Security vulnerability traceability analysis method and system for application software

Abstract

The invention discloses a security vulnerability traceability analysis method and system for application software, relates to the technical field of network security, and solves the technical problem that an effective security protection strategy is difficult to formulate due to the fact that a vulnerability source cannot be quickly and accurately positioned and a risk level cannot be evaluated. The source and the propagation path of the vulnerability attack are determined, reverse DNS query and authenticity verification are performed on the source I P address, the accuracy of the traceability result is further improved, powerful support is provided for quickly positioning the attack source, the basic index score, the time index score and the environment index score are respectively calculated in the aspect of vulnerability risk level calculation, and the accuracy of the traceability result is improved. According to the method, the vulnerability evaluation indexes are comprehensively calculated in combination with respective weights, the actual situation is fully considered, the evaluation result better fits the actual risk, more accurate risk early warning and more targeted vulnerability repair and protection strategies can be provided, and the security protection level of application software is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for tracing and analyzing security vulnerabilities of application software. Background Art

[0002] At present, with the advancement of science and technology and the development of the Internet, application software is widely used in enterprises and personal life, and software security issues are becoming increasingly prominent.

[0003] According to a patent application with publication number CN116502240B, a method for tracing the source of security vulnerabilities in application software is disclosed, which includes: obtaining version information of the current operating system and application software; listing possible security vulnerabilities in the application software under the current operating system based on the version information of the current operating system and application software, and obtaining a first identification feature of each possible security vulnerability; detecting and obtaining a second identification feature of the current security vulnerability of the application software, and comparing the first identification feature with the second identification feature to obtain a comparison result; locating the attacker based on the comparison result and according to different tracing methods.

[0004] However, current application software vulnerability tracing and analysis often relies on single technical methods or simple processes. For example, these methods rely solely on network packet capture tools to capture data, lacking in-depth analysis and screening of traffic. Vulnerability risk assessments are often based on general standards, making them difficult to tailor to specific organizational environments. These methods are unable to quickly and accurately locate vulnerability sources and assess risk levels in the face of complex and volatile network attacks and new vulnerabilities, making it difficult to develop effective security protection strategies and posing significant security risks. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the present invention provides a method and system for tracing and analyzing security vulnerabilities in application software, which solves the problem of being unable to quickly and accurately locate the source of vulnerabilities and assess risk levels, making it difficult to formulate effective security protection strategies.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for tracing and analyzing security vulnerabilities in application software, the method specifically comprising the following steps:

[0007] Use network packet capture tools to collect data packets within a time period to determine the flow range;

[0008] Filter and screen periodic data packets, exclude irrelevant traffic through rule setting, analyze traffic patterns and data characteristics, and obtain abnormal traffic;

[0009] Calculate the similarity between abnormal traffic and related information, filter related information, determine the source IP, and perform reverse DNS query to obtain true and false IP information;

[0010] Calculate the basic, time, and environmental indicator scores of abnormal traffic vulnerabilities, obtain vulnerability scores based on weights, determine the vulnerability level based on the rating range, and generate level information.

[0011] As a further solution of the present invention, the specific method of obtaining abnormal traffic is:

[0012] Based on known vulnerability features or attack patterns, filtering rules are set to screen out relevant data packet traffic and exclude normal traffic. The traffic to be analyzed is analyzed for characteristics, and traffic patterns are identified from the perspectives of traffic size, frequency, and direction. Abnormal situations such as a large number of concurrent requests, abnormal peaks, and low-traffic high-frequency access are recorded as abnormal identified traffic, and a secondary analysis is performed on the abnormal identified traffic.

[0013] As a further solution of the present invention, the specific method of performing secondary analysis on abnormal identification traffic is:

[0014] Perform data feature analysis on abnormal identification traffic, analyze the data features in the data packet, including character strings, encoding methods, and data length, and match the obtained data features with normal data features. If the two do not match, the corresponding abnormal identification traffic will be recorded as abnormal traffic. Conversely, if the two match, no processing will be done.

[0015] As a further solution of the present invention, the specific method of obtaining true and false IP information is as follows:

[0016] Obtain abnormal traffic, correlate and analyze it with relevant information, calculate similarity, filter out correlated information whose similarity exceeds a preset value, trace the source based on the correlated information and abnormal traffic, analyze the source IP to determine the attacker, generate source IP information and perform reverse DNS query. If the domain name does not match the source IP description or there is no valid record, it is recorded as false IP information. If it matches, it is recorded as real IP information.

[0017] As a further solution of the present invention, the specific method of calculating the basic, time, and environmental indicator scores of the abnormal traffic vulnerability is:

[0018] Quantify and assign values to the vulnerability attack vector, attack complexity, and permission requirements and substitute them into the formula Exploitability = 8.22 x AttackVector x AttackComplexity x PrivilegesRequired to calculate the Exploitability indicator;

[0019] Among them, AttackVector represents the vulnerability attack vector assignment, AttackComplexity represents the attack complexity assignment, and PrivilegesRequired represents the permission requirement assignment;

[0020] At the same time, the vulnerability impact is calculated according to the formula Impact = 6.42x(1-(1-ConfidentialityImpact)x(1-IntegrityImpact)x(1-AvailabilityImpact));

[0021] Confidentiality Impact, Integrity Impact, and Availability Impact respectively represent the degree of impact of the vulnerability on the corresponding characteristics of the system;

[0022] Finally, according to the formula The basic indicator score BaseScore is calculated, where RoundUp indicates rounding up, and the time indicator score is calculated based on the basic indicator score.

[0023] As a further solution of the present invention, the specific method of calculating the time index score based on the basic index score is:

[0024] TemporalScore = BaseScore x Exploitability x RemediationLevel ReportConfidence. The temporal index score TemporalScore is calculated according to the formula, where Exploitability represents code maturity, RemediationLevel represents the repair level, and ReportConfidence represents the report credibility.

[0025] As a further solution of the present invention, the specific method of calculating the environmental indicator score of the abnormal traffic vulnerability is:

[0026] The modified base score ModifiedBaseScore, the modified exploitability ModifiedExploitability, the modified remediation level ModifiedRemediationLevel, and the modified report confidence ModifiedReportConfidence are calculated respectively, and the environmental indicator score EnvironmentalScore is calculated according to the formula EnvironmentalScore = ModifiedBaseScore x ModifiedExploitability x ModifiedRemediationLevel x ModifiedReportConfidence.

[0027] As a further solution of the present invention, the specific method of generating the level information is:

[0028] Substitute the calculated basic index score BaseScore, time index score TemporalScore and environmental index score EnvironmentalScore into the formula CVSS = BaseScore × a1 + TemporalScore × a2 + EnvironmentalScore × a3 to calculate the vulnerability scoring index CVSS corresponding to the vulnerability, where a1, a2 and a3 are the corresponding weight coefficients respectively. At the same time, match the obtained vulnerability scoring index CSSS with the corresponding rating interval score to obtain the corresponding vulnerability level and generate vulnerability level information.

[0029] A security vulnerability tracing and analysis system for application software, comprising a data acquisition unit, a data anomaly identification unit, a tracing and analysis processing unit, a vulnerability rating processing unit, and a tracing and analysis information output unit;

[0030] A data acquisition unit, which is used to obtain data packets through a network packet capture tool, continuously collect data within a time period, determine the range of network traffic, and then transmit it to the data anomaly identification unit;

[0031] The data anomaly identification unit is used to filter and screen the obtained periodic data packets, obtain the traffic to be analyzed by setting filtering rules and excluding irrelevant traffic, and identify and analyze the corresponding traffic patterns and data characteristics, filter out abnormal traffic, and transmit it to the traceability analysis processing unit and vulnerability rating processing unit at the same time;

[0032] The source tracing analysis processing unit is used to calculate the similarity between abnormal traffic and other related information, filter out related information that is greater than a preset value, determine the source IP information, perform a reverse DNS query, generate false or real IP information, and then transmit it to the source tracing analysis information output unit;

[0033] The vulnerability rating processing unit is used to calculate the vulnerability risk level corresponding to the abnormal traffic, calculate the corresponding basic indicator score, time indicator score and environmental indicator score respectively, and combine the respective weights to comprehensively calculate the vulnerability scoring index corresponding to the vulnerability. At the same time, the vulnerability level is determined by combining the rating interval score, and the vulnerability level information is generated and transmitted to the traceability analysis information output unit;

[0034] The traceability analysis information output unit is used to display the obtained false or real IP information and vulnerability level information to the corresponding management personnel.

[0035] The present invention provides a method and system for tracing and analyzing security vulnerabilities in application software. Compared with the prior art, it has the following advantages:

[0036] This method uses specialized network packet capture tools to capture data packets and sets filtering rules based on known vulnerability signatures and attack patterns. Combined with a baseline model of normal traffic, it accurately selects traffic for analysis. During the feature analysis phase, it integrates traffic pattern recognition and data feature analysis to identify abnormal traffic from multiple dimensions, improving the accuracy and reliability of data processing and effectively avoiding misjudgments and missed detections.

[0037] The present invention performs correlation analysis on abnormal traffic, combines it with multi-source information such as system login logs and network device records, and filters the related information by calculating similarity. It can comprehensively determine the source and propagation path of the vulnerability attack. At the same time, it performs reverse DNS query and authenticity verification on the source IP address, further improving the accuracy of the tracing results and providing strong support for quickly locating the source of the attack.

[0038] This method calculates vulnerability risk levels by separately calculating basic, temporal, and environmental scores, and then combines these scores with their respective weights to create a comprehensive vulnerability scoring index. The environmental score fully considers an organization's actual circumstances, such as asset value and security measures, making the assessment more aligned with actual risks. This allows for more accurate risk warnings and targeted vulnerability remediation and protection strategies, ultimately enhancing the security and protection of application software. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a diagram of the steps and methods of the present invention;

[0040] Figure 2 This is a block diagram of the system principle of the present invention. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0042] Example 1

[0043] See also Figure 1 This application provides a method for tracing and analyzing security vulnerabilities in application software, which specifically includes the following steps:

[0044] Step S1: Capture data packets using a professional network packet capture tool, such as Wireshark or tcpdump. These tools can capture data packets flowing through a network interface and determine the scope of network traffic based on the captured data packets. Specifically, this includes traffic related to a specific network segment, port, or application. For example, if a web application is suspected of being vulnerable, focus on collecting traffic from the network segment where the application server resides and related ports (such as ports 80 and 443). At the same time, continuously capture data packets within a time period t.

[0045] Step S2: Filter and screen the obtained periodic data packets. Based on known vulnerability characteristics or attack patterns, set filtering rules to screen out relevant data packet traffic, exclude normal data packet traffic that is not relevant to the analysis, and record the remaining data packet traffic as traffic to be analyzed;

[0046] Specifically, basic rules are formulated based on the protocol type, IP address, port number, timestamp, and other dimensions. For example, for SQL injection vulnerabilities, a filtering rule can be set that "the protocol is HTTP and the request URL or parameters contain SQL keywords such as 'union' or 'select'." For ransomware attacks, a rule can be set that "the source IP address is an address in the known malicious IP database and the port is 445 (SMB protocol) or 8080 (common Web service port)."

[0047] By establishing a normal traffic baseline model, data packets irrelevant to the analysis are excluded. Using historical traffic data, statistical analysis methods (such as mean and standard deviation) are used to determine the fluctuation range of normal traffic. For example, if the normal daily request volume of a Web service is between 1,000 and 2,000 times, with a standard deviation of 100, when the request volume exceeds 2,300 times (mean + 3 times the standard deviation) during a certain period of time, the traffic to be analyzed is included, and the remaining traffic that meets the baseline range is considered normal traffic and excluded;

[0048] Then, feature analysis is performed on the traffic to be analyzed, and feature analysis includes traffic pattern recognition and data feature analysis. Traffic pattern recognition observes the traffic pattern, including the size, frequency, and direction of the traffic, and determines whether there is an anomaly. The anomaly here refers to a sudden large number of concurrent requests, abnormal traffic peaks, or continuous low-traffic high-frequency access. The corresponding traffic to be analyzed is recorded as anomaly identified traffic.

[0049] For traffic analysis, a sliding window algorithm is used to calculate the traffic rate in real time. For example, a 5-minute sliding window is set to calculate the average traffic rate within the window. If the traffic rate within a window exceeds 150% of the historical peak value for the same period and lasts for more than 10 minutes, it is considered a traffic abnormality. For example, if the traffic rate of an API interface on an e-commerce platform suddenly soars from an average of 10MB / s to 50MB / s during non-promotional periods and lasts for 15 minutes, further investigation is required.

[0050] Traffic frequency analysis counts the request frequency of data packets per unit time. Probabilistic models such as the Poisson distribution are used to determine whether the request frequency conforms to normal patterns. If the number of requests per minute for a service follows a Poisson distribution with a mean of 50, and the number of requests reaches 150 in a given minute (far exceeding the confidence interval of the Poisson distribution), it is marked as an abnormally high-frequency access.

[0051] Analyze the flow of traffic, draw a network traffic topology diagram, and monitor the source and destination IPs of the traffic. If there are continuous and large-scale connections from internal IPs to known malicious C2 servers (such as an overseas IP address), or if there are frequent accesses from external IPs to internal non-open ports, these are considered flow anomalies.

[0052] Then, the abnormal identification traffic is analyzed for data features, such as specific character strings, encoding methods, data length, etc. For example, if a specific character string containing malicious code is found in the traffic, or the encoding method of the data is different from that of normal business data, this may be evidence of vulnerability exploitation. The obtained data features are matched with the normal data features. If the two do not match, the corresponding abnormal identification traffic is recorded as abnormal traffic. Otherwise, if the two match, it is not processed.

[0053] Build regular expression matching rules based on the characteristic strings of known vulnerability exploits. For example, for the Struts2 remote code execution vulnerability, search for OGNL expression characteristic strings such as "%{" and "(#" in the HTTP request body; for ransomware traffic, search for keywords such as "encrypt," "decrypt," and "key."

[0054] Analyze the data encoding format of the data packet. Normal business data typically uses standard encodings such as UTF-8 and GBK. If Base64 encoding is found and contains executable code (such as Shell commands or Python scripts) after decoding, or if a custom non-standard encoding format is used, it is considered an encoding anomaly. Establish a threshold range for normal data packet length. For example, the normal response data packet length of an API interface is 100-500 bytes. If a response packet exceeds 2000 bytes, further inspection is required to determine whether there is data leakage or malicious padding.

[0055] Step S3: Obtain all abnormal traffic and perform correlation analysis on it, correlate the abnormal traffic with other relevant information, calculate the corresponding similarity, and simultaneously filter out other relevant information with a similarity greater than a preset value and mark it as correlated information. By correlating information from different sources, you can more comprehensively understand the context of the event and determine the source and propagation path of the vulnerability attack. For example, correlate the source IP address in the network traffic with the login information in the system login log to determine whether there is any abnormal login behavior related to the traffic anomaly. Then, trace the source based on the obtained correlation information and the abnormal traffic, determine the initiator of the attack by analyzing the source IP address in the network traffic, generate the source IP information, and perform a reverse DNS query to confirm the source IP information.

[0056] Determine whether the domain name corresponding to the IP address matches the claimed source. If the domain name displayed in the reverse DNS query result is inconsistent with the description of the source IP address, or there is no valid reverse DNS record at all, the IP address may be forged and false IP information is generated. Conversely, if the description is consistent, real IP information is generated. If the domain name in the rDNS query result is inconsistent with the claimed source of the IP address (such as the domain name corresponding to the email sender's IP), or there is no valid DNS record, and there is abnormal behavior in the associated information (such as a large number of abnormal requests in a short period of time), it is marked as a suspected forged IP. For example, if an IP address claims to be from "example.com", but the rDNS query shows the domain name as "malicious-site.net", and the IP initiates brute force cracking, it is highly suspected that the IP is forged.

[0057] Step S4: Calculate the vulnerability risk level corresponding to the abnormal traffic, and calculate the basic indicator score, time indicator score, and environment indicator score separately;

[0058] The specific method for calculating the basic indicator group is to quantify the vulnerability attack vector, attack complexity, and permission requirements. The attack vector refers to the conditions required for an attacker to approach the vulnerability when exploiting the vulnerability. The attack complexity describes the technical obstacles and conditions that an attacker must overcome to successfully exploit the vulnerability, reflecting the difficulty of exploiting the vulnerability. The permission requirement refers to the permission level that an attacker must have on the target system before exploiting the vulnerability. The corresponding quantitative assignments are assigned to each of them, and the specific assignments are as follows:

[0059]

[0060]

[0061] Substitute the quantitative values corresponding to the vulnerability attack vector, attack complexity, and permission requirements into the formula Exploitability = 8.22 x AttackVector x AttackComplexity x PrivilegesRequired to calculate the Exploitability index;

[0062] Among them, AttackVector represents the vulnerability attack vector assignment, AttackComplexity represents the attack complexity assignment, and PrivilegesRequired represents the permission requirement assignment;

[0063] At the same time, the vulnerability impact is calculated according to the formula Impact = 6.42x(1-(1-ConfidentialityImpact)x(1-IntegrityImpact)x(1-AvailabilityImpact));

[0064] Confidentiality Impact, Integrity Impact, and Availability Impact represent the degree of impact of the vulnerability on the corresponding system characteristics. Their values range from 0 (no impact), 0.22 (partial impact), and 0.66 (complete impact) depending on the specific situation.

[0065] Finally, according to the formula The Base Score is calculated, where RoundUp indicates rounding up, and Impact reflects the degree of damage caused by the vulnerability to the system's confidentiality, integrity, and availability.

[0066] Based on the obtained basic indicator score BaseScor, the temporal indicator score TemporalScore is calculated. TemporalScore = BaseScore x Exploitability x RemediationLevelReportConfidence. The temporal indicator score TemporalScore is calculated according to the formula, where Exploitability represents code maturity, RemediationLevel represents the repair level, and ReportConfidence represents report credibility. Assuming that the vulnerability exploit code maturity (E) is fully functional (F, score 0.95), the repair level (R) is unrepaired (U, score 0.87), and the report credibility (C) is confirmed (C, score 1.0), then: TemporalScore = 6.2x0.95x0.87x1.0≈5.1;

[0067] The environmental indicator score is calculated. Based on the actual situation of the organization, the confidentiality impact, integrity impact, availability impact, etc. are adjusted. The adjusted basic score is then calculated. Finally, the environmental score is calculated by combining the adjusted exploit code maturity, repair level, and report credibility. The specific method is as follows:

[0068] Calculate the modified Impact: ModifiedImpact = 6.42 x (1 - (1 - ModifiedConfidentialityImpact) x (1 - ModifiedIntegrityImpact) x (1 - ModifiedAvailabilityImpact));

[0069] In the above formula, ModifiedImpact is the impact after modification;

[0070] ModifiedConfidentialityImpact is the modified confidentiality impact;

[0071] ModifiedIntegrityImpact is the modified integrity impact;

[0072] ModifiedAvailabilityImpact is the modified availability impact;

[0073] The revised basic score is calculated according to the formula Calculate the corrected basic score;

[0074] Calculate the modified exploitability: ModifiedExploitability = 8.22 x ModifiedAttackVector x ModifiedAttackComplexity x ModifiedPrivilegesRequired x ModifiedUserInteraction;

[0075] The environmental index score EnvironmentalScore is calculated according to the formula EnvironmentalScore = ModifiedBaseScore x ModifiedExploitability x ModifiedRemediationLevel x ModifiedReportC'on fidence.

[0076] In the above formula, ModifiedBaseScore: the modified base score;

[0077] ModifiedExploitability: Modified exploitability;

[0078] ModifiedRemediationLevel: the modified remediation level;

[0079] ModifiedReportConfidence: modified report confidence;

[0080] Substitute the calculated basic index score BaseScore, time index score TemporalScore and environmental index score EnvironmentalScore into the formula CVSS = BaseScore × a1 + TemporalScore × a2 + EnvironmentalScore × a3 to calculate the vulnerability scoring index CVSS corresponding to the vulnerability, where a1, a2 and a3 are the corresponding weight coefficients respectively. At the same time, match the obtained vulnerability scoring index CSSS with the corresponding rating interval score to obtain the corresponding vulnerability level and generate vulnerability level information.

[0081] The specific rating interval score indicators are as follows:

[0082] Low risk: CVSS scores range from 0 to 3.9. These vulnerabilities typically require specific conditions to be exploited or have minimal impact on the system.

[0083] Medium: Scores range from 4.0 to 6.9. This vulnerability can be exploited, but requires certain skills or conditions and has a moderate impact on the system.

[0084] High-risk: Scores range from 7.0 to 8.9. These vulnerabilities are easily exploited and may lead to serious consequences such as partial system failure, sensitive information leakage, or privilege escalation.

[0085] Critical: CVSS scores between 9.0 and 10.0. Critical vulnerabilities can be easily exploited to completely compromise the target system and cause serious damage to confidentiality, integrity, and availability.

[0086] Example 2

[0087] See also Figure 2 The present application provides a security vulnerability tracing and analysis system for application software, which includes: a data acquisition unit, a data anomaly identification unit, a tracing and analysis processing unit, a vulnerability rating processing unit and a tracing and analysis information output unit, and is combined with Figure 2 It can be known that the functional units are electrically connected in a unidirectional manner.

[0088] A data acquisition unit is used to acquire data packets through a network packet capture tool, continuously collect data within a time period, determine the network traffic range, and then transmit it to the data anomaly identification unit. The specific processing method is similar to the processing process of step S1 in embodiment 1;

[0089] A data anomaly identification unit is used to filter and screen the obtained periodic data packets, obtain the traffic to be analyzed by setting filtering rules and excluding irrelevant traffic, and identify and analyze the corresponding traffic patterns and data characteristics, screen out abnormal traffic, and transmit it to the tracing analysis processing unit and the vulnerability rating processing unit at the same time. The specific processing method is similar to the processing process of step S2 in embodiment 1;

[0090] A source tracing analysis processing unit is used to calculate the similarity between abnormal traffic and other related information, filter out related information that is greater than a preset value, determine the source IP information, perform a reverse DNS query, generate false or real IP information, and then transmit it to the source tracing analysis information output unit. The specific processing method is similar to the processing process of step S3 in embodiment 1;

[0091] A vulnerability rating processing unit is used to calculate the vulnerability risk level corresponding to the abnormal traffic, calculate the corresponding basic indicator score, time indicator score, and environmental indicator score respectively, and calculate the vulnerability scoring index corresponding to the vulnerability in combination with their respective weights. At the same time, the vulnerability level is determined in combination with the rating interval score, and vulnerability level information is generated and transmitted to the traceability analysis information output unit. The specific processing method is similar to the processing process of step S4 in Example 1;

[0092] The traceability analysis information output unit is used to display the obtained false or real IP information and vulnerability level information to the corresponding management personnel.

[0093] Some of the data in the above formulas are calculated based on their numerical values and are not substituted into parameter units for calculation. At the same time, the contents not described in detail in this specification belong to the existing technology known to those skilled in the art.

[0094] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A method for tracing and analyzing security vulnerabilities in application software, characterized in that: The method specifically comprises the following steps: Use network packet capture tools to collect data packets within a time period to determine the flow range; Filter and screen periodic data packets, exclude irrelevant traffic through rule setting, analyze traffic patterns and data characteristics, and obtain abnormal traffic; Calculate the similarity between abnormal traffic and related information, filter related information, determine the source IP, and perform reverse DNS query to obtain true and false IP information; Calculate the basic, time, and environmental indicator scores of abnormal traffic vulnerabilities, obtain vulnerability scores based on weights, determine the vulnerability level based on the rating range, and generate level information.

2. The method for tracing and analyzing security vulnerabilities of application software according to claim 1, characterized in that: The specific method of obtaining abnormal traffic is: Based on known vulnerability features or attack patterns, filtering rules are set to screen out relevant data packet traffic and exclude normal traffic. The traffic to be analyzed is analyzed for characteristics, and traffic patterns are identified from the perspectives of traffic size, frequency, and direction. Abnormal situations such as a large number of concurrent requests, abnormal peaks, and low-traffic high-frequency access are recorded as abnormal identified traffic, and a secondary analysis is performed on the abnormal identified traffic.

3. The method for tracing and analyzing security vulnerabilities of application software according to claim 2, characterized in that: The specific method of performing secondary analysis on abnormal identification traffic is as follows: Perform data feature analysis on abnormal identification traffic, analyze the data features in the data packet, including character strings, encoding methods, and data length, and match the obtained data features with normal data features. If the two do not match, the corresponding abnormal identification traffic will be recorded as abnormal traffic. Conversely, if the two match, no processing will be done.

4. The method for tracing and analyzing security vulnerabilities of application software according to claim 1, wherein: The specific method of obtaining true and false IP information is as follows: Obtain abnormal traffic, correlate and analyze it with relevant information, calculate similarity, filter out correlated information whose similarity exceeds a preset value, trace the source based on the correlated information and abnormal traffic, analyze the source IP to determine the attacker, generate source IP information and perform reverse DNS query. If the domain name does not match the source IP description or there is no valid record, it is recorded as false IP information. If it matches, it is recorded as real IP information.

5. The method for tracing and analyzing security vulnerabilities of application software according to claim 1, wherein: The specific method for calculating the basic, time, and environmental indicator scores of the abnormal traffic vulnerability is as follows: Quantify and assign values to the vulnerability attack vector, attack complexity, and permission requirements and substitute them into the formula Exploitability = 8.22 x AttackVector x AttackComplexity x PrivilegesRequired to calculate the Exploitability indicator; Among them, AttackVector represents the vulnerability attack vector assignment, AttackComplexity represents the attack complexity assignment, and PrivilegesRequired represents the permission requirement assignment; At the same time, the vulnerability impact is calculated according to the formula Impact = 6.42x(1-(1-ConfidentialityImpact)x(1-IntegrityImpact)x(1-AvailabilityImpact)); Among them, Confidentiality Impact, Integrity Impact, and Availability Impact respectively represent the degree of impact of the vulnerability on the corresponding characteristics of the system; Finally, according to the formula The basic indicator score BaseScore is calculated, where RoundUp indicates rounding up, and the time indicator score is calculated based on the basic indicator score.

6. The method for tracing and analyzing security vulnerabilities of application software according to claim 5, characterized in that: The specific method of calculating the time index score based on the basic index score is: TemporalScore = BaseScore x Exploitability x RemediationLevel ReportConfidence. The temporal index score TemporalScore is calculated according to the formula, where Exploitability represents code maturity, RemediationLevel represents the repair level, and ReportConfidence represents the report credibility.

7. The method for tracing and analyzing security vulnerabilities of application software according to claim 1, wherein: The specific method for calculating the environmental indicator score of abnormal traffic vulnerability is as follows: The modified base score ModifiedBaseScore, the modified exploitability ModifiedExploitability, the modified remediation level ModifiedRemediationLevel, and the modified report confidence ModifiedReportConfidence are calculated respectively, and the environmental indicator score EnvironmentalScore is calculated according to the formula EnvironmentalScore = ModifiedBaseScore x ModifiedExploitability x ModifiedRemediationLevel x ModifiedReportConfidence.

8. The method for tracing and analyzing security vulnerabilities of application software according to claim 1, wherein: The specific method of generating the level information is as follows: Substitute the calculated basic index score BaseScore, time index score TemporalScore and environmental index score EnvironmentalScore into the formula CVSS = BaseScore × a1 + TemporalScore × a2 + EnvironmentalScore × a3 to calculate the vulnerability scoring index CVSS corresponding to the vulnerability, where a1, a2 and a3 are the corresponding weight coefficients respectively. At the same time, match the obtained vulnerability scoring index CSSS with the corresponding rating interval score to obtain the corresponding vulnerability level and generate vulnerability level information.

9. A security vulnerability tracing and analysis system for application software, configured to execute the security vulnerability tracing and analysis method according to any one of claims 1 to 8, characterized in that: It includes data collection unit, data anomaly identification unit, source tracing analysis processing unit, vulnerability rating processing unit and source tracing analysis information output unit; A data acquisition unit, which is used to obtain data packets through a network packet capture tool, continuously collect data within a time period, determine the range of network traffic, and then transmit it to the data anomaly identification unit; The data anomaly identification unit is used to filter and screen the obtained periodic data packets, obtain the traffic to be analyzed by setting filtering rules and excluding irrelevant traffic, and identify and analyze the corresponding traffic patterns and data characteristics, filter out abnormal traffic, and transmit it to the traceability analysis processing unit and vulnerability rating processing unit at the same time; The source tracing analysis processing unit is used to calculate the similarity between abnormal traffic and other related information, filter out related information that is greater than a preset value, determine the source IP information, perform a reverse DNS query, generate false or real IP information, and then transmit it to the source tracing analysis information output unit; The vulnerability rating processing unit is used to calculate the vulnerability risk level corresponding to the abnormal traffic, calculate the corresponding basic indicator score, time indicator score and environmental indicator score respectively, and combine the respective weights to comprehensively calculate the vulnerability scoring index corresponding to the vulnerability. At the same time, the vulnerability level is determined by combining the rating interval score, and the vulnerability level information is generated and transmitted to the traceability analysis information output unit; The traceability analysis information output unit is used to display the obtained false or real IP information and vulnerability level information to the corresponding management personnel.

Images