Network security vulnerability detection method, device and equipment

Abstract

The embodiment of the invention provides a network security vulnerability detection method, device and equipment. The method comprises the following steps: acquiring network access data of a target network, and determining a request data and response data pair from the network access data; in response to sensitive information which is detected from the request data and the response data of the response data pair and affects the data security, determining a request element corresponding to the sensitive information from the request data and the request data of the response data pair; replacing the parameters of the request elements, and reconstructing the request data by using the request elements with the replaced parameters to obtain target request data; and obtaining target response data in the access network data corresponding to the target request data, and if it is detected that the target response data comprises sensitive information, determining that the target network has network security vulnerabilities. The method is used for improving the protection effect on network security vulnerabilities.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a network security vulnerability detection method, device and equipment. Background Art

[0002] As the network security situation at home and abroad becomes increasingly complex, the demand for network data security at home and abroad is also growing.

[0003] In terms of protection against network security vulnerabilities, the relevant technology is to collect network request and response data of network security incidents that are occurring or have occurred due to network security vulnerabilities, analyze and process them, and thus improve the passive protection technology solutions of network security protection. Before a network security incident occurs, there is a lack of active protection technology solutions that actively detect possible network security vulnerabilities and use the detected network security vulnerabilities for protection.

[0004] The technical solution of passive protection has the technical problem that the protection of network security vulnerabilities lags behind the occurrence of network security incidents, resulting in poor protection effect. Summary of the invention

[0005] The embodiments of the present application provide a network security vulnerability detection method, device and equipment to improve the protection effect of network security vulnerabilities.

[0006] In a first aspect, an embodiment of the present application provides a network security vulnerability detection method, comprising:

[0007] Obtaining inbound and outbound network data of the target network, and determining a pair of request data and response data from the inbound and outbound network data;

[0008] In response to detecting sensitive information that affects data security from the response data of the request data and response data pair, determining a request element corresponding to the sensitive information from the request data of the request data and response data pair;

[0009] Replacing the parameters of the request element, and reconstructing the request data using the request element after the parameters are replaced, to obtain target request data;

[0010] The target response data in the inbound and outbound network data corresponding to the target request data is obtained, and if it is detected that the target response data includes the sensitive information, it is determined that a network security vulnerability exists in the target network.

[0011] In a second aspect, an embodiment of the present application provides a network security vulnerability detection device, comprising:

[0012] A data acquisition module, used to obtain the inbound and outbound network data of the target network, and determine the request data and response data pairs from the inbound and outbound network data;

[0013] a data extraction module, configured to, in response to detecting sensitive information affecting data security from the response data of the request data and response data pair, determine a request element corresponding to the sensitive information from the request data of the request data and response data pair;

[0014] A data reconstruction module, used to replace the parameters of the request element, and reconstruct the request data using the request element after the parameters are replaced to obtain target request data;

[0015] The data analysis module is used to obtain target response data in the inbound and outbound network data corresponding to the target request data, and if it is detected that the target response data includes the sensitive information, it is determined that the target network has a network security vulnerability.

[0016] In a third aspect, an embodiment of the present application provides a network security vulnerability detection device, including: a memory, a processor;

[0017] The memory stores computer-executable instructions;

[0018] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0021] Figure 1 Schematic diagram of the process of network security vulnerability detection method provided in this application Figure 1 ;

[0022] Figure 2 Schematic diagram of the process of network security vulnerability detection method provided in this application Figure 2 ;

[0023] Figure 3 A schematic diagram of parameters of a pure digital format request element in a replacement request data provided by this application;

[0024] Figure 4 A schematic diagram of the structure of the network security vulnerability detection device provided by this application;

[0025] Figure 5A schematic diagram of the structure of the network security vulnerability detection device provided in this application.

[0026] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0027] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0028] First, the terms involved in this application are explained:

[0029] JWT: JSON Web Token is a JSON-based token standard. It is a concise, URL-safe token standard for securely transmitting information between two parties. It can verify and ensure the security of information through digital signatures. JWT is usually used for identity authentication and information exchange.

[0030] In order to protect network data security, enterprises and institutions currently take protective measures based on two aspects for network data security caused by sensitive information leakage. On the one hand, network security vulnerability detection is carried out during network security incidents caused by network security vulnerabilities; on the other hand, analysis and processing related to network security vulnerabilities are carried out after network security incidents occur.

[0031] Since the protection measures taken based on the above two aspects rely on the alarm when the network security incident occurs or the detection after the occurrence, it is impossible to actively detect network security vulnerabilities and estimate the losses that may be caused by network security vulnerabilities before network security incidents caused by network security vulnerabilities occur. And since the protection measures taken based on the above two aspects perform regular matching or fingerprint matching on network data based on existing rules, the relevant data causing network security vulnerabilities are extracted from network request and response data. Because the rule library used for matching has a high lag and the matching identification method is relatively single, the extracted data is inaccurate, which in turn affects the effect of protecting network security vulnerabilities.

[0032] Based on the above analysis, it can be concluded that the relevant technology detects and analyzes network security vulnerabilities when or after network security incidents occur. However, there is a technical problem that the protection of network security vulnerabilities lags behind the occurrence of network security incidents, resulting in poor protection effects.

[0033] The network security vulnerability detection method, device and equipment provided in the present application actively obtain the inbound and outbound network data of the target network, analyze the inbound and outbound network data, detect possible network security vulnerabilities, and thus actively discover the network security vulnerabilities existing in the target network, thereby solving the technical problem that the protection of network security vulnerabilities lags behind the occurrence of network data security incidents, resulting in poor protection effect.

[0034] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0035] Figure 1 Schematic diagram of the process of network security vulnerability detection method provided in this application Figure 1 ,like Figure 1 As shown, the method includes:

[0036] S101: Obtain the inbound and outbound network data of the target network, and determine the request data and response data pair from the inbound and outbound network data.

[0037] The network security vulnerability detection method provided by the present application is to detect whether there is a network security vulnerability in the target network. The target network refers to the Internet within the enterprise, and the Internet within the enterprise and the Internet outside the enterprise are exchanged for data through the network entrance and exit. Therefore, the network entrance and exit can be used to obtain the inbound and outbound network data of the enterprise's internal Internet, and the inbound and outbound network data includes multiple pairs of request data sent by the client and response data returned by the server.

[0038] S102: In response to detecting sensitive information that affects data security from the response data of the request data and response data pair, determining a request element corresponding to the sensitive information from the request data of the request data and response data pair.

[0039] In this step, the sensitive information affecting data security detected from the response data includes at least one data security threat point, and the request element determined from the request data includes at least one request element.

[0040] It should be noted that data security threat points refer to data security elements in the response data, the data content of which may cause user personal privacy or enterprise sensitive information to be improperly acquired, accessed, used or disclosed without authorization.

[0041] The request element refers to the request parameter in the request data. By changing the request parameter, the return content corresponding to the sensitive information in the response data may be affected.

[0042] S103: Replace the parameters of the request element, and reconstruct the request data using the request element after the parameters are replaced to obtain the target request data.

[0043] In this step, when replacing the parameters of the request elements, the replacement parameters used have the same data structure as the parameters corresponding to the original request elements. Compared with the original request data, the parameters corresponding to the request elements of the reconstructed target request data are not equal, but other parameters are equal.

[0044] S104: Obtain target response data from the inbound and outbound network data corresponding to the target request data. If it is detected that the target response data includes sensitive information, it is determined that a network security vulnerability exists in the target network.

[0045] In this step, target request data is sent to the target network via the network entry and exit to obtain corresponding target response data.

[0046] A confirmed network security vulnerability refers to a network security vulnerability that causes leakage of user information or corporate information during network requests and responses.

[0047] The network security vulnerability detection method provided by the embodiment of the present application actively obtains the request data and response data pairs in the inbound and outbound data of the target network, extracts sensitive information that affects data security from the response data, and extracts the corresponding request elements from the corresponding request data. Reconstruct the request data based on the request elements to obtain the target request data with the same data structure. Determine whether the target network has a network security vulnerability based on whether there is sensitive information in the target corresponding data corresponding to the target request data. Thereby, the detection of network security vulnerabilities can be advanced before the network security incident occurs, thereby improving the effect of protecting network security vulnerabilities.

[0048] Figure 2 Schematic diagram of the process of network security vulnerability detection method provided in this application Figure 2 ,like Figure 2 As shown, the embodiment of the present application is Figure 1 On this basis, a network security vulnerability detection method is described in detail, and the method includes:

[0049] S201: Obtain inbound and outbound network data of the target network from a full-flow tracing device deployed at a network ingress and egress of the target network.

[0050] In this step, the full flow backtracking device deployed at the network entrance and exit of the target network has the function of capturing network flow data and can store the captured data. Network data can be captured using a network interception device or other means. The captured data can be stored in a database or other devices with data storage functions. The method provided in this application does not limit the means of capturing network data or the storage method of the captured network data.

[0051] S202: Determine a pair of request data and response data from the incoming and outgoing network data, and pre-process the pair of request data and response data.

[0052] Generally, for the secure transmission of network data, the request data and response data in the network data are encrypted before transmission, and the data that is not encrypted is plain text data. Network data is transmitted in the network in the form of data streams, and the network entrance and exit capture the data stream and store it. Therefore, the preprocessing of request data and response data includes two processes: data decryption and data formatting.

[0053] The data decryption process includes: if the request data and the response data are encrypted, the request data and the response data are decrypted using a corresponding decryption algorithm to obtain the plaintext data corresponding to the request data and the response data respectively.

[0054] The data formatting process includes: formatting the plain text data of the request data and the response data according to the data formats of the request data and the response data. For example, if the data formats of the request data and the response data are JSON data formats, the plain text data of the request data and the response data are formatted based on the JSON data format; if the data formats of the request data and the response data are XML data formats, the plain text data of the request data and the response data are formatted based on the XML data format.

[0055] It should be noted that, because the network security vulnerability detection method provided in this application is to detect whether there are security vulnerabilities in the target network, the request data used in this step is the request data sent to the server of the target network, and the response data used is the response data returned from the server of the target network.

[0056] S203: Detect sensitive information that affects data security from the response data in the pair of request data and response data.

[0057] The sensitive information that affects data security proposed in this application refers to data information with confidentiality. Regarding the confidentiality of data, the method provided in this application focuses on preventing data from being accessed and used by unauthorized persons or entities. It requires that data must be subject to strict access control during storage, transmission and use. For example, access rights to relevant data can be restricted through means such as identity authentication and password protection.

[0058] Sensitive information that affects data security includes at least one of the following five types of information: basic personal information, personal identity information, personal social information, basic corporate information, and corporate business information. Each type of data includes multiple data security elements, and each data security element corresponds to a data security threat point. For example:

[0059] The data security elements of personal basic information include: name, gender, ethnicity, nationality, mobile phone number / landline number, email address, date of birth, address / household registration information, and other personal basic information.

[0060] The data security elements of personal identity information include: genes, fingerprints / eyes / face / voiceprints / palmprints, handwriting signatures, and other characteristics (such as gait, video recordings, etc.).

[0061] The data security elements of personal social information include: property information (such as bank balance, transfer records, real estate records, etc.), financial information (such as credit information, insurance information, etc.), social relationship information, educational information, family member information, other social information, etc.

[0062] The data security elements of basic enterprise information include: credit information, tax information, undisclosed judicial information, and other basic enterprise information.

[0063] The data security elements of enterprise business information include: confidential contract information, financial information (such as investment and financial management information, trust information, etc.), sales data (such as sales records, order information, etc.), supply chain data (such as supplier information, inventory status, logistics information, etc.), customer relationship management data (such as customer interaction records, service requests, complaint handling information, etc.), and other enterprise business information.

[0064] S204: In response to detecting sensitive information that affects data security from the response data, determining a request element corresponding to the sensitive information from the corresponding request data.

[0065] In this step, the data format of the request element corresponding to the sensitive information includes at least one of the following five data formats: pure digital data format, user name data format, JWT data format, mobile phone number data format and ID card number data format.

[0066] S205: Replace the parameters of the request element, and reconstruct the request data using the request element after the parameters are replaced to obtain the target request data.

[0067] In this step, the parameters of the request elements can be replaced by exhaustive method. That is, for each request element, based on exhaustive method, a replacement parameter of the same data format is generated, and the replacement parameter is used to replace the original parameter. For example, for a request element in pure digital format, the original parameter is equal to 10001, and the replacement parameter generated by exhaustive method is 10010, then 10010 is used to replace 10001 in the request data to obtain the target request data. Figure 3 A schematic diagram of the parameters of a pure digital format request element in a replacement request data provided for this application, such as Figure 3 As shown, the request data is a GET request data of HTTP version 1.1, wherein the id parameter in the user information userinfo is 10001. After reconstruction, the generated target request data is a GET request of HTTP version 1.1, wherein the id parameter in the user information userinfo is 10010.

[0068] S206: In response to detecting sensitive information in the target request data, determining that a network security vulnerability exists in the target network.

[0069] This step is the same as Figure 1 The steps for determining whether the target network has network security vulnerabilities are the same as those in , and will not be repeated here.

[0070] S207: In response to determining that a network security vulnerability exists in the target network, replace parameters of request elements in batches, and reconstruct request data using the request elements after the parameter replacement to obtain multiple target request data.

[0071] In this step, the request data is reconstructed to obtain the implementation methods and Figure 1 The steps of reconstructing the request data in order to obtain the target request data are the same and will not be repeated here.

[0072] It should be noted that the use of batch reconstruction request data for batch network requests is to simulate attackers attacking network security vulnerabilities and provide analytical data for subsequent assessment of the scale of network security vulnerabilities.

[0073] S208: Determine the scale of the network security vulnerability according to the target response data in the inbound and outbound network data corresponding to the multiple target request data.

[0074] In this step, by analyzing the number of request data and response data pairs with network security vulnerabilities in this batch of target request data and target response data, and the number of request data and response data pairs without network security vulnerabilities, the scale of the network security vulnerability is evaluated, thereby facilitating protection against network security vulnerabilities based on the evaluation results.

[0075] In the above steps, the method provided by the embodiment of the present application actively obtains the inbound and outbound network data of the enterprise's internal Internet, analyzes the request data and response data pairs therein, and determines whether there are network security vulnerabilities in the enterprise's internal Internet, thereby advancing the detection of network security vulnerabilities before network security incidents occur. After discovering a network security vulnerability, batch request data is reconstructed, and network requests are sent to the enterprise's internal Internet to simulate the process of an attacker attacking a network security vulnerability. By analyzing the number of request responses with network security vulnerabilities and the number of request responses without network security vulnerabilities in the batch request data and response data pairs, the scale of the network security vulnerability is estimated, so as to protect the network security vulnerability based on the evaluation results.

[0076] In some implementations of this embodiment, in order to improve the recognition rate of sensitive information and request elements, sensitive information that affects data security is detected from the response data, and the request elements corresponding to the sensitive information are determined from the request data, including: inputting the request data and response data pairs into a pre-trained language processing model, and the language processing model outputs the sensitive information and request elements.

[0077] The training operation of the above language processing model includes the following four stages:

[0078] Pre-training stage: obtaining multiple historical request data and response data pairs; the multiple historical request data and response data pairs include request data and response data pairs with network security vulnerabilities and request data and response data pairs without network security vulnerabilities; constructing a training data set based on the multiple historical request data and response data pairs, pre-training the language processing model, and obtaining a pre-trained language processing model.

[0079] It should be noted that in this stage, the training data set constructed is multiple pairs of historical request data and response data that have been processed by text cleaning and deduplication. The language processing model obtained in the pre-training stage can identify the data structure of the data messages corresponding to the request data and response data.

[0080] Instruction fine-tuning stage: Use instruction data to fine-tune the parameters of the pre-trained language processing model to obtain a fine-tuned language processing model; wherein the instruction data is used to instruct the language processing model to identify request elements and sensitive information.

[0081] In this stage, the instruction data is multiple pairs of request data and response data, where the request elements in the request data and the sensitive information in the response data are set with identifiable labels so that the language processing model can learn to identify the request elements in the request data and the sensitive information in the response data.

[0082] Reward model training phase: During the training process, the reward information is determined based on the relationship between the output of the language processing model and the true value of the output according to the preset reward function; the parameters of the language processing model are adjusted according to the reward information.

[0083] In this stage, the reward function is designed to set higher scores for samples of request data and response data pairs that correctly identify request elements and / or data security threat points by judging the relationship between the output of the language processing model and the output truth value, thereby guiding the language processing model to adjust parameters according to the score to optimize the recognition effect of the language processing model.

[0084] Reinforcement learning fine-tuning phase: Fine-tune the parameters of the language processing model based on the sensitive information and request elements output by the language processing model and the actually determined sensitive information and request elements.

[0085] In this stage, the generated language processing model is put into actual application scenarios for learning, and the model parameters are adjusted in real time according to actual feedback information so that the model can adapt to the ever-changing network environment.

[0086] The following uses an actual implementation process of a network security vulnerability detection method as an example to illustrate the method provided by this application in detail.

[0087] The full flow backtracking device at the Internet entrance and exit of a certain enterprise collected the full flow data of the enterprise's internal Internet outbound and inbound traffic within 3 months and saved it in the database. Through retrieval, it was found that a certain response data contained the user's name and mobile phone number information. The request data corresponding to the response data was backtracked to obtain a pair of request data and response data.

[0088] The analysis found that the response data and the corresponding request data were encrypted using an encryption algorithm, and the corresponding decryption algorithm was used to decrypt the response data and the corresponding request data to obtain their respective plaintext data. The language processing model was used to analyze the plaintext data corresponding to the request data, and it was determined that the request data contained a request element CardID in a pure digital format. Using the exhaustive method, a CardID with the same data format was randomly generated as a new parameter, and the newly generated CardID was used to replace the old CardID to obtain a target request data.

[0089] Use the target request data to send a network request to a server on the enterprise's internal Internet, and obtain the target response data returned by the server.

[0090] The language processing model is used to detect the user name and mobile phone number information corresponding to the newly generated CardID from the target response data to determine that a network security vulnerability has been discovered.

[0091] Use the same method to batch construct multiple target request data with different CardIDs, and use the batch constructed target request data to send multiple network requests to the server of the enterprise's internal Internet to obtain target response data returned by multiple servers.

[0092] Use a language processing model to analyze the multiple target request data and target response data pairs sent in this batch, count the number of request-response data pairs in which request elements are detected from the target request data and sensitive information is detected from the target response data, analyze the statistical number and the total number of request-response pairs, and estimate the scale of the network security vulnerability. Take specific protective measures based on the scale of the network security vulnerability.

[0093] Figure 4 A schematic diagram of the structure of the network security vulnerability detection device provided in this application, such as Figure 4 As shown, the network security vulnerability detection device 40 provided in this embodiment includes:

[0094] The data acquisition module 401 is used to obtain the inbound and outbound network data of the target network, and determine the request data and response data pairs from the inbound and outbound network data.

[0095] The data extraction module 402 is used to determine the request element corresponding to the sensitive information from the request data of the request data and response data pair in response to detecting sensitive information affecting data security from the response data of the request data and response data pair.

[0096] The data reconstruction module 403 is used to replace the parameters of the request elements and reconstruct the request data using the request elements after the parameters are replaced to obtain the target request data.

[0097] The data analysis module 404 is used to obtain the target response data in the inbound and outbound network data corresponding to the target request data. If it is detected that the target response data includes sensitive information, it is determined that there is a network security vulnerability in the target network.

[0098] In a possible implementation, the data extraction module 402 is further configured to input the request data and response data pair into a pre-trained language processing model, and the language processing model outputs the sensitive information and the request elements.

[0099] In a possible implementation, the data reconstruction module 403 is also used to replace the parameters of the request elements in batches in response to determining that the target network has a network security vulnerability, and reconstruct the request data using the request elements after the replacement parameters to obtain multiple target request data.

[0100] The data analysis module 404 is further used to determine the scale of network security vulnerabilities based on target response data in the inbound and outbound network data corresponding to the multiple target request data.

[0101] In one possible implementation, the data extraction module 402 is also used to use the following model training operations to obtain a trained language processing model: obtaining multiple historical request data and response data pairs; the multiple historical request data and response data pairs include request data and response data pairs with network security vulnerabilities and request data and response data pairs without network security vulnerabilities; constructing a training data set based on the multiple historical request data and response data pairs, pre-training the language processing model, and obtaining a pre-trained language processing model; using instruction data to fine-tune the parameters of the pre-trained language processing model to obtain a fine-tuned language processing model; wherein the instruction data is used to instruct the language processing model to identify request elements and sensitive information.

[0102] In a possible implementation, the data extraction module 402 is also used to determine reward information during the training process based on a preset reward function for the relationship between the output of the language processing model and the output true value; and adjust the parameters of the language processing model based on the reward information.

[0103] In a possible implementation, the data extraction module 402 is further used to fine-tune the parameters of the language processing model according to the sensitive information and request elements output by the language processing model and the actually determined sensitive information and request elements.

[0104] In a possible implementation, the sensitive information affecting data security extracted by the data extraction module 402 includes at least one of the following five types of data: basic personal information, personal identity information, personal social information, basic enterprise information, and enterprise business information.

[0105] The data format of the request element corresponding to sensitive information includes at least one of the following five data formats: pure digital data format, user name data format, JWT data format, mobile phone number data format and ID card number data format.

[0106] The network security vulnerability detection device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0107] Figure 5This is a schematic diagram of the structure of the network security vulnerability detection device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0108] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0109] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0110] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0111] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0112] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0113] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0114] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0115] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0116] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0117] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0118] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0119] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0120] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0121] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0122] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A network security vulnerability detection method, characterized in that: include: Obtaining inbound and outbound network data of the target network, and determining a pair of request data and response data from the inbound and outbound network data; In response to detecting sensitive information that affects data security from the response data of the request data and response data pair, determining a request element corresponding to the sensitive information from the request data of the request data and response data pair; Replacing the parameters of the request element, and reconstructing the request data using the request element after the parameters are replaced, to obtain target request data; The target response data in the inbound and outbound network data corresponding to the target request data is obtained, and if it is detected that the target response data includes the sensitive information, it is determined that a network security vulnerability exists in the target network.

2. The method according to claim 1, characterized in that In response to detecting sensitive information that affects data security from the response data of the request data and response data pair, determining a request element corresponding to the sensitive information from the request data of the request data and response data pair includes: The request data and response data pair are input into a pre-trained language processing model, and the language processing model outputs the sensitive information and the request elements.

3. The method according to claim 1, characterized in that The method further comprises: In response to determining that the target network has a network security vulnerability, replacing the parameters of the request elements in batches, and reconstructing the request data using the request elements after the parameters are replaced to obtain a plurality of target request data; The scale of the network security vulnerability is determined based on target response data in the incoming and outgoing network data corresponding to the plurality of target request data.

4. The method according to any one of claims 1 to 3, characterized in that: The method further includes performing the following model training operation to obtain a trained language processing model: Acquire a plurality of historical request data and response data pairs; the plurality of historical request data and response data pairs include request data and response data pairs with network security vulnerabilities and request data and response data pairs without network security vulnerabilities; Constructing a training data set based on the multiple historical request data and response data pairs, pre-training the language processing model, and obtaining a pre-trained language processing model; The parameters of the pre-trained language processing model are fine-tuned using instruction data to obtain a fine-tuned language processing model; wherein the instruction data is used to instruct the language processing model to identify request elements and sensitive information.

5. The method according to claim 4, characterized in that The model training operation also includes: During the training process, reward information is determined based on the relationship between the output of the language processing model and the true value of the output according to the preset reward function; The parameters of the language processing model are adjusted according to the reward information.

6. The method according to claim 5, characterized in that The method further includes: fine-tuning parameters of the language processing model according to the sensitive information and the request elements output by the language processing model and the actually determined sensitive information and request elements.

7. The method according to claim 1, characterized in that The sensitive information that affects data security includes at least one of the following five types of information: basic personal information, personal identity information, personal social information, basic enterprise information and enterprise business information; The data format of the request element corresponding to the sensitive information includes at least one of the following five data formats: pure digital data format, user name data format, JWT data format, mobile phone number data format and ID card number data format.

8. A network security vulnerability detection device, characterized in that: include: A data acquisition module, used to obtain the inbound and outbound network data of the target network, and determine the request data and response data pairs from the inbound and outbound network data; a data extraction module, configured to, in response to detecting sensitive information affecting data security from the response data of the request data and response data pair, determine a request element corresponding to the sensitive information from the request data of the request data and response data pair; A data reconstruction module, used to replace the parameters of the request element, and reconstruct the request data using the request element after the parameters are replaced to obtain target request data; The data analysis module is used to obtain target response data in the inbound and outbound network data corresponding to the target request data, and if it is detected that the target response data includes the sensitive information, it is determined that the target network has a network security vulnerability.

9. An enterprise data security vulnerability discovery device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images