Methods and Systems for Security Vulnerability Source Tracing and Analysis of Application Software

Abstract

The application discloses a security vulnerability tracing analysis method and system for application software, and relates to the technical field of network security.The application solves the technical problem that it is difficult to quickly and accurately locate the source of the vulnerability and assess the risk level, thereby leading to the difficulty in formulating an effective security protection strategy.The application determines the source and propagation path of the vulnerability attack by performing correlation analysis on abnormal traffic, performs reverse DNS query and authenticity verification on the source IP address, and further improves the accuracy of the tracing result, thereby providing strong support for quickly locating the attack source.In terms of vulnerability risk level calculation, basic index scores, time index scores and environment index scores are calculated respectively, and the vulnerability score index is calculated in combination with respective weights, so that the actual situation is fully considered, the evaluation result is more in line with the actual risk, more accurate risk early warning, more targeted vulnerability repair and protection strategies can be provided, and the application software security protection level is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for tracing and analyzing security vulnerabilities in application software. Background Technology

[0002] Currently, with the advancement of technology and the development of the internet, and the widespread use of application software in enterprises and personal life, software security issues are becoming increasingly prominent.

[0003] According to patent application CN116502240B, a method for tracing and analyzing security vulnerabilities in application software is disclosed. The method includes: obtaining version information of the current operating system and the application software; listing potential security vulnerabilities in the application software under the current operating system based on the version information of the current operating system and the application software, and obtaining a first identification feature for each potential security vulnerability; detecting and obtaining a second identification feature of the current security vulnerability of the application software, and comparing the first identification feature and the second identification feature to obtain a comparison result; and locating the attacker based on the comparison result and according to different tracing methods.

[0004] However, current application software security vulnerability tracing and analysis often employs single technical means or simple processes, such as relying solely on network packet capture tools to obtain data, lacking in-depth analysis and filtering of traffic. Furthermore, vulnerability risk assessments are frequently based on general standards, making it difficult to tailor to the specific environment of an organization. These methods, when faced with complex and ever-changing network attacks and new vulnerabilities, cannot quickly and accurately locate the source of vulnerabilities and assess risk levels, leading to difficulties in developing effective security protection strategies and posing significant security risks. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for tracing and analyzing security vulnerabilities in application software, solving the problem of being unable to quickly and accurately locate the source of vulnerabilities and assess risk levels, which makes it difficult to formulate effective security protection strategies.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for tracing and analyzing security vulnerabilities in application software, which specifically includes the following steps:

[0007] Use network packet capture tools to collect data packets within a time period to determine the traffic range;

[0008] Filter periodic data packets, exclude irrelevant traffic by setting rules, analyze traffic patterns and data characteristics, and identify abnormal traffic.

[0009] Calculate the similarity between abnormal traffic and related information, filter the associated information, determine the source IP and perform a reverse DNS lookup to obtain true and false IP information;

[0010] Calculate the basic, time, and environmental indicator scores for abnormal traffic vulnerabilities, assign a vulnerability score based on the weights, determine the vulnerability level according to the rating range, and generate level information.

[0011] As a further aspect of the present invention, the specific method for obtaining abnormal traffic is as follows:

[0012] Filtering rules are set based on known vulnerability characteristics or attack patterns to filter out relevant data packet traffic, exclude normal traffic, and obtain traffic to be analyzed. Characteristic analysis is performed on the traffic to identify traffic patterns from traffic size, frequency, and flow direction. Traffic with a large number of concurrent requests, abnormal peaks, and high-frequency access with low traffic is recorded as abnormal traffic. At the same time, a second analysis is performed on the abnormal traffic.

[0013] As a further aspect of the present invention, the specific method for performing secondary analysis on the abnormal identification traffic is as follows:

[0014] Data feature analysis is performed on abnormal traffic. The data features in the data packets are analyzed, including strings, encoding methods, and data lengths. The obtained data features are then matched with normal data features. If the two do not match, the corresponding abnormal traffic is recorded as abnormal traffic. Otherwise, if the two match, no action is taken.

[0015] As a further aspect of the present invention, the specific method for obtaining true and false IP information is as follows:

[0016] Obtain abnormal traffic, correlate and analyze it with relevant information, calculate similarity, filter out related information with similarity exceeding the preset value, trace the source of abnormal traffic based on related information and abnormal traffic, analyze the source IP to determine the attacker, generate source IP information and perform reverse DNS lookup, if the domain name does not match the source IP description or there is no valid record, record it as fake IP information, if they match, record it as real IP information.

[0017] As a further aspect of the present invention, the specific method for calculating the basic, time, and environmental indicator scores of abnormal traffic vulnerabilities is as follows:

[0018] The vulnerability attack vector, attack complexity, and privilege requirements are quantified and assigned values, and then substituted into the formula Exploitability = 8.22 x AttackVector x AttackComplexity x PrivilegesRequired to calculate the exploitability index.

[0019] Where AttackVector represents the vulnerability attack vector assignment, AttackComplexity represents the attack complexity assignment, and PrivilegesRequired represents the permission requirement assignment;

[0020] The impact of the vulnerability is calculated using the formula Impact = 6.42 x (1 - (1 - ConfidentialityImpact) x (1 - IntegrityImpact) x (1 - AvailabilityImpact)).

[0021] Confidentiality Impact, Integrity Impact, and Availability Impact represent the degree to which a vulnerability affects the corresponding characteristics of the system.

[0022] Finally, according to the formula The base score BaseScore is calculated, where RoundUp represents rounding up, and the time score is calculated based on the base score.

[0023] As a further aspect of the present invention, the specific method for calculating the time index score based on the basic index score is as follows:

[0024] TemporalScore = BaseScore x Exploitability x RemediationLevel ReportConfidence. The TemporalScore is calculated according to the formula, where Exploitability represents code maturity, RemediationLevel represents the level of fixes, and ReportConfidence represents the credibility of the report.

[0025] As a further aspect of the present invention, the specific method for calculating the environmental indicator score of abnormal traffic vulnerabilities is as follows:

[0026] The modified base score (ModifiedBaseScore), modified exploitability (ModifiedExploitability), modified remediation level (ModifiedRemediationLevel), and modified report confidence (ModifiedReportConfidence) are calculated separately. The environmental score is then obtained by using the formula EnvironmentalScore = ModifiedBaseScore x ModifiedExploitability x ModifiedRemediationLevel x ModifiedReportConfidence.

[0027] As a further aspect of the present invention, the specific method for generating the level information is as follows:

[0028] The calculated BaseScore, TemporalScore, and EnvironmentalScore are substituted into the formula CVSS = BaseScore × a1 + TemporalScore × a2 + EnvironmentalScore × a3 to calculate the vulnerability score index CVSS corresponding to the vulnerability, where a1, a2, and a3 are the corresponding weight coefficients. At the same time, the vulnerability score index CVSS is matched with the corresponding rating interval score to obtain the corresponding vulnerability level and generate vulnerability level information.

[0029] A security vulnerability tracing and analysis system for application software includes a data acquisition unit, a data anomaly identification unit, a tracing and analysis processing unit, a vulnerability rating processing unit, and a tracing and analysis information output unit.

[0030] The data acquisition unit is used to acquire data packets through network packet capture tools, continuously collect data within a time period, determine the network traffic range, and then transmit it to the data anomaly identification unit.

[0031] The data anomaly identification unit is used to filter and screen the obtained periodic data packets. By setting filtering rules and rejecting irrelevant traffic, the unit obtains the traffic to be analyzed and identifies and analyzes its corresponding traffic patterns and data characteristics to screen out abnormal traffic. At the same time, the abnormal traffic is transmitted to the source tracing analysis processing unit and the vulnerability rating processing unit.

[0032] The source analysis processing unit is used to calculate the similarity between abnormal traffic and other related information, filter out related information that exceeds the preset value, determine the source IP information, perform a reverse DNS query, generate false or real IP information, and then transmit it to the source analysis information output unit.

[0033] The vulnerability rating and processing unit is used to calculate the vulnerability risk level corresponding to abnormal traffic. It calculates the corresponding basic indicator score, time indicator score and environmental indicator score respectively, and combines their respective weights to calculate the vulnerability score index corresponding to the vulnerability. At the same time, it determines the vulnerability level by combining the rating interval score, generates vulnerability level information, and transmits it to the source tracing and analysis information output unit.

[0034] The source tracing analysis information output unit is used to display the obtained false or real IP information and vulnerability level information to the corresponding administrators.

[0035] This invention provides a method and system for tracing and analyzing security vulnerabilities in application software. Compared with existing technologies, it has the following advantages:

[0036] This invention uses professional network packet capture tools to acquire data packets and sets filtering rules based on known vulnerability characteristics and attack patterns. Combined with a normal traffic baseline model, it can accurately filter out the traffic to be analyzed. In the feature analysis stage, it comprehensively utilizes traffic pattern recognition and data feature analysis to judge abnormal traffic from multiple dimensions, improving the accuracy and reliability of data processing and effectively avoiding false positives and false negatives.

[0037] This invention performs correlation analysis on abnormal traffic, combining it with multi-source information such as system login logs and network device records. By calculating similarity and filtering related information, it can comprehensively determine the source and propagation path of vulnerability attacks. At the same time, it performs reverse DNS lookups and authenticity verification on the source IP address, further improving the accuracy of the tracing results and providing strong support for quickly locating the source of the attack.

[0038] In calculating vulnerability risk levels, this invention calculates basic indicator scores, time indicator scores, and environmental indicator scores separately, and combines their respective weights to comprehensively calculate a vulnerability scoring index. The environmental indicator score fully considers the organization's actual situation, such as asset value and security measures, making the assessment results more closely reflect actual risks. This allows for more accurate risk warnings and more targeted vulnerability remediation and protection strategies, thereby improving the security protection level of application software. Attached Figure Description

[0039] Figure 1 This is a diagram illustrating the steps and methods of the present invention;

[0040] Figure 2 This is a block diagram illustrating the system principle of the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Example 1

[0043] Please see Figure 1 This application provides a method for tracing and analyzing security vulnerabilities in application software, which specifically includes the following steps:

[0044] Step S1: Obtain data packets using professional network packet capture tools, such as Wireshark and tcpdump. These tools can capture data packets flowing through network interfaces and determine the network traffic range based on the acquired data packets. Specifically, this includes traffic related to specific network segments, ports, or applications. For example, if you suspect that a web application has been compromised, focus on collecting traffic from the network segment where the application server is located and related ports (such as ports 80 and 443), while continuously acquiring data packets within a time period t.

[0045] Step S2: Filter and screen the obtained periodic data packets. Based on known vulnerability characteristics or attack patterns, set filtering rules to filter out relevant data packet traffic, while excluding normal data packet traffic that is irrelevant to the analysis, and record the remaining data packet traffic as traffic to be analyzed.

[0046] Specifically, basic rules are established based on dimensions such as protocol type, IP address, port number, and timestamp. For example, for SQL injection vulnerabilities, filtering rules can be set up for requests with the protocol being HTTP and the request URL or parameters containing SQL keywords such as 'union' or 'select'; for ransomware attacks, rules can be set up for the source IP address being an address in a known malicious IP database and the port being 445 (SMB protocol) or 8080 (common web service port).

[0047] By establishing a baseline model for normal traffic, packets irrelevant to the analysis are excluded. Historical traffic data is used, and statistical analysis methods (such as mean and standard deviation) are employed to determine the fluctuation range of normal traffic. For example, if a web service's normal daily average request volume is 1000-2000 times with a standard deviation of 100, and the request volume exceeds 2300 times (mean + 3 times the standard deviation) during a certain period, it is included in the traffic to be analyzed; the remaining traffic that meets the baseline range is considered normal traffic and excluded.

[0048] Next, feature analysis is performed on the obtained traffic to be analyzed. Feature analysis includes traffic pattern recognition and data feature analysis. For traffic pattern recognition, the pattern of traffic is observed, including the size, frequency, and direction of traffic, and it is determined whether there are any anomalies. Here, anomalies refer to a sudden large number of concurrent requests, abnormal traffic peaks, or continuous low-traffic high-frequency access. The corresponding traffic to be analyzed is then recorded as anomaly identification traffic.

[0049] For traffic volume analysis, a sliding window algorithm is used to calculate the traffic rate in real time. For example, a 5-minute sliding window is set to calculate the average traffic rate within the window. If the traffic rate within a window exceeds 150% of the historical peak for the same period and lasts for more than 10 minutes, it is considered an abnormal traffic volume. For example, if an e-commerce platform experiences a sudden spike in the traffic rate of a certain API interface from an average of 10MB / s to 50MB / s during a non-promotional period, and this spike lasts for 15 minutes, further investigation is required.

[0050] For traffic frequency analysis, the request frequency of data packets per unit time is counted. A Poisson distribution model is used to determine whether the request frequency conforms to normal patterns. If a service normally follows a Poisson distribution with a mean of 50 requests per minute, and the number of requests reaches 150 in a certain minute (far exceeding the confidence interval of the Poisson distribution), it is marked as abnormally high-frequency access.

[0051] Analyze traffic flow to create a network traffic topology map and monitor the source and destination IP addresses of traffic. A continuous large number of connections from internal IPs to known malicious C2 servers (such as overseas IP addresses), or frequent accesses from external IPs to internal non-open ports, are considered abnormal traffic flows.

[0052] Next, data feature analysis is performed on the abnormal traffic. The data characteristics in the data packets are analyzed, such as specific strings, encoding methods, and data lengths. For example, if a specific string containing malicious code is found in the traffic, or if the encoding method of the data is different from that of normal business data, this may be evidence that the vulnerability has been exploited. The obtained data features are then matched with normal data features. If the two do not match, the corresponding abnormal traffic is recorded as abnormal traffic. Otherwise, if the two match, no action is taken.

[0053] Based on the characteristic strings of known exploit code, regular expression matching rules are constructed. For example, for Struts2 remote code execution vulnerabilities, OGNL expression characteristic strings such as "%{" and "(#" are searched in the HTTP request body; for ransomware traffic, keywords such as "encrypt", "decrypt", and "key" are searched.

[0054] Analyze the data encoding format of the data packets. Normal business data typically uses standard encodings such as UTF-8 and GBK. If Base64 encoding is found that contains executable code (such as shell commands or Python scripts) after decoding, or if a custom non-standard encoding format is found, it is considered an encoding anomaly, and a threshold range for the normal data packet length should be established. For example, the normal response data packet length for a certain API interface is 100-500 bytes. If a response packet with a length exceeding 2000 bytes appears, further investigation is needed to check for data leakage or malicious padding.

[0055] Step S3: Obtain all abnormal traffic and perform correlation analysis. Associate the abnormal traffic with other relevant information, calculate the corresponding similarity, and filter out other relevant information with similarity greater than a preset value, marking them as associated information. By associating information from different sources, a more comprehensive understanding of the event's context can be achieved, determining the source and propagation path of the vulnerability attack. For example, associate the source IP address in network traffic with login information in system login logs to determine if there are any abnormal login behaviors related to the abnormal traffic. Then, based on the obtained correlation information and abnormal traffic, perform source tracing processing. By analyzing the source IP address in network traffic, determine the attacker, generate source IP information, and simultaneously perform a reverse DNS query to confirm the source IP information.

[0056] The process involves determining whether the domain name corresponding to an IP address matches its claimed source. If the domain name displayed in the reverse DNS lookup result does not match the description of the source IP address, or if there is no valid reverse DNS record, IP address spoofing may exist, generating fake IP information. Conversely, if the description matches, genuine IP information is generated. If the domain name in the rDNS lookup result does not match the claimed source of the IP address (such as the domain name corresponding to an email sender's IP), or if there is no valid DNS record, and there is abnormal behavior in the associated information (such as a large number of abnormal requests in a short period of time), it is marked as a suspected spoofed IP. For example, if an IP address claims to come from "example.com," but the rDNS lookup shows the domain name as "malicious-site.net," and this IP initiates brute-force attacks, then IP spoofing is highly suspected.

[0057] Step S4: Calculate the vulnerability risk level corresponding to the abnormal traffic, and calculate the basic indicator score, time indicator score and environmental indicator score separately.

[0058] The specific method for calculating the basic indicator group is as follows: The attack vector, attack complexity, and privilege requirements are quantified. The attack vector refers to the conditions required for an attacker to approach the vulnerability. Attack complexity describes the technical obstacles and conditions that an attacker needs to overcome to successfully exploit the vulnerability, reflecting the ease or difficulty of exploitation. Privilege requirements refer to the level of privileges an attacker must possess on the target system before exploiting the vulnerability. These are then assigned corresponding quantified values, as shown below:

[0059]

[0060]

[0061] Substitute the quantitative values ​​corresponding to the vulnerability attack vector, attack complexity, and privilege requirements into the formula Exploitability = 8.22 x AttackVector x AttackComplexity x PrivilegesRequired to calculate the exploitability index.

[0062] Where AttackVector represents the vulnerability attack vector assignment, AttackComplexity represents the attack complexity assignment, and PrivilegesRequired represents the permission requirement assignment;

[0063] The impact of the vulnerability is calculated using the formula Impact = 6.42 x (1 - (1 - ConfidentialityImpact) x (1 - IntegrityImpact) x (1 - AvailabilityImpact)).

[0064] The Confidentiality Impact, Integrity Impact, and Availability Impact represent the degree to which a vulnerability affects the corresponding characteristics of the system. Their values ​​can be selected from 0 (no impact), 0.22 (partial impact), and 0.66 (complete impact) depending on the specific circumstances.

[0065] Finally, according to the formula The Base Score is calculated, where RoundUp represents rounding up, and Impact reflects the degree of damage the vulnerability causes to the confidentiality, integrity, and availability of the system.

[0066] Based on the obtained BaseScor score, the TemporalScore is calculated as follows: TemporalScore = BaseScore x Exploitability x RemediationLevel / ReportConfidence. The TemporalScore is calculated according to the formula, where Exploitability represents code maturity, RemediationLevel represents remediation level, and ReportConfidence represents report credibility. Assuming the vulnerability exploit code maturity (E) is fully functional (F, score 0.95), the remediation level (R) is unrepaired (U, score 0.87), and the report credibility (C) is confirmed (C, score 1.0), then: TemporalScore = 6.2 x 0.95 x 0.87 x 1.0 ≈ 5.1;

[0067] The environmental indicator scores are calculated, and adjustments are made based on the organization's actual situation regarding the impact on confidentiality, integrity, and availability. The adjusted base score is then calculated, and finally, the environmental score is derived by combining the adjusted utilization of code maturity, remediation level, and report credibility. The specific method is as follows:

[0068] For the modified Impact calculation, ModifiedImpact = 6.42x(1-(1-ModifiedConfidentialityImpact)x(1-ModifiedIntegrityImpact)x(1-ModifiedAvailabilityImpact));

[0069] In the above formula, ModifiedImpact represents the modified effect;

[0070] ModifiedConfidentialityImpact represents the modified confidentiality impact.

[0071] ModifiedIntegrityImpact represents the modified integrity impact.

[0072] ModifiedAvailabilityImpact represents the modified availability impact.

[0073] The revised base score is calculated according to the formula. The corrected base score is calculated.

[0074] The modified exploitability is calculated as follows: ModifiedExploitability = 8.22 x ModifiedAttackVector x ModifiedAttackComplexity x ModifiedPrivilegesRequired x ModifiedUserInteraction;

[0075] The Environmental Score is calculated using the formula: EnvironmentalScore = ModifiedBaseScore x ModifiedExploitability x ModifiedRemediationLevel x ModifiedReportC'onFidence.

[0076] In the above formula, ModifiedBaseScore is the modified base score.

[0077] ModifiedExploitability: Modified exploitability;

[0078] ModifiedRemediationLevel: The level of repair after modification;

[0079] ModifiedReportConfidence: The confidence level of the revised report;

[0080] The calculated BaseScore, TemporalScore, and EnvironmentalScore are substituted into the formula CVSS = BaseScore × a1 + TemporalScore × a2 + EnvironmentalScore × a3 to calculate the vulnerability score index CVSS corresponding to the vulnerability, where a1, a2, and a3 are the corresponding weight coefficients. At the same time, the vulnerability score index CVSS is matched with the corresponding rating interval score to obtain the corresponding vulnerability level and generate vulnerability level information.

[0081] The specific rating range score indicators are as follows:

[0082] Low risk: CVSS score between 0 and 3.9. These vulnerabilities typically require specific conditions to be exploited or have a minimal impact on the system.

[0083] Medium risk: Score between 4.0 and 6.9. The vulnerability may be exploited, but requires certain skills or conditions, and will have some impact on the system.

[0084] High risk: Score between 7.0 and 8.9. These vulnerabilities are relatively easy to exploit and could lead to serious consequences such as partial system malfunction, leakage of sensitive information, or privilege escalation.

[0085] Critical: CVSS score between 9.0 and 10.0. Critical vulnerabilities can be easily exploited to gain complete control of the target system, causing serious damage to confidentiality, integrity, and availability.

[0086] Example 2

[0087] Please see Figure 2 This application provides a security vulnerability tracing and analysis system for application software. The system includes: a data acquisition unit, a data anomaly identification unit, a tracing and analysis processing unit, a vulnerability rating processing unit, and a tracing and analysis information output unit, and combines... Figure 2 It can be seen that the above functional units are connected electrically in one direction.

[0088] The data acquisition unit is used to acquire data packets through network packet capture tools and continuously collect data within a time period, while determining the network traffic range. Then, it is transmitted to the data anomaly identification unit, and the specific processing method is the same as the processing process of step S1 in embodiment one.

[0089] The data anomaly identification unit is used to filter and screen the obtained periodic data packets. By setting filtering rules and rejecting irrelevant traffic, the unit obtains the traffic to be analyzed and identifies and analyzes its corresponding traffic patterns and data characteristics. Abnormal traffic is then screened out and transmitted to the source tracing analysis processing unit and the vulnerability rating processing unit. The specific processing method is the same as the processing process in step S2 of embodiment one.

[0090] The source analysis processing unit is used to calculate the similarity between abnormal traffic and other related information, filter the associated information that is greater than the preset value, determine the source IP information, perform a reverse DNS query, generate false or real IP information, and then transmit it to the source analysis information output unit. The specific processing method is the same as the processing process in step S3 in embodiment one.

[0091] The vulnerability rating processing unit is used to calculate the vulnerability risk level corresponding to abnormal traffic. It calculates the corresponding basic indicator score, time indicator score and environmental indicator score respectively, and combines their respective weights to calculate the vulnerability score index corresponding to the vulnerability. At the same time, it determines the vulnerability level by combining the rating interval score, generates vulnerability level information, and transmits it to the source tracing analysis information output unit. The specific processing method is the same as the processing process of step S4 in embodiment one.

[0092] The source tracing analysis information output unit is used to display the obtained false or real IP information and vulnerability level information to the corresponding administrators.

[0093] The data in the above formulas are all calculated using numerical values, without substituting the units of the parameters. In addition, the contents not described in detail in this specification are all prior art known to those skilled in the art.

[0094] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A method for security vulnerability trace analysis of application software, characterized in that, The method specifically comprises the following steps: Collecting data packets in a time period by using a network packet capturing tool to determine the flow range; Filtering and screening the period data packets, excluding irrelevant flows by setting rules, analyzing flow patterns and data characteristics, and obtaining abnormal flows; Setting filtering rules based on known vulnerability characteristics or attack patterns to screen out relevant data packet flows, exclude normal flows, obtain to-be-analyzed flows, and analyze their characteristics from flow size, frequency, and flow direction to identify flow patterns, record abnormal identification flows with a large number of concurrent requests, abnormal peak values, and small flow high-frequency access anomalies, and perform secondary analysis on the abnormal identification flows; Performing data characteristic analysis on the abnormal identification flows, analyzing data characteristics in the data packets, including strings, encoding methods, and data lengths, matching the obtained data characteristics with normal data characteristics, recording corresponding abnormal identification flows as abnormal flows if the two do not match, and vice versa; Calculating the similarity of abnormal flows and related information, screening associated information, determining the source IP and performing reverse DNS query to obtain true and false IP information; Obtaining abnormal flows, analyzing associated information, calculating the similarity, screening out associated information with a similarity exceeding a preset value, tracing the source IP according to the associated information and the abnormal flows, determining the attack party by analyzing the source IP, generating source IP information and performing reverse DNS query, recording false IP information if the domain name and the source IP description are inconsistent or no valid record exists, and recording true IP information if the two are consistent; Calculating the basic, time, and environment index scores of the vulnerability of the abnormal flows, obtaining the vulnerability score according to the weights, determining the vulnerability level according to the rating interval, generating the level information, and the specific processing mode is as follows: Quantifying and assigning values to the vulnerability attack vector, attack complexity, and privilege requirements and substituting them into the formula Exploitability=8.22xAttackVectorxAttackComplexityxPrivilegesRequired to calculate the impact of the exploitability index Exploitability; Wherein AttackVector represents the vulnerability attack vector assignment, AttackComplexity represents the attack complexity assignment, and PrivilegesRequired represents the privilege requirement assignment; At the same time, the vulnerability impact is calculated according to the formula Impact= 6.42x(1-(1-ConfidentialityImpact)x(1-IntegrityImpact)x(1-AvailabilityImpact)); Wherein Confidentiality Impact, Integrity Impact, and Availability Impact represent the impact of the vulnerability on the corresponding characteristics of the system. Finally, the base indicator score BaseScore is calculated according to the formula BaseScore = RoundUp ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( TemporalScore=BaseScorexExploitabilityxRemediationLevelReportConfidence, wherein Exploitability represents code maturity, RemediationLevel represents remediation level, and ReportConfidence represents report confidence.

2. The method for security vulnerability root cause analysis of application software according to claim 1, wherein, The specific method for calculating the environmental indicator score of the abnormal traffic vulnerability is as follows: The modified base score ModifiedBaseScore, the modified exploitability ModifiedExploitability, the modified remediation level ModifiedRemediationLevel, and the modified report confidence ModifiedReportConfidence are calculated respectively, and the environmental indicator score EnvironmentalScore is calculated according to the formula EnvironmentalScore=ModifiedBaseScorexModifiedExploitabilityxModifiedRemediationLevelx ModifiedReportConfidence.

3. The method for security vulnerability root cause analysis of application software according to claim 1, wherein, The specific method for generating the grade information is as follows: The base score BaseScore, the temporal score TemporalScore, and the environmental score EnvironmentalScore are substituted into the formula CVSS=BaseScorex a1+TemporalScorex a2+EnvironmentalScorex a3 to calculate the vulnerability score indicator CVSS corresponding to the vulnerability, wherein a1, a2, and a3 are weight coefficients corresponding to the base score, the temporal score, and the environmental score respectively, and the obtained vulnerability score indicator CVSS is matched with the score of the corresponding rating interval to obtain the corresponding vulnerability grade, and the vulnerability grade information is generated.

4. A security vulnerability trace analysis system for application software for performing the security vulnerability trace analysis method according to any one of claims 1 to 3, characterized in that The system comprises a data collection unit, a data anomaly identification unit, a traceability analysis processing unit, a vulnerability rating processing unit, and a traceability analysis information output unit. The data collection unit is configured to acquire data packets by using a network packet capturing tool, continuously collect data in a time period, determine a network traffic range, and then transmit the data to the data anomaly identification unit. The data anomaly identification unit is configured to filter and screen the obtained periodic data packets, obtain to-be-analyzed traffic by setting a filtering rule and excluding irrelevant traffic, identify and analyze traffic patterns and data characteristics corresponding to the to-be-analyzed traffic, screen abnormal traffic, and then transmit the abnormal traffic to the traceability analysis processing unit and the vulnerability rating processing unit. The traceability analysis processing unit is configured to perform similarity calculation on abnormal traffic and other related information, filter associated information greater than a preset value, determine source IP information, perform reverse DNS query, generate false or real IP information, and then transmit the false or real IP information to the traceability analysis information output unit; The vulnerability rating processing unit is configured to calculate the vulnerability danger level corresponding to the abnormal traffic, calculate the basic index score, the time index score and the environment index score corresponding to the abnormal traffic respectively, and comprehensively calculate the vulnerability score index corresponding to the vulnerability by combining the respective weights, determine the vulnerability level by combining the rating interval score, generate the vulnerability level information, and transmit the vulnerability level information to the traceability analysis information output unit; The traceability analysis information output unit is configured to display the obtained false or real IP information and the vulnerability level information to the corresponding management personnel.

Images