Internet asset collection and sensitive information troubleshooting and early warning system based on flow and code analysis

Abstract

The invention discloses an internet asset acquisition and sensitive information troubleshooting and early warning system based on flow and code analysis, and particularly relates to bank information security, the internet asset acquisition and sensitive information troubleshooting and early warning system comprises a bank internet asset acquisition module, an interface flow matching module, a bank sensitive information troubleshooting module and an early warning response module which are connected through signals; the bank internet asset collection module collects asset information and flow data information respectively, and then carries out asset list comparison and management. Through multi-dimensional data acquisition and processing, bank internet asset information can be comprehensively and accurately acquired, asset association can be clearly presented, a detailed data basis is provided for bank asset security management, application code hard coding sensitive information and interface potential safety hazards are quickly and accurately checked, the information leakage risk is reduced, and the bank asset security management efficiency is improved. Security risks are monitored in real time, related personnel are notified in time, powerful support is provided for bank security decision making, emergency response linkage improves the ability of the bank to cope with security incidents, and losses are reduced.

Description

Technical Field

[0001] The present invention relates to the field of banking information security, and more specifically, to an Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis. Background Art

[0002] Driven by the FinTech wave, banks are actively expanding their online businesses, leading to explosive growth in the number of internet assets. Beyond traditional online and mobile banking applications, a plethora of innovative business-related assets have emerged, including mobile payment interfaces, supply chain financial service platforms, and robo-advisory systems. For example, the mobile banking application of a large state-owned bank alone encompasses dozens of functional modules, including account management, remittances, financial product purchases, and loan applications. Each module relies on a network of servers, databases, APIs, and other assets.

[0003] These assets are distributed across diverse network environments, including internal data centers, public clouds, and private clouds. Their complex architectures and diverse deployment methods make management significantly more difficult. Banks struggle to accurately grasp detailed asset information, such as the frequency of interface calls, security configurations, and inter-asset dependencies. This makes it difficult to quickly locate affected assets, assess the scope of risk, and develop effective response strategies when faced with security incidents.

[0004] Hard-coding sensitive information in bank application code can have disastrous consequences. For example, if database connection passwords are hard-coded in the code of a core business system, once the code is illegally obtained, hackers can directly access the database that stores massive amounts of customer account information and transaction records. Sensitive data such as customer names, ID numbers, bank card numbers, and balances would be exposed, potentially leading to a large-scale customer information leak.

[0005] A bank once hard-coded a database access key in its internal testing system code due to developer negligence. Criminals exploited a vulnerability to obtain the code and illegally transferred customer funds, causing huge economic losses to the bank and its customers. It also seriously damaged the bank's reputation and credibility, triggered a crisis of customer trust, and led to customer loss.

[0006] Banking involves the transmission of a large amount of sensitive information, such as customer login credentials and financial transaction instructions. If the online banking login interface lacks a robust identity authentication mechanism, two-factor authentication, or strong encryption, hackers can intercept user accounts and passwords through network sniffing and other means, and then manipulate accounts to conduct operations such as transfers.

[0007] If some banks' third-party payment interfaces lack proper access control for partners and strict limits on call frequency and scope, they can be used maliciously, leading to the theft of customer funds. For example, in one case, criminals exploited a permission loophole in the interface between a bank and an e-commerce platform to forge transaction requests and defraud the bank of funds, causing significant losses to the bank and its customers, and also drawing regulatory attention and penalties.

[0008] Traditional asset collection technology faces significant challenges in banking scenarios. Manually combing through a bank's vast and complex asset systems, such as those spanning numerous branches and subsystems, is nearly impossible, prone to errors, and extremely inefficient. Scanning tools also struggle to penetrate banks' complex network environments and security systems.

[0009] The bank's online banking system is equipped with multiple layers of firewalls and security gateways. Standard scanning tools are unable to penetrate deeply enough to obtain complete asset information. For example, some interfaces hidden within the internal network and only called during specific business processes remain undetected. Existing tools are even more difficult to adapt and accurately capture assets related to emerging fintech applications, such as those on blockchain financial platforms. This prevents banks from fully understanding their asset status and creates blind spots in security management.

[0010] When it comes to bank code verification, manual audits struggle to keep up with the massive and constantly updated code. The core business system code for a medium-sized bank can reach millions of lines, making manual audits difficult to fully cover. Simple text search tools are ineffective against the complex encryption and obfuscation of bank code.

[0011] Banks have strict code security reviews and employ multiple encryption algorithms to protect sensitive information. Text search tools are unable to identify encrypted sensitive information. Furthermore, banking systems undergo frequent upgrades, and existing troubleshooting methods are unable to monitor code changes in real time. Newly introduced hard-coded sensitive information is difficult to detect in a timely manner, leaving banking systems vulnerable to security risks. If exploited, this could lead to serious financial incidents.

[0012] In order to solve the above problems, a technical solution is now provided. Summary of the Invention

[0013] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides an Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis to solve the problems raised in the above-mentioned background technology.

[0014] To achieve the above object, the present invention provides the following technical solutions: The internet asset collection and sensitive information screening and early warning system based on traffic and code analysis includes a bank internet asset collection module, an interface traffic matching module, a bank sensitive information screening module, and an early warning response module. Each module is connected by signals. The bank's Internet asset collection module collects asset information and traffic data information respectively, and then compares and manages the asset list; The interface traffic matching module is used to perform interface traffic matching; The bank's sensitive information screening module is used to comprehensively detect and manage the bank's internet asset-related codes and interfaces. This includes screening for hard-coded sensitive information, managing sensitive information interface risks, removing inefficient and invalid URLs, sorting out unmanaged applications, assessing the security of non-internet interfaces, and managing application security testing. Through early warning and corresponding processing procedures, it promptly discovers and resolves sensitive information-related security issues. Based on the results of asset collection and sensitive information screening, and with the help of risk assessment models, the early warning response module provides timely early warning responses to various security risks according to type and level through multiple channels.

[0015] In a preferred embodiment, the operation of the bank's Internet asset collection module specifically includes the following: Filter internet-related modules from the banking service catalog. Based on the module-associated repository information, which is the code repository, obtain a list of internet repositories. For the backend repositories in the list, pull the main branch code and parse it to obtain the backend repository interface address. Associate the backend repository interface address with the application name, contact person, interface type, and gateway configuration. Perform interface conversion based on the gateway table to obtain the actual requested URL. This creates a URL list table clustered by application, i.e., url_ck. For the front-end warehouses in the Internet warehouse list, hard-coding tools are used to conduct special inspections on the bank's Internet application codes, and sensitive information such as ID card numbers, mobile phone numbers and intranet IP addresses are detected and checked.

[0016] In a preferred embodiment, the operation of the bank's Internet asset collection module specifically includes the following: By collecting HTTP traffic forwarded on the bank's network devices, all URL information is parsed according to the original message and stored in the URL log tool, namely url_log. The collected URLs are merged and deduplicated. For requests with encrypted operations, the intranet interaction traffic is collected, processed by the gateway table conversion script, and merged with the encrypted request to obtain url_log_converted.

[0017] In a preferred embodiment, the operation of the interface traffic matching module specifically includes the following: Divide the backend warehouse interfaces into non-Internet interfaces and Internet interfaces. For each non-Internet interface, evaluate whether it can be called from the Internet. If it can be called, perform security hardening or take it offline. For the Internet interface, perform gateway forwarding. Compare url_ck and url_log. For URLs (AB) with no traffic in url_ck, further verification is conducted. Inefficient URLs are managed, confirmed to be retained, or offline. Invalid URLs are issued with warnings and offline or security reinforcement. For URLs (BA) that appear in url_log but are missing from url_ck, warnings are issued and the URLs are managed in the application repository. By comparing the URLs in the compiled list, unmanaged URLs are promptly discovered and issued with warnings. The person in charge of the application is located according to the entry point and is investigated, focusing on cases where Internet URLs exist in non-Internet application code and are actually accessed. As appropriate, the service catalog module information is split and adjusted. Security management is implemented for the discovered URLs, and service is resumed after they pass manual penetration testing. For URLs (AB) with no traffic in url_ck, analyze and obtain inefficient and invalid URLs, issue warnings, and notify application contacts by email. URLs that have been disabled or evaluated as unavailable should be taken offline as soon as possible.

[0018] In a preferred embodiment, for URLs (AB) with no traffic in url_ck and when processing inefficient URLs, URL_ck is associated with an application security testing platform to obtain the URL application security testing time, issue an early warning for URLs that have not undergone application security testing, and send an email to remind the application contact that the URL has not undergone application security testing. When performing application security testing, URLs related to a certain application are exported from the URL_ck table to provide a complete URL list.

[0019] In a preferred embodiment, the operation of the bank sensitive information screening module further includes the following specific contents: Rely on traffic analysis tools to conduct a secondary analysis of the risk content initially screened by the URL log tool and store it in URL_log_risk. When there are new hits, timely warnings are issued, and application contacts are notified by email to verify the risk and provide feedback, and to carry out investigation and governance work.

[0020] In a preferred embodiment, the operation of the early warning response module includes the following specific contents: The risk assessment model comprehensively considers multi-dimensional data of asset collection and sensitive information screening to set risk levels The calculation of asset importance is considered , the value range is 0-1, the larger the value, the more important it is; the degree of asset exposure , the value range is 0-1, the larger the value, the higher the exposure; sensitive information risk coefficient , determined according to the severity of the sensitive information, with a value range of 0-1; Building a formula ,in is the weight coefficient of each item, and .

[0021] In a preferred embodiment, the operation of the early warning response module also includes the following specific contents: Once the risk assessment model determines the risk type and level, the system selects an early warning method based on pre-set rules. For low-risk situations, only a system pop-up window will be used to alert relevant personnel within the bank's internal management system. For medium-risk situations, in addition to the system pop-up window, an email notification will also be sent. For high-risk situations, multiple methods, including email, SMS, and system pop-up windows, will be used simultaneously to ensure that relevant personnel receive early warning information in a timely manner. The early warning response module is connected to the bank's firewall system through a standard API. When a high-risk network attack warning is triggered, the early warning response module sends a command containing suspicious IP addresses and port range information to the firewall. The firewall immediately blocks the relevant network connection according to the command to prevent the attack from spreading further. The early warning response module is integrated with the intrusion detection system. When the intrusion detection system detects abnormal behavior and triggers an early warning, the early warning response module receives the signal and instructs the intrusion detection system to conduct a more in-depth detection and analysis of the affected area, and at the same time initiates the isolation process of the affected assets. When the risk of data leakage or data loss is detected and an early warning is triggered, the early warning response module sends instructions to the data backup and recovery system to start the data backup and recovery process. According to the pre-set backup strategy, the affected data is restored to the most recent safe state, and the backup and recovery time and data version information are recorded.

[0022] The technical effects and advantages of the Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis of the present invention are as follows: 1. Through multi-dimensional data collection and processing, the bank's internet asset collection module can comprehensively cover all types of bank internet assets and accurately obtain detailed asset information, including location, relationships, and usage status. This provides banks with a clear and accurate asset inventory, helping them gain a deeper understanding of their own asset status and providing a solid data foundation for security management and decision-making. 2. Utilize a variety of technologies and tools to conduct comprehensive and detailed inspection and management of the bank's internet asset-related codes and interfaces. This allows for efficient detection of hard-coded sensitive information, security risks in interface transmission, and various other security issues related to sensitive information. This allows for timely early warning and resolution measures, effectively reducing the risk of information leaks and security incidents, and safeguarding the information and financial security of bank customers. 3. Through scientific risk assessment models and diversified early warning methods, it is possible to issue early warnings for various security risks in a timely and accurate manner based on the results of asset collection and sensitive information screening, so that relevant personnel can quickly understand the risk situation and take corresponding measures. At the same time, the linkage mechanism with the bank's security management system ensures that effective emergency response measures can be automatically executed when a security incident occurs, quickly blocking attacks, isolating affected assets, and restoring data, thereby minimizing the impact of security incidents on the bank, ensuring the bank's business continuity and stability, and enhancing the bank's information security protection capabilities and emergency response capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a structural diagram of the Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis of the present invention. DETAILED DESCRIPTION

[0024] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0025] Example 1 Figure 1 The present invention provides an Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis, including a bank Internet asset collection module, an interface traffic matching module, a bank sensitive information screening module, and an early warning response module. Each module is connected by signals. The bank's Internet asset collection module collects asset information and traffic data information respectively, and then compares and manages the asset list; The interface traffic matching module is used to perform interface traffic matching; The bank's sensitive information screening module is used to comprehensively detect and manage the bank's internet asset-related codes and interfaces. This includes screening for hard-coded sensitive information, managing sensitive information interface risks, removing inefficient and invalid URLs, sorting out unmanaged applications, assessing the security of non-internet interfaces, and managing application security testing. Through early warning and corresponding processing procedures, it promptly discovers and resolves sensitive information-related security issues. Based on the results of asset collection and sensitive information screening, and with the help of risk assessment models, the early warning response module provides timely early warning responses to various security risks according to type and level through multiple channels.

[0026] The operation of the bank's Internet asset collection module specifically includes the following: Filter internet-related modules from the banking service catalog. Based on the module-associated repository information, which is the code repository, obtain a list of internet repositories. For the backend repositories in the list, pull the main branch code and parse it to obtain the backend repository interface address. Associate the backend repository interface address with the application name, contact person, interface type, and gateway configuration. Perform interface conversion based on the gateway table to obtain the actual requested URL. This creates a URL list table clustered by application, i.e., url_ck. For the front-end warehouses in the Internet warehouse list, hard-coding tools are used to conduct special inspections on the bank's Internet application codes, and sensitive information such as ID card numbers, mobile phone numbers and intranet IP addresses are detected and checked.

[0027] The operation of the bank's Internet asset collection module specifically includes the following: By collecting HTTP traffic forwarded on the bank's network devices, all URL information is parsed according to the original message and stored in the URL log tool, namely url_log. The collected URLs are merged and deduplicated. For requests with encrypted operations, the intranet interaction traffic is collected, processed by the gateway table conversion script, and merged with the encrypted request to obtain url_log_converted.

[0028] The operation of the interface traffic matching module specifically includes the following: Divide the backend warehouse interfaces into non-Internet interfaces and Internet interfaces. For each non-Internet interface, evaluate whether it can be called from the Internet. If it can be called, perform security hardening or take it offline. For the Internet interface, perform gateway forwarding. Compare url_ck and url_log. For URLs (AB) with no traffic in url_ck, further verification is conducted. Inefficient URLs are managed, confirmed to be retained, or offline. Invalid URLs are issued with warnings and offline or security reinforcement. For URLs (BA) that appear in url_log but are missing from url_ck, warnings are issued and the URLs are managed in the application repository. By comparing the URLs in the compiled list, unmanaged URLs are promptly discovered and issued with warnings. The person in charge of the application is located according to the entry point and is investigated, focusing on cases where Internet URLs exist in non-Internet application code and are actually accessed. As appropriate, the service catalog module information is split and adjusted. Security management is implemented for the discovered URLs, and service is resumed after they pass manual penetration testing. For URLs (AB) with no traffic in url_ck, analyze and obtain inefficient and invalid URLs, issue warnings, and notify application contacts by email. URLs that have been disabled or evaluated as unavailable should be taken offline as soon as possible.

[0029] For URLs (AB) with no traffic in url_ck and when processing inefficient URLs, URL_ck is associated with the application security testing platform to obtain the URL application security testing time, issue warnings for URLs that have not undergone application security testing, and email application contacts to remind them that the URL has not undergone application security testing. When performing application security testing, URLs related to a certain application are exported from the URL_ck table to provide a complete URL list.

[0030] Starting from the bank's service directory, the system associates repository information to obtain a list of internet repositories. It then parses the code to obtain the front-end page address and back-end interface address. These addresses are then matched and converted with relevant information to form a URL list (url_ck) clustered by application. Simultaneously, HTTP traffic data from the bank's network devices is collected and, after parsing, merging, deduplication, and special processing for encrypted requests, is generated to produce url_log_converted. By comparing url_ck and url_log, URLs in different situations are processed accordingly, enabling comprehensive collection and effective management of the bank's internet assets.

[0031] By selecting relevant modules from the bank's service catalog, obtaining a list of internet repositories, pulling the code, and parsing it, the front-end repository page addresses and back-end repository interface addresses can be clearly identified, forming a URL list (url_ck) clustered by application. This helps banks comprehensively understand their internet assets, avoid missing assets, and provide basic data support for subsequent asset management and maintenance. For example, this method can clearly identify the URL corresponding to each application, facilitating unified management and maintenance, and improving asset management efficiency. HTTP traffic forwarded by bank network devices is collected, and all URL information is parsed and stored in a URL logging tool (url_log), where traffic is consolidated and deduplicated. This helps banks gain a deeper understanding of the source, destination, and characteristics of network traffic, providing data support for network performance optimization and security monitoring. For example, traffic log analysis can identify abnormal network traffic and enable timely measures to ensure network security and stability. By comparing url_ck with url_log, banks can verify URLs with no traffic in url_ck. Inefficient and invalid URLs can be alerted and taken offline or secured. URLs that appear in url_log but are missing from url_ck can also be alerted and added to the application repository for management. This helps banks promptly identify and address potential security risks and improve their network security capabilities. For example, promptly deactivating invalid URLs can reduce the likelihood of attacks, and managing missing URLs can improve network security management systems.

[0032] Based on the internet repository list, hard-coding tools are used to inspect the bank's internet application code, screening for sensitive information such as ID numbers, mobile phone numbers, and intranet IP addresses. Traffic analysis tools are used to conduct a secondary analysis of the risk content initially identified by the URL log tool, and confirmed risk information is stored in URL_log_risk. Through various methods, such as matching url_ck with URL_log to analyze inefficient and invalid URLs, comparing unmanaged URLs against the compiled URL list and performing relevant processing, assessing the possibility of non-internet interfaces in the full URL list being called from the internet, and linking url_ck to the application security testing platform to obtain and manage URL application security testing time and lists, comprehensive testing and management of the bank's internet asset-related code and interfaces are carried out to promptly identify and resolve security issues related to sensitive information.

[0033] Hard-coding tools are used to conduct specialized inspections of application code in internet warehouse inventories, accurately targeting sensitive information such as ID numbers, mobile phone numbers, and intranet IP addresses. This overcomes the inefficiency and omissions of traditional manual audits, effectively reducing the risk of sensitive information leaks caused by hard-coding in code, and safeguarding customer privacy and the security of the bank's core data. For example, this tool can promptly identify issues such as developers accidentally hard-coding database access keys in their code, preventing hackers from illegally accessing the database after obtaining the code. Traffic analysis tools are used to conduct secondary analysis of risk content initially identified by URL log tools, improving the accuracy of risk identification and avoiding false positives and missed detections. Confirmed risk information is stored in URL_log_risk for subsequent tracking and action, helping banks to comprehensively and in-depth manage potential security threats and providing a reliable basis for security decision-making. By matching url_ck with URL_log, inefficient and invalid URLs can be accurately analyzed and identified based on traffic matching and the last update time in URL_log. Prompting and addressing these URLs can promptly eliminate redundant assets, reduce resource waste, improve the efficiency of the bank's internet assets, and reduce maintenance costs. This also helps banks focus resources on managing and maintaining critical assets, improving overall operational efficiency.

[0034] The operation of the bank sensitive information screening module also includes the following specific contents: Rely on traffic analysis tools to conduct a secondary analysis of the risk content initially screened by the URL log tool and store it in URL_log_risk. When there are new hits, timely warnings are issued, and application contacts are notified by email to verify the risk and provide feedback, and to carry out investigation and governance work.

[0035] The operation of the early warning response module includes the following specific contents: The risk assessment model comprehensively considers multi-dimensional data of asset collection and sensitive information screening to set risk levels The calculation of asset importance is considered , the value range is 0-1, the larger the value, the more important it is; the degree of asset exposure , the value range is 0-1, the larger the value, the higher the exposure; sensitive information risk coefficient , determined according to the severity of the sensitive information, with a value range of 0-1; Building a formula ,in is the weight coefficient of each item, and .

[0036] The operation of the early warning response module also includes the following specific contents: Once the risk assessment model determines the risk type and level, the system selects an early warning method based on pre-set rules. For low-risk situations, only a system pop-up window will be used to alert relevant personnel within the bank's internal management system. For medium-risk situations, in addition to the system pop-up window, an email notification will also be sent. For high-risk situations, multiple methods, including email, SMS, and system pop-up windows, will be used simultaneously to ensure that relevant personnel receive early warning information in a timely manner. The early warning response module is connected to the bank's firewall system through a standard API. When a high-risk network attack warning is triggered, the early warning response module sends a command containing suspicious IP addresses and port range information to the firewall. The firewall immediately blocks the relevant network connection according to the command to prevent the attack from spreading further. The early warning response module is integrated with the intrusion detection system. When the intrusion detection system detects abnormal behavior and triggers an early warning, the early warning response module receives the signal and instructs the intrusion detection system to conduct a more in-depth detection and analysis of the affected area, and at the same time initiates the isolation process of the affected assets. When the risk of data leakage or data loss is detected and an early warning is triggered, the early warning response module sends instructions to the data backup and recovery system to start the data backup and recovery process. According to the pre-set backup strategy, the affected data is restored to the most recent safe state, and the backup and recovery time and data version information are recorded.

[0037] The risk assessment model comprehensively considers multi-dimensional data from asset collection and sensitive information screening. It constructs a formula to calculate risk levels by setting parameters such as asset importance, asset exposure, and the sensitive information risk factor. Based on the risk assessment results, the system selects different alert methods according to pre-set rules and notifies relevant personnel. Simultaneously, this module integrates with security management systems such as the bank's firewall, intrusion detection system, and data backup and recovery system. When different security risks trigger alerts, it automatically executes appropriate emergency measures, such as blocking suspicious network connections, isolating affected assets, and initiating data backup and recovery. The emergency response process is recorded to provide a basis for subsequent analysis and improvement.

[0038] By comprehensively considering multiple dimensions such as asset importance, asset exposure, and the risk factor of sensitive information, and constructing a formula to calculate risk levels, a comprehensive and accurate quantitative assessment of the security risks faced by banks can be conducted. This precise risk assessment helps banks accurately understand their security posture and provides a scientific basis for subsequent early warning and response measures. The system uses different alert methods based on different risk levels, ranging from system pop-up notifications for low-risk situations, to email notifications for medium-risk situations, to a combination of methods for high-risk situations, ensuring that relevant personnel receive timely and accurate risk information. This tiered alert approach minimizes unnecessary disruption to staff while ensuring sufficient attention is paid to critical risks when they arise, thereby improving the effectiveness and relevance of alerts. By recording various information during the emergency response process, including risk type, alert method, response measures, and results, banks are provided with a wealth of security management data. This data can be used for post-event analysis and summary, helping banks identify weaknesses in security management and continuously optimize risk assessment models, early warning mechanisms, and emergency response strategies, thereby continuously improving their overall information security capabilities.

[0039] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0040] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis, characterized by: It includes a bank internet asset collection module, an interface traffic matching module, a bank sensitive information screening module, and an early warning response module. Each module is connected through signals. The bank's Internet asset collection module collects asset information and traffic data information respectively, and then compares and manages the asset list; The interface traffic matching module is used to perform interface traffic matching; The bank's sensitive information screening module is used to comprehensively detect and manage the bank's internet asset-related codes and interfaces. This includes screening for hard-coded sensitive information, managing sensitive information interface risks, removing inefficient and invalid URLs, sorting out unmanaged applications, assessing the security of non-internet interfaces, and managing application security testing. Through early warning and corresponding processing procedures, it promptly discovers and resolves sensitive information-related security issues. Based on the results of asset collection and sensitive information screening, and with the help of risk assessment models, the early warning response module provides timely early warning responses to various security risks according to type and level through multiple channels.

2. The Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis according to claim 1 is characterized by: The operation of the bank's Internet asset collection module specifically includes the following: Filter internet-related modules from the banking service catalog. Based on the module-associated repository information, which is the code repository, obtain a list of internet repositories. For the backend repositories in the list, pull the main branch code and parse it to obtain the backend repository interface address. Associate the backend repository interface address with the application name, contact person, interface type, and gateway configuration. Perform interface conversion based on the gateway table to obtain the actual requested URL. This creates a URL list table clustered by application, i.e., url_ck. For the front-end warehouses in the Internet warehouse list, hard-coding tools are used to conduct special inspections on the bank's Internet application codes, and sensitive information such as ID card numbers, mobile phone numbers and intranet IP addresses are detected and checked.

3. The Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis according to claim 2 is characterized by: The operation of the bank's Internet asset collection module specifically includes the following: By collecting HTTP traffic forwarded on the bank's network devices, all URL information is parsed according to the original message and stored in the URL log tool, namely url_log. The collected URLs are merged and deduplicated. For requests with encrypted operations, the intranet interaction traffic is collected, processed by the gateway table conversion script, and merged with the encrypted request to obtain url_log_converted.

4. The Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis according to claim 3 is characterized by: The operation of the interface traffic matching module specifically includes the following: Divide the backend warehouse interfaces into non-Internet interfaces and Internet interfaces. For each non-Internet interface, evaluate whether it can be called from the Internet. If it can be called, perform security hardening or take it offline. For the Internet interface, perform gateway forwarding. Compare url_ck and url_log. For URLs (AB) with no traffic in url_ck, further verification is conducted. Inefficient URLs are managed, confirmed to be retained, or offline. Invalid URLs are issued with warnings and offline or security reinforcement. For URLs (BA) that appear in url_log but are missing from url_ck, warnings are issued and the URLs are managed in the application repository. By comparing the URLs in the compiled list, unmanaged URLs are promptly discovered and issued with warnings. The person in charge of the application is located according to the entry point and is investigated, focusing on cases where Internet URLs exist in non-Internet application code and are actually accessed. As appropriate, the service catalog module information is split and adjusted. Security management is implemented for the discovered URLs, and service is resumed after they pass manual penetration testing. For URLs (AB) with no traffic in url_ck, analyze and obtain inefficient and invalid URLs, issue warnings, and notify application contacts by email. URLs that have been disabled or evaluated as unavailable should be taken offline as soon as possible.

5. The Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis according to claim 4 is characterized by: For URLs (AB) with no traffic in url_ck and when processing inefficient URLs, URL_ck is associated with the application security testing platform to obtain the URL application security testing time, issue warnings for URLs that have not undergone application security testing, and email application contacts to remind them that the URL has not undergone application security testing. When performing application security testing, URLs related to a certain application are exported from the URL_ck table to provide a complete URL list.

6. The Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis according to claim 5 is characterized by: The operation of the bank sensitive information screening module also includes the following specific contents: Rely on traffic analysis tools to conduct a secondary analysis of the risk content initially screened by the URL log tool and store it in URL_log_risk. When there are new hits, timely warnings are issued, and application contacts are notified by email to verify the risk and provide feedback, and to carry out investigation and governance work.

7. The Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis according to claim 6 is characterized by: The operation of the early warning response module includes the following specific contents: The risk assessment model comprehensively considers multi-dimensional data of asset collection and sensitive information screening to set risk levels The calculation of asset importance is considered , the value range is 0-1, the larger the value, the more important it is; the degree of asset exposure , the value range is 0-1, the larger the value, the higher the exposure; Sensitive information risk factor , determined according to the severity of the sensitive information, with a value range of 0-1; Building a formula ,in is the weight coefficient of each item, and .

8. The Internet asset collection and sensitive information screening and early warning system based on traffic and code analysis according to claim 7 is characterized by: The operation of the early warning response module also includes the following specific contents: Once the risk assessment model determines the risk type and level, the system selects an early warning method based on preset rules. For low-risk situations, only a pop-up window will be used to alert relevant personnel in the bank's internal management system. For medium-risk situations, in addition to system pop-up notifications, email notifications will also be sent; for high-risk situations, multiple methods such as email, SMS, and system pop-up notifications will be used simultaneously to ensure that relevant personnel receive warning information in a timely manner; The early warning response module is connected to the bank's firewall system through a standard API. When a high-risk network attack warning is triggered, the early warning response module sends a command containing suspicious IP addresses and port range information to the firewall. The firewall immediately blocks the relevant network connection according to the command to prevent the attack from spreading further. The early warning response module is integrated with the intrusion detection system. When the intrusion detection system detects abnormal behavior and triggers an early warning, the early warning response module receives the signal and instructs the intrusion detection system to conduct a more in-depth detection and analysis of the affected area, and at the same time initiates the isolation process of the affected assets. When the risk of data leakage or data loss is detected and an early warning is triggered, the early warning response module sends instructions to the data backup and recovery system to start the data backup and recovery process. According to the pre-set backup strategy, the affected data is restored to the most recent safe state, and the backup and recovery time and data version information are recorded.

Images