Software security detection method and system for fingerprint browser

Abstract

The invention belongs to the field of information security, and discloses a software security detection method and system for a fingerprint browser, and the method comprises the steps: 1, obtaining a feature matrix and a module interaction log based on a camouflage feature, a behavior feature and a module interaction feature; step 2, obtaining a camouflage detection probability matrix, a camouflage sample and a camouflage traceability report; 3, constructing a module dependency graph, and obtaining a disguise propagation path and a high-risk module set; 4, obtaining a logic vulnerability and an optimal utilization path; and 5, calculating a comprehensive risk score and selecting a protection strategy based on the comprehensive risk score. The challenges of the fingerprint browser in camouflage detection, attack traceability and vulnerability mining can be comprehensively handled, the defects of the prior art are overcome through an innovative technical means, and an efficient and safe fingerprint browser protection mechanism is provided for a user.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a software security detection method and system for a fingerprint browser. Background Art

[0002] With the increasing awareness of privacy protection, fingerprint browsers, as a tool with camouflage function, have been widely used in recent years. It helps users achieve identity camouflage and privacy protection on the Internet by dynamically modifying key fingerprint features such as hardware features, network attributes, and operating system information of users. However, the popularity of this tool has also caused a series of security risks. On the one hand, the camouflage function of fingerprint browsers may be used by malicious users to evade tracking, perform batch malicious operations, or hide attack behaviors. Especially in attack scenarios such as malicious scripts and automated crawlers, fingerprint camouflage increases the difficulty of detection and tracing, making traditional behavior analysis and tracking technologies difficult to work. On the other hand, the complexity of fingerprint browsers themselves also introduces new security risks. Since fingerprint camouflage involves the collaborative work of multiple modules, such as network communication modules, browser rendering engines, camouflage parameter generation modules, etc., the dependencies between modules are complex and dynamic, and traditional vulnerability detection methods (such as static code analysis or single-point dynamic analysis) are difficult to fully cover. More seriously, the dependencies between these modules often hide potential logical vulnerabilities or design defects. Once exploited by attackers, the security of the entire fingerprint browser may be breached, thereby threatening the privacy and security of users.

[0003] Existing technologies have obvious shortcomings in solving these problems. For the problem of disguise detection, traditional methods usually perform static analysis based on the characteristic rules of specific disguise behaviors (such as certain fixed browser parameters), but this method lacks adaptability to complex and dynamic disguise behaviors and can be easily bypassed by opponents through advanced disguise methods. As for vulnerability mining, most tools are based on the logical analysis of a single module (such as symbolic execution of a specific function), which makes it difficult to capture the vulnerability path generated by the interaction of multiple modules. In addition, existing disguise detection and vulnerability mining technologies often run independently and fail to form a coordinated security protection strategy, resulting in the results of disguise detection cannot be directly used to repair vulnerabilities, and the findings of vulnerability mining cannot help identify disguise risks more efficiently. Therefore, existing technical means seem to be powerless when faced with the complex disguise behaviors and internal security risks of fingerprint browsers. Summary of the invention

[0004] The purpose of the present invention is to disclose a software security detection method and system for a fingerprint browser, so as to solve the technical problems pointed out in the background technology.

[0005] In order to achieve the above object, the present invention adopts the following technical solution: On the one hand, the present invention provides a software security detection method for a fingerprint browser, comprising: The first step is to obtain the feature matrix and module interaction log based on the camouflage features, behavior features, and module interaction features; The second step is to obtain the camouflage detection probability matrix, camouflage samples and camouflage tracing report; The third step is to build a module dependency graph to obtain the disguised propagation path and the set of high-risk modules; Step 4: Obtain logical vulnerabilities and optimal exploit paths; Step 5: Calculate the comprehensive risk score and select a protection strategy based on the comprehensive risk score; Get the camouflage detection probability matrix, including: Build an improved variational autoencoder model, which is used to capture the feature matrix Distribution deviation, detecting camouflage behavior: ; in: is the input feature matrix; is the feature matrix reconstructed by the encoder and decoder; Represents the Frobenius norm, which is used to measure the feature reconstruction error; The latent distribution generated for the encoder; is the prior distribution; A tuning parameter to control the strength of the latent space constraints; is the regularization term; is the distribution deviation; Optimization by gradient descent , output camouflage detection probability matrix , Elements in express is the probability of camouflaging the feature.

[0006] On the other hand, the present invention provides a software security detection system for a fingerprint browser, comprising a first acquisition module, a second acquisition module, a construction module, a fourth acquisition module and a calculation module; The first acquisition module is used to acquire a feature matrix and a module interaction log based on camouflage features, behavior features, and module interaction features; The second acquisition module is used to obtain the camouflage detection probability matrix, camouflage samples and camouflage tracing report; Build a module dependency graph to obtain the disguised propagation path and high-risk module set; The fourth acquisition module is used to obtain logical vulnerabilities and optimal exploitation paths; The calculation module is used to calculate the comprehensive risk score and select a protection strategy based on the comprehensive risk score; Get the camouflage detection probability matrix, including: Build an improved variational autoencoder model, which is used to capture the feature matrix Distribution deviation, detecting camouflage behavior: ; in: is the input feature matrix; is the feature matrix reconstructed by the encoder and decoder; Represents the Frobenius norm, which is used to measure the feature reconstruction error; The latent distribution generated for the encoder; is the prior distribution; A tuning parameter to control the strength of the latent space constraints; is the regularization term; is the distribution deviation; Optimization by gradient descent , output camouflage detection probability matrix , Elements in express is the probability of camouflaging the feature.

[0007] Beneficial effects: The present invention proposes a fingerprint browser security detection method and system based on adversarial environment and multi-hop dependency analysis. The present invention can comprehensively deal with the challenges of fingerprint browsers in camouflage detection, attack tracing and vulnerability mining, overcome the shortcomings of the prior art through innovative technical means, and provide users with an efficient and secure fingerprint browser protection mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0009] Figure 1 It is a schematic diagram of the software security detection method for fingerprint browser of the present invention. DETAILED DESCRIPTION

[0010] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

[0011] like Figure 1 In one embodiment shown, the present invention provides a software security detection method for a fingerprint browser, comprising: The first step is to obtain the feature matrix and module interaction log based on the camouflage features, behavior features, and module interaction features; The second step is to obtain the camouflage detection probability matrix, camouflage samples and camouflage tracing report; The third step is to build a module dependency graph to obtain the disguised propagation path and the set of high-risk modules; Step 4: Obtain logical vulnerabilities and optimal exploit paths; Step 5: Calculate the comprehensive risk score and select a protection strategy based on the comprehensive risk score; Preferably, obtaining a camouflage detection probability matrix includes: Build an improved variational autoencoder (VAE) model, which is used to capture the feature matrix Distribution deviation, detecting camouflage behavior: ; in: is the input feature matrix; is the feature matrix reconstructed by the encoder and decoder; Represents the Frobenius norm, which is used to measure the feature reconstruction error; The latent distribution generated for the encoder; is a prior distribution (e.g., a standard normal distribution); It is a parameter that controls the strength of the latent space constraint. Generally speaking, the value range of β is [0,1]. The larger the value, the stronger the constraint on the latent space, and the smaller the value, the weaker the constraint on the latent space. A common initial value can be β=0.5, but it may need to be adjusted based on experiments. For example, if the model is overfitting, β can be increased to increase the constraint. is the regularization term; is the distribution deviation; Optimization by gradient descent , use the back propagation algorithm to calculate the gradient of the loss function relative to the network parameters, and continuously update the parameters to minimize the loss function, outputting the camouflage detection probability matrix , Elements in express is the probability of camouflaging the feature.

[0012] The innovation lies in the introduction of additional regularization terms ,By strengthening the normal constraint of the latent space, the sensitivity to the distribution deviation of camouflage features is improved.

[0013] Preferably, the disguised features include hardware information and network information, the behavioral features include API call frequency, page loading time and file loading times, and the module interaction features include the calling frequency and calling sequence between modules, such as the interactive path of the disguised module calling the network module. The definition of the module interaction feature dimension ensures that the core disguise functions and operating behaviors of the fingerprint browser are covered, providing comprehensive support for subsequent steps.

[0014] Preferably, the hardware information includes the CPU model of the device running the fingerprint browser; the network information includes the IP address of the device running the fingerprint browser.

[0015] Preferably, obtaining a feature matrix and a module interaction log based on the disguise feature, the behavior feature, and the module interaction feature includes: Standardize camouflage features; The camouflaged features (such as IP address ranges) are interval-normalized to eliminate scale differences between different camouflage schemes: ; in, and are the upper and lower limits of the camouflage range, It is the total IP range size.

[0016] Time-weighted processing of behavioral features; To emphasize the importance of recent behavior, Introduce the time decay factor: ; is the behavior characteristic value, is the collection time, is the current time, is the time decay coefficient, which is used to control the importance of time.

[0017] The building block calls the feature matrix M: ; in, It is a module For modules The call weight, Indicates the number of calls. is the weight of the k3th call type; N1 represents the total number of call types; Call types include different API calls, different request types (GET, POST, etc.) or different operation modes (synchronous call, asynchronous call, etc.). Each type may have different impacts on security, so a weight needs to be assigned to each call type.

[0018] The collected camouflage features , standardized behavioral characteristics and the module call feature matrix Combined into a unified feature matrix , The form is as follows: ; in, is the number of time windows, and each row represents the browser status within a time window. is the total number of modules; Extract the call records between modules from the browser running log and generate module interaction logs , each call record contains the module with call relationship, call frequency, call type and timestamp sequence. For example, the record format is as follows: . Interaction log Directly used for subsequent module dependency analysis and vulnerability mining.

[0019] Feature Matrix Interaction log with modules They are used for camouflage detection and module dependency graph construction respectively. Feature matrix Provides information on dynamic behavior and camouflage patterns, while interaction logs It captures complex dependencies between modules.

[0020] Preferably, obtaining a disguised sample includes: Generate complex disguise samples using Generative Adversarial Networks (GANs) , enhance the recognition ability of the camouflage detection model for complex camouflage behaviors; the optimization objective function of the adversarial generation network is: ; in: is random noise sampled from the underlying distribution; is a disguised sample generated by the generator; It is a discriminator that determines whether the sample is a real feature; represents the optimization objective function; represents the expected calculation of random noise z sampled from the potential distribution p(z), It means to perform expected calculation on the real data sample x from the data distribution X, where x represents the real data sample.

[0021] GAN generator generates fake samples ,These samples are used to conduct adversarial training on the camouflage detection model to further improve the generalization ability of camouflage behavior detection.

[0022] Preferably, obtaining a spoofing tracing report includes: The camouflage detection probability matrix Interaction log with modules Combined, construct the camouflage propagation weight matrix : ; in: Representation Module To module The disguised propagation weight of Representation Module Calling Modules The number of calls; is the time-dependency adjustment factor; and The latest and earliest timestamps for inter-module calls; To prevent positive numbers with zero denominators.

[0023] ϵ is a positive number that prevents the denominator from being zero. It is usually a very small positive number. Common values ​​include: ϵ=1e-5: often used to avoid zero division errors in calculations; ϵ=1e-8: Used to ensure numerical stability when the timestamp difference is very small.

[0024] Through the weight matrix Construct a camouflage propagation graph and use a depth-first search algorithm to mark the propagation path of the camouflage behavior; finally output a camouflage traceability report , including: The source module of the disguised behavior; The set of propagation paths and affected modules; The weight of disguise propagation between modules.

[0025] γ is the time correlation adjustment factor, which is used to balance the impact of time factors on the propagation weight. Usually, the value of γ is adjusted according to the application scenario, and the typical value range can be 0.1 to 1. For example: γ=0.5: indicates that the time factor has a moderate impact on the propagation weight; γ=1.0: indicates that the time factor has a very strong influence on the propagation weight; γ=0.1: indicates that the time factor has a weak influence on the propagation weight.

[0026] Provided to subsequent dependency analysis models to disguise samples Used to enhance the robustness of subsequent model training and disguise the traceability report Used to support the construction of module dependency graphs.

[0027] This step combines the improved VAE and GAN models to achieve the detection of camouflage behavior and the generation of complex camouflage samples, and provides basic support for subsequent module dependency analysis and vulnerability mining by tracing the camouflage propagation path.

[0028] Preferably, constructing a module dependency graph to obtain a disguised propagation path and a high-risk module set includes: Construction of module dependency graph: Module dependency graph By module collection and the set of directed edges Composition, edge Representation Module Calling Modules ; The calculation of weights takes into account the following three parts: Camouflage Probability Impact: Exploitation Module The probability of camouflage Describe the propagation of masquerades on the call path; Call frequency: feature matrix of calls from the module Extract the module To module Number of calls ; Time decay factor: introduces time correlation through time series information to reduce the impact of historical calls; The expression of module propagation influence weight is: ; in: It is a module and modules The call time difference; is the time decay parameter, which is used to adjust the influence of time factors on the propagation weight; The value of τ depends on the actual scenario and data. It can be set to a specific time window, such as τ=60 (indicating a time decay of 60 seconds), or set according to the average value of the time distribution in the data, such as τ=1000 (indicating a decay of 1000 seconds).

[0029] Through the above calculations, a directed graph containing all module call relationships is generated , and record the weights of all edges; Analysis of camouflage propagation paths: Module dependency graph being built In the example, the high-weight edges whose weights are greater than the set weight threshold are analyzed for disguised propagation paths: For each path , defining the propagation impact score : ; Select the communication impact score above the threshold The path is marked as a high-camouflage propagation path, and the module set on the path is recorded; High-weight edges refer to those with large weight values ​​that have a significant impact on the camouflage propagation path. They can usually be screened by setting a threshold (0.6).

[0030] High-risk module flags: Based on the high-weight edges in the propagation path, the risk level of each module is assessed: For modules , calculate the camouflage propagation score , defined as the sum of the weights of all incident edges: ; like Exceeding the set threshold , then the module Mark as a high-risk module and output its module number and risk score ; V represents a collection of modules.

[0031] The setting rules include: Percentage-based rules: Set the threshold to the highest camouflage propagation score of the top 10% or 20% of all modules; or, Rules based on historical data: Use known high-risk modules in historical data to count the distribution of their disguised propagation scores, and select the 90% or 95% quantile of the score distribution as the threshold.

[0032] This step combines the camouflage detection probability and module interaction log to build a module dependency graph, analyze the propagation path and impact range of camouflage behavior between modules, identify high-risk modules, and lay a data foundation for subsequent vulnerability mining and security protection.

[0033] Preferably, obtaining logical vulnerabilities and optimal exploitation paths includes: Module multi-hop dependency analysis: In the module dependency graph In the definition of multi-hop dependency strength between modules , For capturing slave modules To module Dependencies: ; in: It is a module arrive The maximum weight path of It is on the path The call weight of It is the edge The probability of camouflage propagation on ; is the coefficient that adjusts the effect of camouflage propagation; This formula combines the call weight and the influence of disguised propagation, focusing on analyzing high-dependency paths and screening potential high-risk chains. Control the weight of fake propagation in dependency analysis to ensure that the impact of fake behavior is properly reflected in the dependency path.

[0034] Logical vulnerability mining: The paths whose multi-hop dependency strength is greater than the set multi-hop dependency strength threshold are selected. Above, analyze the logical loopholes: Constructing a set of path constraints , logical constraints of modules on the aggregation path: Each module The set of constraints Describe its logical conditions and input-output relationships; The constraints of the constraint set include: module input and output legitimacy, data verification, permission control, function dependency and other logical relationships; For example, the multi-hop dependency strength threshold may be set to three quarters of the number of edges on the maximum weight path.

[0035] Combined with path constraints: ; Checking path constraints using the constraint solver If satisfied, the path is marked as a logic loophole; Vulnerability Exploitation Path Optimization: For the paths marked as logical vulnerabilities, optimize the vulnerability exploitation path: Defining path costs is the sum of the costs of all dependencies on the path: ; The optimization goal is to minimize the path cost and find the best utilization path , the output is the potential vulnerability attack path.

[0036] Preferably, calculating the comprehensive risk score and selecting a protection strategy based on the comprehensive risk score includes: Calculating Vulnerability Impact Score : For the vulnerability list and module Related vulnerabilities, exploiting path cost Calculate its impact contribution: ; in: For modules The number of associated vulnerabilities; It is The path cost of the optimal exploit path for a vulnerability; is the amplification factor, used to enhance the impact of high-cost paths; is a positive number that prevents the denominator from being zero; Calculating the camouflage propagation score : based on , a time-attenuated regularization term is introduced to reflect the dynamic impact of camouflage propagation: ; in: For modules 's camouflage propagation score; It is a module The interval between the most recent risk event and the current time; is the time decay parameter; is the coefficient that adjusts the effect of camouflage propagation; Calculating a composite risk score : The comprehensive risk score of a module is composed of the weighted vulnerability impact score and the camouflage propagation score: ; in, and They are the weight coefficients of vulnerability impact score and camouflage propagation score respectively.

[0037] Furthermore, the comprehensive risk score Select a dynamic protection strategy for each module: High-risk module processing ( ): Isolate module: cut off the interaction between the module and other modules and record abnormal behaviors; Restricted behavior: Reduce the frequency of calling high-risk modules or lower their permissions; Generate repair suggestions: Generate module repair solutions based on vulnerability triggering conditions and dependency chains.

[0038] Medium risk module processing ( ): Dynamic monitoring: real-time monitoring of module operation status; Exception capture: record its call log and mark the exception call path.

[0039] Low risk module processing ( ): Maintain normal operation and update risk assessment records regularly.

[0040] and They respectively represent the set first risk score threshold and second risk score threshold.

[0041] Furthermore, the execution process of the protection measures is used as feedback to update the camouflage detection model and the dependency analysis model: Model update mechanism: Added calling behavior and camouflage features of the isolation module, and updated the camouflage detection model parameters; Dynamically adjust the edge weights in the module dependency graph to reflect the latest risk distribution.

[0042] Adaptive adjustment: Recalculate the fake propagation impact score based on real-time monitoring data and the time decay coefficient , ensuring the dynamic adaptability of the model.

[0043] By introducing the time decay regularization term and propagation impact weight for patent scenarios, calculating the comprehensive risk score of the module, and dynamically triggering real-time protection measures, this step realizes a closed-loop design from risk assessment to active protection, providing core protection for the security of the entire patent system.

[0044] The present invention also provides a software security detection system for a fingerprint browser, comprising a first acquisition module, a second acquisition module, a construction module, a fourth acquisition module and a calculation module; The first acquisition module is used to acquire a feature matrix and a module interaction log based on camouflage features, behavior features, and module interaction features; The second acquisition module is used to obtain the camouflage detection probability matrix, camouflage samples and camouflage tracing report; Build a module dependency graph to obtain the disguised propagation path and high-risk module set; The fourth acquisition module is used to obtain logical vulnerabilities and optimal exploitation paths; The calculation module is used to calculate the comprehensive risk score and select a protection strategy based on the comprehensive risk score; Get the camouflage detection probability matrix, including: Build an improved variational autoencoder model, which is used to capture the feature matrix Distribution deviation, detecting camouflage behavior: ; in: is the input feature matrix; is the feature matrix reconstructed by the encoder and decoder; Represents the Frobenius norm, which is used to measure the feature reconstruction error; The latent distribution generated for the encoder; is the prior distribution; A tuning parameter to control the strength of the latent space constraints; is the regularization term; is the distribution deviation; Optimization by gradient descent , output camouflage detection probability matrix , Elements in express is the probability of camouflaging the feature.

[0045] The advancement of the present invention is: 1. Camouflage detection and tracing mechanism in adversarial environment: In order to solve the problems of insufficient adaptability and weak traceability of disguise detection in the prior art, the present invention introduces a disguise detection mechanism in an adversarial environment. By constructing an adversarial disguise behavior model (such as variational autoencoders and adversarial generative networks), the present invention can accurately identify complex and dynamic disguise behaviors and infer the real fingerprint characteristics behind the disguise. Combined with the comparison and analysis of the malicious fingerprint library, this mechanism can efficiently trace the disguise behavior and help quickly identify potential malicious users or attack sources.

[0046] 2. Vulnerability mining technology based on multi-hop dependency analysis: In view of the problem of complex module interactions and high vulnerability concealment in fingerprint browsers, the present invention proposes a vulnerability mining technology based on multi-hop dependency analysis. By constructing a module interaction dependency graph, the calling relationship and logical dependency chain between modules are dynamically analyzed to discover potential cross-module vulnerabilities. At the same time, symbolic execution technology is used to deeply explore complex logical branches, and reinforcement learning is combined to optimize vulnerability exploitation paths, thereby achieving efficient vulnerability mining and verification. This method overcomes the limitations of traditional single-module vulnerability mining methods and greatly improves the comprehensiveness and accuracy of vulnerability discovery.

[0047] 3. Unified safety detection and protection closed loop: In view of the problem that camouflage detection and vulnerability mining are operated in isolation in the prior art, the present invention designs a unified closed-loop security detection and protection system. The system directly uses the camouflage detection results to optimize the vulnerability mining process, such as priority exploration of dependent paths based on camouflage behavior. In addition, the system can generate a comprehensive risk report and automatically trigger protection measures (such as isolating malicious operations or prompting users to repair) based on real-time monitoring of camouflage behavior and vulnerability exploitation attempts. Through this closed-loop design, the present invention realizes the coordinated optimization of camouflage detection and vulnerability mining, and significantly improves the overall security protection capability.

[0048] Through the above innovations, the present invention breaks through the limitations of the existing technology, can comprehensively cope with the complex challenges of fingerprint browsers in camouflage detection, attack tracing and vulnerability mining, and provide users with efficient and reliable security protection.

[0049] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A software security detection method for a fingerprint browser, characterized in that: include: The first step is to obtain the feature matrix and module interaction log based on the camouflage features, behavior features, and module interaction features; The second step is to obtain the camouflage detection probability matrix, camouflage samples and camouflage tracing report; The third step is to build a module dependency graph to obtain the disguised propagation path and the set of high-risk modules; Step 4: Obtain logical vulnerabilities and optimal exploit paths; Step 5: Calculate the comprehensive risk score and select a protection strategy based on the comprehensive risk score; Get the camouflage detection probability matrix, including: Build an improved variational autoencoder model, which is used to capture the feature matrix Distribution deviation, detecting camouflage behavior: ； in: is the input feature matrix; is the feature matrix reconstructed by the encoder and decoder; Represents the Frobenius norm, which is used to measure the feature reconstruction error; The latent distribution generated for the encoder; is the prior distribution; A tuning parameter to control the strength of the latent space constraints; is the regularization term; is the distribution deviation; Optimization by gradient descent , output camouflage detection probability matrix , Elements in express is the probability of camouflaging the feature.

2. The software security detection method for fingerprint browser according to claim 1, characterized in that: The camouflage features include hardware information and network information, the behavioral features include API call frequency, page loading time and file loading times, and the module interaction features include the calling frequency and calling sequence between modules; Hardware information includes the CPU model of the device running the fingerprint browser; network information includes the IP address of the device running the fingerprint browser.

3. The software security detection method for fingerprint browser according to claim 1, characterized in that: Obtain feature matrix and module interaction log based on camouflage features, behavior features, and module interaction features, including: Standardize camouflage features; Time-weighted processing of behavioral features; The building block calls the feature matrix M: ； in, It is a module For modules The call weight, Indicates the number of calls. is the weight of the k3th call type; N1 represents the total number of call types; The collected camouflage features , standardized behavioral characteristics and the module call feature matrix Combined into a unified feature matrix , The form is as follows: ； in, is the number of time windows, and each row represents the browser status within a time window. is the total number of modules; Extract the call records between modules from the browser running log and generate module interaction logs ,Each call record contains the module with the call relationship, the call frequency, the call type and the ,timestamp sequence.

4. The software security detection method for fingerprint browser according to claim 1, characterized in that: Get camouflage samples, including: Generate complex disguise samples using generative adversarial networks , enhance the recognition ability of the camouflage detection model for complex camouflage behaviors; the optimization objective function of the adversarial generation network is: ； in: is random noise sampled from the latent distribution; is a disguised sample generated by the generator; It is a discriminator that determines whether the sample is a real feature; represents the optimization objective function.

5. The software security detection method for fingerprint browser according to claim 4 is characterized in that: Obtain a spoofing traceability report, including: The camouflage detection probability matrix Interaction log with modules Combined, construct the camouflage propagation weight matrix : ； in: Representation Module To module The disguised propagation weight of Representation Module Calling Modules The number of calls; is the time-dependency adjustment factor; and The latest and earliest timestamps for inter-module calls; To prevent positive numbers with zero denominators; Through the weight matrix Construct a camouflage propagation graph and use a depth-first search algorithm to mark the propagation path of camouflage behavior; finally output a camouflage traceability report , including: The source module of the disguised behavior; The set of propagation paths and affected modules; Pretend propagation weights between modules.

6. The software security detection method for fingerprint browser according to claim 1, characterized in that: Build a module dependency graph to obtain the disguised propagation path and high-risk module set, including: Construction of module dependency graph: Module dependency graph By module collection and the set of directed edges Composition, edge Representation Module Calling Modules ; The calculation of weights takes into account the following three parts: Camouflage Probability Impact: Exploitation Module The probability of camouflage Describe the propagation of masquerades on the call path; Call frequency: feature matrix of calls from modules Extract the module To module Number of calls ; Time decay factor: introduces time correlation through time series information to reduce the impact of historical calls; The expression of module propagation influence weight is: ； in: It is a module and modules The call time difference; is the time decay parameter, which is used to adjust the influence of time factors on the propagation weight; Through the above calculations, a directed graph containing all module call relationships is generated , and record the weights of all edges; Analysis of camouflage propagation paths: Module dependency graph being built In the example, the high-weight edges whose weights are greater than the set weight threshold are analyzed for disguised propagation paths: For each path , defining the propagation impact score : ； Select the communication impact score above the threshold The path is marked as a high-camouflage propagation path, and the module set on the path is recorded; High-risk module flags: Based on the high-weight edges in the propagation path, the risk level of each module is assessed: For modules , calculate the camouflage propagation score , defined as the sum of the weights of all incident edges: ； like Exceeding the set threshold , then the module Mark as a high-risk module and output its module number and risk score ; V represents a collection of modules.

7. The software security detection method for fingerprint browser according to claim 6, characterized in that: Obtain logical vulnerabilities and optimal exploit paths, including: Module multi-hop dependency analysis: In the module dependency graph In the definition of multi-hop dependency strength between modules , For capturing slave modules To module Dependencies: ； in: It is a module arrive The maximum weight path of It is on the path The call weight of It is the edge The probability of camouflage propagation on ; is the coefficient that adjusts the effect of camouflage propagation; Logical vulnerability mining: The paths whose multi-hop dependency strength is greater than the set multi-hop dependency strength threshold are selected. Above, analyze the logical loopholes: Constructing a set of path constraints , logical constraints of modules on the aggregation path: Each module The set of constraints Describe its logical conditions and input-output relationships; Combined with path constraints: ； Checking path constraints using the constraint solver If satisfied, the path is marked as a logic loophole; Vulnerability Exploitation Path Optimization: For the paths marked as logical vulnerabilities, optimize the vulnerability exploitation path: Defining path costs is the sum of the costs of all dependencies on the path: ； The optimization goal is to minimize the path cost and find the best utilization path , the output is the potential vulnerability attack path.

8. The software security detection method for fingerprint browser according to claim 1, characterized in that: Calculate the comprehensive risk score and select a protection strategy based on the comprehensive risk score, including: Calculating Vulnerability Impact Score : For the vulnerability list and module Related vulnerabilities, exploiting path cost Calculate its impact contribution: ； in: For modules The number of associated vulnerabilities; It is The path cost of the optimal exploit path for a vulnerability; is the amplification factor, used to enhance the impact of high-cost paths; is a positive number that prevents the denominator from being zero; Calculating the camouflage propagation score : based on , a time-attenuated regularization term is introduced to reflect the dynamic impact of camouflage propagation: ； in: For modules 's camouflage propagation score; It is a module The interval between the most recent risk event and the current time; is the time decay parameter; is the coefficient that adjusts the effect of camouflage propagation; Calculating a composite risk score : The comprehensive risk score of a module is composed of the weighted vulnerability impact score and the camouflage propagation score: ； in, and They are the weight coefficients of vulnerability impact score and camouflage propagation score respectively.

9. A software security detection system for a fingerprint browser, characterized in that: It includes a first acquisition module, a second acquisition module, a construction module, a fourth acquisition module and a calculation module; The first acquisition module is used to acquire a feature matrix and a module interaction log based on camouflage features, behavior features, and module interaction features; The second acquisition module is used to obtain the camouflage detection probability matrix, camouflage samples and camouflage tracing report; Build a module dependency graph to obtain the disguised propagation path and high-risk module set; The fourth acquisition module is used to obtain logical vulnerabilities and optimal exploitation paths; The calculation module is used to calculate the comprehensive risk score and select a protection strategy based on the comprehensive risk score; Get the camouflage detection probability matrix, including: Build an improved variational autoencoder model, which is used to capture the feature matrix Distribution deviation, detecting camouflage behavior: ； in: is the input feature matrix; is the feature matrix reconstructed by the encoder and decoder; Represents the Frobenius norm, which is used to measure the feature reconstruction error; The latent distribution generated for the encoder; is the prior distribution; A tuning parameter to control the strength of the latent space constraints; is the regularization term; is the distribution deviation; Optimization by gradient descent , output camouflage detection probability matrix , Elements in express is the probability of camouflaging the feature.

Images