An intelligent detection method for business logic vulnerabilities

Abstract

This invention discloses an intelligent detection method for business logic vulnerabilities, belonging to the field of vulnerability detection technology. It addresses the technical problems of poor tracing and analysis of the multi-dimensional impact of vulnerabilities in existing solutions, as well as the poor effectiveness of autonomous evaluation and optimization of detection results. Based on business logs, it monitors, digitizes, and dynamically marks newly added business records to obtain normal or abnormal business records. Based on the analyzed abnormal business records, it performs tracing and analysis of abnormal logic rules to determine the logical vulnerability impact corresponding to the abnormal logic rule and represents it digitally. It conducts business logic vulnerability coverage analysis on the logical vulnerability impact data obtained from processing all newly added business records, and dynamically optimizes and manages the business logic rules for the subsequent implementation of existing business logic vulnerability detection solutions based on the analysis results.

Description

Technical Field

[0001] This invention relates to the field of vulnerability detection technology, and more specifically to an intelligent detection method for business logic vulnerabilities. Background Technology

[0002] Business logic vulnerabilities refer to design or implementation flaws in the business processes or rules of an application. These flaws can be exploited by attackers to perform unauthorized operations, obtain sensitive information, or damage the system. Unlike traditional security vulnerabilities, such as SQL injection and cross-site scripting, business logic vulnerabilities usually do not involve direct technical attack methods, but rather achieve malicious purposes by abusing or bypassing the intended workflow of the application.

[0003] Existing business logic vulnerability detection technologies based on business logs typically require prior labeling and training of the business logs to identify the results. They also require matching and analysis of the information to be identified in the business logs to determine whether an attack has occurred. However, they can only detect and analyze vulnerabilities that have already been attacked. They cannot perform vulnerability impact analysis from different perspectives or perform autonomous evaluation and optimization of detection results for vulnerabilities that have already occurred. This results in poor performance in tracing the multi-dimensional impact of vulnerabilities that have already occurred and poor performance in autonomous evaluation and optimization of detection results. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent detection method for business logic vulnerabilities, which solves the technical problems of poor traceability analysis of the multidimensional impact of vulnerabilities in existing solutions, and poor self-evaluation and optimization of detection results.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] An intelligent detection method for business logic vulnerabilities includes:

[0007] The newly added business records are monitored and digitized based on business logs to obtain the business logic specification identifier corresponding to the newly added business records. The business records to which they belong are dynamically marked according to the business logic specification identifier to obtain normal business records or abnormal business records.

[0008] Based on the abnormal business records obtained from the analysis, traceability analysis of abnormal logic rules is performed to determine the impact of logical vulnerabilities corresponding to the abnormal logic rules to which the abnormal business records belong and their digital representation.

[0009] Based on business logs, we perform business logic vulnerability coverage analysis on the logic vulnerability impact data obtained from the processing of all newly added business records. Based on the analysis results, we dynamically optimize and manage the business logic rules for the subsequent implementation of the existing business logic vulnerability detection scheme. The dynamic optimization and management of business logic rules includes maintaining the implementation of the existing business logic vulnerability detection scheme, upgrading and optimizing some business logic rules of the existing business logic vulnerability detection scheme for common or special vulnerability types, or upgrading and optimizing the overall business logic rules of the existing business logic vulnerability detection scheme for both common and special vulnerability types.

[0010] Preferably, the business records newly added in real time in the business log are obtained, and the business objects that actively interact with the business in the business records are marked as target business objects, and the business objects that passively interact with the target business objects in the business records are marked as target business interaction objects;

[0011] The interaction content and results of the corresponding business actions between the target business object and the target business interaction object are obtained. The target business interaction object, interaction content and interaction results are sorted and combined to obtain the business sequence to be detected corresponding to the business record. The business logic standard data associated with the business sequence to be detected and the target business object are analyzed through the business logic recognition model, and the business logic specification identifier GF corresponding to the business record is output.

[0012] The business logic specification identifier contains a value of 0 or 1.

[0013] Preferably, the expression for the business logic identification model is: In the formula, [YJk] is the business sequence to be detected corresponding to the business record, k = 1, 2, 3; YJk is YJ1, YJ2, YJ3, which are the target business interaction object, interaction content, and interaction result, respectively; UB is the business logic standard data associated with the target business object;

[0014] Based on the business logic specification identifier with a value of 0, the relevant business record is marked as a normal business record;

[0015] The business record to which the business record belongs is marked as an abnormal business record based on the business logic specification identifier with a value of 1.

[0016] Preferably, the vulnerability type corresponding to the abnormal business record is obtained, and the total number of occurrences of the corresponding regular vulnerability type is incremented by one, or the total number of occurrences of the corresponding special vulnerability type is incremented by one.

[0017] Additionally, based on the abnormal business records, obtain the abnormal logic rules between the target business object and the target business interaction object, obtain all other business objects with the same abnormal logic rules and mark them as verification business objects;

[0018] Perform business logic vulnerability verification and detection on all verification business objects, and count the total number of verification business objects with business logic vulnerabilities in the abnormal logic rules. This is done using the formula... Calculate and analyze the logical vulnerability status value LY corresponding to the relevant abnormal logic rule; where NY and NH are the total number of all verification business objects where the business logic vulnerability exists and the total number of all verification business objects with the same abnormal logic rule, respectively.

[0019] Preferably, if the impact value of a logical vulnerability is 1, then the impact value of the logical vulnerability corresponding to the abnormal logical rule is set to α, and the total number of vulnerabilities in the local business logic is incremented by one; α is the interaction impact coefficient corresponding to the abnormal logical rule.

[0020] If the impact value of a logical vulnerability is not 1, then the impact value of the logical vulnerability corresponding to the abnormal logic rule is set to α×LY, and the total number of vulnerabilities in the local business logic part is incremented by one.

[0021] Preferably, the total number of all newly added business records in the business log and their corresponding marked normal business records and abnormal business records are obtained, and then processed using the formula... Calculate the first vulnerability existence status value LC1 corresponding to all newly added business records; where YY1 is the total number of vulnerabilities in the local business logic; YY2 is the total number of vulnerabilities in the overall business logic; YZ is the total number of all newly added business records; η is the vulnerability type influence correction coefficient, with a value range of (1, 3); β is the standard value of the first vulnerability existence status; and C is a real number greater than 0.

[0022] Preferably, the impact value αi of the logical vulnerabilities corresponding to all the abnormal logical rules is obtained, where i represents different abnormal logical rules, i = 1, 2, 3, ..., n; n is a positive integer representing the total number of abnormal logical rules, and is obtained through the formula... Calculate the second vulnerability existence status value LC2 corresponding to all abnormal logic rules; where μ is the standard value of the second vulnerability existence status.

[0023] Preferably, the vulnerability type coverage value LFj corresponding to different vulnerability types for all business logics is obtained by calculating the first vulnerability existence status value and the second vulnerability existence status value with the total number of occurrences of regular vulnerability types and the total number of occurrences of special vulnerability types using the formula LFj=ω×NLj; where j=1,2; NLj are NL1 and NL2, which are the total number of occurrences of regular vulnerability types and the total number of occurrences of special vulnerability types, respectively; LFj are LF1 and LF2, which are the vulnerability type coverage values ​​corresponding to regular vulnerability types and special vulnerability types, respectively; ω is the overall vulnerability existence impact coefficient, ω=max(LC 1, LC 2); max() means to obtain the maximum value among different real numbers;

[0024] The vulnerability type coverage values ​​calculated for different vulnerability types are sorted and combined to obtain a vulnerability type coverage monitoring sequence.

[0025] Preferably, data analysis is performed on the vulnerability type coverage regulatory sequence to determine the vulnerability detection status corresponding to the business logic and to implement targeted business logic vulnerability detection management.

[0026] Preferably, if the vulnerability type covers no more than 1 element in the regulatory sequence, the existing business logic vulnerability detection scheme will continue to be implemented.

[0027] If the vulnerability type covers more than 1 element in the regulatory sequence, then the existing business logic vulnerability detection scheme will be upgraded and optimized by implementing some business logic rules for regular vulnerability types or special vulnerability types.

[0028] If all elements in the regulatory sequence that the vulnerability type covers are greater than 1, then the existing business logic vulnerability detection scheme will be upgraded and optimized in terms of the overall business logic rules for both regular and special vulnerability types.

[0029] Compared to existing solutions, the beneficial effects achieved by this invention are:

[0030] This invention monitors and digitizes newly added business records based on business logs, obtaining the business logic specification identifier corresponding to the newly added business record. It realizes the digital representation of the business logic specification corresponding to the newly added business record, and dynamically marks the business record according to the business logic specification identifier to obtain normal or abnormal business records. It can not only obtain the specification type corresponding to the business record, but also provide reliable single-time monitoring data support for subsequent data analysis of different aspects of business logic vulnerabilities.

[0031] This invention performs traceability analysis of abnormal logic rules based on the abnormal business records obtained through analysis, determines the impact of logical vulnerabilities corresponding to the abnormal logic rules to which the abnormal business records belong, and digitally represents them. It realizes the extended analysis and digital processing representation of abnormal logic rules for abnormal business records marked in the previous analysis, and can provide reliable mining and analysis data support for multi-dimensional analysis of business logic vulnerability coverage of logical vulnerability impact data.

[0032] This invention performs business logic vulnerability coverage analysis on different aspects of the logic vulnerability impact data obtained from the processing of all newly added business records. Based on the analysis results, it dynamically optimizes and manages the business logic rules for the subsequent implementation of the existing business logic vulnerability detection scheme. This enables the overall-dimensional expansion analysis of the local vulnerability monitoring and analysis data from the early stage, improves the effect of multi-dimensional impact tracing analysis of existing vulnerabilities, and enhances the self-evaluation and optimization effect of detection results. Attached Figure Description

[0033] The invention will now be further described with reference to the accompanying drawings.

[0034] Figure 1 This is a flowchart of an intelligent detection method for business logic vulnerabilities according to the present invention.

[0035] Figure 2 This is a flowchart illustrating the data analysis and digitization of the impact value of logical vulnerabilities in this invention. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] like Figure 1 As shown, this invention is an intelligent detection method for business logic vulnerabilities, comprising:

[0038] New business records are monitored and digitized based on business logs to obtain the corresponding business logic specification identifier. This identifier is then used to dynamically mark the associated business records, identifying them as normal or abnormal. This includes:

[0039] Retrieve newly added business records from the business log in real time, and mark the business objects that actively interact with the business objects in the business records as target business objects, and mark the business objects that passively interact with the target business objects in the business records as target business interaction objects;

[0040] The specific business operations can be determined based on the actual application requirements of the specific application scenario, such as the XX management system. Real-time updated business records in the business log refer to information automatically generated and recorded by the system whenever a specific business activity or event occurs during system operation. These records typically contain key details about the business operation, such as operation time, executing user, operation type, and involved data. For example, if business A requests action processing on business B, then business A is the target business object, and business B is the target business interaction object.

[0041] The system obtains the interaction content and results of the corresponding business actions between the target business object and the target business interaction object. It sorts and combines the target business interaction object, interaction content, and interaction results. Specifically, the interaction content can be that business A requests business B to add, delete, or modify data C. The interaction result can be that the request is successfully processed or the request fails. The system obtains the business sequence to be detected corresponding to the business record, and performs data analysis on the business logic standard data associated with the business sequence to be detected and the target business object through the business logic identification model. It outputs the business logic specification identifier GF corresponding to the business record.

[0042] The expression for the business logic identification model is as follows: In the formula, [YJk] is the business sequence to be detected corresponding to the business record, k = 1, 2, 3; YJk is YJ1, YJ2, YJ3, which are the target business interaction object, interaction content, and interaction result, respectively; UB is the business logic standard data associated with the target business object, which is determined according to the business logic design data of the target business object.

[0043] Business logic specification identifiers are used to calculate the business interaction data between the target business object and the target business interaction object, so as to digitally represent the corresponding single business logic specification state.

[0044] Business logic specification identifiers contain values ​​of 0 or 1;

[0045] A business logic specification identifier with a value of 0 indicates the business logic specification of the corresponding business record;

[0046] A business logic specification flag with a value of 1 indicates that the business logic of the corresponding business record is not standardized.

[0047] Based on the business logic specification identifier with a value of 0, the relevant business record is marked as a normal business record;

[0048] The relevant business record is marked as an abnormal business record based on the business logic specification identifier with a value of 1.

[0049] In this embodiment of the invention, new business records are monitored and digitized based on business logs to obtain the business logic specification identifier corresponding to the new business record. This realizes the digital representation of the business logic specification corresponding to the new business record, and dynamically marks the business record according to the business logic specification identifier to obtain normal or abnormal business records. This not only obtains the specification type corresponding to the business record, but also provides reliable single-time monitoring data support for subsequent data analysis of different aspects of business logic vulnerabilities.

[0050] Based on the abnormal business records obtained from the analysis, a retrospective analysis of the abnormal logic rules is performed to determine the impact of the logical vulnerabilities corresponding to the abnormal logic rules to which the abnormal business records belong, and their digital representation; including:

[0051] Obtain the vulnerability type corresponding to the abnormal business record, and increment the total number of occurrences of the corresponding common vulnerability type by one, or increment the total number of occurrences of the corresponding special vulnerability type by one.

[0052] The vulnerability types include common vulnerability types and special vulnerability types; common vulnerability types refer to common vulnerabilities that were not considered in the business logic design; special vulnerability types refer to novel vulnerabilities that were not considered in the business logic design; the vulnerability type corresponding to the abnormal business record shall be reviewed and determined by the business logic designer.

[0053] Furthermore, based on the abnormal business records, obtain the abnormal logic rules between the target business object and the target business interaction object, obtain all other business objects with the same abnormal logic rules and mark them as verification business objects; it is understandable that the logic rules are used by several business objects, and when the logic rules are abnormal, it is necessary to further actively expand and analyze other potential logical vulnerabilities of the same abnormal logic rules.

[0054] Perform business logic vulnerability verification and detection on all verification business objects, and count the total number of verification business objects with business logic vulnerabilities in the abnormal logic rules. This is done using the formula... Calculate and analyze the logical vulnerability status value LY corresponding to the relevant abnormal logic rule; where NY and NH are the total number of all verification business objects where the business logic vulnerability exists and the total number of all verification business objects with the same abnormal logic rule, respectively.

[0055] like Figure 2 As shown, if the impact value of a logical vulnerability is 1, then the impact value of the logical vulnerability corresponding to the abnormal logical rule is set to α, and the total number of vulnerabilities in the local business logic is incremented by one; α is the interaction impact coefficient corresponding to the abnormal logical rule. The interaction impact coefficient is determined by professionals in this field based on design requirements data and historical business data. The interaction impact coefficient is used to digitally represent the interaction impact corresponding to the abnormal logical rule.

[0056] If the impact value of a logical vulnerability is not 1, then set the impact value of the logical vulnerability corresponding to the abnormal logic rule to α×LY, and add one to the total number of vulnerabilities in the local business logic part.

[0057] In this embodiment of the invention, the abnormal business records obtained through analysis are used to trace and analyze the abnormal logic rules, determine the impact of the logical vulnerabilities corresponding to the abnormal logic rules to which the abnormal business records belong, and their digital representation. This enables the extended analysis and digital processing representation of the abnormal business records marked in the previous analysis, and can provide reliable mining and analysis data support for the multi-dimensional analysis of the business logic vulnerability coverage of the data affected by logical vulnerabilities.

[0058] Based on business logs, we perform business logic vulnerability coverage analysis on the logic vulnerability impact data obtained from the processing of all newly added business records, and dynamically optimize and manage the business logic rules for the subsequent implementation of the existing business logic vulnerability detection scheme based on the analysis results; including:

[0059] Retrieve all newly added business records in the business log, along with the total number of normal business records and the total number of abnormal business records marked thereon, and then use the formula... Calculate the first vulnerability existence status value LC1 corresponding to all newly added business records; where YY1 is the total number of vulnerabilities in the local business logic; YY2 is the total number of vulnerabilities in the overall business logic; YZ is the total number of all newly added business records; η is the vulnerability type impact correction coefficient, with a value range of (1, 3), specifically 1.514; β is the standard value of the first vulnerability existence status, determined based on the previous business logic vulnerability design requirements data, or based on the previous security test data; C is a real number greater than 0, specifically 0.95;

[0060] Furthermore, obtain the impact value αi of the logical vulnerabilities corresponding to all the abnormal logical rules that occur, where i represents different abnormal logical rules, i = 1, 2, 3, ..., n; n is a positive integer representing the total number of abnormal logical rules, and obtain the impact value αi of the logical vulnerabilities corresponding to all the abnormal logical rules that occur, and obtain the impact value αi of the logical vulnerabilities corresponding to all the abnormal logical rules ... where i represents different abnormal logical rules, i = 1, 2, 3, ..., n; n is a positive integer representing the total number of abnormal logical rules, and obtain the impact value αi of the logical vulnerabilities corresponding to all the abnormal logical rules, and obtain the impact value αi of the logical vulnerabilities Calculate the second vulnerability existence status value LC2 corresponding to all abnormal logic rules; where μ is the standard value of the second vulnerability existence status, which is determined based on the previous business logic vulnerability design requirements data or the previous security test data, and μ > β.

[0061] It should be noted that the first vulnerability existence status value and the second vulnerability existence status value are used to calculate the logical vulnerability data corresponding to all abnormal logical rules from different aspects, so as to digitally represent the overall logical vulnerability impact.

[0062] The vulnerability type coverage value LFj corresponding to different vulnerability types for all business logics is obtained by calculating the first vulnerability existence status value, the second vulnerability existence status value, the total number of occurrences of regular vulnerability types, and the total number of occurrences of special vulnerability types using the formula LFj=ω×NLj; where j=1,2; NLj are NL1 and NL2, which are the total number of occurrences of regular vulnerability types and the total number of occurrences of special vulnerability types, respectively; LFj are LF1 and LF2, which are the vulnerability type coverage values ​​corresponding to regular vulnerability types and special vulnerability types, respectively; ω is the overall vulnerability existence impact coefficient, ω=max(LC 1, LC 2); max() means to get the maximum value among different real numbers;

[0063] It should be noted that the vulnerability type coverage value is used to calculate the impact of different vulnerability types on the overall logical vulnerability data, so as to digitally represent the impact of different vulnerability types on the logical vulnerability.

[0064] The vulnerability type coverage values ​​calculated for different vulnerability types are sorted and combined to obtain a vulnerability type coverage monitoring sequence.

[0065] Data analysis is performed on the vulnerability type coverage of the regulatory sequence to determine the vulnerability status corresponding to the business logic and to implement targeted business logic vulnerability detection management.

[0066] If the vulnerability type covers no more than 1 element in the regulatory sequence, then the vulnerability detection coverage is normal, and the existing business logic vulnerability detection scheme is maintained.

[0067] If there are more than 1 elements in the regulatory sequence that cover vulnerability types, a slightly abnormal vulnerability detection state is generated, and the existing business logic vulnerability detection scheme is upgraded and optimized for some business logic rules of regular vulnerability types or special vulnerability types. The upgrade and optimization of some business logic rules of regular vulnerability types or special vulnerability types is determined according to the vulnerability type to which the element in the regulatory sequence that covers vulnerability types belongs.

[0068] If all elements in the vulnerability type coverage regulatory sequence are greater than 1, a severe abnormal state of vulnerability detection coverage is generated, and the existing business logic vulnerability detection scheme is upgraded and optimized in terms of the overall business logic rules for both regular and special vulnerability types.

[0069] In addition, upgrading and optimizing some business logic rules can supplement and add targeted logic rules for abnormal vulnerability types; upgrading and optimizing the overall business logic rules can supplement and add comprehensive logic rules for all vulnerability types.

[0070] In this embodiment of the invention, by performing business logic vulnerability coverage analysis on the logic vulnerability impact data obtained from the processing of all newly added business records, and by dynamically optimizing and managing the business logic rules for the subsequent implementation of the existing business logic vulnerability detection scheme based on the analysis results, the overall dimension of the local vulnerability monitoring and analysis data in the early stage is expanded, which improves the effect of multi-dimensional impact tracing analysis of the vulnerabilities that have occurred and the effect of autonomous evaluation and optimization of the detection effect.

[0071] Furthermore, the formulas mentioned above are all numerical calculations obtained by removing dimensions and using simulation software to obtain a formula that is closest to the real situation, based on the collection of a large amount of data.

[0072] In the several embodiments provided by this invention, it should be understood that the disclosed methods can be implemented in other ways. For example, the embodiments of the invention described above are merely illustrative; for example, the division of modules is only a logical functional division, and there may be other division methods in actual implementation.

[0073] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0074] Furthermore, the functional modules in the various embodiments of this invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in a combination of hardware and software functional modules.

[0075] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the essential characteristics of the present invention.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for intelligent detection of business logic vulnerabilities, the method comprising: Comprise: Based on the business log to supervise and digitize the newly added business records, get the business logic specification identifier corresponding to the newly added business records, and dynamically mark the business records according to the business logic specification identifier, get the normal business records or abnormal business records; According to the analysis of the obtained abnormal business records, the trace analysis of the abnormal logic rule is carried out, and the logical vulnerability influence corresponding to the abnormal business records is determined and digitally represented; Based on the business log, the logical vulnerability influence data obtained by processing all the newly added business records is analyzed in different aspects, and the subsequent implementation of the existing business logic vulnerability detection scheme is dynamically optimized and managed according to the analysis result; The dynamic optimization management of business logic rules includes maintaining the implementation of the existing business logic vulnerability detection scheme, upgrading and optimizing part of the business logic rules of the existing business logic vulnerability detection scheme for regular vulnerability types or special vulnerability types, or upgrading and optimizing the whole business logic rules of the existing business logic vulnerability detection scheme for regular vulnerability types and special vulnerability types; Wherein, the total number of normal business records and the total number of abnormal business records corresponding to all newly added business records in the business log are obtained, and the formula The first vulnerability existence state value LC1 corresponding to all newly added business records is calculated; in the formula, YY1 is the total number of local business logic vulnerabilities; YY2 is the total number of overall business logic vulnerabilities; YZ is the total number of all newly added business records; η is a vulnerability type influence correction coefficient, the value range is (1, 3); β is a first vulnerability existence state standard value; C is a real number greater than 0. Obtaining the logical vulnerability influence value αi of all abnormal logical rules corresponding to the abnormal logic rule, i is different, i = 1, 2, 3,..., n; n is a positive integer, representing the total number of abnormal logical rules, and through the formula Calculate the second vulnerability existence state value LC2 corresponding to all abnormal logical rules; wherein, μ is the second vulnerability existence state standard value; The first vulnerability existing state value and the second vulnerability existing state value are combined with the total number of general vulnerability types and the total number of special vulnerability types by the formula The vulnerability type coverage values LFj corresponding to all business logics and different vulnerability types are calculated; in the formula, j=1, 2; NLj is NL1 and NL2, which are respectively the total number of general vulnerability types and the total number of special vulnerability types; LFj is LF1 and LF2, which are respectively the vulnerability type coverage values corresponding to general vulnerability types and special vulnerability types; ω is an overall vulnerability existing influence coefficient, ; max() represents obtaining the maximum value in different real numbers; Sort and combine the vulnerability type coverage values calculated for different vulnerability types to obtain a vulnerability type coverage supervision sequence; Data analysis is performed on the vulnerability type coverage supervision sequence, if the elements in the vulnerability type coverage supervision sequence are all less than 1, the implementation of the existing business logic vulnerability detection scheme is maintained; If there is an element greater than 1 in the vulnerability type coverage supervision sequence, upgrade and optimize part of the business logic rules of the existing business logic vulnerability detection scheme for regular vulnerability types or special vulnerability types; If the elements in the vulnerability type coverage supervision sequence are all greater than 1, upgrade and optimize the whole business logic rules of the existing business logic vulnerability detection scheme for regular vulnerability types and special vulnerability types.

2. The method of claim 1, wherein, Get the real-time newly added business records in the business log, and mark the business objects in the business records that actively interact with the target business objects as target business objects, and mark the business objects in the business records that passively interact with the target business objects as target business interaction objects; Get the interaction content and interaction result of the target business object and the target business interaction object corresponding to the business action, sort and combine the target business interaction object, the interaction content and the interaction result to obtain the business record corresponding to the business sequence to be detected, and analyze the business logic standard data associated with the target business object through the business logic identification model. The business logic specification identifier GF corresponding to the business record is output; Wherein, the business logic specification identifier contains 0 or 1 value.

3. The method of claim 2, wherein the method further comprises: The expression of the business logic identification model is ; in the formula, [YJk] is a business record corresponding to a to-be-detected business sequence, k=1, 2, 3; YJk is YJ1, YJ2, YJ3, which are respectively a target business interaction object, an interaction content, and an interaction result; UB is a business logic standard data associated with the target business object. According to the business logic specification identifier with value 0, the business record is marked as a normal business record; According to the business logic specification identifier with value 1, the business record is marked as an abnormal business record.

4. The method of claim 3, wherein the method further comprises: Get the vulnerability type corresponding to the abnormal business record, and add one to the total number of corresponding regular vulnerability types or add one to the total number of corresponding special vulnerability types according to the vulnerability type; And, according to the abnormal business record, the abnormal logic rule between the target business object and the target business interaction object is obtained, all other business objects of the same abnormal logic rule are obtained and marked as verification business objects; The business logic vulnerability checking detection is performed on all the checking business objects, the total number of all the checking business objects with the abnormal logic rules having the business logic vulnerability is counted, and the formula The logic vulnerability state value LY corresponding to the abnormal logic rule is calculated and analyzed; in the formula, NY and NH are respectively the total number of all the checking business objects with the business logic vulnerability and the total number of all the checking business objects with the same abnormal logic rule.

5. The method of claim 4, wherein the method further comprises: If the logic vulnerability influence value is 1, the logic vulnerability influence value corresponding to the abnormal logic rule is set as α, and the total number of local business logic overall vulnerabilities is increased by 1; α is the interaction influence coefficient corresponding to the abnormal logic rule; If the logic vulnerability influence value is not 1, the logic vulnerability influence value corresponding to the abnormal logic rule is set as α×LY, and the total number of local business logic partial vulnerabilities is increased by 1.

Images