Method, apparatus, equipment, and storage medium for detecting unknown cross-site scripting based on test scripts.

Abstract

This application provides a method and apparatus for detecting unknown cross-site scripting (XSS) based on test script generation. It innovatively constructs a Markov chain-driven script generation mechanism and achieves intelligent construction of test scripts through atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test script through dynamic updating and convergence calculation of the state transition matrix. This method effectively addresses the shortcomings of traditional techniques in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown XSS.

Description

Technical Field

[0001] This application relates to the field of data processing, specifically to a method and apparatus for detecting unknown cross-site scripting based on test scripts. Background Technology

[0002] Existing cross-site scripting (XSS) security detection methods have significant shortcomings. Traditional systems lack intelligence in test script generation, making it difficult to effectively simulate attacker behavior patterns and affecting detection coverage.

[0003] Furthermore, existing technologies suffer from bottlenecks in filtering mechanism analysis. Most systems fail to fully utilize response page information and lack a differential comparison mechanism based on the document object model, resulting in insufficient accuracy in filtering rule recognition.

[0004] The existing system has technical shortcomings in script optimization. It lacks the ability to dynamically adjust the script generation process and struggles to adaptively optimize testing strategies through matrix operations, thus impacting detection effectiveness. Solving these problems is crucial for improving security detection capabilities. Summary of the Invention

[0005] To address the problems in the existing technology, this application provides a method and apparatus for detecting unknown cross-site scripts based on test script generation. This method can effectively solve the shortcomings of traditional technologies in script generation, filtering analysis, and optimization, and significantly improve the detection effect of unknown cross-site scripts.

[0006] To solve at least one of the above problems, this application provides the following technical solution:

[0007] Firstly, this application provides a method for detecting unknown cross-site scripting based on test scripts, including:

[0008] Script samples are collected from historical vulnerability databases, and the script samples are decomposed into atomic element sequences. The transition probabilities between adjacent elements in the atomic element sequences are calculated using a third-order Markov chain. The transition probabilities are input into a smoothing algorithm to process low-frequency combinations, generating a probability transition matrix. A state transition matrix is ​​constructed, and the state transition matrix is ​​traversed using a random walk strategy. Paths in the state transition matrix with transition probabilities below a threshold are weighted and sampled. Unicode obfuscation characters and unconventional syntax structures are injected to generate test scripts. The test scripts are then subjected to syntax tree verification to ensure that the test scripts are parseable.

[0009] The test script is submitted to the analysis server to collect response page information. Content deletion markers, character encoding replacement markers, and keyword interception markers are extracted from the response page information. Filtering elements are determined based on the content deletion markers, character encoding replacement markers, and keyword interception markers. Document object model tree difference comparison is performed on the response page information to locate the removed node. Filtered characters are extracted from the removed node, a correction matrix is ​​constructed, and the main diagonal elements corresponding to the filtered characters in the correction matrix are set to zero.

[0010] The probability transition matrix and the correction matrix are multiplied element-wise to update the state transition matrix. The test script is regenerated based on the updated state transition matrix. The test script is submitted to the analysis server to obtain response page information. The matrix update and script generation operations are repeated until the state transition matrix converges, and the final test script is output.

[0011] Furthermore, it also includes: deploying data collection nodes to access the historical vulnerability database, collecting cross-site scripting vulnerability samples, parsing the cross-site scripting vulnerability samples according to syntax rules, extracting keywords, operators, function calls and syntax structures, mapping the keywords, operators, function calls and syntax structures to atomic elements, and constructing a sequence of atomic elements according to the execution order;

[0012] A third-order Markov chain model is established for each atomic element in the atomic element sequence. The co-occurrence frequency between adjacent atomic elements is counted, and the conditional probability is calculated as the transition probability. The transition probability is input into the Kneser-Ney smoothing algorithm. For combinations with transition probabilities below a threshold, interpolation processing is performed. A probability transition matrix is ​​constructed based on the smoothed transition probabilities.

[0013] Furthermore, it also includes: constructing a state transition matrix based on the probability transition matrix; starting from the initial state node of the state transition matrix, performing a random walk according to the transition probability distribution; recording the sequence of state nodes in the walk path; setting a transition probability threshold; assigning weight coefficients to state nodes with transition probabilities lower than the transition probability threshold; and adjusting the sampling probability according to the weight coefficients.

[0014] The state node sequence is converted into an atomic element sequence. Unicode character encoding and non-standard syntax structures are injected into the atomic element sequence to generate an initial test script. An abstract syntax tree parser is constructed, and the initial test script is input into the abstract syntax tree parser for syntax checking. Test scripts that fail the syntax check are corrected to generate the final test script.

[0015] Furthermore, it also includes: encapsulating the test script into a request message according to the HTTP protocol, submitting the request message through the application interface provided by the server, receiving the response message, parsing the response message to obtain the response page information, and extracting the HTTP status code, response header fields and response body content from the response page information;

[0016] The response body content is subjected to string matching to detect whether the original submitted content has been deleted. The character encoding type in the response header field is analyzed and compared with the original encoding to determine whether a replacement has occurred. Based on the HTTP status code, keyword interception is identified. The content deletion mark, the character encoding replacement information and the keyword interception information are integrated into the filter element judgment result.

[0017] Furthermore, it also includes: parsing the response page information using a document object model (DOM) to construct a DOM tree; traversing the DOM tree and the DOM tree of the original submitted content to calculate the structural similarity and content similarity of the nodes; determining the node matching relationship based on the weighted score of the structural similarity and the content similarity; marking unmatched nodes as removed nodes; and extracting filtered characters from the attributes and text content of the removed nodes.

[0018] Construct an identity matrix with the same dimension as the state transition matrix as the correction matrix. Iterate through the filtered characters, locate the main diagonal element corresponding to the filtered character in the correction matrix, modify the value of the main diagonal element to zero, keep the values ​​of other elements unchanged, and generate the final correction matrix.

[0019] Furthermore, it also includes: performing Hadamard product operation on the probability transition matrix and the correction matrix according to the corresponding positions, normalizing each matrix element to generate an updated probability transition matrix, constructing a new state transition matrix based on the updated probability transition matrix, calculating the out-degree and in-degree of each state node in the new state transition matrix, and marking state nodes with an out-degree or in-degree of zero as invalid nodes.

[0020] The invalid nodes and their associated transition paths are removed from the new state transition matrix. Random walk sampling is performed again among the remaining valid state nodes to generate a state node sequence. The state node sequence is converted into an atomic element sequence, Unicode character encoding and non-standard syntax structure are added, and a new test script is generated after syntax tree verification.

[0021] Furthermore, it also includes: submitting the new test script to the analysis server, obtaining response page information, extracting filter elements, constructing a new correction matrix, performing Hadamard product operation on the new correction matrix and the probability transition matrix and normalizing the result, calculating the Frobenius norm of the current state transition matrix and the previous state transition matrix, and recording the matrix convergence state.

[0022] The convergence state of the state transition matrix is ​​judged. When the difference in Frobenius norm between the two rounds of state transition matrices is less than a preset threshold, the iteration stops. Otherwise, the test script is regenerated based on the current state transition matrix and the iteration continues. The test script generated in the last round is used as the final output result.

[0023] Secondly, this application provides an unknown cross-site scripting security detection device based on a test script, comprising:

[0024] The script processing module is used to collect script samples from the historical vulnerability database, decompose the script samples into atomic element sequences, calculate the transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, input the transition probabilities into a smoothing algorithm to process low-frequency combinations, generate a probability transition matrix, construct a state transition matrix, traverse the state transition matrix using a random walk strategy, perform weighted sampling on paths in the state transition matrix with transition probabilities below a threshold, inject Unicode obfuscation characters and unconventional syntax structures, generate a test script, and perform syntax tree verification on the test script to ensure that the test script can be parsed.

[0025] The script analysis module is used to submit the test script to the analysis server, collect response page information, extract content deletion markers, character encoding replacement markers and keyword interception markers from the response page information, determine filtering elements based on the content deletion markers, character encoding replacement markers and keyword interception markers, perform document object model tree difference comparison on the response page information, locate the removed node, extract the filtered characters from the removed node, construct a correction matrix, and set the main diagonal elements of the correction matrix corresponding to the filtered characters to zero.

[0026] The security detection module is used to perform element-wise multiplication of the probability transition matrix and the correction matrix, update the state transition matrix, regenerate the test script based on the updated state transition matrix, submit the test script to the analysis server to obtain response page information, repeat the matrix update and script generation operations until the state transition matrix converges, and output the final test script.

[0027] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the unknown cross-site scripting security detection method based on test script generation.

[0028] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the unknown cross-site scripting security detection method based on test script generation.

[0029] Fifthly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the unknown cross-site scripting security detection method based on test script generation.

[0030] As described above, this application provides a method and apparatus for detecting unknown cross-site scripting (XSS) based on test script generation. It innovatively constructs a Markov chain-driven script generation mechanism and achieves intelligent construction of test scripts through atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test script through dynamic updating and convergence calculation of the state transition matrix. This method effectively solves the shortcomings of traditional techniques in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown XSS. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating the unknown cross-site scripting security detection method based on test script generation in this application embodiment;

[0033] Figure 2 This is a structural diagram of the unknown cross-site script security detection device based on test script generation in the embodiments of this application;

[0034] Figure 3 This is a schematic diagram of the structure of the electronic device in the embodiments of this application.

[0035] Figure label:

[0036] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver storage unit 9144, antenna 9111, speaker 9131, microphone 9132. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0039] To address the problems existing in current technologies, this application provides a method and apparatus for detecting unknown cross-site scripting (XSS) based on test script generation. It innovatively constructs a Markov chain-driven script generation mechanism and achieves intelligent construction of test scripts through atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test script through dynamic updating and convergence calculation of the state transition matrix. This method effectively solves the shortcomings of traditional technologies in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown XSS.

[0040] To effectively address the shortcomings of traditional technologies in script generation, filtering analysis, and optimization, and to significantly improve the effectiveness of unknown cross-site script detection, this application provides an embodiment of an unknown cross-site script security detection method based on test script generation. See [link to embodiment]. Figure 1 The method for detecting unknown cross-site scripting based on test scripts specifically includes the following:

[0041] Step S101: Collect script samples from the historical vulnerability database, decompose the script samples into atomic element sequences, calculate the transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, input the transition probabilities into a smoothing algorithm to process low-frequency combinations, generate a probability transition matrix, construct a state transition matrix, traverse the state transition matrix using a random walk strategy, perform weighted sampling on paths in the state transition matrix with transition probabilities below a threshold, inject Unicode obfuscation characters and unconventional syntax structures, generate a test script, and perform syntax tree verification on the test script to ensure that the test script can be parsed;

[0042] Optionally, this embodiment addresses the issues of insufficient intelligence and mutation capabilities in traditional XSS detection script generation by innovatively designing a test script generation scheme based on Markov chains and random walks. During script construction, this embodiment designs an element transition probability calculation formula: P(ei|ei-3,ei-2,ei-1)=[Count(ei-3,ei-2,ei-1,ei)+δ] / [Count(ei-3,ei-2,ei-1)+δ×V], where ei represents the current element, Count represents the number of occurrences in the sequence, δ is a smoothing factor, and V is the vocabulary size. This context-based probability calculation method can accurately capture the dependencies between script elements.

[0043] This embodiment deeply optimizes the script sample processing strategy. By deploying distributed data collection nodes, the system continuously collects XSS vulnerability samples from major vulnerability databases and security platforms. During sample parsing, an improved lexical analyzer is used to decompose JavaScript code into the smallest semantic units. These atomic elements include keywords (such as "alert", "eval"), operators (such as "+=", "?:"), function calls (such as "document.write"), and special syntax structures (such as arrow functions, template strings). The sample parsing process not only considers standard JavaScript syntax but also various non-standard attack payload variants.

[0044] This embodiment innovatively implements three-order Markov chain modeling. Compared to traditional one-order or two-order models, three-order Markov chains can capture longer contextual dependencies, and the generated scripts are more consistent with real-world attack scenarios. During transition probability calculation, the system not only counts the co-occurrence frequency of directly adjacent elements but also considers the semantic validity of element combinations. For example, when encountering function calls, the system pays special attention to the completeness of the parameter list; when processing conditional statements, it ensures the closure of branch structures.

[0045] This embodiment addresses the data sparsity problem using the Kneser-Ney smoothing algorithm. Traditional methods often assign zero probability to low-frequency or unseen element combinations, resulting in a lack of variability in the generated script. This embodiment achieves a more reasonable probability distribution by reducing higher-order context and supplementing lower-order context. The smoothed transition probabilities support novel element combinations while maintaining syntactic rationality.

[0046] This embodiment establishes a complete state transition framework. Based on the smoothed probability matrix, the system constructs a multidimensional state transition network. Each network node represents an atomic element state, and the edge weights between nodes reflect the transition probabilities. During the random walk, the system employs an improved Metropolis-Hastings algorithm, balancing exploration and exploitation by adjusting the acceptance probability. For paths with transition probabilities below a threshold, the system increases their sampling chances through dynamic weight adjustments, thereby discovering potential bypass methods.

[0047] This embodiment enhances the script's mutation capabilities through Unicode obfuscation and unconventional syntax injection. After generating the base script, the system selectively inserts Unicode character encodings, such as converting "alert" to "\u0061\u006c\u0065\u0072\u0074". Simultaneously, the system injects non-standard but effective syntax structures, such as tag splitting and attribute pollution. These mutation operations significantly improve the script's ability to bypass WAF detection.

[0048] This embodiment ensures script validity through Abstract Syntax Tree (AST) validation. The generated test script is first converted into an AST, and the system checks the integrity of the tree structure and the correctness of the syntax. For scripts that fail validation, the system analyzes the reasons for the failure and makes corrections, such as adding missing parentheses and fixing syntax errors. This rigorous validation mechanism ensures the executability of the generated script.

[0049] This embodiment improves the quality of script generation through multiple optimization measures. Targeted optimizations were performed at every stage, from sample collection to script generation, ensuring that the generated test scripts are both highly offensive and maintain a high success rate. This intelligent script generation solution provides strong technical support for XSS vulnerability detection in web applications.

[0050] This embodiment provides high-quality test samples for subsequent vulnerability verification. Through Markov chain modeling and a random walk strategy, the system can continuously generate novel test scripts, effectively supporting the discovery of unknown XSS vulnerabilities. This script generation method based on a probabilistic model significantly improves the coverage and accuracy of vulnerability detection.

[0051] Step S102: Submit the test script to the analysis server, collect response page information, extract content deletion markers, character encoding replacement markers and keyword interception markers from the response page information, determine filtering elements based on the content deletion markers, character encoding replacement markers and keyword interception markers, perform document object model tree difference comparison on the response page information, locate the removed node, extract the filtered characters from the removed node, construct a correction matrix, and set the main diagonal elements of the correction matrix corresponding to the filtered characters to zero;

[0052] Optionally, this embodiment addresses the problems of difficult filtering rule identification and inaccurate feature extraction in cross-site scripting (XSS) protection mechanisms for web applications by innovatively designing a filtering feature identification scheme based on response analysis and DOM tree difference. In the response analysis process, this embodiment designs a filtering feature scoring formula: Filter_Score=α×(Content_Delete×Weight_c)+β×(Encoding_Change×Weight_e)+γ×(Keyword_Block×Weight_k), where Content_Delete represents the degree of content deletion, Encoding_Change represents the degree of encoding change, Keyword_Block represents the degree of keyword blocking, Weight represents the corresponding weight, and α, β, and γ are scenario adjustment factors.

[0053] This embodiment deeply optimizes the request submission and response collection strategies. By constructing standard HTTP request messages, the test script is encapsulated within the request parameters, and necessary request header fields, such as Content-Type and Accept-Encoding, are added. During request sending, a complete error handling and retry mechanism is implemented to ensure that the test script can be reliably submitted to the analysis server. The response collection stage adopts a streaming processing approach, capable of handling large-scale response data. This embodiment designs a response integrity verification formula: Integrity_Score = (Header_Match × Body_Complete) / (Error_Count + ε), where Header_Match represents the response header matching degree, Body_Complete is the response body integrity degree, Error_Count is the error count, and ε is a smoothing factor.

[0054] This embodiment innovatively implements a multi-dimensional filtering feature extraction mechanism. In content deletion marker analysis, an improved longest common subsequence algorithm is used to compare the original script and response content, accurately locating the deleted content fragments. For character encoding replacement detection, not only the Content-Type field is analyzed, but the actual encoding of the response body is also parsed, and encoding conversion is identified through encoding normalization processing. In keyword interception analysis, multi-level interception judgment rules are established by combining HTTP status codes and response content features to improve detection accuracy.

[0055] This embodiment achieves accurate node change identification through DOM tree difference comparison. The system first normalizes the response page, processing HTML entity encoding, standardizing tag formats, and constructing a standard DOM tree structure. During node traversal, an improved tree edit distance algorithm is used, considering both the structural and attribute features of nodes to achieve accurate node matching. For nodes that fail to match, the system deeply analyzes their contextual relationships to ensure accurate identification of node removal due to filtering.

[0056] This embodiment establishes a complete mechanism for extracting filtered characters. By analyzing the attributes and content of the removed nodes, the system can identify the specific character sequence that triggered the filtering. During the character extraction process, not only complete tags and attributes are considered, but also special content such as JavaScript code snippets and event handlers are analyzed to ensure comprehensive filtering features are obtained. These features are then used to construct a correction matrix to guide the subsequent script generation process.

[0057] This embodiment implements the mathematical expression of filtering features through a correction matrix. The system constructs an identity matrix with the same dimension as the state transition matrix, mapping the extracted filtering characters to the main diagonal positions of the matrix. By setting the corresponding elements to zero, the system achieves precise suppression of specific transition paths, avoiding the repeated use of known invalid character combinations in subsequent generation processes. This matrix-based feature representation provides a reliable mathematical foundation for subsequent script optimization.

[0058] This embodiment combines character-level and structure-level analysis techniques, improving feature extraction accuracy while optimizing computational efficiency. Multi-dimensional response analysis ensures the integrity of filtered features, and DOM tree difference comparison provides precise structural change information. This comprehensive feature analysis scheme demonstrates excellent recognition performance and processing capabilities in practical applications.

[0059] This embodiment provides a reliable basis for optimizing subsequent script generation. Through accurate filtering feature identification, the system can more effectively adjust the script generation strategy, improving testing efficiency. This adaptive optimization method based on precise feedback provides strong technical support for the detection of unknown cross-site scripts.

[0060] This embodiment achieves a precise mapping from filtering features to generation strategies by constructing a correction matrix. This mathematical feature representation not only facilitates subsequent matrix operations but also provides a quantifiable optimization basis for the entire detection process, significantly improving the scientific rigor and effectiveness of the detection scheme.

[0061] Step S103: Perform element-wise product operation on the probability transition matrix and the correction matrix to update the state transition matrix. Regenerate the test script based on the updated state transition matrix. Submit the test script to the analysis server to obtain response page information. Repeat the matrix update and script generation operations until the state transition matrix converges and output the final test script.

[0062] Optionally, this embodiment addresses the problems of low script optimization efficiency and poor convergence in cross-site scripting (XSS) detection of web applications by innovatively designing a test script optimization scheme based on matrix iteration. During matrix operations, this embodiment designs a convergence criterion formula for the state transition matrix: Convergence_Score = ||M_current - M_previous||_F / ||M_previous||_F, where M represents the state transition matrix and ||·||_F represents the Frobenius norm. This formula is used to evaluate the relative change of the matrix between two adjacent iterations. When Convergence_Score is less than a preset threshold, the matrix is ​​considered to have reached convergence.

[0063] This embodiment deeply optimizes the matrix update strategy. Through Hadamard product operations, the system achieves exact corresponding multiplication of the probability transition matrix and the correction matrix. This element-wise product operation accurately reflects the impact of filtering features on the transition probability. During matrix normalization, this embodiment designs a weight adjustment formula: Adjusted_Weight = (Original_Weight × Filter_Factor) / Row_Sum, where Original_Weight represents the original weight, Filter_Factor is the filtering factor, and Row_Sum is the row sum. This normalization process ensures that the updated matrix still satisfies the properties of the probability distribution.

[0064] This embodiment innovatively implements a validity evaluation mechanism for state nodes. After each round of matrix update, the system calculates the out-degree and in-degree of each state node. For nodes with an out-degree or in-degree of zero, it means that the relevant transition paths have been completely filtered, and these nodes will be marked as invalid nodes. In the subsequent script generation process, the system will avoid using these invalid nodes, thereby improving the validity of the generated script. This graph theory-based node evaluation method provides a reliable theoretical foundation for script optimization.

[0065] This embodiment achieves continuous improvement of the test script through iterative optimization. In each iteration, the system re-samples the random walk based on the updated state transition matrix. The sampling process prioritizes paths with higher transition probabilities while maintaining exploration of new paths through appropriate randomness. The generated sequence of atomic elements is then converted into specific JavaScript code and injected with Unicode encoding and non-standard syntax structures to enhance the script's variability.

[0066] This embodiment establishes a complete iteration termination judgment mechanism. The system determines whether the optimization process has reached convergence by tracking the changing trend of the state transition matrix. Specifically, when the matrix change amplitude of multiple consecutive iterations is less than a preset threshold, a relatively stable solution is considered to have been found. This termination judgment method based on mathematical metrics avoids the waste of computational resources caused by excessive iteration.

[0067] This embodiment achieves adaptive adjustment of the script generation strategy through feedback optimization. After each round of test script submission, the system analyzes the response page information and extracts new filtering features. These features are fed back into the generation process in the form of a correction matrix, guiding the optimization direction of the next round of scripts. This closed-loop optimization mechanism can continuously improve the script's bypass capability.

[0068] This embodiment combines mathematical optimization and security testing techniques to improve script quality while ensuring the efficiency of the optimization process. Precise feature modeling is achieved through matrix operations, and dynamic strategy adjustment is achieved through iterative optimization. This mathematical optimization scheme demonstrates excellent convergence and effectiveness in practical applications.

[0069] This embodiment provides reliable technical support for XSS vulnerability detection. Through continuous optimization and iteration, the system can generate more targeted test scripts, improving the efficiency of discovering unknown vulnerabilities. This feedback-based adaptive optimization method significantly improves the accuracy and coverage of vulnerability detection.

[0070] This embodiment achieves a complete closed-loop detection process through the output of the final test script. The script, optimized through multiple rounds, not only contains effective attack payloads but also accumulates the target system's protection characteristics, providing comprehensive technical support for security assessment. This optimization-to-convergence approach ensures the reliability and usability of the detection results.

[0071] The matrix iteration method used in this embodiment has good scalability. By adjusting the matrix dimensions and update rules, the system can adapt to different types of XSS vulnerability detection needs. This flexible optimization framework provides a general technical solution for the security detection of web applications.

[0072] As described above, the unknown cross-site scripting (XSS) security detection method based on test script generation provided in this application can intelligently construct test scripts by innovatively building a Markov chain-driven script generation mechanism and using atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test script through dynamic updating and convergence calculation of the state transition matrix. This method effectively solves the shortcomings of traditional techniques in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown XSS.

[0073] In one embodiment of the unknown cross-site scripting security detection method based on test script generation in this application, it may further include the following:

[0074] Step S201: Deploy data collection nodes to access the historical vulnerability database, collect cross-site scripting vulnerability samples, parse the cross-site scripting vulnerability samples according to syntax rules, extract keywords, operators, function calls and syntax structures, map the keywords, operators, function calls and syntax structures to atomic elements, and construct a sequence of atomic elements according to the execution order;

[0075] Step S202: Establish a third-order Markov chain model for each atomic element in the atomic element sequence, count the co-occurrence frequency between adjacent atomic elements, calculate the conditional probability as the transition probability, input the transition probability into the Kneser-Ney smoothing algorithm, perform interpolation processing on combinations with transition probabilities below a threshold, and construct a probability transition matrix based on the smoothed transition probabilities.

[0076] Optionally, this embodiment addresses the problems of scattered sample collection and incomplete feature extraction in Web application XSS vulnerability detection by innovatively designing a vulnerability sample processing scheme based on distributed collection and probabilistic modeling. During data processing, this embodiment designs an atomic element weight scoring formula: Element_Weight=α×(Usage_Frequency×Context_Relevance)+β×(Attack_Effectiveness×Bypass_Capability)+γ×(Structure_Complexity×Semantic_Importance), where each parameter represents usage frequency, context relevance, attack effectiveness, bypass capability, structural complexity, and semantic importance, respectively, and α, β, and γ are dynamic adjustment factors.

[0077] This embodiment deeply optimizes the vulnerability sample collection strategy. By deploying distributed data collection nodes, the system continuously monitors major vulnerability databases, security forums, and technical blogs. The collection nodes employ intelligent crawling technology, capable of automatically identifying and extracting JavaScript code snippets from web pages. During sample deduplication, this embodiment designs a similarity calculation formula: Similarity_Score=(Token_Match×Structure_Match) / (Length_Difference+ε), where Token_Match represents the token matching degree, Structure_Match is the structural matching degree, Length_Difference is the length difference, and ε is a smoothing factor. This precise deduplication mechanism ensures the quality of the sample database.

[0078] This embodiment innovatively implements a script parsing mechanism. The system employs an improved lexical analyzer and syntax parser, capable of handling various complex JavaScript code structures. During keyword extraction, it not only identifies standard JavaScript keywords but also special identifiers such as DOM manipulation functions and event handlers. For operators, the system establishes a complete priority system to accurately capture operator combination patterns. In function call analysis, it pays particular attention to common XSS attack functions, such as `eval` and `document.write`.

[0079] This embodiment achieves deep code understanding through syntactic structure analysis. The system not only recognizes basic control flow structures (such as if-else and for loops) but also handles advanced features (such as arrow functions and destructuring assignment). During structure extraction, important syntactic markers, such as bracket matching and semicolon placement, are preserved. These syntactic details are crucial for generating effective test scripts. The system also has specific recognition rules for special attack techniques, such as tag splitting and encoding obfuscation.

[0080] This embodiment establishes a complete atomic element mapping system. Each extracted code element is mapped to a predefined set of atomic elements. This mapping is not a simple one-to-one relationship, but takes into account the semantic equivalence of elements. For example, different forms of string concatenation operations (+ operator, concat method) may map to the same atomic element. The system also maintains the dependencies between elements to ensure that the generated sequence is syntactically valid.

[0081] This embodiment implements probabilistic modeling of element sequences using a third-order Markov chain. Compared to traditional first-order or second-order models, the third-order Markov chain can capture dependencies over longer distances, and the generated code is more consistent with actual attack patterns. During probability calculation, the system not only counts the co-occurrence of directly adjacent elements but also considers a broader context.

[0082] This embodiment incorporates the Kneser-Ney smoothing algorithm to address the data sparsity problem. Traditional methods may assign zero probability to low-frequency or unseen element combinations, leading to an overly conservative generation process. Through smoothing, the system can reasonably estimate the probability of these rare combinations, increasing the diversity of the generated scripts. The smoothing algorithm also considers contextual information of different orders, improving mutation capabilities while maintaining syntactic correctness.

[0083] This embodiment uses a probability transition matrix to mathematically represent the generative model. Each element in the matrix represents a transition probability in a specific context, and this structured representation provides a reliable probabilistic foundation for subsequent script generation. Through matrix operations, the system can efficiently perform probabilistic reasoning and path selection.

[0084] This embodiment provides a high-quality probabilistic model for XSS vulnerability detection. Through precise sample processing and probabilistic modeling, the system can generate more effective test scripts. This learning approach based on historical data significantly improves the accuracy and coverage of vulnerability detection.

[0085] The probabilistic modeling method used in this embodiment has good scalability. By continuously adding new samples and updating the probability model, the system can adapt to constantly changing attack techniques. This dynamic learning characteristic provides technical assurance for continuous security detection of web applications.

[0086] In one embodiment of the unknown cross-site scripting security detection method based on test script generation in this application, it may further include the following:

[0087] Step S301: Construct a state transition matrix based on the probability transition matrix. Starting from the initial state node of the state transition matrix, perform a random walk according to the transition probability distribution, record the sequence of state nodes in the walk path, set a transition probability threshold, assign weight coefficients to state nodes with transition probabilities lower than the transition probability threshold, and adjust the sampling probability according to the weight coefficients.

[0088] Step S302: Convert the state node sequence into an atomic element sequence, inject Unicode character encoding and non-standard syntax structure into the atomic element sequence, generate an initial test script, construct an abstract syntax tree parser, input the initial test script into the abstract syntax tree parser for syntax checking, correct test scripts that fail the syntax check, and generate the final test script.

[0089] Optionally, this embodiment addresses the lack of intelligence and adaptability in test script generation during cross-site scripting vulnerability detection by designing a script generation scheme based on random walks and syntax validation. During state transitions, this embodiment designs a node weight adjustment formula: Adjusted_Weight = Base_Weight × exp(α × (1 - P / P_threshold)), where Base_Weight is the base weight, P is the transition probability, P_threshold is the probability threshold, and α is the adjustment factor. This formula allows low-probability transition paths to have a higher sampling opportunity, increasing the diversity of script mutations.

[0090] This embodiment deeply optimizes the construction strategy of the state transition matrix. Through structured analysis of the probability transition matrix, the system establishes a multi-level state space. Each state node not only contains atomic element information but also records contextual dependencies. For example, for a function call state, the node contains attributes such as function name, number of parameters, and parameter types; for an operator state, it contains information such as operand types and precedence. This semantically rich state representation provides more constraints for subsequent random walks.

[0091] This embodiment innovatively implements an adaptive random walk strategy. During the walk, the system dynamically adjusts the transition probabilities of state nodes. For paths with transition probabilities below a threshold, their selection probability is increased through weighting coefficients. This strategy allows the system to explore more potential attack paths, rather than being limited to high-frequency, conventional combinations. In practical applications, the system dynamically adjusts the threshold and weighting coefficients based on the characteristics of the target application, ensuring the diversity and effectiveness of the generated scripts.

[0092] This embodiment improves the quality of script generation through multi-level conversion processing. When converting the state node sequence into an atomic element sequence, the system considers the semantic relationships between elements. For example, when encountering an event handler, it automatically supplements the necessary DOM manipulation code; when using string operations, it ensures string integrity and escaping. This conversion strategy, which considers the actual execution environment, significantly improves the practicality of the generated script.

[0093] This embodiment establishes a complete Unicode obfuscation mechanism. The system maintains a Unicode character mapping table containing encoding methods for various equivalent characters. During the injection process, the system selects an appropriate obfuscation method based on the context. For example, multiple Unicode encoding combinations can be used for JavaScript keywords; different character entity encodings can be used for HTML attributes. This flexible obfuscation strategy effectively improves the script's ability to bypass WAFs.

[0094] This embodiment implements rigorous syntax validation through an abstract syntax tree. The system constructs a dedicated AST parser capable of handling various JavaScript syntax variations. During parsing, the system not only checks the correctness of the syntax but also verifies the rationality of the semantics. For scripts that fail the check, the system analyzes the reasons for the failure and performs intelligent corrections. For example, it may add missing parentheses, fix mismatched quotation marks, or adjust the execution order of statements.

[0095] This embodiment combines theoretical models and engineering practices, improving script quality while ensuring generation efficiency. Path exploration is achieved through random walks, and script validity is ensured through syntax validation. This design philosophy of balancing exploration and verification provides reliable technical support for XSS vulnerability detection.

[0096] This embodiment provides an innovative solution for security testing of web applications. Through intelligent script generation and rigorous syntax validation, the system can continuously generate high-quality test samples. This automated test script generation method significantly improves the efficiency and accuracy of vulnerability detection.

[0097] This embodiment achieves complete detection preparation through the generation of the final test script. The script, after multiple optimizations and verifications, maintains both strong offensive capabilities and a high execution success rate. This quality- and effectiveness-oriented generation method provides a reliable testing foundation for subsequent vulnerability verification.

[0098] The script generation method used in this embodiment has good scalability. By adjusting the state transition strategy and verification rules, the system can adapt to different types of XSS vulnerability detection needs. This flexible generation framework provides a general technical solution for the security detection of web applications.

[0099] In one embodiment of the unknown cross-site scripting security detection method based on test script generation in this application, it may further include the following:

[0100] Step S401: Encapsulate the test script into a request message according to the HTTP protocol, submit the request message through the application interface provided by the analysis server, receive the response message, parse the response message to obtain the response page information, and extract the HTTP status code, response header fields and response body content from the response page information;

[0101] Step S402: Perform string matching on the response body content, detect whether the original submitted content has been deleted, analyze the character encoding type in the response header field, compare the character encoding type with the original encoding to determine whether a replacement has occurred, identify keyword interception based on the HTTP status code, and integrate the content deletion mark, the character encoding replacement information and the keyword interception information into a filter element judgment result.

[0102] Optionally, this embodiment addresses the issues of incomplete feature extraction and insufficient accuracy in the analysis of cross-site scripting (XSS) protection mechanisms for web applications by innovatively designing a filtering feature recognition scheme based on multi-dimensional response analysis. During the filtering judgment process, this embodiment designs a comprehensive scoring formula: Filter_Score=α×(Delete_Weight×Content_Match)+β×(Encode_Weight×Charset_Diff)+γ×(Block_Weight×Status_Level), where each weight factor reflects the importance of different filtering methods, and the matching degree and difference index reflect the specific filtering effect.

[0103] This embodiment deeply optimizes the request message construction strategy. During the HTTP protocol encapsulation process, the system dynamically adjusts the request header fields based on the characteristics of the target application. For the Content-Type field, the system selects the appropriate MIME type based on the script injection location; for Cookie and Session related fields, it maintains consistency with normal requests. During the request body construction process, the system considers the special processing requirements of different parameter positions, such as URL encoding and HTML entity encoding. This meticulous request construction method ensures that the test script can accurately reach the target location.

[0104] This embodiment innovatively implements a response analysis mechanism. During response message parsing, the system not only extracts surface-level HTTP information but also delves into the semantic features of the response content. For HTTP status codes, the system has established detailed judgment rules; different status code sequences may reflect different protection strategies. For example, a 302 status code may indicate redirection blocking, while a 403 status code may indicate direct blocking. In response header analysis, special attention is paid to security-related fields such as X-XSS-Protection and Content-Security-Policy.

[0105] This embodiment implements content deletion detection using a highly efficient string matching algorithm. The system employs an improved KMP algorithm, enabling rapid location of the original script within the response content. During the matching process, it considers not only complete matches but also partial and modified matches. For example, even when the script is split or interfering characters are inserted, the system can still accurately identify deletions. For complex DOM structures, the system combines contextual information for intelligent matching, further improving detection accuracy.

[0106] This embodiment establishes a complete character encoding analysis framework. By analyzing the Content-Type and meta tags in the response header, the system can accurately identify the character encoding type of the page. During the encoding comparison process, it not only considers basic encoding conversions but also analyzes more complex encoding processing situations. For example, when encountering multiple or mixed encodings, the system can trace the complete encoding conversion chain and identify possible protection measures.

[0107] This embodiment achieves deep protection feature recognition through keyword interception analysis. The system not only focuses on direct keyword filtering but also analyzes more complex semantic filtering scenarios. By establishing a keyword feature library, the system can identify various common attack characteristics, such as JavaScript function names, DOM manipulation commands, and event handlers. For detected interceptions, the system makes a comprehensive judgment based on the context to avoid false positives.

[0108] This embodiment combines analysis results from multiple dimensions to achieve accurate filtering feature judgment. By integrating information from three dimensions—content deletion, encoding replacement, and keyword blocking—the system can construct a complete protection feature profile. This multi-dimensional analysis approach effectively improves the accuracy and completeness of feature recognition.

[0109] This embodiment provides reliable feedback for subsequent script optimization. Through accurate filtering feature identification, the system can guide the optimization direction of the test script. This optimization mechanism based on actual protection effectiveness significantly improves the targeting and effectiveness of script mutations.

[0110] This embodiment achieves a comprehensive analysis of the protection mechanism by integrating the results of filtering elements. Through multi-dimensional feature extraction and comprehensive judgment, the system can accurately understand the protection strategy of the target application. This in-depth protection analysis provides an important basis for subsequent bypass testing.

[0111] The analysis method employed in this embodiment exhibits good adaptability. By adjusting the judgment rules and weight parameters, the system can adapt to different types of web application protection mechanisms. This flexible analysis framework provides a general technical solution for XSS vulnerability detection. This adaptive feature recognition method not only improves detection accuracy but also enhances the practical value of the solution.

[0112] In one embodiment of the unknown cross-site scripting security detection method based on test script generation in this application, it may further include the following:

[0113] Step S501: Perform document object model parsing on the response page information, construct a document object model tree, traverse the document object model tree with the document object model tree of the original submitted content, calculate the structural similarity and content similarity of the nodes, determine the node matching relationship based on the weighted score of the structural similarity and content similarity, mark the unmatched nodes as removed nodes, and extract the filtered characters from the attributes and text content of the removed nodes;

[0114] Step S502: Construct an identity matrix with the same dimension as the state transition matrix as the correction matrix. Traverse the filtered characters, locate the main diagonal element corresponding to the filtered character in the correction matrix, modify the value of the main diagonal element to zero, keep the values ​​of other elements unchanged, and generate the final correction matrix.

[0115] Optionally, this embodiment addresses the problems of inaccurate feature extraction and difficulty in quantifying the filtering effect of XSS filtering rules by innovatively designing a feature extraction scheme based on DOM tree differencing and matrix mapping. In the node similarity calculation process, this embodiment designs a comprehensive scoring formula: Node_Score=α×Structure_Similarity+β×Content_Similarity, where Structure_Similarity represents structural similarity, Content_Similarity represents content similarity, and α and β are dynamic weight coefficients that are dynamically adjusted through an environment-adaptive algorithm. Furthermore, this embodiment also designs a structural similarity calculation formula: Structure_Similarity=(Matched_Attributes×Tag_Weight) / (Total_Attributes×Max_Weight), where each parameter represents the number of matched attributes, tag weight, total number of attributes, and maximum weight value, respectively.

[0116] This embodiment deeply optimizes the DOM tree parsing strategy. During the response page parsing process, the system employs an enhanced HTML parser capable of handling various non-standard HTML structures and dynamically generated DOM nodes from JavaScript. The parser not only focuses on standard HTML tags and attributes but also analyzes special content such as comment nodes and text nodes. For JavaScript code snippets, the system pays particular attention to their execution context and scope to ensure accurate capture of DOM changes after code execution. This comprehensive parsing strategy provides a reliable data foundation for subsequent differential analysis.

[0117] This embodiment innovatively implements a multi-dimensional node matching mechanism. During node traversal, the system first establishes preliminary matching relationships based on node label type, attribute features, and hierarchical relationships. For structural similarity, the system considers ancestor relationships, sibling relationships, and child node distribution; for content similarity, it focuses on information such as text content, attribute values, and event handlers. This comprehensive matching strategy can accurately identify node changes caused by filtering. For example, when encountering a partially filtered event handler, the system can precisely locate the modified code segment.

[0118] This embodiment achieves precise feature extraction through analysis of removed nodes. For each marked removed node, the system conducts in-depth analysis of its structural and content features. In attribute analysis, special attention is paid to dangerous attributes that may trigger XSS, such as event handlers like onclick and onerror; in text content analysis, the focus is on identifying JavaScript code snippets and special character sequences. The system also analyzes the node's context to ensure that the extracted filtering features have actual attack significance.

[0119] This embodiment establishes a complete correction matrix construction mechanism. Based on the dimension of the state transition matrix, the system first constructs an identity matrix as the basic framework. This design ensures that the correction matrix does not affect the original transition probabilities in the absence of filtered features. During feature mapping, the system precisely locates each filtered character, finding its corresponding element position on the main diagonal. By setting these elements to zero, the system achieves precise suppression of specific transition paths.

[0120] This embodiment implements the mathematical expression of filtering features through matrix operations. The zeroing operation of the main diagonal elements directly reflects the situation where certain transition paths are completely filtered. This matrix-based feature representation not only facilitates subsequent probability adjustments but also maintains the interpretability of feature extraction. For example, by analyzing the sparsity pattern of the correction matrix, the filtering strategy tendency of the target system can be intuitively understood.

[0121] This embodiment combines DOM analysis and matrix optimization techniques to improve feature extraction accuracy while optimizing computational efficiency. DOM tree differencing ensures the integrity of feature recognition, while matrix mapping provides a precise mathematical expression. This approach, combining qualitative analysis and quantitative representation, demonstrates excellent performance in practical applications.

[0122] This embodiment provides a reliable feature extraction scheme for XSS detection. Through precise DOM differencing and matrix mapping, the system can accurately identify and represent the features of filtering rules. This feature extraction method based on actual response analysis significantly improves the targeting and effectiveness of subsequent testing.

[0123] This embodiment achieves a precise mapping from filtering features to generation strategies by constructing a correction matrix. This mathematical feature representation not only facilitates subsequent matrix operations but also provides a quantifiable optimization basis for the entire detection process. This scheme design, which emphasizes the quality of feature extraction, provides strong technical support for the security detection of web applications.

[0124] The feature extraction method used in this embodiment has good scalability. By adjusting the similarity calculation strategy and matrix construction rules, the system can adapt to different types of XSS protection mechanisms. This flexible feature extraction framework provides a reliable technical guarantee for the continuous security monitoring of web applications.

[0125] In one embodiment of the unknown cross-site scripting security detection method based on test script generation in this application, it may further include the following:

[0126] Step S601: Perform Hadamard product operation on the probability transition matrix and the correction matrix according to the corresponding positions, normalize each matrix element, generate an updated probability transition matrix, construct a new state transition matrix based on the updated probability transition matrix, calculate the out-degree and in-degree of each state node in the new state transition matrix, and mark state nodes with zero out-degree or in-degree as invalid nodes.

[0127] Step S602: Delete the invalid nodes and their related transition paths from the new state transition matrix, re-sample the remaining valid state nodes by random walk, generate a state node sequence, convert the state node sequence into an atomic element sequence, add Unicode character encoding and non-standard syntax structure, and generate a new test script after syntax tree verification.

[0128] Optionally, this embodiment addresses the issues of low script optimization efficiency and poor convergence in Web application XSS vulnerability detection by innovatively designing a script update scheme based on matrix operations and state space optimization. In the matrix processing, this embodiment designs a normalization formula: P'ij=(Pij×Mij) / Σ(Pik×Mik), where Pij represents the probability transition matrix element, Mij represents the correction matrix element, and P'ij is the updated probability value. Simultaneously, a node validity scoring formula is introduced: Node_Score=min(In_Degree,Out_Degree) / max(Total_In,Total_Out), used to evaluate the connectivity of state nodes.

[0129] This embodiment deeply optimizes the matrix update strategy. During the Hadamard product operation, the system employs a sparse matrix storage structure to effectively handle the large-scale state space. For each matrix element, the product operation considers not only the numerical value but also the semantic validity of the transition path. For example, when a transition path involves a function call, special attention is paid to the completeness of parameter matching; when conditional structures are involved, the rationality of branch logic is ensured. This update strategy, which considers the actual execution environment, significantly improves the quality of the generated script.

[0130] This embodiment innovatively implements a validity evaluation mechanism for state nodes. By analyzing the out-degree and in-degree of nodes, the system can accurately identify invalid state nodes. For a node with an out-degree of zero, it means that the state cannot continue to transition to other valid states; for a node with an in-degree of zero, it means that the state cannot be reached normally from other states. This graph theory-based node evaluation method provides a reliable theoretical foundation for the optimization of the state space. In practical applications, the system dynamically adjusts the evaluation threshold to ensure a reasonable size of the state space.

[0131] This embodiment improves script generation efficiency through dynamic adjustment of the state space. When deleting invalid nodes and their associated paths, the system maintains the connectivity of state transitions. For certain critical transition states, even if their connectivity is weak, they are considered for retention to maintain the diversity of generated scripts. This optimization strategy, balancing efficiency and diversity, effectively improves the quality of script generation. For example, when processing event handler states, even if some triggering methods are filtered, the system retains other possible triggering paths.

[0132] This embodiment establishes a complete random walk strategy update mechanism. When sampling on the new state transition matrix, the system employs an improved Monte Carlo method. By dynamically adjusting the transition probabilities, the system can maintain randomness while favoring paths more likely to succeed. This intelligent sampling strategy ensures script variability while improving generation efficiency. For example, when certain character encoding methods are found to be particularly effective, the system will appropriately increase the sampling probability of the relevant paths.

[0133] This embodiment enhances the script's bypass capability through dynamic Unicode encoding injection. During the atomic element sequence conversion process, the system selectively applies different Unicode encoding schemes based on previous filtering characteristics. This adaptive encoding strategy includes not only basic character conversions but also more complex encoding combinations, such as multiple encodings and hybrid encodings. Simultaneously, the system injects some non-standard but effective syntax structures, further improving the script's mutability.

[0134] This embodiment combines theoretical analysis and engineering practice, improving optimization efficiency while ensuring the reliability of the results. Precise feature modeling is achieved through matrix operations, and generation efficiency is enhanced through state-space optimization. This mathematical optimization scheme demonstrates excellent performance and stability in practical applications.

[0135] This embodiment provides an efficient script optimization scheme for XSS vulnerability detection. Through continuous matrix updates and state optimization, the system can quickly generate highly targeted test scripts. This adaptive optimization mechanism significantly improves the efficiency and accuracy of vulnerability detection.

[0136] This embodiment achieves dynamic adjustment of the detection strategy by generating new test scripts. The scripts, optimized through multiple rounds, maintain strong offensive capabilities while ensuring a high execution success rate. This quality- and effectiveness-focused generation method provides reliable technical support for the security detection of web applications.

[0137] The optimization method employed in this embodiment has good scalability. By adjusting the matrix operation rules and state evaluation criteria, the system can adapt to different types of XSS vulnerability detection needs. This flexible optimization framework provides a general technical solution for continuous security detection of web applications.

[0138] In one embodiment of the unknown cross-site scripting security detection method based on test script generation in this application, it may further include the following:

[0139] Step S701: Submit the new test script to the analysis server, obtain the response page information, extract the filter elements, construct a new correction matrix, perform Hadamard product operation on the new correction matrix and the probability transition matrix and normalize it, calculate the Frobenius norm of the current state transition matrix and the previous round state transition matrix, and record the matrix convergence state.

[0140] Step S702: Determine the convergence state of the state transition matrix. Stop iterating when the difference in Frobenius norm between the two rounds of state transition matrices is less than a preset threshold. Otherwise, regenerate the test script based on the current state transition matrix and continue iterating. Use the test script generated in the last round as the final output result.

[0141] Optionally, this embodiment innovatively designs a convergence analysis scheme based on matrix norm to address issues such as ambiguity in iteration termination conditions and inaccurate convergence judgment in Web application XSS vulnerability detection. During the convergence judgment process, this embodiment designs a matrix difference evaluation formula: Convergence_Rate=||M_current-M_previous||_F / ||M_previous||_F, where ||·||_F represents the Frobenius norm, and M represents the state transition matrix. Simultaneously, an iteration stability scoring formula is introduced: Stability_Score=1-(Σ|ΔPij|) / (2×N), where ΔPij represents the change in matrix elements, N is the matrix dimension, and this score reflects the overall stability of the state transition probability.

[0142] This embodiment deeply optimizes the matrix convergence analysis strategy. When calculating the Frobenius norm, the system not only focuses on the overall numerical changes but also analyzes local convergence characteristics. By tracking the transition probability changes of key state nodes, the system can more accurately determine whether the optimization process has reached a stable state. For example, when important attack vectors are involved, the system will focus on analyzing the convergence of relevant transition paths. This multi-level convergence analysis method ensures the reliable termination of the iterative process. In the matrix norm calculation process, the system adopts an optimized numerical calculation method, improving the efficiency of large-scale matrix processing.

[0143] This embodiment innovatively implements an iterative stability evaluation mechanism. By analyzing the matrix change trends of consecutive iterations, the system can identify local oscillations and false convergence. For certain special attack patterns, even if the local transition probability changes significantly, the system will terminate the iteration in a timely manner as long as the overall attack effect tends to stabilize. This evaluation strategy, which balances local changes and overall stability, effectively avoids the waste of resources caused by excessive iteration. For example, when it is found that certain mutation methods, although generating new transition paths, fail to improve the bypass effect, the system will promptly adjust the optimization direction.

[0144] This embodiment improves the accuracy of convergence judgment through dynamic threshold adjustment. Based on a preset threshold, the system dynamically adjusts the judgment criteria according to the matrix change characteristics observed during the iteration process. For complex protection mechanisms, the system appropriately relaxes the convergence conditions, allowing for more exploration iterations; for simple filtering rules, it adopts stricter termination conditions to accelerate the convergence speed. This adaptive threshold adjustment strategy ensures both sufficient detection and improved optimization efficiency.

[0145] This embodiment establishes a complete iterative termination decision mechanism. The system not only considers the matrix convergence state but also analyzes changes in the quality of the generated scripts. By tracking the bypass effects and mutation characteristics of each round of scripts, the system can determine whether continued iteration will bring significant improvement. This multi-dimensional termination judgment method ensures the quality and effectiveness of the final output script. For example, when it is found that the scripts generated in multiple consecutive rounds have failed to break through the existing protection mechanism, the system will consider terminating the current optimization direction.

[0146] This embodiment ensures the quality of the optimization results through the selection of the final script. After the iteration ends, the system comprehensively evaluates the scripts generated in the last few rounds and selects the most representative and aggressive version as the final output. This quality-focused selection strategy ensures the practical value of the detection results. Simultaneously, the system also saves key intermediate results from the iteration process, providing valuable reference data for subsequent protection analysis.

[0147] This embodiment combines numerical analysis and security testing techniques to improve the accuracy of convergence determination while optimizing computational efficiency. Precise assessment of the convergence state is achieved through matrix norm analysis, and reasonable termination of the iteration process is ensured through dynamic threshold adjustment. This mathematical convergence analysis scheme demonstrates excellent performance and reliability in practical applications.

[0148] This embodiment provides a reliable optimized termination mechanism for XSS vulnerability detection. Through accurate convergence judgment, the system can stop iteration at an appropriate time, avoiding unnecessary consumption of computational resources. This termination judgment method based on mathematical metrics significantly improves the practicality and efficiency of the detection scheme.

[0149] This embodiment achieves a complete closed-loop detection process through the output of the final test script. The script, after convergence verification, not only possesses strong attack capabilities but also maintains high execution efficiency. This output method, which emphasizes quality and effectiveness, provides reliable technical support for the security assessment of web applications.

[0150] The convergence analysis method used in this embodiment has good adaptability. By adjusting the convergence judgment criteria and threshold parameters, the system can adapt to different types of XSS vulnerability detection needs. This flexible convergence analysis framework provides a general technical solution for the security detection of web applications. This adaptive convergence judgment method not only improves the detection efficiency but also enhances the practical value of the solution.

[0151] To effectively address the shortcomings of traditional technologies in script generation, filtering analysis, and optimization, and to significantly improve the effectiveness of unknown cross-site scripting (XSS) detection, this application provides an embodiment of an unknown XSS security detection device based on test script generation, which implements all or part of the aforementioned unknown XSS security detection method. See [link to embodiment]. Figure 2 The unknown cross-site scripting security detection device based on the test script specifically includes the following components:

[0152] Script processing module 10 is used to collect script samples from a historical vulnerability database, decompose the script samples into atomic element sequences, calculate the transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, input the transition probabilities into a smoothing algorithm to process low-frequency combinations, generate a probability transition matrix, construct a state transition matrix, traverse the state transition matrix using a random walk strategy, perform weighted sampling on paths in the state transition matrix with transition probabilities below a threshold, inject Unicode obfuscation characters and unconventional syntax structures, generate a test script, and perform syntax tree verification on the test script to ensure that the test script can be parsed.

[0153] Script analysis module 20 is used to submit the test script to the analysis server, collect response page information, extract content deletion markers, character encoding replacement markers and keyword interception markers from the response page information, determine filtering elements based on the content deletion markers, character encoding replacement markers and keyword interception markers, perform document object model tree difference comparison on the response page information, locate the removed node, extract the filtered characters from the removed node, construct a correction matrix, and set the main diagonal elements of the correction matrix corresponding to the filtered characters to zero.

[0154] The security detection module 30 is used to perform element-wise multiplication of the probability transition matrix and the correction matrix, update the state transition matrix, regenerate the test script based on the updated state transition matrix, submit the test script to the analysis server to obtain response page information, repeat the matrix update and script generation operations until the state transition matrix converges, and output the final test script.

[0155] As described above, the unknown cross-site scripting (XSS) security detection device based on test script generation provided in this application can intelligently construct test scripts by innovatively building a Markov chain-driven script generation mechanism and using atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test script through dynamic updating and convergence calculation of the state transition matrix. This method effectively solves the shortcomings of traditional technologies in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown XSS.

[0156] From a hardware perspective, in order to effectively address the shortcomings of traditional technologies in script generation, filtering analysis, and optimization, and significantly improve the effectiveness of unknown cross-site script detection, this application provides an embodiment of an electronic device for implementing all or part of the aforementioned method for detecting unknown cross-site scripts based on test script generation. The electronic device specifically includes the following components:

[0157] The system comprises a processor, memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to realize information transmission between the unknown cross-site scripting security detection device based on test script generation and core business systems, user terminals, and related databases and other related devices; the logic controller can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the logic controller can be implemented with reference to the embodiments of the unknown cross-site scripting security detection method based on test script generation and the embodiments of the unknown cross-site scripting security detection device based on test script generation in the embodiments, the contents of which are incorporated herein, and repeated details will not be described again.

[0158] It is understood that the user terminal may include smartphones, tablet computers, network set-top boxes, portable computers, desktop computers, personal digital assistants (PDAs), in-vehicle devices, smart wearable devices, etc. Among these, the smart wearable devices may include smart glasses, smartwatches, smart bracelets, etc.

[0159] In practical applications, the unknown cross-site scripting (XSS) security detection method generated based on the test script can be partially executed on the electronic device side as described above, or all operations can be completed on the client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are completed on the client device, the client device may further include a processor.

[0160] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0161] Figure 3 This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 3 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 3 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0162] In one embodiment, the unknown cross-site scripting security detection method based on the test script can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following controls:

[0163] Step S101: Collect script samples from the historical vulnerability database, decompose the script samples into atomic element sequences, calculate the transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, input the transition probabilities into a smoothing algorithm to process low-frequency combinations, generate a probability transition matrix, construct a state transition matrix, traverse the state transition matrix using a random walk strategy, perform weighted sampling on paths in the state transition matrix with transition probabilities below a threshold, inject Unicode obfuscation characters and unconventional syntax structures, generate a test script, and perform syntax tree verification on the test script to ensure that the test script can be parsed;

[0164] Step S102: Submit the test script to the analysis server, collect response page information, extract content deletion markers, character encoding replacement markers and keyword interception markers from the response page information, determine filtering elements based on the content deletion markers, character encoding replacement markers and keyword interception markers, perform document object model tree difference comparison on the response page information, locate the removed node, extract the filtered characters from the removed node, construct a correction matrix, and set the main diagonal elements of the correction matrix corresponding to the filtered characters to zero;

[0165] Step S103: Perform element-wise product operation on the probability transition matrix and the correction matrix to update the state transition matrix. Regenerate the test script based on the updated state transition matrix. Submit the test script to the analysis server to obtain response page information. Repeat the matrix update and script generation operations until the state transition matrix converges and output the final test script.

[0166] As described above, the electronic device provided in this application innovatively constructs a Markov chain-driven script generation mechanism and achieves intelligent construction of test scripts through atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test scripts through dynamic updating and convergence calculation of the state transition matrix. This method effectively solves the shortcomings of traditional techniques in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown cross-site scripts.

[0167] In another embodiment, the unknown cross-site scripting security detection device generated based on the test script can be configured separately from the central processing unit 9100. For example, the unknown cross-site scripting security detection device generated based on the test script can be configured as a chip connected to the central processing unit 9100, and the function of the unknown cross-site scripting security detection method based on the test script can be implemented through the control of the central processing unit.

[0168] like Figure 3 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily need to include these components. Figure 3 All components shown; in addition, the electronic device 9600 may also include Figure 3 For components not shown, please refer to existing technologies.

[0169] like Figure 3 As shown, the central processing unit 9100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of various components of the electronic device 9600.

[0170] The memory 9140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 9100 may execute the program stored in the memory 9140 to perform information storage or processing, etc.

[0171] Input unit 9120 provides input to central processing unit 9100. Input unit 9120 may be, for example, a keypad or touch input device. Power supply 9170 provides power to electronic device 9600. Display 9160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0172] The memory 9140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 via the central processing unit 9100.

[0173] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for the electronic device for communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0174] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processing unit 9100 to provide input signals and receive output signals, which is the same as in a conventional mobile communication terminal.

[0175] Based on different communication technologies, multiple communication modules 9110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module 9110 (transmitter / receiver) is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby realizing typical telecommunications functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Additionally, the audio processor 9130 is coupled to a central processing unit 9100, enabling on-device recording via the microphone 9132 and on-device playback of stored audio via the speaker 9131.

[0176] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the unknown cross-site scripting security detection method based on test script generation, where the execution subject is a server or client, as described in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the unknown cross-site scripting security detection method based on test script generation, where the execution subject is a server or client, as described in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0177] Step S101: Collect script samples from the historical vulnerability database, decompose the script samples into atomic element sequences, calculate the transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, input the transition probabilities into a smoothing algorithm to process low-frequency combinations, generate a probability transition matrix, construct a state transition matrix, traverse the state transition matrix using a random walk strategy, perform weighted sampling on paths in the state transition matrix with transition probabilities below a threshold, inject Unicode obfuscation characters and unconventional syntax structures, generate a test script, and perform syntax tree verification on the test script to ensure that the test script can be parsed;

[0178] Step S102: Submit the test script to the analysis server, collect response page information, extract content deletion markers, character encoding replacement markers and keyword interception markers from the response page information, determine filtering elements based on the content deletion markers, character encoding replacement markers and keyword interception markers, perform document object model tree difference comparison on the response page information, locate the removed node, extract the filtered characters from the removed node, construct a correction matrix, and set the main diagonal elements of the correction matrix corresponding to the filtered characters to zero;

[0179] Step S103: Perform element-wise product operation on the probability transition matrix and the correction matrix to update the state transition matrix. Regenerate the test script based on the updated state transition matrix. Submit the test script to the analysis server to obtain response page information. Repeat the matrix update and script generation operations until the state transition matrix converges and output the final test script.

[0180] As described above, the computer-readable storage medium provided in this application innovatively constructs a Markov chain-driven script generation mechanism, and achieves intelligent construction of test scripts through atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test scripts through dynamic updating and convergence calculation of the state transition matrix. This method effectively solves the shortcomings of traditional techniques in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown cross-site scripts.

[0181] Embodiments of this application also provide a computer program product capable of implementing all steps of the unknown cross-site scripting security detection method based on test script generation, where the execution subject is a server or client, as described in the above embodiments. When executed by a processor, this computer program / instruction implements the steps of the unknown cross-site scripting security detection method based on test script generation. For example, the computer program / instruction implements the following steps:

[0182] Step S101: Collect script samples from the historical vulnerability database, decompose the script samples into atomic element sequences, calculate the transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, input the transition probabilities into a smoothing algorithm to process low-frequency combinations, generate a probability transition matrix, construct a state transition matrix, traverse the state transition matrix using a random walk strategy, perform weighted sampling on paths in the state transition matrix with transition probabilities below a threshold, inject Unicode obfuscation characters and unconventional syntax structures, generate a test script, and perform syntax tree verification on the test script to ensure that the test script can be parsed;

[0183] Step S102: Submit the test script to the analysis server, collect response page information, extract content deletion markers, character encoding replacement markers and keyword interception markers from the response page information, determine filtering elements based on the content deletion markers, character encoding replacement markers and keyword interception markers, perform document object model tree difference comparison on the response page information, locate the removed node, extract the filtered characters from the removed node, construct a correction matrix, and set the main diagonal elements of the correction matrix corresponding to the filtered characters to zero;

[0184] Step S103: Perform element-wise product operation on the probability transition matrix and the correction matrix to update the state transition matrix. Regenerate the test script based on the updated state transition matrix. Submit the test script to the analysis server to obtain response page information. Repeat the matrix update and script generation operations until the state transition matrix converges and output the final test script.

[0185] As described above, the computer program product provided in this application innovatively constructs a Markov chain-driven script generation mechanism and achieves intelligent construction of test scripts through atomic element sequence analysis and random walk strategies. A filtering analysis mechanism based on DOM tree difference is designed, combining multi-dimensional tag extraction and node localization to establish a filtering rule recognition strategy. A matrix iterative optimization mechanism is introduced, achieving adaptive optimization of the test scripts through dynamic updating and convergence calculation of the state transition matrix. This method effectively solves the shortcomings of traditional techniques in script generation, filtering analysis, and optimization adjustment, significantly improving the detection effect of unknown cross-site scripts.

[0186] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0187] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0188] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0189] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0190] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. An unknown cross-site scripting security detection method based on test script generation, characterized in that, The method comprises: Collecting script samples from a historical vulnerability library, disassembling the script samples into atomic element sequences, calculating transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, inputting the transition probabilities into a smoothing algorithm to process low-frequency combinations, generating a probability transition matrix, constructing a state transition matrix, traversing the state transition matrix using a random walk strategy, weighting sampling paths in the state transition matrix with transition probabilities below a threshold, injecting Unicode obfuscation characters and irregular syntax structures, generating test scripts, and performing syntax tree verification on the test scripts to ensure that the test scripts are parsable; Submitting the test scripts to an analysis server, collecting response page information, extracting content deletion markers, character encoding replacement markers, and keyword blocking markers from the response page information, determining filtering elements based on the content deletion markers, the character encoding replacement markers, and the keyword blocking markers, performing document object model tree difference comparison on the response page information, locating removed nodes, extracting filtered characters from the removed nodes, and constructing a correction matrix by setting the main diagonal elements corresponding to the filtered characters in the correction matrix to zero; Performing element-by-element multiplication operations on the probability transition matrix and the correction matrix, updating the state transition matrix, regenerating test scripts based on the updated state transition matrix, submitting the test scripts to the analysis server to obtain response page information, and repeatedly performing matrix updating and script generation operations until the state transition matrix converges, and outputting the final test scripts.

2. The method of claim 1, wherein the method is based on a test script generation of unknown cross-site scripting security detection, and The collecting script samples from a historical vulnerability library, disassembling the script samples into atomic element sequences, calculating transition probabilities between adjacent elements in the atomic element sequences using a third-order Markov chain, inputting the transition probabilities into a smoothing algorithm to process low-frequency combinations, generating a probability transition matrix, comprises: Deploying a data collection node to access a historical vulnerability library, collecting cross-site scripting vulnerability samples, parsing the cross-site scripting vulnerability samples according to syntax rules, extracting keywords, operator symbols, function calls, and syntax structures, mapping the keywords, operator symbols, function calls, and syntax structures to atomic elements, and constructing an atomic element sequence according to the execution order; Establishing a third-order Markov chain model for each atomic element in the atomic element sequence, counting the co-occurrence frequency between adjacent atomic elements, calculating the conditional probability as the transition probability, inputting the transition probability into the Kneser-Ney smoothing algorithm, interpolating combinations with transition probabilities below a threshold, and constructing a probability transition matrix based on the smoothed transition probabilities.

3. The method of claim 1, wherein the method further comprises: The constructing a state transition matrix, traversing the state transition matrix using a random walk strategy, weighting sampling paths in the state transition matrix with transition probabilities below a threshold, injecting Unicode obfuscation characters and irregular syntax structures, generating test scripts, and performing syntax tree verification on the test scripts to ensure that the test scripts are parsable, comprises: constructing a state transition matrix based on the probability transition matrix, starting from a starting state node of the state transition matrix, performing a random walk according to a transition probability distribution, recording a sequence of state nodes in the walk path, assigning a weight coefficient to a state node with a transition probability lower than a threshold, and adjusting a sampling probability according to the weight coefficient; converting the sequence of state nodes into a sequence of atomic elements, injecting Unicode character encoding and an irregular syntax structure into the sequence of atomic elements, generating an initial test script, constructing an abstract syntax tree parser, inputting the initial test script into the abstract syntax tree parser for syntax checking, and correcting a test script that fails the syntax checking to generate a final test script.

4. The method of claim 1, wherein the method further comprises: The test script is submitted to an analysis server, response page information is collected, content deletion markers, character encoding replacement markers, and keyword interception markers in the response page information are extracted, and filtering elements are judged based on the content deletion markers, the character encoding replacement markers, and the keyword interception markers, including: The test script is encapsulated into a request message according to the HTTP protocol, the request message is submitted through an application programming interface provided by the analysis server, a response message is received, response page information is obtained by parsing the response message, HTTP status codes, response header fields, and response body content are extracted from the response page information; The response body content is subjected to string matching to detect whether the original submission content is deleted, the character encoding type in the response header field is analyzed, the character encoding type is compared with the original encoding to determine whether replacement has occurred, keyword interception conditions are identified based on the HTTP status code, and the content deletion markers, the character encoding replacement markers, and the keyword interception markers are integrated into a filtering element judgment result.

5. The method of claim 1, wherein the method further comprises: The response page information is subjected to document object model tree difference comparison, and a removed node is located, filtered characters are extracted from the removed node, a correction matrix is constructed, and main diagonal elements corresponding to the filtered characters in the correction matrix are set to zero, including: The response page information is subjected to document object model parsing, a document object model tree is constructed, node traversal is performed on the document object model tree and the document object model tree of the original submission content, the structural similarity and the content similarity of the nodes are calculated, the node matching relationship is determined based on the weighted score of the structural similarity and the content similarity, and the unmatched nodes are marked as removed nodes, and filtered characters are extracted from the attributes and text content of the removed nodes; A unit matrix with the same dimension as the state transition matrix is constructed as a correction matrix, the filtered characters are traversed, the positions of main diagonal elements corresponding to the filtered characters in the correction matrix are located, the values of the main diagonal elements are modified to zero, and the values of other elements remain unchanged, and a final correction matrix is generated.

6. The method of claim 1, wherein the method further comprises: The probability transition matrix and the correction matrix are subjected to element-by-element multiplication, the state transition matrix is updated, and a test script is regenerated based on the updated state transition matrix, including: The probability transition matrix and the correction matrix are subjected to Hadamard multiplication operation according to corresponding positions, each matrix element is normalized to generate an updated probability transition matrix, a new state transition matrix is constructed based on the updated probability transition matrix, the out-degree and the in-degree of each state node in the new state transition matrix are calculated, and a state node with zero out-degree or in-degree is marked as an invalid node; The invalid node and its related transition path are deleted from the new state transition matrix, random walk sampling is performed again among the remaining valid state nodes, a state node sequence is generated, the state node sequence is converted into an atomic element sequence, Unicode character coding and irregular syntax structure are added, and a new test script is generated after syntax tree verification.

7. The method of claim 1, wherein the method further comprises: The test script is submitted to the analysis server to obtain response page information, and the matrix updating and script generating operations are repeatedly performed until the state transition matrix converges, and a final test script is output, including: The new test script is submitted to the analysis server to obtain response page information, filter elements are extracted, a new correction matrix is constructed, the new correction matrix and the probability transition matrix are subjected to Hadamard multiplication operation and normalized, the Frobenius norm of the current state transition matrix and the last round state transition matrix is calculated, and the matrix convergence state is recorded; The convergence state of the state transition matrix is judged, and when the Frobenius norm difference of two rounds of state transition matrices is less than a preset threshold, the iteration is stopped, otherwise the test script is regenerated based on the current state transition matrix and the iteration is continued, and the test script generated in the last round is taken as the final output result.

8. An unknown cross-site scripting security detection apparatus based on a test script generation, characterized by, The device comprises: A script processing module is configured to collect script samples from a historical vulnerability library, disassemble the script samples into an atomic element sequence, calculate transition probabilities between adjacent elements in the atomic element sequence by using a third-order Markov chain, input the transition probabilities into a smoothing algorithm to process low-frequency combinations, generate a probability transition matrix, construct a state transition matrix, traverse the state transition matrix by using a random walk strategy, perform weighted sampling on paths with transition probabilities lower than a threshold in the state transition matrix, inject Unicode obfuscation characters and irregular syntax structures, generate a test script, and perform syntax tree verification on the test script to ensure that the test script is analyzable; A script analysis module is configured to submit the test script to an analysis server, collect response page information, extract content deletion markers, character coding replacement markers and keyword interception markers in the response page information, judge filter elements based on the content deletion markers, the character coding replacement markers and the keyword interception markers, perform document object model tree difference comparison on the response page information, locate removed nodes, extract filtered characters from the removed nodes, construct a correction matrix, and set zero to main diagonal elements in the correction matrix corresponding to the filtered characters. The security detection module is configured to perform element-by-element multiplication operation on the probability transition matrix and the correction matrix, update the state transition matrix, regenerate a test script based on the updated state transition matrix, submit the test script to the analysis server to obtain response page information, repeatedly perform matrix updating and script generating operations until the state transition matrix converges, and output a final test script.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the unknown cross-site script security detection method based on test script generation according to any one of claims 1 to 7 when executing the program.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the steps of the unknown cross-site script security detection method based on test script generation according to any one of claims 1 to 7 when executed by the processor.

Images