Vulnerability detection method and system for cross-domain resource sharing

Abstract

The invention provides a vulnerability detection method and system for cross-domain resource sharing. The method comprises the following steps: firstly, constructing a multi-dimensional heuristic request set comprising a protocol conversion sequence, a sub-domain penetration feature and a null value parameter combination, and adjusting and generating a dynamic association request set through a dynamic parameter inheritance link; then, the requests are injected into an isolated sandbox environment, and a strategy declaration vector and a resource loading track are captured at the same time; secondly, mapping the strategy declaration vector to a behavior track space by adopting a multi-dimensional space projection algorithm so as to calculate a strategy deviation degree parameter; based on the parameter, activating a deep interface scanning engine to identify a callback function dependency chain of an unverified source, and generating an interface exposure parameter; and finally, integrating the strategy deviation degree parameter and the interface exposure degree parameter to generate a cross-domain risk coefficient, and triggering a vulnerability alarm according to a dynamic weight distribution mechanism. According to the technical scheme provided by the embodiment of the invention, the security threat detection precision and efficiency in cross-domain resource sharing are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of cross-domain resource sharing, and in particular to a vulnerability detection method and system for cross-domain resource sharing. Background Art

[0002] As Internet services become increasingly complex and diverse, cross-origin resource sharing (CORS) has become an indispensable part of modern network applications. However, this resource sharing method also brings potential security risks, especially in the process of data interaction between different security domains, which may be subject to threats such as unauthorized access and data leakage.

[0003] Existing cross-domain resource sharing vulnerability detection solutions mainly rely on static code analysis, rule-based security policy checks, and simple penetration testing. These methods usually identify known types of vulnerabilities through predefined rule sets or pattern matching, and use manual review to further verify possible security risks. In addition, there are some automated tools that can detect weak links in the system by simulating attack behaviors.

[0004] The main drawbacks of existing solutions are their limited adaptability and low detection accuracy. First, due to their reliance on fixed rule sets or pattern matching, existing methods are difficult to cope with rapidly evolving network security threats, especially those attacks that exploit unknown vulnerabilities or advanced persistent threats (APTs). Second, traditional detection tools and methods mostly focus on the identification of known attack patterns, but are unable to cope with attack paths that are highly concealed and logically complex. Finally, some existing solutions often require a lot of manpower and material resources for configuration and maintenance during actual deployment, and are prone to false positives or false negatives, which affects their effectiveness and reliability in actual applications. Summary of the invention

[0005] The embodiments of the present application provide a vulnerability detection method and system for cross-domain resource sharing, so as to solve the problems of insufficient accuracy and low efficiency in security threat detection in cross-domain resource sharing in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a vulnerability detection method for cross-domain resource sharing, including: Constructing a multi-dimensional probe request set and performing dynamic parameter inheritance link adjustment to generate a dynamic association request set, wherein the multi-dimensional probe request set includes a protocol conversion sequence, a subdomain penetration feature, and a null value parameter combination; Inject a set of dynamically associated requests into an isolated sandbox environment, and synchronously capture a policy declaration vector and a resource loading track. The policy declaration vector extracts the response header policy declaration feature through a semantic parsing engine, and the resource loading track records the cross-domain resource interaction timing and generates a track space coordinate sequence through behavioral fingerprinting technology. Execute the deviation map construction of the strategy declaration vector and the trajectory space coordinate sequence, and use the multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate the strategy deviation parameter; Activating a deep interface scanning engine based on the policy deviation parameter, the deep interface scanning engine constructs a message monitoring topology structure map through an adaptive port clustering algorithm, identifies the callback function dependency chain of the unverified source and generates an interface exposure parameter; The policy deviation parameter and the interface exposure parameter are integrated to generate a cross-domain risk coefficient. The deep interface scanning engine performs nonlinear superposition on the policy deviation parameter and the exposure parameter through a dynamic weight allocation mechanism. When the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution, a cross-domain resource sharing vulnerability alarm is triggered.

[0007] Optionally, the executing of constructing a deviation map of the strategy declaration vector and the trajectory space coordinate sequence, and using a multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate a strategy deviation parameter, includes: A multi-dimensional attention mechanism is used to adjust the dynamic parameter association strength of the protocol conversion sequence, and a cross-protocol path coupling unit is used to interactively calculate the cross-protocol jump path of the protocol conversion sequence and the nested domain name mapping structure of the subdomain penetration feature, and output a semantic association parameter set carrying the cross-protocol jump feature; Based on the spatiotemporal evolution law of the empty value parameter request template and the trajectory space coordinate sequence fused by the bidirectional temporal network, the behavior fingerprint marking pattern of the resource loading trajectory and the multi-level domain name space distribution of the subdomain penetration feature are transformed into coordinates by using the topological alignment unit to generate a trajectory mapping parameter set containing cross-domain interaction spatiotemporal features; Establishing a manifold space constraint relationship between the semantic association parameter set and the trajectory mapping parameter set, generating a multidimensional projection constraint condition according to the dynamic path distribution of the protocol conversion sequence, and realizing the spatiotemporal offset calculation of the semantic features and spatiotemporal features by using a shared subspace reconstruction algorithm; The cross-protocol jump feature is integrated with the spatiotemporal offset to generate a policy deviation parameter, a dynamic coupling unit is used to nonlinearly associate the offset calculation result with the path weight of the protocol conversion sequence, and the calibration rule of the request template with the null value parameter is combined to output the policy deviation parameter carrying the cross-protocol association feature.

[0008] Optionally, the multi-dimensional attention mechanism is used to adjust the dynamic parameter association strength of the protocol conversion sequence, and the cross-protocol path coupling unit is used to interactively calculate the cross-protocol jump path of the protocol conversion sequence and the nested domain name mapping structure of the subdomain penetration feature, and output a semantic association parameter set carrying the cross-protocol jump feature, including: Construct a multi-level protocol conversion path analysis network to capture the topological connection pattern of the cross-protocol jump path, and use a heterogeneous convolution kernel group to perform multi-granularity path association analysis on the protocol conversion sequence, and perform coordinate transformation on the protocol conversion level features and the nested domain name space distribution of the subdomain penetration features to generate a dynamic path parameter set carrying the cross-protocol jump features; A protocol-aware parameter coupling unit is used to perform cross-protocol association strength adjustment on the dynamic path parameter set, and a protocol-aware parameter set carrying path association characteristics is generated based on the coupling relationship between the topological connectivity parameter and the domain name mapping density parameter of the subdomain penetration characteristic; The protocol perception parameter set and the empty value parameter request template are integrated in the time and space dimensions by using the cross-protocol gating interaction module, and the temporal distribution characteristics of the cross-protocol jump path are reconstructed by combining the path evolution law modeling unit to generate a dynamic coupling parameter set carrying time and space correlation characteristics; A feature pyramid fusion algorithm is adopted to perform the manifold space alignment operation of the multi-level domain name mapping relationship between the dynamic coupling parameter set and the sub-domain penetration feature, and the topological constraint rules are used to eliminate the structural deviation between the protocol jump trajectory and the domain name space distribution to generate a semantic association parameter set carrying cross-protocol semantic association features.

[0009] Optionally, the protocol-aware parameter coupling unit is used to perform cross-protocol association strength adjustment on the dynamic path parameter set, and a protocol-aware parameter set carrying path association characteristics is generated based on the coupling relationship between the topological connectivity parameter and the domain name mapping density parameter of the subdomain penetration feature, including: Performing multi-level path association analysis on the protocol conversion sequence through a path topology analysis unit, capturing the path connection density distribution pattern and directional evolution law of the cross-protocol jump behavior in the protocol conversion sequence based on a spatial convolution kernel group, and outputting a path topology parameter set; Using a domain name density parsing unit to perform a hierarchical space compression operation on the nested topological structure, extracting the spatial distribution intensity characteristics of the multi-level domain name mapping relationship based on an adaptive pooling strategy, and outputting a domain name density parameter set; The path topology parameter set and the domain name density parameter set are input into a timing constraint module by using a cross-protocol coupling unit, and a dynamic coupling parameter vector is generated by using a gated loop unit based on the timing variation law of the cross-protocol association path and the topological constraint relationship of the sub-domain penetration feature; A topological constraint projection algorithm is used to perform a spatial dimension alignment operation between the dynamic coupling parameter vector and the request template of the null value parameter, and based on the topological constraint rules, the structural deviation between the protocol jump trajectory and the domain name space distribution is eliminated, and a protocol-aware parameter set carrying cross-protocol semantic association features is output.

[0010] Optionally, the cross-protocol coupling unit is used to input the path topology parameter set and the domain name density parameter set into a timing constraint module, and a dynamic coupling parameter vector is generated by a gated loop unit based on the timing change law of the cross-protocol association path and the topological constraint relationship of the subdomain penetration feature, including: Based on the connection density distribution pattern of the path topology parameter set and the spatial intensity characteristics of the domain name density parameter set, a multi-scale path correlation analysis is performed on the temporal evolution trajectory of the cross-protocol jump path to generate a primary temporal feature vector carrying short-term fluctuations and long-term evolution rules; Using the primary time series feature vector, a multi-window weight dynamic allocation process is performed on the cross-protocol association strength to generate a dynamic weight parameter set reflecting the coupling strength of the cross-protocol jump path and the subdomain penetration feature in different time intervals; Based on the hierarchical evolution law of the cross-protocol jump path under the constraints of the nested topology structure and the spatial distribution intensity of the domain name mapping density parameter, the dynamic weight parameter set and the domain name density parameter set are interactively calculated and processed to generate an intermediate fusion parameter set carrying spatiotemporal correlation features; According to the topological constraint relationship between the intermediate fusion parameter set and the sub-domain penetration feature, the timing deviation of the cross-protocol jump path and the difference in the spatial structure dimension of the domain name mapping are eliminated to generate a dynamic coupling feature parameter vector that adapts to subsequent spatial alignment operations.

[0011] Optionally, the method of using the primary time series feature vector to perform multi-window weight dynamic allocation processing on the cross-protocol association strength to generate a dynamic weight parameter set reflecting the coupling strength of the cross-protocol jump path and the subdomain penetration feature in different time intervals includes: A hierarchical time window division mechanism is constructed based on the short-term fluctuation characteristics and long-term evolution law carried by the primary time series feature vector, and a multi-granularity time slicing operation is performed on the time series evolution trajectory of the cross-protocol jump path to generate a set of window feature vectors carrying different time scale correlation strengths; Performing a dynamic analysis of path association strength on the window feature vector set using a cross-protocol attention screening module, and generating an attention weight matrix reflecting the coupling strength between the cross-protocol jump path and the subdomain penetration feature based on the spatial distribution intensity parameter under the nested topological structure constraint; A multimodal interaction unit is used to perform hierarchical fusion calculation on the spatial distribution characteristics of the attention weight matrix and the domain name density parameter set, and an intermediate parameter set carrying dynamic coupling weights is generated based on the temporal evolution law of the cross-protocol jump path and the spatial constraint relationship of the domain name mapping density; Execute a topological dimension matching operation between the intermediate parameter set and the subdomain penetration feature, eliminate the conflict between the timing slice deviation of the cross-protocol jump path and the structural dimension of the domain name space distribution through a path trajectory reconstruction algorithm, and output a dynamic weight parameter set that is adapted to subsequent interactive calculation processing.

[0012] Optionally, the establishing of the manifold space constraint relationship between the semantic association parameter set and the trajectory mapping parameter set, generating a multidimensional projection constraint condition according to the dynamic path distribution of the protocol conversion sequence, and using a shared subspace reconstruction algorithm to realize the spatiotemporal offset calculation of the semantic features and spatiotemporal features, includes: Based on the cross-protocol jump characteristics of the semantic association parameter set and the spatiotemporal evolution law of the trajectory mapping parameter set, a manifold space alignment constraint is constructed, and the semantic feature vector and the spatiotemporal feature vector are projected into a shared manifold space using a nonlinear mapping unit to generate a dynamic projection tensor carrying cross-protocol spatiotemporal associations; Extracting multi-dimensional path evolution features according to the dynamic path distribution of the protocol conversion sequence, and performing feature decoupling operations on the dynamic projection tensor in combination with a tensor decomposition algorithm to generate multi-dimensional projection constraint conditions that reflect the coupling strength between the cross-protocol jump path and the sub-domain penetration feature; Based on the topological alignment rule of the shared manifold space, a subspace reconstruction calculation is performed on the multidimensional projection constraint condition, and the manifold space offset of the semantic feature vector and the spatiotemporal feature vector is nonlinearly superimposed using a spatiotemporal coupling unit to generate an offset parameter set that carries the dynamic evolution law of the cross-protocol jump path; Perform a topological dimension alignment operation between the offset parameter set and the subdomain penetration feature, eliminate the spatiotemporal feature dimension deviation between the semantic association parameter set and the trajectory mapping parameter set through a manifold space compensation algorithm, and output a dynamically coupled offset parameter set that integrates the adaptation strategy deviation parameters.

[0013] In a second aspect, an embodiment of the present application provides a vulnerability detection system for cross-domain resource sharing, including: A construction module, used to construct a multi-dimensional probe request set and perform dynamic parameter inheritance link adjustment to generate a dynamic association request set, wherein the multi-dimensional probe request set includes a protocol conversion sequence, a subdomain penetration feature, and a null value parameter combination; A synchronization module is used to inject a set of dynamically associated requests into an isolated sandbox environment, and synchronously capture a policy declaration vector and a resource loading trajectory. The policy declaration vector extracts the response header policy declaration feature through a semantic parsing engine, and the resource loading trajectory records the cross-domain resource interaction timing and generates a trajectory space coordinate sequence through a behavioral fingerprint tagging technology. A processing module, used for executing the construction of a deviation map of the strategy declaration vector and the trajectory space coordinate sequence, and using a multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate a strategy deviation parameter; A monitoring module, used to activate a deep interface scanning engine based on the policy deviation parameter, wherein the deep interface scanning engine constructs a message monitoring topology structure map through an adaptive port clustering algorithm, identifies the callback function dependency chain of the unverified source and generates an interface exposure parameter; An integration module is used to integrate the policy deviation parameter and the interface exposure parameter to generate a cross-domain risk coefficient. The deep interface scanning engine performs nonlinear superposition of the policy deviation parameter and the exposure parameter through a dynamic weight allocation mechanism. When the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution, a cross-domain resource sharing vulnerability alarm is triggered.

[0014] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a cross-domain resource sharing vulnerability detection method as described in the first aspect above.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a cross-domain resource sharing vulnerability detection method as described in the first aspect.

[0016] In an embodiment of the present application, a multi-dimensional probe request set is constructed and a dynamic parameter inheritance link adjustment is performed to generate a dynamic association request set, wherein the multi-dimensional probe request set includes a protocol conversion sequence, a sub-domain penetration feature, and a null value parameter combination; the dynamic association request set is injected into an isolated sandbox environment, and a policy declaration vector and a resource loading trajectory are captured synchronously, wherein the policy declaration vector extracts the response header policy declaration feature through a semantic parsing engine, and the resource loading trajectory records the cross-domain resource interaction timing through a behavioral fingerprint marking technology and generates a trajectory space coordinate sequence; a deviation map of the policy declaration vector and the trajectory space coordinate sequence is constructed, and a multi-dimensional space projection algorithm is used to convert the policy declaration vector and the trajectory space coordinate sequence into a dynamic association request set; The policy declaration vector is mapped to the behavior trajectory space and the policy deviation parameter is calculated; based on the policy deviation parameter, the deep interface scanning engine is activated, and the deep interface scanning engine constructs a message monitoring topology structure map through an adaptive port clustering algorithm, identifies the callback function dependency chain of unverified sources and generates an interface exposure parameter; the policy deviation parameter and the interface exposure parameter are integrated to generate a cross-domain risk coefficient, and the deep interface scanning engine performs nonlinear superposition of the policy deviation parameter and the exposure parameter through a dynamic weight allocation mechanism, and triggers a cross-domain resource sharing vulnerability alarm when the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution.

[0017] The technical solution of this application has the following beneficial effects: This application combines multi-dimensional probe request sets, dynamic parameter inheritance link adjustment, request injection in an isolated sandbox environment, and synchronous capture of policy declaration vectors and resource loading trajectories, etc., to not only accurately detect potential vulnerabilities in cross-domain resource sharing, but also effectively improve the accuracy and comprehensiveness of security assessments. In addition, through the adaptive port clustering algorithm and dynamic weight allocation mechanism, the ability to identify unauthorized access and data leakage risks is further enhanced, providing strong technical support for protecting the security of network resources.

[0018] Furthermore, the method constructs the deviation map between the policy declaration vector and the trajectory space coordinate sequence through a series of sophisticated data processing steps, and calculates the policy deviation parameter. First, the dynamic parameter association strength of the protocol conversion sequence and the nested domain name mapping structure of the cross-protocol jump path and the subdomain penetration feature are adjusted and interactively calculated using the multi-dimensional attention mechanism and the cross-protocol path coupling unit to generate a semantic association parameter set carrying the cross-protocol jump feature. Then, based on the bidirectional temporal network, the spatiotemporal evolution law of the empty value parameter request template and the trajectory space coordinate sequence is fused, and the behavioral fingerprint marking pattern of the resource loading trajectory and the subdomain penetration feature are transformed by the topological alignment unit to form a trajectory mapping parameter set containing the cross-domain interaction spatiotemporal features. Then, the manifold space constraint relationship between the above two parameter sets is established, and the spatiotemporal offset of the semantic features and spatiotemporal features is calculated using the shared subspace reconstruction algorithm. Finally, the cross-protocol jump features and the spatiotemporal offset are integrated, and the dynamic coupling unit is combined with the calibration rule of the empty value parameter request template to output the final policy deviation parameter.

[0019] Through the above method, using a highly customized data processing process, the accuracy and comprehensiveness of cross-domain resource sharing vulnerability detection are significantly improved. Specifically, by using technical means such as multi-dimensional attention mechanism and cross-protocol path coupling unit, it is possible to not only capture the complex changes in the protocol conversion and subdomain penetration process in detail, but also effectively integrate spatiotemporal features to more accurately identify potential security threats. In addition, by establishing a manifold space constraint relationship and applying a shared subspace reconstruction algorithm, the correlation analysis between semantic features and spatiotemporal features is further enhanced, making the calculation of policy deviation parameters more scientific and reasonable. This not only helps to improve the sensitivity and specificity of vulnerability detection, but also provides a solid foundation for subsequent risk assessment. Ultimately, this method can provide more accurate and reliable cross-domain resource sharing security protection in a complex network environment.

[0020] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A flow chart of a cross-domain resource sharing vulnerability detection method provided by the present application is shown; Figure 2A schematic diagram of the structure of a cross-domain resource sharing vulnerability detection system provided by the present application is shown; Figure 3 A schematic diagram of the structure of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0024] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0026] Figure 1 A flowchart of a vulnerability detection method for cross-domain resource sharing is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes: 101. Construct a multi-dimensional probe request set and perform dynamic parameter inheritance link adjustment to generate a dynamic association request set, wherein the multi-dimensional probe request set includes a protocol conversion sequence, a subdomain penetration feature, and a null value parameter combination; Among them, the multi-dimensional probing request set includes various types of requests, which are designed to test the security of cross-domain resource sharing from different dimensions and angles. Specifically, it includes protocol conversion sequences, subdomain penetration characteristics, and null value parameter combinations.

[0027] Dynamic parameter inheritance link adjustment: refers to dynamically adjusting the parameters of subsequent requests based on the results of the previous request when building a request set, in order to more accurately simulate the actual attack path.

[0028] Dynamically associated request set: The adjusted request set can more accurately reflect the potential risks in the actual cross-domain resource sharing process.

[0029] Protocol conversion sequence: A series of requests arranged in the order of different network protocol conversions, used to test cross-protocol security vulnerabilities.

[0030] Subdomain penetration characteristics: A structured data model used to represent the relationship between different subdomains and their possible security weaknesses.

[0031] Empty value parameter combination: Contains various parameter combinations of undefined or empty values. The purpose is to test the system's ability to handle abnormal input.

[0032] In actual operation, first, we collect and construct a multi-dimensional set of probing requests including protocol conversion sequences, subdomain penetration characteristics, and null value parameter combinations. Then, we use dynamic parameter inheritance links to optimize these requests, ensuring that each request can simulate the real attack behavior to the greatest extent possible and adjust the parameters of subsequent requests based on the results of the previous request.

[0033] For example, suppose a bank is evaluating the security of its cross-origin resource sharing (CORS) policy. The security team first built a multi-dimensional set of probing requests, which included various protocol conversion attempts for different API endpoints (such as from HTTP to HTTPS), subdomain penetration characteristics (simulating attackers trying to access resources through different subdomains), and requests with null value parameters (testing the server's handling of abnormal input). These requests are then adjusted through a dynamic parameter inheritance link, such as adjusting the parameter values ​​of subsequent requests based on the status code returned by the first request, ultimately forming a series of dynamically associated request sets ready for the next step of testing.

[0034] 102. Inject a dynamically associated request set into the isolated sandbox environment, and synchronously capture a policy declaration vector and a resource loading trajectory, wherein the policy declaration vector extracts the response header policy declaration feature through a semantic parsing engine, and the resource loading trajectory records the cross-domain resource interaction timing and generates a trajectory space coordinate sequence through a behavioral fingerprinting technology; Among them, isolated sandbox environment: a controlled and closed testing environment used to run unknown or potentially dangerous code without affecting the main system.

[0035] Policy Statement Vector: Security policy features extracted by analyzing the response header to describe the server's allowed scope for cross-domain requests.

[0036] Resource loading trajectory: records the time sequence and behavior patterns of cross-domain resource interactions. The resulting spatial coordinate sequence helps understand the actual usage of resources.

[0037] Semantic parsing engine: A tool that can automatically parse and extract key information from text, mainly used here to identify the security policy of the response header.

[0038] Behavioral fingerprinting technology: Generates a unique "fingerprint" for tracking and analysis by monitoring the behavioral characteristics of resource loading, such as timestamps, access frequency, etc.

[0039] In actual operation, the previously prepared set of dynamic association requests is deployed to an isolated sandbox environment for execution. At the same time, the policy declaration features of all response headers and the resource loading timing are monitored and recorded to form a trajectory space coordinate sequence, providing basic data for subsequent analysis.

[0040] Continuing with the above banking example, a dynamically associated request set is executed in an isolated sandbox environment. Every time a request is sent, the system captures the policy statement information in the response header, and tracks each resource loading process through behavioral fingerprinting technology, recording detailed timing information. For example, when a request attempts to access specific account information, the system will record key information such as the timestamp of the access, the source IP address of the request, etc., in detail to facilitate subsequent analysis of whether there is unauthorized data access behavior.

[0041] 103. Execute the construction of a deviation map of the strategy declaration vector and the trajectory space coordinate sequence, and use a multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate the strategy deviation parameter; Among them, the deviation map is constructed: by comparing the differences between the policy declaration vector and the resource loading trajectory, a graph showing the degree of deviation between the two is constructed.

[0042] Multidimensional space projection algorithm: A mathematical method that can map high-dimensional data into a low-dimensional space for easy visualization and analysis.

[0043] Policy deviation parameter: A numerical indicator that quantifies the gap between the policy declaration vector and the actual resource loading behavior.

[0044] Deviation graph construction: By comparing the differences between the policy declaration vector and the resource loading trajectory, a graph showing the degree of deviation between the two is constructed.

[0045] Multidimensional space projection algorithm: A mathematical method that can map high-dimensional data into a low-dimensional space for easy visualization and analysis.

[0046] Policy deviation parameter: A numerical indicator that quantifies the gap between the policy declaration vector and the actual resource loading behavior.

[0047] In actual operation, a deviation map is constructed based on the policy declaration vector and the trajectory space coordinate sequence, and a multi-dimensional space projection algorithm is used to map the policy declaration vector to the behavior trajectory space, so as to quantify the policy deviation parameters and identify potential security threats.

[0048] Continuing with the above example, the security team began to build a deviation map, comparing the policy statement vector of each request with the actual resource loading trajectory. If a request is found to be allowed by the policy statement, but the actual loading trajectory shows an abnormal behavior pattern (such as frequent attempts to access sensitive data), the request will be marked as having a high policy deviation. Through the multidimensional space projection algorithm, the team can clearly see these deviation points and further confirm whether there are security vulnerabilities.

[0049] 104. Activate a deep interface scanning engine based on the policy deviation parameter, wherein the deep interface scanning engine constructs a message monitoring topology structure map through an adaptive port clustering algorithm, identifies the callback function dependency chain of the unverified source, and generates an interface exposure parameter; Among them, Deep Interface Scanning Engine: an advanced tool for in-depth detection and analysis of the security of application program interfaces.

[0050] Adaptive Port Clustering Algorithm: An intelligent algorithm that automatically groups similar network connections based on traffic characteristics for further analysis.

[0051] Message monitoring topology diagram: A graphical representation of the message flow and their relationships in network communication.

[0052] Interface exposure parameter: measures the degree of external exposure of the API interface, reflecting the potential level of security risks.

[0053] In actual operation, the policy deviation parameter is used to trigger the deep interface scanning engine, and the message monitoring topology structure map is constructed through the adaptive port clustering algorithm to identify the callback function dependency chain of the unverified source, and then evaluate the exposure of the interface.

[0054] According to the above embodiment, once a request with a high policy deviation is identified, the security team starts the deep interface scanning engine. This engine quickly scans the entire network, paying special attention to the ports and services involved in the requests with high policy deviation. Through the adaptive port clustering algorithm, it can efficiently locate those interfaces that may have security risks and generate interface exposure parameters to help the team understand which interfaces are most likely to become attack targets.

[0055] 105. Integrate the policy deviation parameter and the interface exposure parameter to generate a cross-domain risk coefficient. The deep interface scanning engine performs nonlinear superposition on the policy deviation parameter and the exposure parameter through a dynamic weight allocation mechanism. When the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution, a cross-domain resource sharing vulnerability alarm is triggered.

[0056] Among them, the cross-domain risk coefficient is an overall security risk assessment value obtained by comprehensively considering the policy deviation parameters and interface exposure parameters.

[0057] Dynamic weight allocation mechanism: A flexible weight calculation method that can adjust the importance of different factors according to specific circumstances.

[0058] Dynamic threshold judgment conditions: a set of criteria. When these conditions are met, the system will trigger an alarm to notify relevant personnel.

[0059] In actual operation, the cross-domain risk coefficient is generated by integrating the policy deviation parameter and the interface exposure parameter. The deep interface scanning engine performs nonlinear superposition of these two parameters through a dynamic weight distribution mechanism. When the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution, a cross-domain resource sharing vulnerability alarm is triggered.

[0060] Continuing with the above example, finally, combining the data obtained from all the previous steps, the development team calculated the cross-domain risk coefficient of the entire e-commerce platform. Taking into account the different types of interfaces and their respective exposure levels, the team adopted a dynamic weight allocation mechanism to perform weighted averaging and obtained the final risk score. Once this score exceeds the preset dynamic threshold, the system will automatically issue an alarm to remind the security team to take immediate action.

[0061] Through the implementation of steps 101 to 105, this solution can not only comprehensively evaluate the security risks in the cross-domain resource sharing process, but also accurately locate the problem and provide effective solutions. From building a multi-dimensional set of trial requests to finally generating a cross-domain risk factor and triggering an alarm, each step is closely linked to ensure the systematicness and integrity of the detection process. This method greatly improves the ability to discover and defend against cross-domain resource sharing-related vulnerabilities, providing strong support for network security.

[0062] In order to solve the complex correlation problem between the policy declaration vector and the resource loading trajectory and further improve the accuracy and comprehensiveness of cross-domain resource sharing vulnerability detection, in some embodiments, the step 103 executes the deviation map construction of the policy declaration vector and the trajectory space coordinate sequence, and uses a multidimensional space projection algorithm to map the policy declaration vector to the behavior trajectory space and calculate the policy deviation parameter, including: A multi-dimensional attention mechanism is used to adjust the dynamic parameter association strength of the protocol conversion sequence, and a cross-protocol path coupling unit is used to interactively calculate the cross-protocol jump path of the protocol conversion sequence and the nested domain name mapping structure of the sub-domain penetration feature, and output a semantic association parameter set carrying the cross-protocol jump feature; based on the bidirectional temporal network fusion empty value parameter request template and the spatiotemporal evolution law of the trajectory space coordinate sequence, a topological alignment unit is used to transform the behavioral fingerprint marking pattern of the resource loading trajectory with the multi-level domain name space distribution of the sub-domain penetration feature, and generate a trajectory containing cross-domain interactive spatiotemporal features. Trace mapping parameter set; establish a manifold space constraint relationship between the semantic association parameter set and the trajectory mapping parameter set, generate multidimensional projection constraints according to the dynamic path distribution of the protocol conversion sequence, and use a shared subspace reconstruction algorithm to realize the spatiotemporal offset calculation of semantic features and spatiotemporal features; integrate the cross-protocol jump features and the spatiotemporal offset to generate a strategy deviation parameter, use a dynamic coupling unit to nonlinearly associate the offset calculation result with the path weight of the protocol conversion sequence, and combine the calibration rules of the request template of the null value parameter to output the strategy deviation parameter carrying the cross-protocol association feature.

[0063] In this embodiment, a multi-dimensional attention mechanism: a technology that can automatically adjust the weights of different input features, aimed at enhancing the model's attention to key information, is used here to optimize the dynamic parameter association strength in the protocol conversion sequence.

[0064] Cross-protocol path coupling unit: A specially designed module to handle the data interaction logic between different network protocols, ensuring that the cross-protocol jump path can be correctly mapped to the nested domain name structure of the subdomain penetration feature.

[0065] Bidirectional Time Series Network: A neural network architecture that combines forward and backward time series analysis capabilities, suitable for capturing spatiotemporal evolution patterns, and particularly suitable for processing time-tagged data.

[0066] Topological alignment unit: The behavior patterns of different data sources are aligned through coordinate transformation technology to facilitate subsequent analysis. Here, it is used to match the behavior fingerprint marking pattern of resource loading trajectory with the spatial distribution of subdomain penetration characteristics.

[0067] Manifold space constraint relationship: A mathematical model that defines the relationship between points in a high-dimensional space, which is used to constrain the relative positions between semantic features and spatiotemporal features, helping to more accurately calculate the offset between them.

[0068] Shared Subspace Reconstruction Algorithm: A method for finding common low-dimensional representations among multiple high-dimensional datasets, extracting core features and reducing redundant information by reconstructing subspaces.

[0069] Dynamic coupling unit: responsible for processing the nonlinear relationship between two or more variables. Its purpose here is to associate the offset calculation result with the path weight of the protocol conversion sequence to generate the final policy deviation parameter.

[0070] In an embodiment of the present application, a multi-dimensional attention mechanism and a cross-protocol path coupling unit are first used to adjust the dynamic parameters of the protocol conversion sequence, and the dynamic parameters are interactively calculated with the nested domain name mapping structure of the subdomain penetration feature to generate a semantically associated parameter set carrying the cross-protocol jump feature.

[0071] Then, based on the bidirectional temporal network fusion of the empty parameter request template and the spatiotemporal evolution law of the trajectory spatial coordinate sequence, the topological alignment unit is used to match the behavior pattern of the resource loading trajectory with the spatial distribution of the subdomain penetration characteristics to generate a trajectory mapping parameter set.

[0072] Next, the manifold space constraint relationship between the two parameter sets is established, and the shared subspace reconstruction algorithm is used to calculate the spatiotemporal offset of semantic features and spatiotemporal features.

[0073] Finally, these features are integrated and a dynamic coupling unit is used to generate the strategy deviation parameters.

[0074] Here is a specific example: In the scenario of an online education platform, the development team wanted to evaluate the security of its API interface, especially the potential threats of cross-origin resource sharing (CORS). They first constructed a multi-dimensional trial request set containing multiple protocol conversion sequences, subdomain penetration characteristics, and null value parameter combinations, and generated a dynamic association request set through dynamic parameter inheritance link adjustment.

[0075] Next, we run these requests in an isolated sandbox environment and capture the policy declaration vector and resource loading trace synchronously. To deeply analyze this data, we use a multi-dimensional attention mechanism and a cross-protocol path coupling unit to process the protocol conversion sequence, and a bidirectional temporal network and a topological alignment unit to process the resource loading trace.

[0076] Through this method, they not only found that some API interfaces were at risk of unauthorized access, but also identified specific cross-protocol jump paths and subdomain penetration patterns. Ultimately, the policy deviation parameters calculated based on these findings helped the team identify the security risks that needed to be fixed first, thereby greatly improving the overall security of the platform.

[0077] In order to solve the complex association problem between the cross-protocol jump path and the sub-domain penetration structure, and further improve the accuracy and comprehensiveness of the strategy deviation parameter calculation, in the above embodiment, the multi-dimensional attention mechanism is used to adjust the dynamic parameter association strength of the protocol conversion sequence, and the cross-protocol jump path of the protocol conversion sequence is interactively calculated with the nested domain name mapping structure of the sub-domain penetration feature by using the cross-protocol path coupling unit, and the semantic association parameter set carrying the cross-protocol jump feature is output, including: A multi-level protocol conversion path analysis network is constructed to capture the topological connection pattern of the cross-protocol jump path, and a heterogeneous convolution kernel group is used to perform multi-granular path association analysis on the protocol conversion sequence, and the protocol conversion level features and the nested domain name space distribution of the sub-domain penetration feature are coordinate-converted to generate a dynamic path parameter set carrying the cross-protocol jump feature; a protocol-aware parameter coupling unit is used to perform cross-protocol association strength adjustment on the dynamic path parameter set, and a protocol-aware parameter set carrying path association features is generated based on the coupling relationship between the topological connectivity parameter and the domain name mapping density parameter of the sub-domain penetration feature; a cross-protocol gated interaction module is used to fuse the protocol-aware parameter set with the null value parameter request template in spatiotemporal dimensions, and a path evolution law modeling unit is used to reconstruct the trajectory of the temporal distribution characteristics of the cross-protocol jump path to generate a dynamic coupling parameter set carrying spatiotemporal association features; a feature pyramid fusion algorithm is used to perform a manifold space alignment operation of the dynamic coupling parameter set and the multi-level domain name mapping relationship of the sub-domain penetration feature, and a topological constraint rule is used to eliminate the structural deviation between the protocol jump trajectory and the domain name space distribution to generate a semantic association parameter set carrying cross-protocol semantic association features.

[0078] In this embodiment, a multi-level protocol conversion path analysis network is a network architecture specially designed to capture the topological connection patterns of jump paths between different protocols, through which complex protocol conversion paths can be identified.

[0079] Heterogeneous convolution kernel group: A set of convolution kernels optimized for different types of data features, capable of performing multi-granularity path correlation analysis on protocol conversion sequences to extract richer path features.

[0080] Dynamic path parameter set: A data set containing the coordinate transformation results from protocol conversion layer features to nested domain name space distribution, used to describe the specific characteristics of the cross-protocol jump path.

[0081] Protocol-aware parameter coupling unit: A module designed to adjust the cross-protocol association strength based on the topological connectivity and domain name mapping density to ensure an effective match between path features and subdomain structures.

[0082] Cross-protocol gating interaction module: Combining the empty value parameter request template with the protocol-aware parameter set, a dynamic coupling parameter set carrying spatiotemporal correlation features is generated through spatiotemporal dimensional fusion to simulate cross-domain resource sharing behavior in the real world.

[0083] Path evolution law modeling unit: responsible for reconstructing the temporal distribution characteristics of the cross-protocol jump path, helping to understand the path change trend, and generating trajectory data with time dimension information.

[0084] Feature pyramid fusion algorithm: A multi-level feature fusion method that can integrate features at different scales. It is used here to align the dynamic coupling parameter set with the subdomain penetration features in manifold space.

[0085] Topology constraint rules: A series of rules used to eliminate the structural deviation between the protocol jump trajectory and the domain name space distribution, ensuring that the final generated semantic association parameter set is more accurate.

[0086] In an embodiment of the present application, a multi-level protocol conversion path analysis network is first constructed to capture the topological connection pattern of the cross-protocol jump path, and a heterogeneous convolutional kernel group is used to perform multi-granularity path association analysis on the protocol conversion sequence to generate a dynamic path parameter set.

[0087] Then, the protocol-aware parameter coupling unit is used to adjust the cross-protocol association strength of these path parameter sets, and a protocol-aware parameter set is generated based on the relationship between topological connectivity and domain name mapping density.

[0088] Then, the protocol-aware parameter set and the empty-value parameter request template are fused in the spatiotemporal dimensions through the cross-protocol gating interaction module, and the timing distribution characteristics of the cross-protocol jump path are reconstructed in combination with the path evolution law modeling unit to generate a dynamic coupling parameter set.

[0089] Finally, the feature pyramid fusion algorithm is used to align these parameter sets with the subdomain penetration features in manifold space, and topological constraint rules are applied to eliminate structural deviations to generate semantically associated parameter sets that carry cross-protocol semantic association features.

[0090] Here is a specific example: In an online medical service platform, the development team wanted to evaluate the security of its API interface, especially the risks that cross-origin resource sharing (CORS) might bring. They first built a multi-level protocol conversion path analysis network to capture the jump paths and topological connection patterns between different protocols. The platform's protocol conversion sequence was analyzed in detail through a heterogeneous convolutional kernel group, and a dynamic path parameter set was generated.

[0091] Next, the protocol-aware parameter coupling unit was used to adjust the correlation strength of these path parameter sets, and a protocol-aware parameter set was generated based on the topological connectivity and domain name mapping density of the subdomain penetration characteristics. To further enhance the analysis effect, the team used the cross-protocol gating interaction module to fuse these parameter sets with the empty value parameter templates in actual user requests in the spatiotemporal dimension, and at the same time reconstructed the temporal distribution characteristics of the cross-protocol jump path through the path evolution law modeling unit to generate a dynamic coupling parameter set.

[0092] Finally, the feature pyramid fusion algorithm was used to align these parameter sets with the subdomain penetration features in manifold space, and the potential structural deviations were eliminated through topological constraint rules, and finally a semantic association parameter set with cross-protocol semantic association features was obtained. This series of operations helped the team discover several key security risks and take corresponding protective measures, greatly improving the security of the platform.

[0093] In order to solve the complex association problem between the cross-protocol jump path and the sub-domain mapping structure, and further improve the accuracy and comprehensiveness of the path association feature extraction, in the above-mentioned multiple embodiments, the protocol-aware parameter coupling unit is used to perform cross-protocol association strength adjustment on the dynamic path parameter set, and a protocol-aware parameter set carrying path association features is generated based on the coupling relationship between the topological connectivity parameter and the domain name mapping density parameter of the sub-domain penetration feature, including: The protocol conversion sequence is subjected to multi-level path association analysis by a path topology analysis unit, and the path connection density distribution pattern and directional evolution law of the cross-protocol jump behavior in the protocol conversion sequence are captured based on a spatial convolution kernel group, and a path topology parameter set is output; a domain name density analysis unit is used to perform a hierarchical space compression operation on the nested topology structure, and the spatial distribution intensity characteristics of the multi-level domain name mapping relationship are extracted based on an adaptive pooling strategy, and a domain name density parameter set is output; a cross-protocol coupling unit is used to input the path topology parameter set and the domain name density parameter set into a timing constraint module, and a dynamic coupling parameter vector is generated by a gated loop unit based on the timing change law of the cross-protocol association path and the topological constraint relationship of the sub-domain penetration feature; a topology constraint projection algorithm is used to perform a spatial dimension alignment operation between the dynamic coupling parameter vector and the request template of the null value parameter, and the structural deviation between the protocol jump trajectory and the domain name space distribution is eliminated based on the topology constraint rule, and a protocol-aware parameter set carrying cross-protocol semantic association features is output.

[0094] In this embodiment, the path topology analysis unit is a technical module for parsing and identifying the path connection density distribution pattern and directional evolution law of cross-protocol jump behavior in a protocol conversion sequence.

[0095] Spatial convolution kernel group: A set of convolution kernels specially designed to capture path features at different levels, suitable for multi-granularity analysis of complex path structures.

[0096] Path topology parameter set: A data set that includes everything from the path connection density distribution pattern to the directional evolution law, used to describe the specific characteristics of the cross-protocol jump path.

[0097] Domain Density Parsing Unit: A module for processing nested topological structures and extracting their spatial distribution intensity features, which is achieved through hierarchical spatial compression operations.

[0098] Adaptive pooling strategy: A method that dynamically adjusts the data sampling rate to efficiently extract the spatial distribution intensity characteristics of multi-level domain name mapping relationships.

[0099] Cross-protocol coupling unit: responsible for integrating the path topology parameter set with the domain name density parameter set, and generating a dynamic coupling parameter vector that reflects the timing change rules and topological constraint relationship between the two.

[0100] Gated Recurrent Unit (GRU): An improved recurrent neural network unit that is particularly suitable for processing long-term dependencies in sequence data. It is used here to capture the temporal changes in cross-protocol association paths.

[0101] Topologically constrained projection algorithm: A technique for performing spatial dimension alignment operations, ensuring structural consistency between the dynamic coupling parameter vector and the null-value parameter request template, and eliminating deviations.

[0102] In an embodiment of the present application, a path topology analysis unit is first used to perform multi-level path association analysis on the protocol conversion sequence, and a path topology parameter set is generated based on a spatial convolution kernel group to capture the path connection density distribution pattern and directional evolution law.

[0103] Then, the domain name density parsing unit is used to perform hierarchical spatial compression operations on the nested topological structure, and the spatial distribution intensity characteristics of the multi-level domain name mapping relationship are extracted based on the adaptive pooling strategy to generate a domain name density parameter set.

[0104] Then, the path topology parameter set and the domain density parameter set are input into the timing constraint module through the cross-protocol coupling unit, and the dynamic coupling parameter vector reflecting the timing change law of the cross-protocol associated path is generated through the gated recurrent unit.

[0105] Finally, the topological constraint projection algorithm is used to perform spatial dimension alignment on the dynamic coupling parameter vector and the empty value parameter request template to eliminate the structural deviation between the protocol jump trajectory and the domain name space distribution, and generate a protocol-aware parameter set carrying cross-protocol semantic association features.

[0106] Here is a specific example: In the application scenario of an online financial service platform, the development team wanted to evaluate the security of its API interface, especially the risks that cross-origin resource sharing (CORS) might bring. They first used the path topology analysis unit to perform multi-level path correlation analysis on various protocol conversion sequences involved in their services, and captured the path connection density distribution pattern and directional evolution law of cross-protocol jump behavior based on the spatial convolution kernel group, and generated a detailed path topology parameter set.

[0107] Next, the domain density parsing unit was used to perform hierarchical spatial compression operations on the nested topological structures of all subdomains in the platform, and the spatial distribution intensity characteristics of these subdomains were extracted based on the adaptive pooling strategy to generate a domain density parameter set. In order to better understand the relationship between these paths and domain name structures, the team used a cross-protocol coupling unit to input the path topology parameter set and the domain density parameter set into the timing constraint module, and generated a dynamic coupling parameter vector that reflects the timing change law of the cross-protocol associated path through the gated loop unit.

[0108] Finally, the topology constraint projection algorithm was used to align the parameter vectors with the empty value parameter templates in the actual user request, eliminating the structural deviation between the protocol jump trajectory and the domain name space distribution, and obtaining a protocol-aware parameter set with cross-protocol semantic association features. This series of operations helped the team discover multiple potential security risks and take corresponding protective measures, significantly improving the security of the platform.

[0109] In order to solve the complex association problem between the cross-protocol jump path and the timing variation law, and further improve the accuracy and comprehensiveness of the dynamic coupling parameter vector generation, in the above multiple embodiments, the cross-protocol coupling unit is used to input the path topology parameter set and the domain name density parameter set into the timing constraint module, and the gated loop unit is used to generate a dynamic coupling parameter vector for the timing variation law of the cross-protocol association path and the topological constraint relationship of the sub-domain penetration feature, including: Based on the connection density distribution pattern of the path topology parameter set and the spatial intensity characteristics of the domain name density parameter set, a multi-scale path correlation analysis is performed on the temporal evolution trajectory of the cross-protocol jump path to generate a primary temporal feature vector carrying short-term fluctuations and long-term evolution laws; using the primary temporal feature vector, a multi-window weight dynamic allocation process is performed on the cross-protocol correlation strength to generate a dynamic weight parameter set that reflects the coupling strength of the cross-protocol jump path and the sub-domain penetration characteristics in different time intervals; based on the hierarchical evolution law of the cross-protocol jump path under the constraints of the nested topology structure and the spatial distribution intensity of the domain name mapping density parameters, the dynamic weight parameter set and the domain name density parameter set are interactively calculated to generate an intermediate fusion parameter set carrying spatiotemporal correlation characteristics; according to the topological constraint relationship between the intermediate fusion parameter set and the sub-domain penetration characteristics, the timing deviation of the cross-protocol jump path and the difference in the spatial structure dimension of the domain name mapping are eliminated to generate a dynamic coupling feature parameter vector adapted to subsequent spatial alignment operations.

[0110] In this embodiment, multi-scale path association analysis processing: a technical means to extract short-term fluctuations and long-term evolution laws by performing multi-level time series analysis on the path topology parameter set and the domain name density parameter set.

[0111] Primary temporal feature vector: A data set containing everything from path connection density distribution patterns to spatial intensity features, used to describe the temporal variation characteristics of cross-protocol jump paths.

[0112] Multi-window weight dynamic allocation processing: A method that captures the coupling strength between cross-protocol hopping paths and subdomain penetration characteristics by adjusting weights in different time intervals.

[0113] Dynamic weight parameter set: A set of parameters that reflect the coupling strength of cross-protocol jump paths and subdomain penetration characteristics in different time intervals, calculated based on the primary timing feature vector.

[0114] Intermediate fusion parameter set: combines the spatial distribution intensity characteristics of the dynamic weight parameter set and the domain density parameter set to generate a fused dataset with spatiotemporal correlation features.

[0115] Dynamically coupled characteristic parameter vector: The final output after multiple calculations and optimizations is adapted to subsequent spatial alignment operations and can effectively eliminate timing deviations and spatial structure dimension differences.

[0116] In an embodiment of the present application, firstly, based on the connection density distribution pattern of the path topology parameter set and the spatial intensity characteristics of the domain name density parameter set, a multi-scale path correlation analysis is performed on the timing evolution trajectory of the cross-protocol jump path to generate a primary timing feature vector carrying short-term fluctuations and long-term evolution laws.

[0117] Then, the primary time series feature vector is used to perform multi-window weight dynamic allocation processing on the cross-protocol correlation strength, and a dynamic weight parameter set is generated that reflects the coupling strength of the cross-protocol jump path and sub-domain penetration characteristics in different time intervals.

[0118] Then, based on the hierarchical evolution law of the cross-protocol jump path under the constraints of the nested topological structure and the spatial distribution intensity of the domain name mapping density parameters, the dynamic weight parameter set and the domain name density parameter set are interactively calculated and processed to generate an intermediate fusion parameter set carrying spatiotemporal correlation features.

[0119] Finally, according to the topological constraint relationship between the intermediate fusion parameter set and the subdomain penetration characteristics, the timing deviation of the cross-protocol jump path and the difference in the spatial structure dimension of the domain name mapping are eliminated, and a dynamic coupling feature parameter vector adapted to the subsequent spatial alignment operation is generated.

[0120] Here is a specific example: In an application scenario of an online travel service platform, the development team wanted to evaluate the security of its API interface, especially the risks that cross-origin resource sharing (CORS) might bring. They first used the path topology analysis unit to perform multi-level path association analysis on various protocol conversion sequences in their services, and captured the path connection density distribution pattern and directional evolution law of cross-protocol jump behavior based on the spatial convolution kernel group, and generated a detailed path topology parameter set. Then, the domain name density analysis unit was used to perform hierarchical spatial compression operations on the nested topological structure of all subdomains in the platform, and the spatial distribution intensity characteristics of these subdomains were extracted based on the adaptive pooling strategy to generate a domain name density parameter set.

[0121] In order to better understand the relationship between these paths and domain name structures, the team used a cross-protocol coupling unit to input the path topology parameter set and the domain name density parameter set into the timing constraint module. Through the gated recurrent unit, they conducted an in-depth analysis of the timing change law of the cross-protocol jump path and the topological constraint relationship of the subdomain penetration characteristics, and generated a primary timing feature vector.

[0122] Then, the primary time series feature vector was used to dynamically allocate multi-window weights to the cross-protocol association strength and generate a dynamic weight parameter set. Based on the hierarchical evolution law of the cross-protocol jump path under the constraints of the nested topology structure and the spatial distribution intensity of the domain name mapping density parameter, the team interactively calculated the dynamic weight parameter set and the domain name density parameter set and generated an intermediate fusion parameter set.

[0123] Finally, based on the topological constraint relationship between the intermediate fusion parameter set and the subdomain penetration feature, the timing deviation of the cross-protocol jump path and the difference in the spatial structure dimension of the domain name mapping were eliminated, and a dynamic coupling feature parameter vector adapted to the subsequent spatial alignment operation was obtained. This series of operations helped the team identify and fix multiple potential security risks, significantly improving the overall security of the platform.

[0124] In order to solve the complex association problem between the cross-protocol jump path and the timing change law, and further improve the accuracy and comprehensiveness of the dynamic weight parameter set generation, in the above multiple embodiments, the primary timing feature vector is used to perform multi-window weight dynamic allocation processing on the cross-protocol association strength, and a dynamic weight parameter set reflecting the coupling strength of the cross-protocol jump path and the subdomain penetration feature in different time intervals is generated, including: A hierarchical time window division mechanism is constructed based on the short-term fluctuation characteristics and long-term evolution laws carried by the primary time series feature vector, and a multi-granularity time slicing operation is performed on the time series evolution trajectory of the cross-protocol jump path to generate a window feature vector set carrying different time scale correlation strengths; a cross-protocol attention screening module is used to perform path correlation strength dynamic analysis on the window feature vector set, and an attention weight matrix reflecting the coupling strength between the cross-protocol jump path and the sub-domain penetration feature is generated based on the spatial distribution intensity parameters under the constraints of the nested topological structure; a multimodal interaction unit is used to perform hierarchical fusion calculation on the spatial distribution characteristics of the attention weight matrix and the domain name density parameter set, and an intermediate parameter set carrying dynamic coupling weights is generated based on the time series evolution law of the cross-protocol jump path and the spatial constraint relationship of the domain name mapping density; a topological dimension matching operation is performed between the intermediate parameter set and the sub-domain penetration feature, and a path trajectory reconstruction algorithm is used to eliminate the conflict between the time series slicing deviation of the cross-protocol jump path and the structural dimension of the domain name spatial distribution, and a dynamic weight parameter set adapted to subsequent interactive calculation processing is output.

[0125] In this embodiment, the hierarchical time window division mechanism is a technical means to capture short-term fluctuations and long-term evolution laws by slicing time series data at different time scales.

[0126] Window feature vector set: contains multiple sub-vector sets after time slicing operations, each sub-vector represents the path correlation strength in different time intervals.

[0127] Cross-protocol attention filtering module: A technical module for dynamically analyzing path association strength and generating an attention weight matrix based on the spatially distributed strength parameters of the nested topological structure.

[0128] Attention weight matrix: A matrix that reflects the coupling strength between cross-protocol jump paths and sub-domain penetration features, used to guide weight allocation in subsequent calculations.

[0129] Multimodal interaction unit: A technical unit that fuses different data modes and performs hierarchical fusion calculations on the spatial distribution characteristics of the attention weight matrix and the domain density parameter set.

[0130] Intermediate parameter set: A dataset that combines the spatial distribution features of the attention weight matrix and the domain density parameter set to generate the final parameter set carrying the dynamic coupling weights.

[0131] Path trace reconstruction algorithm: A technique used to eliminate the conflict between the timing slice deviation of the cross-protocol jump path and the dimensionality of the domain name space distribution structure, ensuring that the generated parameter set is suitable for subsequent calculations.

[0132] In an embodiment of the present application, the scheme first constructs a hierarchical time window division mechanism based on the short-term fluctuation characteristics and long-term evolution laws carried by the primary timing feature vector, performs multi-granularity time slicing operations on the timing evolution trajectory of the cross-protocol jump path, and generates a set of window feature vectors carrying different time scale correlation strengths.

[0133] Next, the cross-protocol attention screening module is used to perform dynamic analysis of the path association strength on the window feature vector set, and an attention weight matrix reflecting the coupling strength of the cross-protocol jump path and the sub-domain penetration feature is generated based on the spatial distribution intensity parameters of the nested topological structure.

[0134] Then, a multimodal interaction unit is used to hierarchically fuse the spatial distribution characteristics of the attention weight matrix and the domain name density parameter set, and an intermediate parameter set carrying dynamic coupling weights is generated based on the temporal evolution law of the cross-protocol jump path and the spatial constraint relationship of the domain name mapping density.

[0135] Finally, the topological dimension matching operation of the intermediate parameter set and the subdomain penetration characteristics is performed. The path trajectory reconstruction algorithm is used to eliminate the conflict between the timing slice deviation of the cross-protocol jump path and the structural dimension of the domain name space distribution, and the dynamic weight parameter set adapted to the subsequent interactive calculation processing is output.

[0136] Here is a specific example: In an application scenario of an online payment platform, the development team wanted to evaluate the security of its API interface, especially the risks that cross-origin resource sharing (CORS) might bring. They first used the path topology analysis unit to perform multi-level path correlation analysis on various protocol conversion sequences in their service, and captured the path connection density distribution pattern and directional evolution law of cross-protocol jump behavior based on the spatial convolution kernel group, and generated a detailed path topology parameter set.

[0137] Next, the domain name density resolution unit was used to perform a hierarchical spatial compression operation on the nested topological structure of all subdomains in the platform, and the spatial distribution intensity characteristics of these subdomains were extracted based on the adaptive pooling strategy to generate a domain name density parameter set.

[0138] In order to better understand the relationship between these paths and domain name structures, the team constructed a hierarchical time window division mechanism based on the short-term fluctuation characteristics and long-term evolution laws carried by the primary timing feature vectors, performed multi-granularity time slicing operations on the timing evolution trajectories of cross-protocol jump paths, and generated a set of window feature vectors carrying different time scale correlation strengths.

[0139] Next, the cross-protocol attention screening module is used to perform dynamic analysis of the path association strength on the window feature vector set, and an attention weight matrix reflecting the coupling strength between the cross-protocol jump path and the sub-domain penetration feature is generated based on the spatial distribution intensity parameters of the nested topological structure.

[0140] Then, a multimodal interaction unit was used to hierarchically fuse the spatial distribution characteristics of the attention weight matrix and the domain name density parameter set, and an intermediate parameter set carrying dynamic coupling weights was generated based on the temporal evolution law of the cross-protocol jump path and the spatial constraint relationship between the domain name mapping density.

[0141] Finally, we performed a topological dimension matching operation between the intermediate parameter set and the subdomain penetration characteristics, and eliminated the conflict between the timing slice deviation of the cross-protocol jump path and the structural dimension of the domain name space distribution through the path trajectory reconstruction algorithm, and obtained a dynamic weight parameter set that was adapted to the subsequent interactive calculation processing. This series of operations helped the team identify and fix multiple potential security risks, significantly improving the overall security of the platform.

[0142] In order to solve the complex association problem between semantic features and spatiotemporal features and further improve the accuracy and comprehensiveness of the coupling strength analysis of cross-protocol jump paths and subdomain penetration features, as another embodiment, the manifold space constraint relationship between the semantic association parameter set and the trajectory mapping parameter set is established, multidimensional projection constraints are generated according to the dynamic path distribution of the protocol conversion sequence, and the spatiotemporal offset calculation of semantic features and spatiotemporal features is realized by using a shared subspace reconstruction algorithm, including: Based on the cross-protocol jump characteristics of the semantic association parameter set and the spatiotemporal evolution law of the trajectory mapping parameter set, a manifold space alignment constraint is constructed, and the semantic feature vector and the spatiotemporal feature vector are projected to the shared manifold space using a nonlinear mapping unit to generate a dynamic projection tensor carrying cross-protocol spatiotemporal associations; multi-dimensional path evolution features are extracted according to the dynamic path distribution of the protocol conversion sequence, and a feature decoupling operation is performed on the dynamic projection tensor in combination with a tensor decomposition algorithm to generate a multi-dimensional projection constraint condition that reflects the coupling strength between the cross-protocol jump path and the subdomain penetration feature; based on the shared flow The topological alignment rule of the spatiotemporal space performs subspace reconstruction calculation on the multidimensional projection constraint condition, and utilizes the spatiotemporal coupling unit to nonlinearly superimpose the semantic feature vector and the manifold space offset of the spatiotemporal feature vector to generate an offset parameter set that carries the dynamic evolution law of the cross-protocol jump path; performs a topological dimension alignment operation between the offset parameter set and the subdomain penetration feature, eliminates the spatiotemporal feature dimension deviation between the semantic association parameter set and the trajectory mapping parameter set through the manifold space compensation algorithm, and outputs a dynamic coupling offset parameter set that integrates the adaptation strategy deviation parameters.

[0143] In this embodiment, manifold space alignment constraint: a mathematical model used to align different types of feature vectors in a high-dimensional space, ensuring that they are compared and analyzed in the same coordinate system.

[0144] Nonlinear mapping unit: A technical means to map high-dimensional data into a low-dimensional space or a shared manifold space for subsequent processing and analysis.

[0145] Dynamic projection tensor: A data structure containing cross-protocol spatiotemporal correlation information, generated through nonlinear mapping, and used to describe the relationship between cross-protocol jump paths and spatiotemporal evolution laws.

[0146] Multi-dimensional path evolution features: Path change features at different levels and time points extracted from the protocol conversion sequence are used to describe the trend of path changes over time and protocol.

[0147] Tensor decomposition algorithm: An advanced data analysis method used to decompose complex high-dimensional data into multiple more understandable low-dimensional components, here used for feature decoupling operations.

[0148] Multidimensional projection constraints: A set of constraints generated based on the path evolution characteristics to guide the subsequent subspace reconstruction calculations to ensure that the results meet the expected coupling strength.

[0149] Spatiotemporal coupling unit: A fusion technique used to combine the offsets of semantic feature vectors and spatiotemporal feature vectors to generate an offset parameter set that carries dynamic evolution rules.

[0150] Manifold space compensation algorithm: A technique used to eliminate dimensional deviations between different feature sets, ensuring that the final generated parameter set is integrated with the deviation parameters of the adaptation strategy.

[0151] In an embodiment of the present application, a manifold space alignment constraint is first constructed based on the cross-protocol jump characteristics of the semantic association parameter set and the spatiotemporal evolution law of the trajectory mapping parameter set, and a nonlinear mapping unit is used to project the semantic feature vector and the spatiotemporal feature vector to a shared manifold space to generate a dynamic projection tensor carrying cross-protocol spatiotemporal associations.

[0152] Then, the multi-dimensional path evolution features are extracted according to the dynamic path distribution of the protocol conversion sequence, and the tensor decomposition algorithm is used to perform feature decoupling operations on the dynamic projection tensor to generate multi-dimensional projection constraints that reflect the coupling strength between the cross-protocol jump path and the sub-domain penetration feature.

[0153] Then, based on the topological alignment rules of the shared manifold space, subspace reconstruction calculations are performed on the multidimensional projection constraints, and the manifold space offsets of the semantic feature vector and the spatiotemporal feature vector are nonlinearly superimposed using the spatiotemporal coupling unit to generate an offset parameter set that carries the dynamic evolution law of the cross-protocol jump path.

[0154] Finally, the topological dimension alignment operation of the offset parameter set and the subdomain penetration feature is performed, and the spatiotemporal feature dimension deviation between the semantic association parameter set and the trajectory mapping parameter set is eliminated through the manifold space compensation algorithm, and the dynamically coupled offset parameter set integrated with the adaptation strategy deviation parameter is output.

[0155] Here is a specific example: In the application scenario of an online medical appointment platform, the development team wanted to evaluate the security of its API interface, especially the risks that cross-origin resource sharing (CORS) might bring. They first built a detailed multi-dimensional set of trial requests, including protocol conversion sequences, subdomain penetration characteristics, and null value parameter combinations, and generated a dynamic association request set through dynamic parameter inheritance link adjustment. Next, they ran these requests in an isolated sandbox environment to synchronously capture policy declaration vectors and resource loading trajectories.

[0156] In order to deeply analyze these data, the team constructed manifold space alignment constraints based on the cross-protocol jump characteristics of the semantic association parameter set and the spatiotemporal evolution law of the trajectory mapping parameter set. The semantic feature vector and the spatiotemporal feature vector are projected to the shared manifold space using a nonlinear mapping unit, generating a dynamic projection tensor carrying cross-protocol spatiotemporal associations. Then, the multi-dimensional path evolution features are extracted based on the dynamic path distribution of the protocol conversion sequence, and the feature decoupling operation is performed on the dynamic projection tensor in combination with the tensor decomposition algorithm, generating a multi-dimensional projection constraint condition that reflects the coupling strength of the cross-protocol jump path and the subdomain penetration feature.

[0157] Based on the topological alignment rules of the shared manifold space, the team performed subspace reconstruction calculations on the multi-dimensional projection constraints, and used the spatiotemporal coupling unit to nonlinearly superimpose the manifold space offsets of the semantic feature vector and the spatiotemporal feature vector, generating an offset parameter set that carries the dynamic evolution law of the cross-protocol jump path. Finally, by performing the topological dimension alignment operation of the offset parameter set and the subdomain penetration feature, the manifold space compensation algorithm was used to eliminate the spatiotemporal feature dimension deviation of the semantic association parameter set and the trajectory mapping parameter set, and a dynamically coupled offset parameter set with integrated adaptation strategy deviation parameters was obtained. This series of operations helped the team identify and fix multiple potential security risks, significantly improving the overall security of the platform.

[0158] Figure 2 A schematic diagram of the structure of a cross-domain resource sharing vulnerability detection device (or system) is provided for an embodiment of the present application, such as Figure 2 As shown, the device comprises: A construction module 21 is used to construct a multi-dimensional probe request set and perform dynamic parameter inheritance link adjustment to generate a dynamic association request set, wherein the multi-dimensional probe request set includes a protocol conversion sequence, a subdomain penetration feature, and a null value parameter combination; A synchronization module 22 is used to inject a set of dynamically associated requests into an isolated sandbox environment, and synchronously capture a policy declaration vector and a resource loading trajectory, wherein the policy declaration vector extracts a response header policy declaration feature through a semantic parsing engine, and the resource loading trajectory records a cross-domain resource interaction timing sequence and generates a trajectory space coordinate sequence through a behavior fingerprinting technology; A processing module 23, for executing the construction of a deviation map of the strategy declaration vector and the trajectory space coordinate sequence, and using a multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate a strategy deviation parameter; A monitoring module 24, configured to activate a deep interface scanning engine based on the policy deviation parameter, wherein the deep interface scanning engine constructs a message monitoring topology structure map through an adaptive port clustering algorithm, identifies a callback function dependency chain of an unverified source, and generates an interface exposure parameter; The integration module 25 is used to integrate the policy deviation parameter and the interface exposure parameter to generate a cross-domain risk coefficient. The deep interface scanning engine performs nonlinear superposition on the policy deviation parameter and the exposure parameter through a dynamic weight allocation mechanism. When the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution, a cross-domain resource sharing vulnerability alarm is triggered.

[0159] Figure 2 The cross-domain resource sharing vulnerability detection device can execute Figure 1The implementation principle and technical effect of the vulnerability detection method for cross-domain resource sharing described in the embodiment are not described in detail. The specific way in which each module and unit performs operations in the vulnerability detection device for cross-domain resource sharing in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0160] In one possible design, Figure 2 A cross-domain resource sharing vulnerability detection device of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0161] The processing component 32 is used for the above Figure 1 The embodiment provides a cross-domain resource sharing vulnerability detection method.

[0162] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0163] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0164] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0165] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0166] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0167] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0168] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 A cross-domain resource sharing vulnerability detection method according to the illustrated embodiment.

[0169] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0170] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0171] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A vulnerability detection method for cross-domain resource sharing, characterized in that: include: Constructing a multi-dimensional probe request set and performing dynamic parameter inheritance link adjustment to generate a dynamic association request set, wherein the multi-dimensional probe request set includes a protocol conversion sequence, a subdomain penetration feature, and a null value parameter combination; Inject a dynamically associated request set into an isolated sandbox environment, and synchronously capture a policy declaration vector and a resource loading track. The policy declaration vector extracts the response header policy declaration feature through a semantic parsing engine, and the resource loading track records the cross-domain resource interaction timing and generates a track space coordinate sequence through behavioral fingerprinting technology. Execute the deviation map construction of the strategy declaration vector and the trajectory space coordinate sequence, and use the multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate the strategy deviation parameter; Activating a deep interface scanning engine based on the policy deviation parameter, the deep interface scanning engine constructs a message monitoring topology structure map through an adaptive port clustering algorithm, identifies the callback function dependency chain of the unverified source and generates an interface exposure parameter; The policy deviation parameter and the interface exposure parameter are integrated to generate a cross-domain risk coefficient. The deep interface scanning engine performs nonlinear superposition on the policy deviation parameter and the exposure parameter through a dynamic weight allocation mechanism. When the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution, a cross-domain resource sharing vulnerability alarm is triggered.

2. The method according to claim 1, characterized in that The executing of the deviation map construction of the strategy declaration vector and the trajectory space coordinate sequence, and using a multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate the strategy deviation parameter, includes: A multi-dimensional attention mechanism is used to adjust the dynamic parameter association strength of the protocol conversion sequence, and a cross-protocol path coupling unit is used to interactively calculate the cross-protocol jump path of the protocol conversion sequence and the nested domain name mapping structure of the subdomain penetration feature, and output a semantic association parameter set carrying the cross-protocol jump feature; Based on the spatiotemporal evolution law of the empty value parameter request template and the trajectory space coordinate sequence fused by the bidirectional temporal network, the behavior fingerprint marking pattern of the resource loading trajectory and the multi-level domain name space distribution of the subdomain penetration feature are transformed into coordinates by using the topological alignment unit to generate a trajectory mapping parameter set containing cross-domain interaction spatiotemporal features; Establishing a manifold space constraint relationship between the semantic association parameter set and the trajectory mapping parameter set, generating a multidimensional projection constraint condition according to the dynamic path distribution of the protocol conversion sequence, and realizing the spatiotemporal offset calculation of the semantic features and spatiotemporal features by using a shared subspace reconstruction algorithm; The cross-protocol jump feature is integrated with the spatiotemporal offset to generate a policy deviation parameter, a dynamic coupling unit is used to nonlinearly associate the offset calculation result with the path weight of the protocol conversion sequence, and the calibration rule of the request template with the null value parameter is combined to output the policy deviation parameter carrying the cross-protocol association feature.

3. The method according to claim 2, characterized in that The multi-dimensional attention mechanism is used to adjust the dynamic parameter association strength of the protocol conversion sequence, and the cross-protocol path coupling unit is used to interactively calculate the cross-protocol jump path of the protocol conversion sequence and the nested domain name mapping structure of the subdomain penetration feature, and output a semantic association parameter set carrying the cross-protocol jump feature, including: Construct a multi-level protocol conversion path analysis network to capture the topological connection pattern of the cross-protocol jump path, and use a heterogeneous convolution kernel group to perform multi-granularity path association analysis on the protocol conversion sequence, and perform coordinate transformation on the protocol conversion level features and the nested domain name space distribution of the subdomain penetration features to generate a dynamic path parameter set carrying the cross-protocol jump features; A protocol-aware parameter coupling unit is used to perform cross-protocol association strength adjustment on the dynamic path parameter set, and a protocol-aware parameter set carrying path association characteristics is generated based on the coupling relationship between the topological connectivity parameter and the domain name mapping density parameter of the subdomain penetration characteristic; The protocol perception parameter set and the empty value parameter request template are integrated in the time and space dimensions by using the cross-protocol gating interaction module, and the temporal distribution characteristics of the cross-protocol jump path are reconstructed by combining the path evolution law modeling unit to generate a dynamic coupling parameter set carrying time and space correlation characteristics; A feature pyramid fusion algorithm is adopted to perform the manifold space alignment operation of the multi-level domain name mapping relationship between the dynamic coupling parameter set and the sub-domain penetration feature, and the topological constraint rules are used to eliminate the structural deviation between the protocol jump trajectory and the domain name space distribution to generate a semantic association parameter set carrying cross-protocol semantic association features.

4. The method according to claim 3, characterized in that The protocol-aware parameter coupling unit is used to perform cross-protocol association strength adjustment on the dynamic path parameter set, and a protocol-aware parameter set carrying path association characteristics is generated based on the coupling relationship between the topological connectivity parameter and the domain name mapping density parameter of the subdomain penetration feature, including: Performing multi-level path association analysis on the protocol conversion sequence through a path topology analysis unit, capturing the path connection density distribution pattern and directional evolution law of the cross-protocol jump behavior in the protocol conversion sequence based on a spatial convolution kernel group, and outputting a path topology parameter set; Using a domain name density parsing unit to perform a hierarchical space compression operation on the nested topological structure, and extracting the spatial distribution intensity characteristics of the multi-level domain name mapping relationship based on an adaptive pooling strategy, and outputting a domain name density parameter set; The path topology parameter set and the domain name density parameter set are input into a timing constraint module by using a cross-protocol coupling unit, and a dynamic coupling parameter vector is generated by using a gated loop unit based on the timing variation law of the cross-protocol association path and the topological constraint relationship of the sub-domain penetration feature; A topological constraint projection algorithm is used to perform a spatial dimension alignment operation between the dynamic coupling parameter vector and the request template of the null value parameter, and based on the topological constraint rules, the structural deviation between the protocol jump trajectory and the domain name space distribution is eliminated, and a protocol-aware parameter set carrying cross-protocol semantic association features is output.

5. The method according to claim 4, characterized in that The cross-protocol coupling unit is used to input the path topology parameter set and the domain name density parameter set into the timing constraint module, and a dynamic coupling parameter vector is generated by the gated loop unit based on the timing change law of the cross-protocol association path and the topological constraint relationship of the sub-domain penetration feature, including: Based on the connection density distribution pattern of the path topology parameter set and the spatial intensity characteristics of the domain name density parameter set, a multi-scale path correlation analysis is performed on the temporal evolution trajectory of the cross-protocol jump path to generate a primary temporal feature vector carrying short-term fluctuations and long-term evolution rules; Using the primary time series feature vector, a multi-window weight dynamic allocation process is performed on the cross-protocol association strength to generate a dynamic weight parameter set reflecting the coupling strength of the cross-protocol jump path and the subdomain penetration feature in different time intervals; Based on the hierarchical evolution law of the cross-protocol jump path under the constraints of the nested topology structure and the spatial distribution intensity of the domain name mapping density parameter, the dynamic weight parameter set and the domain name density parameter set are interactively calculated and processed to generate an intermediate fusion parameter set carrying spatiotemporal correlation features; According to the topological constraint relationship between the intermediate fusion parameter set and the sub-domain penetration feature, the timing deviation of the cross-protocol jump path and the difference in the spatial structure dimension of the domain name mapping are eliminated to generate a dynamic coupling feature parameter vector that adapts to subsequent spatial alignment operations.

6. The method according to claim 5, characterized in that The method of using the primary time series feature vector to dynamically allocate multi-window weights to the cross-protocol association strength to generate a dynamic weight parameter set reflecting the coupling strength of the cross-protocol jump path and the subdomain penetration feature in different time intervals includes: A hierarchical time window division mechanism is constructed based on the short-term fluctuation characteristics and long-term evolution law carried by the primary time series feature vector, and a multi-granularity time slicing operation is performed on the time series evolution trajectory of the cross-protocol jump path to generate a window feature vector set carrying different time scale correlation strengths; Using a cross-protocol attention screening module to perform a dynamic analysis of the path association strength on the window feature vector set, and generating an attention weight matrix reflecting the coupling strength between the cross-protocol jump path and the subdomain penetration feature based on the spatial distribution intensity parameter under the nested topological structure constraint; A multimodal interaction unit is used to perform hierarchical fusion calculation on the spatial distribution characteristics of the attention weight matrix and the domain name density parameter set, and an intermediate parameter set carrying dynamic coupling weights is generated based on the temporal evolution law of the cross-protocol jump path and the spatial constraint relationship of the domain name mapping density; Execute a topological dimension matching operation between the intermediate parameter set and the subdomain penetration feature, eliminate the conflict between the timing slice deviation of the cross-protocol jump path and the structural dimension of the domain name space distribution through a path trajectory reconstruction algorithm, and output a dynamic weight parameter set that is adapted to subsequent interactive calculation processing.

7. The method according to claim 2, characterized in that The method of establishing a manifold space constraint relationship between the semantic association parameter set and the trajectory mapping parameter set, generating a multidimensional projection constraint condition according to the dynamic path distribution of the protocol conversion sequence, and realizing the calculation of the spatiotemporal offset of the semantic features and the spatiotemporal features by using a shared subspace reconstruction algorithm, includes: Based on the cross-protocol jump characteristics of the semantic association parameter set and the spatiotemporal evolution law of the trajectory mapping parameter set, a manifold space alignment constraint is constructed, and the semantic feature vector and the spatiotemporal feature vector are projected into a shared manifold space using a nonlinear mapping unit to generate a dynamic projection tensor carrying cross-protocol spatiotemporal associations; Extracting multi-dimensional path evolution features according to the dynamic path distribution of the protocol conversion sequence, and performing feature decoupling operations on the dynamic projection tensor in combination with a tensor decomposition algorithm to generate multi-dimensional projection constraint conditions that reflect the coupling strength between the cross-protocol jump path and the sub-domain penetration feature; Based on the topological alignment rule of the shared manifold space, a subspace reconstruction calculation is performed on the multidimensional projection constraint condition, and the manifold space offset of the semantic feature vector and the spatiotemporal feature vector is nonlinearly superimposed using a spatiotemporal coupling unit to generate an offset parameter set that carries the dynamic evolution law of the cross-protocol jump path; Perform a topological dimension alignment operation between the offset parameter set and the subdomain penetration feature, eliminate the spatiotemporal feature dimension deviation between the semantic association parameter set and the trajectory mapping parameter set through a manifold space compensation algorithm, and output a dynamically coupled offset parameter set that integrates the adaptation strategy deviation parameters.

8. A vulnerability detection system for cross-domain resource sharing, characterized in that: include: A construction module, used to construct a multi-dimensional probe request set and perform dynamic parameter inheritance link adjustment to generate a dynamic association request set, wherein the multi-dimensional probe request set includes a protocol conversion sequence, a subdomain penetration feature, and a null value parameter combination; A synchronization module is used to inject a set of dynamically associated requests into an isolated sandbox environment, and synchronously capture a policy declaration vector and a resource loading trajectory. The policy declaration vector extracts the response header policy declaration feature through a semantic parsing engine, and the resource loading trajectory records the cross-domain resource interaction timing and generates a trajectory space coordinate sequence through a behavioral fingerprint tagging technology. A processing module, used for executing the construction of a deviation map of the strategy declaration vector and the trajectory space coordinate sequence, and using a multi-dimensional space projection algorithm to map the strategy declaration vector to the behavior trajectory space and calculate a strategy deviation parameter; A monitoring module, used to activate a deep interface scanning engine based on the policy deviation parameter, wherein the deep interface scanning engine constructs a message monitoring topology structure map through an adaptive port clustering algorithm, identifies the callback function dependency chain of the unverified source and generates an interface exposure parameter; An integration module is used to integrate the policy deviation parameter and the interface exposure parameter to generate a cross-domain risk coefficient. The deep interface scanning engine performs nonlinear superposition of the policy deviation parameter and the exposure parameter through a dynamic weight allocation mechanism. When the superposition result meets the dynamic threshold judgment condition generated based on the protocol conversion sequence weight distribution, a cross-domain resource sharing vulnerability alarm is triggered.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a cross-domain resource sharing vulnerability detection method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, a cross-domain resource sharing vulnerability detection method as described in any one of claims 1 to 7 is implemented.

Images