Vulnerability detection method and device, storage medium and program product

Abstract

The invention discloses a vulnerability detection method and device, a storage medium and a program product. Relates to the field of artificial intelligence or financial science and technology, and comprises the following steps: obtaining single flow data of a target platform to obtain first flow data, and matching the first flow data with flow data in a target knowledge base to obtain a matching result; based on a matching result, determining a service type corresponding to the first traffic data, and obtaining a target service type; and based on the target service type, determining a target workflow in the N agent workflows, and performing vulnerability detection on the target platform by using the target workflow to obtain a vulnerability detection result, the N agent workflows being used for performing vulnerability detection on vulnerabilities of different service types. According to the method and the device, the problem of high omission ratio of complex business logic vulnerabilities due to the fact that vulnerabilities are identified by depending on a rule base and adopting a model matching mode is solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence or financial technology, and specifically, to a vulnerability detection method, device, storage medium and program product. Background Art

[0002] In today's cybersecurity landscape, while numerous security scanning tools can detect long-term security vulnerabilities, many complex business logic vulnerabilities remain. Because they rely on specific business processes and user interactions, they are often difficult to detect directly with traditional scanning tools. Detecting these vulnerabilities typically requires in-depth manual code review and penetration testing, which is not only time-consuming and labor-intensive, but also prone to missed detections due to the tester's limited experience and knowledge.

[0003] In related technologies, rule-based static scanning generally performs static analysis on the code through a predefined rule library and uses pattern matching to identify potential security issues. However, this detection method mainly targets known vulnerability patterns and is still prone to missing unknown vulnerability patterns.

[0004] Currently, no effective solution has been proposed to the problem that related technologies rely on rule libraries and use model matching to identify vulnerabilities, resulting in a high missed detection rate for complex business logic vulnerabilities. Summary of the Invention

[0005] The main purpose of this application is to provide a vulnerability detection method, device, storage medium and program product to solve the problem in related technologies that rely on rule libraries, use model matching to identify vulnerabilities, and have a high missed detection rate for complex business logic vulnerabilities.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a vulnerability detection method is provided. The method includes: obtaining single flow data of a target platform to obtain first flow data, and matching the first flow data with flow data in a target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of a business type; based on the matching result, determining the business type corresponding to the first flow data to obtain a target business type; based on the target business type, determining a target workflow among N intelligent agent workflows, and using the target workflow to perform vulnerability detection on the target platform to obtain a vulnerability detection result, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer.

[0007] Furthermore, the target workflow is used to perform vulnerability detection on the target platform to obtain vulnerability detection results, including: extracting parameters related to the vulnerability in the first traffic data to obtain target parameters; based on the target parameters and preset prompt words, using the target language model to extract parameters related to the target parameters from a parameter database to obtain a target parameter set, wherein the parameter database includes: parameters in T pieces of traffic data, T is a positive integer; based on the target parameter set, vulnerability detection is performed on the target platform to obtain the vulnerability detection result.

[0008] Furthermore, vulnerability detection is performed on the target platform based on the target parameter set to obtain the vulnerability detection result, including: using each parameter in the target parameter set to replace the parameter in the first traffic data to obtain M second traffic data, where M is a positive integer; and vulnerability detection is performed on the target platform based on the M second traffic data to obtain the vulnerability detection result.

[0009] Furthermore, vulnerability detection is performed on the target platform based on the M second traffic data to obtain the vulnerability detection result, including: replaying the M second traffic data to the target platform and receiving a response message returned by the target platform; determining whether the second traffic data is successfully replayed based on the similarity between the format of the response message corresponding to each second traffic data and the message format of the first traffic data; and determining the vulnerability detection result based on the successfully replayed second traffic data.

[0010] Furthermore, before obtaining the target parameter set by extracting parameters related to the target parameter from the parameter database using the target language model based on the target parameter and the preset prompt word, it also includes: obtaining T traffic data of the target platform to obtain T third traffic data; classifying the T third traffic data based on the message structure and the uniform resource locator structure of each third traffic data to obtain a first classification result; performing secondary classification on the T third traffic data based on the first classification result of each third traffic data and the business type to which the third traffic data belongs to to obtain a second classification result; performing parameter extraction on the third traffic data based on the second classification result of each third traffic data, and storing the extracted parameters in the parameter database.

[0011] Furthermore, before matching the first traffic data with the traffic data in the target knowledge base to obtain a matching result, it includes: collecting network traffic data through an interface testing tool, and marking the business type of the network traffic data to obtain S target traffic data, where S is a positive integer; vectorizing the S target traffic data to obtain S processed target traffic data; and storing the S processed target traffic data in the target knowledge base.

[0012] Furthermore, after acquiring a single flow data of the target platform and obtaining the first flow data, it also includes: identifying whether the message in the first flow data is a preset message, and obtaining an identification result, wherein the preset message includes at least one of the following: a message recording image information, a message of a cascading style sheet; when the identification result indicates that the message in the first flow data is not the preset message, performing a step of matching the first flow data with the flow data in the target knowledge base to obtain a matching result.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a vulnerability detection device is provided. The device includes: an acquisition unit, which is used to acquire a single flow data of a target platform, obtain first flow data, and match the first flow data with the flow data in a target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of a business type; a determination unit, which is used to determine the business type corresponding to the first flow data based on the matching result, and obtain a target business type; a processing unit, which is used to determine a target workflow among N intelligent agent workflows based on the target business type, and use the target workflow to perform vulnerability detection on the target platform to obtain a vulnerability detection result, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer.

[0014] Furthermore, the processing unit includes: a first extraction subunit, used to extract parameters related to the vulnerability in the first traffic data to obtain target parameters; a second extraction subunit, used to extract parameters related to the target parameters from a parameter database based on the target parameters and preset prompt words using a target language model to obtain a target parameter set, wherein the parameter database includes: parameters in T pieces of traffic data, where T is a positive integer; a detection subunit, used to perform vulnerability detection on the target platform based on the target parameter set to obtain the vulnerability detection result.

[0015] Furthermore, the detection subunit includes: a replacement module, used to replace the parameters in the first traffic data with each parameter in the target parameter set to obtain M second traffic data, where M is a positive integer; a detection module, used to perform vulnerability detection on the target platform based on M second traffic data to obtain the vulnerability detection result.

[0016] Furthermore, the detection module includes: a replay submodule, used to replay M second traffic data to the target platform and receive a response message returned by the target platform; a first determination submodule, used to determine whether the second traffic data is successfully replayed based on the similarity between the format of the response message corresponding to each second traffic data and the message format of the first traffic data; a second determination submodule, used to determine the vulnerability detection result based on the successfully replayed second traffic data.

[0017] Furthermore, the processing unit also includes: an acquisition subunit, which is used to obtain T traffic data of the target platform and obtain T third traffic data before obtaining the target parameter set by extracting parameters related to the target parameter from the parameter database using the target language model based on the target parameter and the preset prompt word; a first classification subunit, which is used to classify the T third traffic data based on the message structure and the uniform resource locator structure of each third traffic data to obtain a first classification result; a second classification subunit, which is used to perform secondary classification on the T third traffic data based on the first classification result of each third traffic data and the business type to which the third traffic data belongs to, to obtain a second classification result; a third extraction subunit, which is used to extract parameters of the third traffic data based on the second classification result of each third traffic data, and store the extracted parameters in the parameter database.

[0018] Furthermore, the vulnerability detection device also includes: a collection unit, which is used to collect network traffic data through an interface testing tool and mark the business type of the network traffic data before matching the first traffic data with the traffic data in the target knowledge base to obtain a matching result, so as to obtain S target traffic data, where S is a positive integer; a vectorization unit, which is used to perform vectorization processing on the S target traffic data to obtain S processed target traffic data; and a storage unit, which is used to store the S processed target traffic data in the target knowledge base.

[0019] Furthermore, the vulnerability detection device also includes: an identification unit, which is used to obtain a single flow data of the target platform and obtain the first flow data, identify whether the message in the first flow data is a preset message, and obtain an identification result, wherein the preset message includes at least one of the following: a message recording image information, a message of a cascading style sheet; a matching unit, which is used to perform a step of matching the first flow data with the flow data in the target knowledge base to obtain a matching result when the identification result indicates that the message in the first flow data is not the preset message.

[0020] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the vulnerability detection method.

[0021] According to another aspect of the present application, an electronic device is provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the vulnerability detection method is executed when the program is running.

[0022] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, which implement the steps of the vulnerability detection method when executed by a processor.

[0023] In an embodiment of the present application, a single flow data of a target platform is obtained to obtain first flow data, and the first flow data is matched with the flow data in a target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of the business type; based on the matching result, the business type corresponding to the first flow data is determined to obtain a target business type; based on the target business type, a target workflow is determined among N intelligent agent workflows, and the target workflow is used to perform vulnerability detection on the target platform to obtain a vulnerability detection result, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer, thereby solving the technical problem in related technologies of relying on a rule base, identifying vulnerabilities by model matching, and having a high missed detection rate for complex business logic vulnerabilities.

[0024] In this application, business logic vulnerability detection is performed through intelligent workflow based on the business type of traffic data, avoiding the pattern matching method used in related technologies for vulnerability detection, which is difficult to adapt to complex business logic and leads to a high rate of missed vulnerability detection, thereby achieving the technical effect of improving the detection accuracy of business logic vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0026] Figure 1 A hardware structure block diagram of a computer terminal for implementing a vulnerability detection method is shown;

[0027] Figure 2 is a flowchart of a vulnerability detection method provided according to an embodiment of the present application;

[0028] Figure 3is a schematic diagram of a vulnerability detection system provided according to an embodiment of the present application;

[0029] Figure 4 is a schematic diagram of a message analysis module provided according to an embodiment of the present application;

[0030] Figure 5 is a schematic diagram of a vulnerability detection sub-workflow provided according to an embodiment of the present application;

[0031] Figure 6 is a schematic diagram of a parameter extraction module provided according to an embodiment of the present application;

[0032] Figure 7 is a schematic diagram of a vulnerability detection device provided according to an embodiment of the present application;

[0033] Figure 8 This is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] It should be noted that the vulnerability detection method and device in this application can be used in the field of financial technology to detect business logic vulnerabilities in financial services in the system, and can also be used in any field other than the field of financial technology to detect business logic vulnerabilities. This application does not limit the application field of the vulnerability detection method and device.

[0037] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following interpretations:

[0038] Agent: A software entity that can autonomously perform tasks, perceive the environment and make decisions. In this invention, it specifically refers to an intelligent processing unit based on a large language model.

[0039] RAG: Retrieval-Augmented Generation, a technique that combines an external knowledge base with a large language model to enhance the model's output quality by retrieving relevant knowledge.

[0040] Business logic vulnerabilities: refer to security flaws in the design or implementation of application business processes. These vulnerabilities are usually closely related to specific business scenarios.

[0041] Prompt word engineering: A technical approach that uses carefully designed prompt words to guide large language models to complete specific tasks.

[0042] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation portals for users to choose to agree or refuse the automated decision-making results; if the user chooses to refuse, the expert decision-making process will be entered.

[0043] The present invention can be applied to various software products, control systems, and client (including but not limited to: mobile clients, PCs, etc.) control systems of various financial institutions. Taking software products as an example for illustration, the software products installed on the mobile clients can detect business logic vulnerabilities associated with processing the business content of financial institutions (including but not limited to: transfer, financial management, funds, payment, account checking, advertising, recommendation and other business functions).

[0044] Example 1

[0045] According to an embodiment of the present application, a method embodiment of a vulnerability detection method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0046] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a vulnerability detection method. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (illustrated as 102a, 102b, ..., 102n in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0047] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0048] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the vulnerability detection method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned vulnerability detection method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0049] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0050] The display may be, for example, a touch screen liquid crystal display (LCD), which enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0051] Under the above operating environment, this application provides Figure 2 The vulnerability detection method shown. Figure 2 This is a flowchart of a vulnerability detection method according to Example 1 of the present application.

[0052] Step S201, obtain single flow data of the target platform, obtain first flow data, and match the first flow data with the flow data in the target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of the business type.

[0053] The above-mentioned target platform can be a platform for financial institutions to handle financial business. In this embodiment, the traffic data of the target platform can be obtained one by one, and each traffic can be filtered and sorted to remove messages that are not related to the business logic (such as pictures, css (cascading style sheets)). In the case that the above-mentioned first traffic data is a message that is not related to the business logic (such as pictures, css (cascading style sheets)), the traffic data can be used for vulnerability detection. In the case that the first traffic data is not a message that is not related to the business logic, vulnerability detection can continue. The above-mentioned target knowledge base may include: network traffic data that carries identification information of the business type. The above-mentioned business types may include but are not limited to: login, text message, file upload, file download, etc.

[0054] In this embodiment, the first traffic data can be matched with the traffic data in the target knowledge base to obtain a matching result. The above matching result may include the matching degree between the first traffic data and each traffic data in the target knowledge base. For example, the first traffic data can be vectorized, and the vectorized first traffic data can be matched with the vectorized traffic data in the target knowledge base to obtain the matching degree between the first traffic data and the traffic data in the target knowledge base.

[0055] Step S202: Based on the matching result, determine the service type corresponding to the first traffic data to obtain the target service type.

[0056] In this embodiment, based on the degree of match between the first traffic data and each traffic data in the target knowledge base, the business type corresponding to the traffic data in the target database whose degree of match with the first traffic data is greater than a preset threshold is determined as the business type corresponding to the first traffic data, and this business type is recorded as the target business type. In an optional example, if the degree of match between the traffic data in the target database and the first traffic data is not greater than a preset threshold, the target language model (e.g., a large model) can be used to identify the business type of the first traffic data.

[0057] For example, the traffic currently being analyzed (corresponding to the first traffic data) can be matched and classified with the knowledge base traffic (i.e., the traffic data in the target knowledge base) to obtain a vectorized matching degree. A matching degree of 80% or above (the threshold can be adjusted) is considered a successful match. A matching degree below 80% allows the large model to identify the service type. After the service type is identified, vulnerability detection can be performed.

[0058] Step S203, based on the target business type, determine the target workflow among the N intelligent agent workflows, and use the target workflow to perform vulnerability detection on the target platform to obtain vulnerability detection results, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer.

[0059] The above-mentioned N intelligent agent workflows can be used to detect vulnerabilities involved in different business types. For example, for SMS business types, it can include SMS spraying vulnerability detection workflows, SMS blasting vulnerability detection workflows and SMS-related vulnerability detection workflows. Each workflow can be an intelligent agent workflow.

[0060] In this embodiment, based on the target business type, an agent can be selected from N agent workflows to detect vulnerabilities of the target business type, thereby obtaining a target workflow. The target workflow is then used to perform vulnerability detection on the target platform to obtain vulnerability detection results. Specifically, based on the parameters in the first flow data, parameters similar to and having the same function as the parameters can be obtained to obtain a target parameter set. The first flow data can then be replaced based on the parameters in the target parameter set to obtain multiple replaced flow data. The multiple replaced flow data can then be used to perform vulnerability detection on the target assessment. This achieves the purpose of performing vulnerability detection on business logic vulnerabilities based on business scenarios.

[0061] In this embodiment, through the above steps, business logic vulnerability detection is performed based on the business type of traffic data through an agent workflow. This avoids the vulnerability detection method used in related technologies, which uses pattern matching, but is difficult to adapt to complex business logic and results in a high rate of missed detections. This achieves the technical effect of improving the accuracy of business logic vulnerability detection. This further solves the technical problem in related technologies that relies on rule bases and uses model matching to identify vulnerabilities, resulting in a high rate of missed detections for complex business logic vulnerabilities.

[0062] Optionally, in the vulnerability detection method provided in the embodiment of the present application, a target workflow is used to perform vulnerability detection on the target platform to obtain vulnerability detection results, including: extracting parameters related to the vulnerability in the first traffic data to obtain target parameters; based on the target parameters and preset prompt words, using the target language model to extract parameters related to the target parameters from the parameter database to obtain a target parameter set, wherein the parameter database includes: parameters in T pieces of traffic data, T is a positive integer; based on the target parameter set, vulnerability detection is performed on the target platform to obtain vulnerability detection results.

[0063] In this embodiment, parameters (corresponding to target parameters, such as user identification and sensitive operation instructions) that may be associated with specific types of vulnerabilities can be analyzed and identified in network traffic data (i.e., first traffic data) for subsequent vulnerability detection. Subsequently, a preset prompt word (i.e., instruction or question that guides the large language model to extract parameters) and a target language model (e.g., large model) can be used to further extract a set of parameters closely related to the target parameters from a database (i.e., parameter database) that stores parameters from all historical traffic data. This parameter set will contain more detailed parameter information and possible parameter values, which can be used to construct test cases and implement simulated attack tests. Finally, based on the extracted target parameter set, a series of test cases can be automatically generated through an intelligent agent workflow to perform vulnerability detection on the target platform. These test cases simulate possible attack scenarios. By observing the platform's response to these test cases, the intelligent agent can identify and verify existing security vulnerabilities, ultimately generating a detailed vulnerability detection report. By integrating the large language model, prompt word engineering, parameter database, and intelligent agent workflow, complex business logic vulnerabilities can be automatically identified and tested, improving testing efficiency and accuracy.

[0064] For example, in this embodiment, the presence of possible attack points in the first traffic data can be identified based on the large model prompt word engineering. For example, for SMS spraying traffic, it is possible to identify whether the parameters of the message sent contain parameters related to the user. According to the identified parameters (corresponding to the target parameters), the prompt word engineering can be used for the business type of vulnerability detection (for example, for test SMS spraying, different levels of user information can be obtained). In the business parameter database (corresponding to the target parameter set), the corresponding business parameter set (corresponding to the target parameter set) is obtained. Then, based on the business parameter set, vulnerability detection is performed on the target platform to obtain vulnerability detection results. This avoids the reliance on manual experience for test case design in related technologies, where the test coverage rate is heavily dependent on the professional level of the testers. Secondly, the detection capability is limited, making it difficult to discover complex business logic vulnerabilities. The ability to understand the business context is insufficient, and the false alarm rate and missed alarm rate are high, thereby achieving the technical effect of improving the detection rate of business logic vulnerabilities.

[0065] Optionally, in the vulnerability detection method provided in the embodiment of the present application, vulnerability detection is performed on the target platform based on the target parameter set to obtain a vulnerability detection result, including: using each parameter in the target parameter set to replace the parameter in the first traffic data to obtain M second traffic data, where M is a positive integer; and performing vulnerability detection on the target platform based on the M second traffic data to obtain a vulnerability detection result.

[0066] In this embodiment, the obtained target parameter set can be used in the intelligent agent workflow (target workflow) to modify the parameter information of the first traffic data and implement replay. Specifically, the parameters in the target parameter set can be used to replace the corresponding parameters in the first traffic data one by one. In order to construct a new test traffic (second traffic data), each parameter combination can simulate a possible attack scenario to test the target platform's response to abnormal parameter input. Using the generated M second traffic data, a series of test requests are initiated to the target platform to simulate a variety of possible attack methods to detect whether the security defense mechanism of the target platform is strong enough and whether it can correctly handle and respond to these abnormal or malicious parameter inputs. Based on the response of the target platform to the M test traffic (second traffic data), analyze and determine whether there is a security vulnerability. The vulnerability detection results may include vulnerability classification, severity assessment, and possible repair suggestions.

[0067] Through the intelligent agent workflow, the target platform can be tested systematically and automatically to detect potential business logic vulnerabilities without the need to manually design a large number of test cases, thereby improving the efficiency and coverage of vulnerability detection.

[0068] Optionally, in the vulnerability detection method provided in the embodiment of the present application, vulnerability detection is performed on the target platform based on M second traffic data to obtain a vulnerability detection result, including: replaying the M second traffic data to the target platform, and receiving a response message returned by the target platform; determining whether the second traffic data is successfully replayed based on the similarity between the format of the response message corresponding to each second traffic data and the message format of the first traffic data; and determining the vulnerability detection result based on the successfully replayed second traffic data.

[0069] In this embodiment, the second flow data can be used to send a request to the target platform to simulate an attack or abnormal operation to test the security and stability of the platform. Specifically, the second flow data can be replayed to the target platform. For example, M second flow data can be sent to the target platform in sequence, which is equivalent to replaying the modified first flow data. After receiving the response message returned by the target platform, it can be compared with the response message format of the original first flow data. The similarity of the format can be compared, that is, whether the modified flow data has received a normal response from the platform and has not caused an error or abnormal termination. If the format of the response message is similar to the message format of the first flow data to a certain threshold (for example, 80%), the replay of the second flow data is considered successful. For the second flow data that is successfully replayed, its corresponding response message content can be further analyzed to find possible security vulnerabilities or abnormal behaviors, including checking whether there are unexpected responses, leaked sensitive information, improper authorization, etc. Based on the analysis results, it can be determined whether the target platform has security vulnerabilities. If any unexpected behavior or security issues are found, they can be recorded to form part of the vulnerability detection report. If no obvious problems are found, it can be determined that under the current test conditions, there are no vulnerabilities in the target assessment, which effectively combines the advantages of automated testing and in-depth understanding of business logic, and improves the accuracy of the detection results of business logic vulnerabilities.

[0070] For example, after replaying M second traffic data to the target platform, the response message returned by the target platform can be received. Afterwards, the prompter project can be used to perform a unified analysis of all replay results, among which the format of the response message can be identified, and the understanding ability of the large model can be used to identify whether the response format is similar to the original successful traffic message (that is, the message corresponding to the first traffic data). If similar, it can be regarded as a successful replay; then, according to the detection rules, it is identified whether the content of the response message meets the vulnerability characteristics to obtain the vulnerability detection results.

[0071] Optionally, in the vulnerability detection method provided in the embodiment of the present application, before extracting parameters related to the target parameters from the parameter database using the target language model based on the target parameters and preset prompt words to obtain the target parameter set, it also includes: obtaining T traffic data of the target platform to obtain T third traffic data; classifying the T third traffic data based on the message structure and the uniform resource locator structure of each third traffic data to obtain a first classification result; based on the first classification result of each third traffic data and the business type to which the third traffic data belongs, performing secondary classification on the T third traffic data to obtain a second classification result; based on the second classification result of each third traffic data, extracting parameters from the third traffic data, and storing the extracted parameters in the parameter database.

[0072] In this embodiment, traffic interfaces can be classified based on the URL (Uniform Resource Locator) and message structure of the third traffic data. Traffic interfaces with the same URL structure and message parameter structure can be grouped together. Each category can then be further classified based on the target knowledge base and traffic service type. Parameters from the third traffic data for each service type can be extracted. Finally, the extracted parameters and the service type corresponding to the parameters can be stored in a parameter database. For example, parameters can be extracted and modeled from 10 SMS spray messages, with the main parameter key being userId and the parameter attribute being userLevel. This achieves the purpose of constructing parameter sets for traffic data of different service types.

[0073] Optionally, in the vulnerability detection method provided in the embodiment of the present application, before matching the first traffic data with the traffic data in the target knowledge base to obtain a matching result, it includes: collecting network traffic data through an interface testing tool, and marking the business type of the network traffic data to obtain S target traffic data, where S is a positive integer; vectorizing the S target traffic data to obtain S processed target traffic data; and storing the S processed target traffic data in the target knowledge base.

[0074] The aforementioned interface testing tool can capture and record network requests and responses during software execution or user interaction, used to monitor and collect traffic data on the target platform. In this embodiment, the interface testing tool can be used to intercept and record all data exchanges conducted through the network interface, including requests sent by the client to the server and responses returned by the server. The collected network traffic data requires further processing to identify the service type to which it belongs. For example, traffic may be associated with functions such as user login, SMS sending, and payment transactions. This labeling process can be completed manually or assisted by automated scripts or machine learning models. After screening and labeling, traffic data labeled with specific service types can be obtained, which are recorded as S target traffic data. To enable intelligent agents and large models to understand and analyze traffic data, the textual traffic data can be converted into numerical or vectorized representations, so that similarities and differences between traffic flows can be captured through mathematical operations. The S vectorized traffic data can be added to the knowledge base, forming the basis for subsequent intelligent agent workflow and RAG technical analysis. Over time and with the accumulation of data, the target knowledge base will become increasingly rich, encompassing a variety of service scenarios and traffic patterns, providing strong support for intelligent agents to identify potential attack points. This ensures that the traffic data stored in the target knowledge base is not only sufficient in quantity but also fully reflects the business logic and user interaction characteristics of the target platform, laying a solid foundation for subsequent vulnerability detection. By continuously collecting, annotating, and processing traffic data, the target knowledge base can continuously evolve, improving the agent's detection capabilities and the system's adaptability.

[0075] For example, the knowledge sources in the target knowledge base can include the following two methods: one is to use the interface testing tool to collect the interfaces and description information involved in the traffic data, and the business type can be determined based on the description information of the interface; the other is to label the business type of the traffic data through the target (for example, large models, manual labeling), and then the collected knowledge (that is, the processed target traffic data) can be quantified and stored in the target knowledge base, thereby achieving the purpose of building a database of traffic data of different business types.

[0076] Optionally, in the vulnerability detection method provided in the embodiment of the present application, after obtaining a single flow data of the target platform and obtaining the first flow data, it also includes: identifying whether the message in the first flow data is a preset message, and obtaining an identification result, wherein the preset message includes at least one of the following: a message recording image information, a message of a cascading style sheet; when the identification result indicates that the message in the first flow data is not a preset message, performing a step of matching the first flow data with the flow data in the target knowledge base to obtain a matching result.

[0077] The above-mentioned preset messages may be messages that do not carry business logic information or are less relevant to business logic vulnerability detection in the context of security testing and vulnerability detection. Preset messages may include, but are not limited to: (1) messages that record image information, which are mainly used to transmit image files and usually do not contain business logic or key parameters; (2) messages for Cascading Style Sheets (CSS): used to define the appearance and layout of web page elements, which also do not directly involve business logic.

[0078] In this embodiment, each message of the target platform can be analyzed by the intelligent agent to determine whether it belongs to the preset message type. Specifically, the judgment can be made based on the structure, content and metadata of the message. The intelligent agent can identify whether the message contains image information or CSS code, thereby obtaining an identification result of whether each message is a preset message. In the case that the message in the first traffic data is not a preset message, the first traffic data can be matched with the traffic data in the target knowledge base. By filtering out messages that do not directly contribute to the detection of business logic vulnerabilities, unnecessary consumption of computing resources and waste of analysis time can be avoided, that is, invalid analysis on non-business-related messages is avoided, ensuring the pertinence of subsequent matching and vulnerability detection, and improving the quality and efficiency of the overall test.

[0079] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0080] Example 2

[0081] The second embodiment of the present invention provides an optional vulnerability detection system, which can be used to execute the vulnerability detection method provided in the first embodiment of the present invention.

[0082] Figure 3 Schematic diagram of a vulnerability detection system according to an embodiment of the present application. Figure 3 As shown in the figure, the system's main entry / main module is S1. The S1 main module / main entry consists of three parts: A1 - platform traffic, A2 - parameter extraction module, and A3 - message analysis module. A1 - platform traffic is intercepted and captured by the test tool, including complete request and response messages. The traffic is transmitted to the A2 and A3 modules for subsequent processing.

[0083] Figure 4 Schematic diagram of a message analysis module according to an embodiment of the present application, such as Figure 4 As shown, Figure 3The A2-message analysis module includes: A21 single traffic processing module, A22 traffic classification module, A23 business traffic RAG knowledge base and A24 business vulnerability detection module, among which the A24 business vulnerability detection module includes: A241 vulnerability detection sub-workflow 1.

[0084] Specifically, the A21 single traffic processing module is responsible for filtering and sorting the A1 platform traffic one by one, removing irrelevant messages (such as pictures, CSS, etc.) (i.e. preset messages), and then transmitting the traffic to the A22 traffic classification module.

[0085] The A23RAG knowledge base (i.e., the target knowledge base) contains classification information on network traffic and business types. Business types include but are not limited to login, SMS, file upload, file download, etc. The knowledge base knowledge comes from two main sources: one is the interface and description information collection in the interface testing tool, and the other is manual labeling. The knowledge collected by these two methods is then quantified and stored in the knowledge base.

[0086] The A22 traffic classification module can be combined with the A23 RAG knowledge base to perform business classification. The main logic is to match the currently analyzed traffic with the knowledge base traffic and classify it into a vectorized match. A match of 80% or above (the threshold can be adjusted) is considered a successful match. A match below 80% will be considered a large model for business type identification. After the business classification is identified, the corresponding vulnerability detection type in the A24 business vulnerability detection module is called.

[0087] The A24 business vulnerability detection module includes A241-vulnerability detection sub-workflows related to the business type. For example, for the SMS business type, it includes the SMS spraying vulnerability detection workflow, the SMS blasting vulnerability detection workflow, and the SMS-related vulnerability detection workflow. Each workflow is an intelligent agent workflow.

[0088] Figure 5 Schematic diagram of the vulnerability detection sub-workflow provided in accordance with an embodiment of the present application, such as Figure 5 As shown, the vulnerability detection sub-workflow A241 can be written for a general vulnerability detection step, including A2411-attack point identification module, A2412-acquisition business parameter set module, A2413-batch attacker module, A2414-result analyzer module, and A2415 parameter requirement knowledge base.

[0089] Among them, A2411-Attack Point Identification Module: It can be an intelligent agent that identifies possible attack points in traffic based on large-scale model prompt word engineering. For example, for SMS spraying traffic, it identifies whether the parameters of the sent message contain user-related parameters (i.e., target parameters);

[0090] A2412-Business parameter set acquisition module: Based on the parameters identified by the A2411-attack point identification module, use the prompt word project for the vulnerability detection type (for example, for test SMS spraying, obtain user information of different levels), and obtain the corresponding business parameter set in the A33-business parameter database; this required prompt word will be recorded as knowledge in the A2415 knowledge base for the parameter extraction process, among which, A33-business parameter database: contains parameter data used by different business types, and the data is generated by the parameter extraction process.

[0091] A2413-Batch attacker module: uses the parameter set obtained by A2412 to modify the parameter information of the corresponding traffic and implement replay.

[0092] A2414 - Result Analyzer Module: This module uses the prompter project to perform a unified analysis of all replay results. A key detection criterion is identifying the format of the response results. Leveraging the understanding capabilities of a large model, this module identifies a replay success if the response format is similar to the original successful traffic message. Detection rules are then used to determine whether the content of the response message matches the vulnerability signature.

[0093] Figure 6 is a schematic diagram of a parameter extraction module provided according to an embodiment of the present application, such as Figure 6 As shown, the A3-parameter extraction module includes: A31-message classifier, A32-parameter extractor, and A33-service parameter database.

[0094] Among them, A31-Message Classifier: It can first classify traffic interfaces according to the traffic URL and message structure, and classify those with the same URL structure and parameter structure into one category.

[0095] A32-Parameter Extractor: A32 is an intelligent agent responsible for extracting parameters from traffic of the same type. A32 first uses A22 to classify each type of traffic data after A31 classification. It then combines the A2415 parameter requirement knowledge base and the traffic business type to obtain the prompt word used for parameter extraction. It then extracts parameters from the traffic based on the prompt word and finally stores the extracted parameters and the corresponding business type in the A33-Business Parameter Database (for example, extracting and modeling parameters from 10 SMS spray messages, with the main parameter key = userId and the parameter attribute = userLevel).

[0096] In this embodiment, the intelligent agent can automatically analyze business processes to reduce manual intervention. For example, it can intelligently identify attack points, improve test efficiency, automatically extract parameters and generate test parameter sets, automatically connect various test processes, and speed up testing. It can also provide accurate business logic understanding capabilities through the RAG knowledge base, improve classification accuracy, and reduce false alarm rates through the semantic understanding capabilities of the intelligent agent. In this embodiment, test experience can be automatically accumulated into the knowledge base (for example, the business types of traffic data in the knowledge base are expanded) to achieve continuous optimization of test strategies.

[0097] Example 3

[0098] The embodiment of the present application also provides a vulnerability detection device. It should be noted that the vulnerability detection device of the embodiment of the present application can be used to execute the vulnerability detection method provided in the embodiment of the present application. The vulnerability detection device provided in the embodiment of the present application is introduced below.

[0099] According to an embodiment of the present application, a device for implementing the above vulnerability detection method is also provided, such as Figure 7 As shown, the device includes: an acquisition unit 71, a determination unit 72 and a processing unit 73.

[0100] The acquisition unit 71 is configured to acquire single flow data of a target platform, obtain first flow data, and match the first flow data with flow data in a target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of a business type;

[0101] A determination unit 72 is configured to determine the service type corresponding to the first traffic data based on the matching result, and obtain a target service type;

[0102] The processing unit 73 is used to determine the target workflow among N intelligent agent workflows based on the target business type, and use the target workflow to perform vulnerability detection on the target platform to obtain vulnerability detection results, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer.

[0103] In the vulnerability detection device provided in the embodiment of the present application, a single flow data of the target platform can be obtained by the acquisition unit 71 to obtain the first flow data, and the first flow data can be matched with the flow data in the target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of the business type, and the business type corresponding to the first flow data is determined based on the matching result by the determination unit 72 to obtain the target business type, and the target workflow is determined based on the target business type in N intelligent agent workflows by the processing unit 73, and the target workflow is used to perform vulnerability detection on the target platform to obtain a vulnerability detection result, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer. This solves the technical problem in the related technology of relying on a rule base, using a model matching method to identify vulnerabilities, and having a high missed detection rate for complex business logic vulnerabilities.

[0104] In this embodiment, business logic vulnerability detection is performed through the intelligent workflow according to the business type of the traffic data, avoiding the vulnerability detection method using pattern matching in related technologies, which is difficult to adapt to complex business logic and leads to a high rate of missed vulnerability detection, thereby achieving the technical effect of improving the detection accuracy of business logic vulnerabilities.

[0105] Optionally, in the vulnerability detection device provided in the embodiment of the present application, the processing unit includes: a first extraction subunit, used to extract parameters related to the vulnerability in the first traffic data to obtain target parameters, a second extraction subunit, used to extract parameters related to the target parameters from the parameter database based on the target parameters and preset prompt words using a target language model to obtain a target parameter set, wherein the parameter database includes: parameters in T pieces of traffic data, T is a positive integer; a detection subunit, used to perform vulnerability detection on the target platform based on the target parameter set to obtain a vulnerability detection result.

[0106] Optionally, in the vulnerability detection device provided in the embodiment of the present application, the detection subunit includes: a replacement module, used to replace the parameters in the first traffic data with each parameter in the target parameter set to obtain M second traffic data, where M is a positive integer; a detection module, used to perform vulnerability detection on the target platform based on the M second traffic data to obtain a vulnerability detection result.

[0107] Optionally, in the vulnerability detection device provided in the embodiment of the present application, the detection module includes: a replay submodule, used to replay M second traffic data to the target platform and receive a response message returned by the target platform; a first determination submodule, used to determine whether the second traffic data is successfully replayed based on the similarity between the format of the response message corresponding to each second traffic data and the message format of the first traffic data; and a second determination submodule, used to determine the vulnerability detection result based on the successfully replayed second traffic data.

[0108] Optionally, in the vulnerability detection device provided in the embodiment of the present application, the processing unit also includes: an acquisition subunit, which is used to extract parameters related to the target parameters from the parameter database based on the target parameters and preset prompt words, and obtain T traffic data of the target platform before obtaining the target parameter set, to obtain T third traffic data; a first classification subunit, which is used to classify the T third traffic data based on the message structure and the uniform resource locator structure of each third traffic data, to obtain a first classification result; a second classification subunit, which is used to perform secondary classification on the T third traffic data based on the first classification result of each third traffic data and the business type to which the third traffic data belongs, to obtain a second classification result; a third extraction subunit, which is used to extract parameters of the third traffic data based on the second classification result of each third traffic data, and store the extracted parameters in the parameter database.

[0109] Optionally, in the vulnerability detection device provided in the embodiment of the present application, the vulnerability detection device also includes: an acquisition unit, used to collect network traffic data through an interface testing tool before matching the first traffic data with the traffic data in the target knowledge base to obtain a matching result, and mark the business type of the network traffic data to obtain S target traffic data, where S is a positive integer; a vectorization unit, used to perform vectorization processing on the S target traffic data to obtain S processed target traffic data; and a storage unit, used to store the S processed target traffic data in the target knowledge base.

[0110] Optionally, in the vulnerability detection device provided in the embodiment of the present application, the vulnerability detection device also includes: an identification unit, which is used to obtain a single flow data of the target platform and obtain the first flow data, and then identify whether the message in the first flow data is a preset message to obtain an identification result, wherein the preset message includes at least one of the following: a message recording image information, a message of a cascading style sheet; a matching unit, which is used to perform a step of matching the first flow data with the flow data in the target knowledge base to obtain a matching result when the identification result indicates that the message in the first flow data is not a preset message.

[0111] It should be noted that the acquisition unit 71, determination unit 72, and processing unit 73 described above correspond to steps S201 to S203 in the first embodiment, and the examples and application scenarios implemented by each unit and the corresponding steps are the same, but are not limited to the contents disclosed in the first embodiment. It should be noted that the above modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be run as part of a device in the computer terminal 10 provided in the first embodiment.

[0112] Example 4

[0113] An embodiment of the present application may provide an electronic device, Figure 8 This is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 8 As shown, the electronic device may include: one or more ( Figure 8 Only one is shown) processor 802, memory 804, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0114] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, implementing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0115] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain single traffic data of the target platform, obtain first traffic data, and match the first traffic data with the traffic data in the target knowledge base to obtain a matching result, wherein the target knowledge base includes: network traffic data carrying identification information of the business type; based on the matching result, determine the business type corresponding to the first traffic data to obtain the target business type; based on the target business type, determine the target workflow in N intelligent agent workflows, and use the target workflow to perform vulnerability detection on the target platform to obtain a vulnerability detection result, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer.

[0116] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: using the target workflow to perform vulnerability detection on the target platform to obtain vulnerability detection results, including: extracting parameters related to the vulnerability in the first traffic data to obtain target parameters; based on the target parameters and preset prompt words, using the target language model to extract parameters related to the target parameters from the parameter database to obtain a target parameter set, wherein the parameter database includes: parameters in T pieces of traffic data, T is a positive integer; based on the target parameter set, performing vulnerability detection on the target platform to obtain vulnerability detection results.

[0117] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: perform vulnerability detection on the target platform based on the target parameter set to obtain vulnerability detection results, including: using each parameter in the target parameter set to replace the parameter in the first traffic data to obtain M second traffic data, where M is a positive integer; perform vulnerability detection on the target platform based on the M second traffic data to obtain vulnerability detection results.

[0118] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: perform vulnerability detection on the target platform based on M second traffic data to obtain vulnerability detection results, including: replaying M second traffic data to the target platform and receiving a response message returned by the target platform; determining whether the second traffic data is successfully replayed based on the similarity between the format of the response message corresponding to each second traffic data and the message format of the first traffic data; and determining the vulnerability detection result based on the successfully replayed second traffic data.

[0119] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: before extracting parameters related to the target parameters from the parameter database based on the target parameters and preset prompt words to obtain the target parameter set, it also includes: obtaining T traffic data of the target platform to obtain T third traffic data; based on the message structure and uniform resource locator structure of each third traffic data, classifying the T third traffic data to obtain a first classification result; based on the first classification result of each third traffic data and the business type to which the third traffic data belongs, performing secondary classification on the T third traffic data to obtain a second classification result; based on the second classification result of each third traffic data, extracting parameters of the third traffic data, and storing the extracted parameters in the parameter database.

[0120] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: before matching the first traffic data with the traffic data in the target knowledge base to obtain the matching result, it includes: collecting network traffic data through the interface testing tool, and marking the business type of the network traffic data to obtain S target traffic data, where S is a positive integer; vectorizing the S target traffic data to obtain S processed target traffic data; and storing the S processed target traffic data in the target knowledge base.

[0121] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: after obtaining the single traffic data of the target platform and obtaining the first traffic data, it also includes: identifying whether the message in the first traffic data is a preset message, and obtaining an identification result, wherein the preset message includes at least one of the following: a message recording image information, a message of a cascading style sheet; when the identification result indicates that the message in the first traffic data is not a preset message, executing the step of matching the first traffic data with the traffic data in the target knowledge base to obtain a matching result.

[0122] By adopting the embodiment of the present application, business logic vulnerability detection is performed through the intelligent workflow according to the business type of the traffic data, avoiding the vulnerability detection method used in related technologies using pattern matching, which is difficult to adapt to complex business logic and leads to a high rate of missed vulnerability detection, thereby achieving the technical effect of improving the detection accuracy of business logic vulnerabilities.

[0123] It can be understood by those skilled in the art that Figure 8 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile internet device (MID), a PAD or other terminal device. Figure 8 It does not limit the structure of the above electronic device. For example, the electronic device may also include Figure 8 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 8 Different configurations shown.

[0124] A person skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0125] Example 5

[0126] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the vulnerability detection method provided in the first embodiment.

[0127] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0128] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the vulnerability detection method.

[0129] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0130] In the above embodiments of the present application, the descriptions of each embodiment have their own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. In the several embodiments provided in the present application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0131] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0132] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0133] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0134] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A vulnerability detection method, characterized in that: include: Acquire single flow data of a target platform to obtain first flow data, and match the first flow data with flow data in a target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of a business type; Based on the matching result, determining the service type corresponding to the first traffic data to obtain a target service type; Based on the target business type, a target workflow is determined among N intelligent agent workflows, and the target workflow is used to perform vulnerability detection on the target platform to obtain vulnerability detection results, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer.

2. The vulnerability detection method according to claim 1, wherein: Performing vulnerability detection on the target platform using the target workflow to obtain vulnerability detection results includes: Extracting the parameters related to the vulnerability in the first flow data to obtain the target parameters, Based on the target parameter and the preset prompt word, a target language model is used to extract parameters related to the target parameter from a parameter database to obtain a target parameter set, wherein the parameter database includes: parameters in T pieces of traffic data, where T is a positive integer; Perform vulnerability detection on the target platform based on the target parameter set to obtain the vulnerability detection result.

3. The vulnerability detection method according to claim 2, wherein: Performing vulnerability detection on the target platform based on the target parameter set to obtain the vulnerability detection result includes: Replacing a parameter in the first flow data with each parameter in the target parameter set to obtain M second flow data, where M is a positive integer; Perform vulnerability detection on the target platform based on the M pieces of the second traffic data to obtain the vulnerability detection result.

4. The vulnerability detection method according to claim 3, characterized in that: Performing vulnerability detection on the target platform based on the M pieces of second traffic data to obtain the vulnerability detection result includes: replaying the M pieces of the second traffic data to the target platform, and receiving a response message returned by the target platform; determining whether the second traffic data is successfully replayed based on a similarity between a format of a response message corresponding to each second traffic data and a message format of the first traffic data; The vulnerability detection result is determined based on the successfully replayed second traffic data.

5. The vulnerability detection method according to claim 2, wherein: Before obtaining a target parameter set by extracting parameters related to the target parameter from a parameter database using a target language model based on the target parameter and a preset prompt word, the method further includes: Obtain T pieces of traffic data from the target platform and obtain T third-party traffic data; Classifying the T pieces of third traffic data based on a message structure and a uniform resource locator structure of each piece of the third traffic data to obtain a first classification result; Based on the first classification result of each piece of the third traffic data and the service type to which the third traffic data belongs, performing secondary classification on the T pieces of the third traffic data to obtain a second classification result; Based on the second classification result of each third flow data, parameters are extracted from the third flow data, and the extracted parameters are stored in the parameter database.

6. The vulnerability detection method according to claim 1, wherein: Before matching the first traffic data with traffic data in a target knowledge base to obtain a matching result, the method includes: Collect network traffic data through an interface testing tool, mark the service type of the network traffic data, and obtain S target traffic data, where S is a positive integer; Performing vectorization processing on the S target flow data to obtain S processed target flow data; The S processed target traffic data are stored in the target knowledge base.

7. The vulnerability detection method according to claim 1, wherein: After obtaining the single flow data of the target platform and obtaining the first flow data, the method further includes: Identify whether a message in the first traffic data is a preset message, and obtain an identification result, wherein the preset message includes at least one of the following: a message recording image information, and a message of a cascading style sheet; When the identification result indicates that the message in the first traffic data is not the preset message, a step of matching the first traffic data with traffic data in a target knowledge base to obtain a matching result is performed.

8. A vulnerability detection device, characterized in that: include: an acquisition unit, configured to acquire single flow data of a target platform, obtain first flow data, and match the first flow data with flow data in a target knowledge base to obtain a matching result, wherein the target knowledge base includes: network flow data carrying identification information of a business type; a determining unit, configured to determine, based on the matching result, a service type corresponding to the first traffic data, and obtain a target service type; A processing unit is used to determine a target workflow among N intelligent agent workflows based on the target business type, and use the target workflow to perform vulnerability detection on the target platform to obtain vulnerability detection results, wherein the N intelligent agent workflows are used to perform vulnerability detection on vulnerabilities of different business types, and N is a positive integer.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the computer-readable storage medium is located is controlled to execute the vulnerability detection method according to any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the steps of the vulnerability detection method according to any one of claims 1 to 7 are implemented.

Images