopts an adaptive adjustment algorithm, and the specific steps include:

[0039] B1: Obtain the identified risk point information and security vulnerability information from the risk identification module, collect multi-dimensional information of the application, use the fusion algorithm to fuse the risk point information, security vulnerability information and multi-dimensional information to obtain fused data, and perform risk assessment based on the fused data;

[0040] B2: Based on the results of risk assessment, use adaptive genetic algorithm to analyze the fusion data, and formulate adaptive test strategy based on the analysis results to clarify the test scope, test methods, and test case priorities;

[0041] B3: Use automated testing tools to test applications according to the established automated testing strategy. If an area is at high risk or automated testing is not possible, perform manual penetration testing.

[0042] B4: Collect the results of automated testing and manual penetration testing, conduct comprehensive analysis, evaluate the test results, and feed back the test results to the adaptive genetic algorithm. According to the test results and feedback, the test strategy is adaptively adjusted. At the same time, a test report is generated and submitted to the staff for review and processing.

[0043] Specifically, the risk identification module includes: a threat intelligence unit, a risk assessment unit, a policy recommendation unit, and a real-time update unit; the threat intelligence unit is used to collect and analyze the latest IoT security threat intelligence using a data mining algorithm; the risk assessment unit is used to assess the possibility and impact of risks based on threat intelligence and the actual situation of the application; the policy recommendation unit is used based on historical security test data and the specific environment of the current application; the real-time update unit is used to maintain real-time synchronization with external threat intelligence sources through an API interface.

[0044] Specifically, the repair module includes: a vulnerability discovery unit, an automated repair unit, and a repair verification unit; the vulnerability discovery unit is used to use a vulnerability tracking system to record and report vulnerabilities discovered during the security test process; the automated repair unit is used to formulate a vulnerability repair plan and track the repair progress; the repair verification unit is used to verify whether the vulnerability has been effectively repaired, and once the verification is completed, re-execute the security test.

[0045] Specifically, the knowledge graph module includes: a knowledge extraction unit, a graph construction unit, and a visualization display unit; the knowledge extraction unit is used to extract security knowledge from vulnerability databases, security forums, and technical documents; the graph construction unit is used to organize the extracted security knowledge into a graph form, including vulnerability associations, attack paths, and protective measures; the visualization display unit is used to display the security knowledge graph to testers and security experts in a graphical manner.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] 1. The present invention proposes an application security testing system based on multi-dimensional risk analysis, and optimizes and improves the architecture, operation steps and processes. The system has the advantages of simple process, low investment and operation costs, and low production work costs.

[0048] 2. The present invention proposes an application security testing system based on multi-dimensional risk analysis. The system uses a risk identification module, combined with multi-dimensional information of threat intelligence, application architecture, code, and external interfaces, to comprehensively and accurately identify security threats and risks in applications, and conduct preliminary evaluation and classification, which helps to discover and resolve potential security issues in the early stages of development and reduce subsequent repair costs and risks; the policy recommendation unit provides testers with intelligent security testing policy recommendations based on historical security test data and the specific environment of the current application, thereby improving the pertinence and efficiency of testing; the security execution module realizes the automation of security testing and vulnerability repair by adopting automated tools and processes, which not only saves a lot of manpower costs and time, but also improves the accuracy of testing and the timeliness of vulnerability repair.

[0049] 3. The present invention proposes an application security testing system based on multi-dimensional risk analysis. The knowledge graph module enables testers and security experts to more intuitively understand the security status and risk distribution of the application, facilitating the formulation of targeted security strategies and protective measures; the monitoring and reporting module provides staff with timely and accurate security information and suggestions. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is an architecture diagram of an application security testing system based on multi-dimensional risk analysis of the present invention;

[0051] Figure 2 This is a workflow diagram of a risk identification module of an application security testing system based on multi-dimensional risk analysis of the present invention;

[0052] Figure 3 This is a risk assessment flow chart of an application security testing system based on multi-dimensional risk analysis of the present invention. DETAILED DESCRIPTION

[0053] Example 1

[0054] See also Figure 1 ,An embodiment provided by the present invention: an application security testing system based on multi-dimensional risk analysis, including: a risk identification module, a security execution module, a repair module, a knowledge graph module, and a monitoring and reporting module;

[0055] The risk identification module is used to identify security threats and risks in applications. It collects and analyzes the application architecture, code, external interfaces, and combines the latest threat intelligence to conduct preliminary risk assessment and classification.

[0056] The security execution module is used to perform specific test operations to discover and verify security vulnerabilities;

[0057] The repair module is responsible for recording vulnerability information, formulating repair plans, and tracking repair progress;

[0058] The knowledge graph module is used to display information about vulnerabilities, attack methods, and protection measures in a graphical manner by building a security knowledge graph;

[0059] The monitoring and reporting module is used to monitor the security status of the application and generate security reports.

[0060] The risk identification module includes: threat intelligence unit, risk assessment unit, strategy recommendation unit, and real-time update unit;

[0061] Threat intelligence unit, which uses data mining algorithms to collect and analyze the latest IoT security threat intelligence, including known vulnerabilities and attack methods;

[0062] The risk assessment unit is used to assess the possibility and impact of risks based on threat intelligence and the actual situation of the application;

[0063] The policy recommendation unit is used to provide intelligent security testing policy recommendations to testers based on historical security testing data and the specific environment of the current application;

[0064] The real-time update unit is used to maintain real-time synchronization with external threat intelligence sources through the API interface to ensure that risk assessment is based on the latest threat information.

[0065] The security execution module includes: automated testing unit and manual penetration testing unit;

[0066] Automated testing unit for static code analysis, dynamic code analysis, and penetration testing of applications using SonarQube static code scanner, OWASP ZAP dynamic analysis tool, and penetration testing framework;

[0067] The artificial penetration testing unit is used to simulate hacker attack behaviors and conduct in-depth penetration testing on applications.

[0068] The repair module includes: vulnerability discovery unit, automated repair unit, and repair verification unit;

[0069] Vulnerability Discovery Unit, which uses a vulnerability tracking system to record and report vulnerabilities discovered during security testing;

[0070] The automated repair unit is used to develop vulnerability repair plans and track the repair progress, mainly to repair high-risk vulnerabilities first based on the severity and impact of the vulnerabilities;

[0071] The repair verification unit is used to verify whether the vulnerability has been effectively repaired. After the verification is completed, the security test is re-executed.

[0072] The knowledge graph module includes: knowledge extraction unit, graph construction unit, and visualization display unit;

[0073] Knowledge extraction unit, used to extract security knowledge from various security data sources, such as vulnerability databases, security forums, and technical documents;

[0074] The graph construction unit is used to organize the extracted security knowledge into a graph form, including vulnerability associations, attack paths, and protection measures;

[0075] The visualization unit is used to display the security knowledge graph to testers and security experts in a graphical manner.

[0076] The monitoring and reporting module includes: security monitoring unit, anomaly detection unit, and security reporting unit;

[0077] Security monitoring unit, used to monitor the security status of the application in real time, including network traffic and user behavior;

[0078] Anomaly detection unit, which uses machine learning algorithms to detect anomalies in monitoring data and promptly discover existing security threats;

[0079] The security reporting unit is used to regularly generate security reports to inform staff of the security status of the application and the status of vulnerability repairs.

[0080] The specific workflows of the risk identification module, security execution module, repair module, knowledge graph module, monitoring and reporting module and their corresponding units include:

[0081] The threat intelligence unit in the risk identification module collects and analyzes security threat intelligence from inside and outside, and passes the collected threat intelligence to the risk assessment unit for further analysis and evaluation; the risk assessment unit receives the information transmitted by the threat intelligence unit, and conducts risk assessment on potential security threats in combination with the actual situation of the application, determines the severity and urgency of the threat, and passes the assessment results to the strategy recommendation unit, and synchronizes the relevant information to the knowledge graph module for updating; the strategy recommendation unit provides test strategy recommendations for the security execution module based on the risk assessment results, passes the test strategy recommendations to the security execution module, and guides it to perform specific test operations; the real-time update unit is responsible for monitoring the latest changes in threat intelligence and risk assessment results, timely updating the data and policies in the risk identification module, and maintaining real-time communication with the threat intelligence unit and risk assessment unit to ensure the accuracy and timeliness of the data;

[0082] The automated testing unit in the security execution module automatically performs security testing according to the testing strategy provided by the strategy recommendation unit, and passes the test results to the repair module and the monitoring and reporting module for subsequent processing and analysis; the manual penetration testing unit also passes the test results to the repair module and the monitoring and reporting module;

[0083] The repair module integrates the test results of the automated testing unit and the manual penetration testing unit through the vulnerability discovery unit, identifies specific vulnerabilities in the application, and passes the vulnerability information to the automated repair unit and the repair verification unit; the automated repair unit attempts to automatically perform repair operations for known vulnerabilities, and passes the repair results to the repair verification unit for verification; the repair verification unit verifies whether the vulnerability has been successfully repaired, and feeds back the verification results to the monitoring and reporting module, and synchronizes the repair information to the knowledge graph module for update;

[0084] The knowledge extraction unit of the knowledge graph module extracts knowledge related to application security from various data sources and passes the extracted knowledge to the graph construction unit; the graph construction unit uses the extracted knowledge to construct a security knowledge graph to display the relationship between vulnerabilities, attack methods, and protection measures, and passes the constructed knowledge graph to the visualization display unit; the visualization display unit provides the visualization results to security personnel for viewing and synchronizes them to the monitoring and reporting module;

[0085] The security monitoring unit in the monitoring and reporting module monitors the security status of the application in real time, and passes the monitored security events to the anomaly detection unit for processing; the anomaly detection unit passes the detected anomaly information to the repair module for processing, and synchronizes the relevant information to the security reporting unit; the security reporting unit provides the security report to relevant personnel for review, and synchronizes the report content to the knowledge graph module for archiving and updating.

[0086] Furthermore, the specific implementation steps of the repair module include:

[0087] (1) Start vulnerability discovery: Use a vulnerability tracking system to perform a comprehensive scan of the application, record and report the vulnerabilities found;

[0088] (2) Vulnerability assessment and ranking: Evaluate the discovered vulnerabilities and determine their severity and priority;

[0089] (3) Develop a remediation plan: Develop a detailed remediation plan based on the vulnerability assessment results;

[0090] (4) Perform repair: Repair the vulnerabilities in the application according to the repair plan;

[0091] (5) Repair verification: Re-run the security test to verify whether the vulnerability has been effectively repaired;

[0092] (6) Generate repair report: Write a repair report and provide feedback on the repair results to relevant parties;

[0093] (7) Continuous monitoring and updating: Continue to monitor the security status of the application and promptly identify and address new vulnerabilities.

[0094] Example 2

[0095] See also Figure 2-Figure 3 , the specific execution steps of the risk identification module in this embodiment include:

[0096] A1: Integrate API interfaces and information capture methods to collect multi-source security data in real time, combine external threat intelligence from network security communities, security announcements, and vulnerability databases, and fuse them to obtain risk basic data X = {x1,...,x n}, and use machine learning algorithms to train X={x1,...,x n} for preprocessing, where x n represents the nth risk basic data, and n represents the number of risk basic data;

[0097] Furthermore, the multi-source security data includes: code base, log files, user feedback, and third-party security reports; external threat intelligence includes: known vulnerabilities, malware samples, and hacker attack techniques.

[0098] A2: Integrate the static code structure and dynamic runtime data of the application to dynamically build the flowchart of the application based on the risk basic data X = {x1,...,x n}, use the flowchart analysis method to identify the risk points of the application and the corresponding risk data;

[0099] A3: Use the pre-trained deep learning classification model to classify the identified risk data according to the preset risk type and generate classification labels B = {b1,...,b m}, and obtain the classified risk data Y = {y1,...,y m}, where b m Represents the classification label of the mth classification risk data, y m represents the mth classified risk data, and m represents the number of classified risk data;

[0100] Among them, the risk types include: 1) network security risks, such as cyber attacks, malware, data leakage, and privacy infringement; 2) fraud risks, such as online fraud, false advertising, and false advertising; 3) technical risks, such as technology obsolescence, technology dependence, and data security.

[0101] Furthermore, the formula for the probability of belonging to the s-th risk type is:

[0102]

[0103] Where P(y=s|x n ) represents the probability of belonging to the s-th risk type, z s represents the original output of the model for the nth risk basic data belonging to the sth risk category, q represents the number of risk type categories, and exp(·) represents the exponential function.

[0104] A4: Use the risk assessment model to classify risk data Y = {y1,...,y m} to conduct risk quantitative assessment and use fuzzy comprehensive evaluation method to calculate the risk value R = {r1,...,r m}, and sort the classified risk data in descending order according to the risk value to generate a risk priority list;

[0105] A5: Establish a monitoring mechanism to track application status and external environment changes in real time, and dynamically adjust risk priority ranking.

[0106] The specific steps of A2 include:

[0107] A2.1: Prepare static code analysis tools, dynamic runtime data capture tools, and data preprocessing tools, run static code analysis tools to obtain source code control flow information, capture dynamic data when the application is running, and integrate static and dynamic data to obtain a fused data set;

[0108] A2.2: Based on the fused data set, a control flow graph and a data flow graph are constructed and merged into a dynamic flow graph containing control flow and data flow information. The flow graph is dynamically updated according to the runtime data captured in real time.

[0109] A2.3: Risk basic data X = {x1,...,x n}Match with the dynamic flowchart to find risk points, and use the path analysis method to identify risk points and their context to obtain risk data.

[0110] The specific steps of A4 include:

[0111] A4.1: Determine the objectives and scope of risk assessment, receive classified risk data Y = {y1,...,y m}, and decompose the risk assessment problem into different components, forming a hierarchical structure including the goal layer, the criterion layer and the solution layer, where the goal layer is the overall risk assessment, the criterion layer is the various aspects or dimensions of the risk assessment, and the solution layer is the specific classified risk data;

[0112] A4.2: Classify the risk data Y = {y1,...,y m}In the input hierarchical structure, use the 1-9 scaling method to compare the elements at the same level and construct a judgment matrix Use the eigenvalue decomposition method to calculate the largest eigenvalue λ of M max , according to λ max Calculate the consistency ratio κ of the judgment matrix, the formula is:

[0113]

[0114] Among them, a ij represents the elements of the judgment matrix, β represents the complexity factor, which is used to reflect the complexity of the judgment matrix. When the number of elements contained in the judgment matrix is ​​large and the comparison relationship between them is complex, |β-1|≤0.05; when the judgment matrix is ​​relatively simple, β≤0.05, and β∈[0,1], η represents the average random consistency index, which is a constant obtained by looking up the table according to the order n of the judgment matrix, δ represents the expert credibility, which is used to measure the reliability or experience level of the experts who construct the judgment matrix, and is determined by evaluating the background, experience, and historical performance of the experts, and δ∈[0,1], n represents the order of the judgment matrix;

[0115] Furthermore, each row and column of the judgment matrix M represents an element at the same level, and the element a in the matrix ij Indicates the importance of element i relative to element j; in the 1-9 scaling method, a scale of 1 indicates that two elements are equally important, 9 indicates that one element is extremely more important than the other, and intermediate values ​​indicate intermediate degrees of importance. At the same time, the specific calculation steps and eigenvalue decomposition method of the 1-9 scaling method are prior art contents in this field, and are not the inventive solutions of the present application, and are not elaborated here.

[0116] A4.3: Adjust the judgment matrix according to the consistency ratio κ;

[0117] If κ≤0.1, the elements in the eigenvector of the judgment matrix can be used as weights;

[0118] If κ>0.1, the judgment matrix is ​​readjusted;

[0119] A4.4: Calculate the maximum eigenvalue of the adjusted judgment matrix and its corresponding eigenvector W, and normalize W to obtain a normalized weight vector. At the same time, the normalized weight vectors of different levels are combined to obtain a weight matrix.

[0120] A4.5: Set the risk level to low risk, medium risk, high risk, and extremely high risk, determine the membership function for each criterion layer element, and construct a fuzzy judgment matrix based on the membership function and the actual value of the criterion layer element;

[0121] A4.6: Perform a synthetic operation on the fuzzy judgment matrix and the weight matrix to obtain the comprehensive risk value of each classified risk data;

[0122] A4.7: According to the comprehensive risk value, the classified risk data are sorted in descending order to generate a risk priority list, and the risk data with the highest risk value are listed as the priority objects.

[0123] The security execution module uses an adaptive adjustment algorithm, the specific steps include:

[0124] B1: Obtain the identified risk point information and security vulnerability information from the risk identification module, collect multi-dimensional information of the application, use the fusion algorithm to fuse the risk point information, security vulnerability information and multi-dimensional information to obtain fused data, and perform risk assessment based on the fused data;

[0125] B2: According to the results of the risk assessment, an adaptive genetic algorithm is used to analyze the fusion data, and based on the analysis results, an adaptive test strategy is formulated to clarify the test scope, test method, and priority of test cases. The adaptive genetic algorithm is a prior art in this field and is not an inventive solution of the present application, and will not be described in detail here.

[0126] B3: Use automated testing tools to test applications according to the established automated testing strategy. If an area is at high risk or automated testing is not possible, perform manual penetration testing.

[0127] B4: Collect the results of automated testing and manual penetration testing, conduct comprehensive analysis, evaluate the test results, and feed back the test results to the adaptive genetic algorithm. According to the test results and feedback, the test strategy is adaptively adjusted. At the same time, a test report is generated and submitted to the staff for review and processing.

[0128] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in the field may also change, modify, replace and modify the above-mentioned embodiments without departing from the purpose and scope of protection of the present invention, and all of these are within the protection of the present invention.

Claims

1. An application security testing system based on multi-dimensional risk analysis, characterized in that: include: Risk identification module, security execution module, repair module, knowledge graph module, monitoring and reporting module; The risk identification module is used to identify security threats and risks in the application and to perform preliminary assessment and classification of the risks; The security execution module is used to perform specific test operations to discover and verify security vulnerabilities; The repair module is responsible for recording vulnerability information, formulating a repair plan, and tracking the repair progress; The knowledge graph module is used to display the information of vulnerabilities, attack methods and protection measures in a graphical manner by constructing a security knowledge graph; The monitoring and reporting module is used to monitor the security status of the application and generate a security report.

2. The application security testing system based on multi-dimensional risk analysis according to claim 1, characterized in that: The specific execution steps of the risk identification module include: A1: Integrate API interfaces and information capture methods to collect multi-source security data in real time, combine external threat intelligence from network security communities, security announcements, and vulnerability databases, and fuse them to obtain risk basic data X = {x1,...,x n }, and use machine learning algorithms to train X={x1,...,x n } for preprocessing, where x n represents the nth risk basic data, and n represents the number of risk basic data; A2: Integrate the static code structure and dynamic runtime data of the application to dynamically build the flowchart of the application based on the risk basic data X = {x1,...,x n }, use the flowchart analysis method to identify the risk points of the application and the corresponding risk data.

3. The application security testing system based on multi-dimensional risk analysis as claimed in claim 2, characterized in that: The specific execution steps of the risk identification module also include: A3: Use the pre-trained deep learning classification model to classify the identified risk data according to the preset risk type and generate classification labels B = {b1,...,b m }, and obtain the classified risk data Y = {y1,...,y m }, where b m Represents the classification label of the mth classification risk data, y m represents the mth classified risk data, and m represents the number of classified risk data; A4: Use the risk assessment model to classify risk data Y = {y1,...,y m } to conduct risk quantitative assessment and use fuzzy comprehensive evaluation method to calculate the risk value R = {r1,...,r m }, and sort the classified risk data in descending order according to the risk value to generate a risk priority list; A5: Establish a monitoring mechanism to track application status and external environment changes in real time, and dynamically adjust risk priority ranking.

4. The application security testing system based on multi-dimensional risk analysis as claimed in claim 3, characterized in that: The specific steps of A2 include: A2.1: Prepare static code analysis tools, dynamic runtime data capture tools, and data preprocessing tools, run static code analysis tools to obtain source code control flow information, capture dynamic data when the application is running, and integrate static and dynamic data to obtain a fused data set; A2.2: Based on the fused data set, a control flow graph and a data flow graph are constructed and merged into a dynamic flow graph containing control flow and data flow information. The flow graph is dynamically updated according to the runtime data captured in real time. A2.3: Risk basic data X = {x1,...,x n }Match with the dynamic flowchart to find risk points, and use the path analysis method to identify risk points and their context to obtain risk data.

5. The application security testing system based on multi-dimensional risk analysis as claimed in claim 4, characterized in that: The specific steps of A4 include: A4.1: Determine the objectives and scope of risk assessment, receive classified risk data Y = {y1,...,y m }, and decompose the risk assessment problem into different components, forming a hierarchical structure including the goal layer, the criterion layer and the solution layer; A4.2: Classify the risk data Y = {y1,...,y m }In the input hierarchical structure, use the 1-9 scaling method to compare the elements at the same level and construct a judgment matrix Use the eigenvalue decomposition method to calculate the largest eigenvalue λ of M max , according to λ max Calculate the consistency ratio κ of the judgment matrix, the formula is: Among them, a ij represents the judgment matrix element, β represents the complexity factor, and β∈[0,1], η represents the average random consistency index, which is a constant obtained by looking up the table according to the order n of the judgment matrix, δ represents the expert confidence, and δ∈[0,1], n represents the order of the judgment matrix; A4.3: Adjust the judgment matrix according to the consistency ratio κ; If κ≤0.1, the elements in the eigenvector of the judgment matrix can be used as weights; If κ>0.1, the judgment matrix is ​​readjusted.

6. The application security testing system based on multi-dimensional risk analysis as claimed in claim 5, characterized in that: The specific steps of A4 also include: A4.4: Calculate the maximum eigenvalue of the adjusted judgment matrix and its corresponding eigenvector W, and normalize W to obtain a normalized weight vector. At the same time, the normalized weight vectors of different levels are combined to obtain a weight matrix. A4.5: Set the risk level to low risk, medium risk, high risk, and extremely high risk, determine the membership function for each criterion layer element, and construct a fuzzy judgment matrix based on the membership function and the actual value of the criterion layer element; A4.6: Perform a synthetic operation on the fuzzy judgment matrix and the weight matrix to obtain the comprehensive risk value of each classified risk data; A4.7: According to the comprehensive risk value, the classified risk data are sorted in descending order to generate a risk priority list, and the risk data with the highest risk value are listed as the priority objects.

7. The application security testing system based on multi-dimensional risk analysis according to claim 6, characterized in that: The security execution module adopts an adaptive adjustment algorithm, and the specific steps include: B1: Obtain the identified risk point information and security vulnerability information from the risk identification module, collect multi-dimensional information of the application, use the fusion algorithm to fuse the risk point information, security vulnerability information and multi-dimensional information to obtain fused data, and perform risk assessment based on the fused data; B2: Based on the results of risk assessment, use adaptive genetic algorithm to analyze the fusion data, and formulate adaptive test strategy based on the analysis results to clarify the test scope, test methods, and test case priorities; B3: Use automated testing tools to test applications according to the established automated testing strategy. If an area is at high risk or automated testing is not possible, perform manual penetration testing. B4: Collect the results of automated testing and manual penetration testing, conduct comprehensive analysis, evaluate the test results, and feed back the test results to the adaptive genetic algorithm. According to the test results and feedback, the test strategy is adaptively adjusted. At the same time, a test report is generated and submitted to the staff for review and processing.

8. The application security testing system based on multi-dimensional risk analysis according to claim 7, characterized in that: The risk identification module includes: a threat intelligence unit, a risk assessment unit, a strategy recommendation unit, and a real-time update unit; the threat intelligence unit is used to collect and analyze the latest IoT security threat intelligence using a data mining algorithm; the risk assessment unit is used to assess the possibility and impact of risks based on threat intelligence and the actual situation of the application; the strategy recommendation unit is used based on historical security test data and the specific environment of the current application; the real-time update unit is used to maintain real-time synchronization with external threat intelligence sources through an API interface.

9. The application security testing system based on multi-dimensional risk analysis according to claim 8, characterized in that: The repair module includes: a vulnerability discovery unit, an automated repair unit, and a repair verification unit; the vulnerability discovery unit is used to use a vulnerability tracking system to record and report vulnerabilities discovered during the security test process; the automated repair unit is used to formulate a vulnerability repair plan and track the repair progress; the repair verification unit is used to verify whether the vulnerability has been effectively repaired, and after the verification is completed, re-execute the security test.

10. The application security testing system based on multi-dimensional risk analysis according to claim 9, characterized in that: The knowledge graph module includes: a knowledge extraction unit, a graph construction unit, and a visualization display unit; the knowledge extraction unit is used to extract security knowledge from vulnerability databases, security forums, and technical documents; the graph construction unit is used to organize the extracted security knowledge into a graph form, including vulnerability associations, attack paths, and protective measures; the visualization display unit is used to display the security knowledge graph to testers and security experts in a graphical manner.

Images