Security detection method and device based on fingerprint feature hierarchical model

Abstract

The application embodiment provides a security detection method and device based on a fingerprint feature hierarchical model, innovatively constructs a five-layer fingerprint feature library, realizes accurate identification of a Web application through multi-dimensional features such as a protocol stack, a framework path, a page structure, a JavaScript variable and external resources. A version identification mechanism based on an abnormal response is designed, a reliable version confirmation strategy is established by combining semantic version matching and feature weight voting. A vulnerability knowledge processing mechanism is introduced, and accurate detection of vulnerabilities is realized through natural language analysis and detection load verification. The method effectively solves the deficiencies of traditional technologies in fingerprint identification, version confirmation and vulnerability detection, and significantly improves the accuracy and reliability of security detection.

Description

Technical Field

[0001] This application relates to the field of data processing, specifically to a security detection method and apparatus based on a fingerprint feature hierarchy model. Background Technology

[0002] Existing security detection methods have significant shortcomings. Traditional systems lack hierarchy in web application fingerprinting, making it difficult to effectively integrate feature information from different levels, which affects the accuracy of version identification.

[0003] Furthermore, existing technologies suffer from bottlenecks in version identification. Most systems fail to fully utilize anomaly responses and version identification information, and lack a voting mechanism based on feature weights, resulting in insufficient reliability of version identification results.

[0004] Existing systems have technical shortcomings in vulnerability detection. They lack the ability to intelligently process vulnerability knowledge, making it difficult to verify vulnerabilities through probe payloads, thus affecting the accuracy of detection results. Solving these problems is crucial for improving security detection capabilities. Summary of the Invention

[0005] To address the problems in existing technologies, this application provides a security detection method and apparatus based on a fingerprint feature hierarchy model, which can effectively solve the shortcomings of traditional technologies in fingerprint recognition, version verification, and vulnerability detection, and significantly improve the accuracy and reliability of security detection.

[0006] To solve at least one of the above problems, this application provides the following technical solution:

[0007] Firstly, this application provides a security detection method based on a fingerprint feature hierarchy model, including:

[0008] A multi-layer fingerprint feature library is constructed, dividing the web application into a support layer, a development framework layer, an application software layer, a front-end framework layer, and a third-party plugin layer. The support layer feature library is constructed by collecting TCP / IP protocol stack fingerprints and HTTP response header features; the development framework layer feature library is constructed by collecting framework paths and cookie naming rules; the application software layer feature library is constructed by collecting HTML page structure and static resource paths; the front-end framework layer feature library is constructed by collecting JavaScript global variables and Webpack bundling hash values; and the third-party plugin layer feature library is constructed by collecting external resource domain names and CSS class names. The five feature libraries are combined to form a fingerprint feature hierarchy model.

[0009] Sending a malformed HTTP request triggers an abnormal response, obtains the abnormal response data, monitors user network traffic, extracts version identifiers of JavaScript and CSS files, constructs semantic version range matching rules, performs feature extraction on the abnormal response data and the version identifiers based on the semantic version range matching rules, generates version identification results, and when features in the five-layer feature library conflict, calculates feature weight coefficients, initiates a voting mechanism based on the feature weight coefficients, and verifies the version identification results.

[0010] Data from a vulnerability knowledge base and security announcements are collected. Natural language processing is performed on the vulnerability knowledge base data and security announcement data to extract vulnerability description information. A vulnerability index matrix is ​​constructed, and the vulnerability description information is mapped to the vulnerability index matrix to generate a vulnerability version range. The version identification results are matched with the vulnerability version range to generate a high-risk target list. Probe payloads are sent to the targets in the high-risk target list to obtain response header information. The existence of vulnerabilities is verified based on the response header information, and a vulnerability detection report is output.

[0011] Furthermore, it also includes: constructing a feature association matrix, mapping the support layer features, development framework layer features, application software layer features, front-end framework layer features and third-party plugin layer features to a feature vector space, performing dimensionality normalization processing on the feature vector space, calculating the similarity coefficient between feature vectors, constructing a feature hierarchy relationship graph based on the similarity coefficient, inputting the feature hierarchy relationship graph into a feature combination model, and generating feature combination weights;

[0012] Based on the aforementioned feature combination weights, a hierarchical feature fusion network is constructed. The features of the support layer and the features of the development framework layer are combined to form an infrastructure feature sub-model. The features of the application software layer and the features of the front-end framework layer are combined to form an application framework feature sub-model. The features of the third-party plugin layer are mapped to the plugin feature sub-model. The infrastructure feature sub-model, the application framework feature sub-model, and the plugin feature sub-model are hierarchically combined to generate a fingerprint feature hierarchical model.

[0013] Furthermore, it also includes: constructing a request exception injection module, injecting malformed fields into the HTTP request header, modifying the HTTP request method and request parameters, generating a malformed HTTP request, sending the malformed HTTP request to the target system, collecting the abnormal response status code, abnormal response header and abnormal response body, constructing a traffic monitoring proxy, deploying a traffic mirror node, collecting user access traffic, extracting the JavaScript file path and CSS file path from the user access traffic, downloading the JavaScript file and the CSS file, and parsing the file content to obtain the version identifier;

[0014] A semantic version parser is constructed, which divides the version number into major version number, minor version number, and revision number, establishes a version number interval mapping table, matches the error information in the abnormal response data with the version number interval mapping table, extracts version features, matches the version identifiers of the JavaScript file and the CSS file with the version number interval mapping table, extracts version features, and generates version identification results based on the version features.

[0015] Furthermore, it also includes: constructing a feature weight calculation matrix, calculating the accuracy coefficient, coverage coefficient, and timeliness coefficient of the support layer features, development framework layer features, application software layer features, front-end framework layer features, and third-party plugin layer features, inputting the accuracy coefficient, coverage coefficient, and timeliness coefficient into the weight calculation model to generate feature weight coefficients, constructing feature conflict detection rules based on the feature weight coefficients, and performing conflict detection on the features in the five-layer feature library;

[0016] A multi-dimensional voting matrix is ​​constructed, and the feature weight coefficients are mapped to the voting weight space. The features in the five-layer feature library are grouped, and the voting weight of each group of features is calculated. The voting weights are arranged in descending order to generate a voting priority queue. Based on the voting priority queue, version verification rules are constructed, and the version identification results are verified through multiple rounds of voting to generate version verification results.

[0017] Furthermore, it also includes: deploying vulnerability data collection nodes, connecting to vulnerability knowledge base data sources and security bulletin data sources, collecting vulnerability identifiers, vulnerability descriptions, vulnerability scores, impact scope and remediation plans, constructing a vulnerability data preprocessing module, performing text segmentation on the vulnerability knowledge base data and the security bulletin data, removing stop words, extracting keywords, calculating word frequency weights, generating vulnerability keyword vectors, and inputting the vulnerability keyword vectors into a text classification model to extract vulnerability description information;

[0018] A vulnerability index construction module is constructed to classify the vulnerability description information according to vulnerability type, affected components, and vulnerability triggering conditions, construct vulnerability feature vectors, calculate the similarity between vulnerability feature vectors, construct a vulnerability association network based on the similarity, map the vulnerability association network to a multi-dimensional index space, and generate a vulnerability index matrix.

[0019] Furthermore, it also includes: performing dimensional decomposition on the vulnerability description information, extracting component name, version number, and patch number information, standardizing the component name to generate a component identifier, converting the version number into a version range representation, mapping the patch number to a patch sequence number, constructing a vulnerability feature tuple based on the component identifier, the version range, and the patch sequence number, and mapping the vulnerability feature tuple to the corresponding dimension of the vulnerability index matrix;

[0020] Version range information is extracted from the vulnerability index matrix using matrix operations. The intersection and union of the version ranges are calculated to generate version constraints. The version constraints are converted into version range expressions. Version matching rules are constructed based on the version range expressions. The version matching rules are normalized to generate the vulnerability version range.

[0021] Furthermore, it also includes: standardizing the version identification results, converting the version identification results into a version range representation, performing a range operation between the version range representation and the vulnerability version range, calculating the intersection of the version ranges, determining the version matching degree based on the intersection, setting a risk threshold, adding targets with a version matching degree higher than the risk threshold to a high-risk target list, and generating a probe payload for each target in the high-risk target list;

[0022] The system employs a multi-threaded approach to send probe payloads to targets in the high-risk target list, collects response status codes, response header fields, and response body content, extracts feature information from the response header fields, matches the feature information with vulnerability feature rules, calculates the confidence level of vulnerability existence, classifies the detection results based on the confidence level, and generates a vulnerability detection report.

[0023] Secondly, this application provides a security detection device based on a fingerprint feature hierarchy model, comprising:

[0024] The model building module is used to construct a multi-layer fingerprint feature library. It divides the web application into a support layer, a development framework layer, an application software layer, a front-end framework layer, and a third-party plugin layer. It collects TCP / IP protocol stack fingerprints and HTTP response header features to build the support layer feature library, collects framework paths and cookie naming rules to build the development framework layer feature library, collects HTML page structure and static resource paths to build the application software layer feature library, collects JavaScript global variables and Webpack bundling hash values ​​to build the front-end framework layer feature library, and collects external resource domain names and CSS class names to build the third-party plugin layer feature library. The five feature libraries are combined to form a fingerprint feature hierarchy model.

[0025] The version identification module is used to send malformed HTTP requests to trigger abnormal responses, obtain abnormal response data, monitor user network traffic, extract version identifiers of JavaScript and CSS files, construct semantic version range matching rules, extract features from the abnormal response data and the version identifiers based on the semantic version range matching rules, generate version identification results, and when features in the five-layer feature library conflict, calculate feature weight coefficients, start a voting mechanism based on the feature weight coefficients, and verify the version identification results.

[0026] The security detection module is used to collect vulnerability knowledge base data and security announcement data, perform natural language processing on the vulnerability knowledge base data and security announcement data to extract vulnerability description information, construct a vulnerability index matrix, map the vulnerability description information to the vulnerability index matrix, generate vulnerability version ranges, match the version identification results with the vulnerability version ranges to generate a high-risk target list, send probe payloads to targets in the high-risk target list, obtain response header information, verify the existence of vulnerabilities based on the response header information, and output a vulnerability detection report.

[0027] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the security detection method based on a fingerprint feature hierarchy model.

[0028] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the security detection method based on a fingerprint feature hierarchy model.

[0029] Fifthly, this application provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the security detection method based on a fingerprint feature hierarchy model.

[0030] As described above, this application provides a security detection method and apparatus based on a fingerprint feature hierarchy model. By innovatively constructing a five-layer fingerprint feature library, it achieves accurate identification of Web applications through multi-dimensional features such as protocol stack, framework path, page structure, JavaScript variables, and external resources. A version identification mechanism based on abnormal responses is designed, combining semantic version matching and feature weight voting to establish a reliable version confirmation strategy. A vulnerability knowledge processing mechanism is introduced, achieving accurate vulnerability detection through natural language analysis and probe payload verification. This method effectively solves the shortcomings of traditional technologies in fingerprint recognition, version confirmation, and vulnerability detection, significantly improving the accuracy and reliability of security detection. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating the security detection method based on a fingerprint feature hierarchy model in an embodiment of this application.

[0033] Figure 2 This is a structural diagram of the security detection device based on a fingerprint feature hierarchy model in the embodiments of this application;

[0034] Figure 3 This is a schematic diagram of the structure of the electronic device in the embodiments of this application.

[0035] Figure label:

[0036] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver storage unit 9144, antenna 9111, speaker 9131, microphone 9132. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0039] To address the shortcomings of existing technologies, this application provides a security detection method and apparatus based on a fingerprint feature hierarchy model. By innovatively constructing a five-layer fingerprint feature library, it achieves accurate identification of web applications through multi-dimensional features such as protocol stack, framework path, page structure, JavaScript variables, and external resources. A version identification mechanism based on anomaly responses is designed, combining semantic version matching and feature weight voting to establish a reliable version confirmation strategy. A vulnerability knowledge processing mechanism is introduced, achieving accurate vulnerability detection through natural language analysis and probe payload verification. This method effectively solves the deficiencies of traditional technologies in fingerprint recognition, version confirmation, and vulnerability detection, significantly improving the accuracy and reliability of security detection.

[0040] To effectively address the shortcomings of traditional technologies in fingerprint recognition, version verification, and vulnerability detection, and to significantly improve the accuracy and reliability of security detection, this application provides an embodiment of a security detection method based on a fingerprint feature hierarchy model. See [link to embodiment]. Figure 1 The security detection method based on the fingerprint feature hierarchy model specifically includes the following:

[0041] Step S101: Construct a multi-layer fingerprint feature library. Divide the web application into a support layer, development framework layer, application software layer, front-end framework layer, and third-party plugin layer. Collect TCP / IP protocol stack fingerprints and HTTP response header features to construct the support layer feature library. Collect framework paths and cookie naming rules to construct the development framework layer feature library. Collect HTML page structure and static resource paths to construct the application software layer feature library. Collect JavaScript global variables and Webpack bundling hash values ​​to construct the front-end framework layer feature library. Collect external resource domain names and CSS class names to construct the third-party plugin layer feature library. Combine the five feature libraries to form a fingerprint feature hierarchy model.

[0042] Optionally, this embodiment innovatively designs a multi-layered feature library construction scheme to address the problems of feature fragmentation and low recognition accuracy in Web application fingerprinting. The hierarchical feature scoring uses the formula: Layer_Score=Σ(Wi×Fi×Si), where Wi represents the feature weight of each layer, Fi represents the feature completeness, and Si represents the feature stability. This multi-dimensional scoring method achieves accurate feature quantification. The weight of each feature layer is dynamically adjusted according to its importance in application recognition, ensuring the accuracy and adaptability of the feature library.

[0043] This embodiment implements deep protocol analysis in the support layer feature acquisition. Through precise parsing of the TCP / IP protocol stack, the system can capture underlying network features including TCP window size, IP TTL value, and TCP MSS value. In HTTP response header analysis, it not only focuses on basic explicit identifiers such as Server and X-Powered-By, but also extracts implicit features such as response header order and custom header fields. For example, when analyzing a web server, different versions of server software can be accurately distinguished by the initial TCP window size and the order of TCP options, while the specific web server version can be identified by the timestamp format and error page features in the HTTP response header.

[0044] This embodiment innovatively implements a framework fingerprinting mechanism at the development framework layer. By analyzing the unique URL routing patterns of each framework, the system establishes a path feature library, including typical routing structures of common web frameworks such as Spring, Django, and Laravel. In terms of cookie analysis, a framework-level cookie feature model is constructed by extracting features such as cookie naming rules, scope settings, and expiration time formats. These features have a clear correspondence with the framework version, and the framework version can be accurately inferred through feature combination analysis.

[0045] This embodiment designs a static resource fingerprint extraction scheme for the application software layer. Through in-depth analysis of the HTML document structure, including DOM tree structure features, comment content features, and tag attribute features, an application-level structural feature library is constructed. In static resource path analysis, information such as the organization method, naming rules, and version markers of resource files is extracted to establish a resource path feature model. These features can effectively distinguish different versions of application software, providing a reliable basis for version identification.

[0046] This embodiment implements deep feature extraction at the front-end framework layer. A front-end framework feature library is constructed by analyzing features such as the namespace of JavaScript global variables, method signatures, and property structures. In Webpack bundling analysis, a build tool feature model is established by extracting features such as filename hash values, module loading methods, and code splitting strategies. These features have a stable correspondence with the front-end framework version, and the framework version can be accurately identified through feature matching.

[0047] This embodiment designs an external resource feature extraction scheme for the third-party plugin layer. By analyzing information such as CDN domain names, resource paths, and version tags of external resources, a plugin-level feature library is constructed. In CSS class name analysis, by extracting information such as naming rules, style priorities, and selector features, a style framework feature model is established. These features can effectively identify the version information of third-party plugins, providing support for version management of the plugin library.

[0048] This embodiment, by establishing a multi-layered feature library, not only solves the problem of traditional single-feature features being easily bypassed, but also provides more comprehensive version identification capabilities. Features at each layer complement each other through correlation analysis; when a feature at a certain layer is not obvious, cross-validation can be performed using features from other layers. This multi-layered feature extraction scheme significantly improves the accuracy and reliability of web application fingerprinting.

[0049] This embodiment's innovative design establishes a continuously optimizing feature extraction framework. Through continuous feature updates and verification, the system can adapt to the rapid development of Web technologies. This dynamically evolving feature library provides reliable technical support for the security assessment of Web applications, demonstrating strong identification capabilities and adaptability in practical applications.

[0050] Step S102: Send a malformed HTTP request to trigger an abnormal response, obtain abnormal response data, monitor user network traffic, extract version identifiers of JavaScript and CSS files, construct semantic version range matching rules, extract features from the abnormal response data and the version identifiers based on the semantic version range matching rules, generate version identification results, and when features in the five-layer feature library conflict, calculate feature weight coefficients, start a voting mechanism based on the feature weight coefficients, and verify the version identification results.

[0051] Optionally, this embodiment addresses the issues of insufficient information and feature conflicts in web application version identification by innovatively designing a version identification scheme based on abnormal response triggering and multi-dimensional feature fusion. First, a request exception injection module is constructed. This module injects specific malformed fields into the HTTP request header, such as modifying Content-Length to a negative value or inserting a non-standard X-Custom-Header. Simultaneously, the request method is mutated, for example, by changing the GET method to GETX or inserting illegal characters into the POST request body. These malformed requests can trigger the web application's exception handling logic, thereby exposing version-related error information in the response. This embodiment designs an abnormal response scoring formula: Error_Score=α×(Status_Weight×Status_Match)+β×(Header_Weight×Header_Match)+γ×(Body_Weight×Body_Match), where each Match represents the feature matching degree of the corresponding part, each Weight represents the weight coefficient, and α, β, and γ are scenario adjustment factors.

[0052] This embodiment deeply optimizes the traffic monitoring strategy. By deploying distributed traffic mirroring nodes, complete communication data is obtained without affecting normal user access. During traffic parsing, the system focuses on loading requests for JavaScript and CSS files, extracting version information from file paths using regular expressions, such as the version number in " / static / js / main.5e8f6a2.js". For scenarios using a content delivery network, the system tracks 302 redirects to ensure the correct resource files are obtained. After the files are downloaded, the JavaScript code is analyzed using an AST (Abstract Syntax Tree) to extract version declarations from global variables; the CSS parser analyzes stylesheet files to identify specific version comments. This information collectively constitutes an important supplement to the version characteristics.

[0053] This embodiment innovatively implements a semantic versioning mechanism. Based on the Semantic Versioning Specification (SemVer), the version number is parsed into three levels: major version number, minor version number, and revision number. By establishing a version number range mapping table, the system can accurately express the range relationship of versions, such as ">=2.3.0<3.0.0" representing all 2.3.0 and above versions 2.x. This range representation method can handle not only precise version numbers but also fuzzy version ranges. When an exception response contains information such as "Compatible with jQuery 1.x", the system can correctly parse and match the corresponding version range. This embodiment designs a version matching scoring formula: Version_Match = (Pattern_Weight × Version_Similarity) / (Version_Distance + ε), where Pattern_Weight represents the pattern weight, Version_Similarity is the version similarity, Version_Distance is the version distance, and ε is a smoothing factor.

[0054] This embodiment achieves accurate conflict resolution through feature weight calculation. To address potential feature conflicts within the five-layer feature library, the system constructs a multi-dimensional weight calculation matrix. The accuracy coefficient reflects the feature recognition accuracy and is obtained through statistical analysis of historical recognition results; the coverage coefficient represents the feature's coverage of different versions and is determined through feature library integrity assessment; the timeliness coefficient reflects the feature's update frequency and is calculated from feature update records. These coefficients collectively determine the feature's weight in conflict resolution.

[0055] This embodiment establishes a complete voting verification mechanism. Based on the calculated feature weights, the system constructs a multi-dimensional voting matrix. Features are grouped according to hierarchical relationships, and the comprehensive voting weight of each group is calculated. Feature groups with higher weights have greater voting influence, ensuring that the identification results are more inclined towards features with higher reliability. Through multiple rounds of voting, the system can effectively filter out inconsistent identification results, improving the accuracy of version identification.

[0056] This embodiment, through multi-dimensional feature analysis and intelligent conflict handling, not only solves the information deficiency problem in traditional version identification methods but also establishes a continuously optimizeable identification framework. The system can extract effective version features from complex web application environments, and through feature fusion and conflict handling, ensures the accuracy of the identification results. This intelligent identification scheme demonstrates excellent adaptability and recognition performance in various web applications.

[0057] This embodiment combines active detection and passive monitoring, minimizing the impact on the target system while ensuring accuracy in version identification. Version information is obtained by triggering abnormal responses through malformed requests, file features are extracted through traffic monitoring, and semantic version parsing and multi-round voting ensure reliable results. This design philosophy, balancing security and accuracy, allows the system to obtain sufficient information during version identification without adversely affecting the target system. In practical applications, this scheme significantly improves the accuracy and efficiency of version identification.

[0058] Step S103: Collect vulnerability knowledge base data and security bulletin data; perform natural language processing on the vulnerability knowledge base data and the security bulletin data to extract vulnerability description information; construct a vulnerability index matrix; map the vulnerability description information to the vulnerability index matrix to generate a vulnerability version range; match the version identification results with the vulnerability version range to generate a high-risk target list; send probe payloads to targets in the high-risk target list to obtain response header information; verify the existence of vulnerabilities based on the response header information; and output a vulnerability detection report.

[0059] Optionally, this embodiment addresses the issues of fragmented vulnerability information and high false positive rates in web application vulnerability detection by innovatively designing a vulnerability analysis and verification scheme based on natural language processing. First, a distributed vulnerability data collection network is established, connecting to mainstream vulnerability databases such as CVE, NVD, and CNVD, while simultaneously monitoring security announcements from major vendors. During the collection process, particular attention is paid to key information such as the complete description of the vulnerability, affected versions, and remediation plans. This embodiment designs a vulnerability relevance scoring formula: Vuln_Score=α×(Description_Match×Info_Weight)+β×(Version_Match×Version_Weight)+γ×(Patch_Match×Patch_Weight), where each Match represents the degree of matching in the corresponding dimension, each Weight represents a weight coefficient, and α, β, and γ are scenario adjustment factors.

[0060] This embodiment deeply optimizes the natural language processing workflow. First, the vulnerability description text is segmented and part-of-speech tagged to identify key technical terms, version information, and vulnerability types. Stop word filtering removes irrelevant information, retaining only valid technical content. During keyword extraction, an improved TF-IDF algorithm is used to calculate word frequency weights, considering both the positional information and semantic importance of words in the vulnerability description. This embodiment designs the keyword weight calculation formula: Word_Weight=(TF×IDF×Position_Factor) / (Context_Noise+ε), where TF represents word frequency, IDF represents inverse document frequency, Position_Factor is the positional weight, Context_Noise is the contextual noise, and ε is the smoothing factor. Through this multi-dimensional text analysis, the system can accurately extract the key features of vulnerabilities.

[0061] This embodiment innovatively implements a vulnerability index construction mechanism. Based on the extracted vulnerability description information, the system performs multi-dimensional classification according to vulnerability type (such as SQL injection, XSS, file upload, etc.), affected components (such as web servers, databases, frameworks, etc.), and vulnerability triggering conditions. By calculating the cosine similarity between vulnerability feature vectors, a correlation network between vulnerabilities is established. This correlation network not only reflects the similarity between vulnerabilities but also discovers potential vulnerability variants, providing more comprehensive feature support for subsequent vulnerability detection.

[0062] This embodiment achieves accurate vulnerability matching through version range generation. The system first performs structured processing on the version information in the vulnerability description, converting the text-based version description into a standard version range representation. During version matching, not only is precise matching of version numbers considered, but also the impact of patch levels. By extracting the intersection and union of version ranges through matrix operations, the system can accurately determine the version range affected by the vulnerability, avoiding version judgment biases in traditional methods.

[0063] This embodiment establishes a complete vulnerability verification mechanism. For high-risk targets, the system generates specific probe payloads. These payloads are carefully designed to effectively verify the existence of vulnerabilities without causing actual harm to the target system. In response analysis, the system not only focuses on status codes and error messages but also analyzes special fields in the response header and characteristic patterns in the response body, improving the accuracy of verification through multi-dimensional feature matching.

[0064] This embodiment establishes a multi-layered vulnerability analysis framework, which not only solves the information fragmentation problem in traditional methods but also provides more accurate vulnerability verification capabilities. The system can extract effective features from massive amounts of vulnerability data and significantly reduce the false positive rate through intelligent analysis and verification. This precise vulnerability detection solution has demonstrated excellent detection performance in various web applications.

[0065] This embodiment combines natural language processing and vulnerability feature engineering to improve the efficiency of vulnerability analysis while ensuring detection accuracy. It extracts vulnerability features through automated text analysis, ensures reliable detection results through multi-dimensional feature matching, and reduces false positives through an intelligent verification mechanism. This design philosophy, balancing efficiency and accuracy, enables the system to quickly locate problems while ensuring the reliability of detection results. In practical applications, this solution significantly improves the quality and efficiency of vulnerability detection.

[0066] This embodiment provides clear guidance for security operations personnel by outputting a detailed vulnerability detection report. The report includes not only basic vulnerability information and risk level, but also technical details, scope of impact, and remediation recommendations. This comprehensive vulnerability report effectively supports subsequent remediation work and improves the efficiency of vulnerability remediation.

[0067] As described above, the security detection method based on a fingerprint feature hierarchy model provided in this application can accurately identify Web applications by innovatively constructing a five-layer fingerprint feature library and utilizing multi-dimensional features such as protocol stack, framework path, page structure, JavaScript variables, and external resources. A version identification mechanism based on abnormal responses is designed, combining semantic version matching and feature weight voting to establish a reliable version confirmation strategy. A vulnerability knowledge processing mechanism is introduced, achieving accurate vulnerability detection through natural language analysis and probe payload verification. This method effectively addresses the shortcomings of traditional technologies in fingerprint recognition, version confirmation, and vulnerability detection, significantly improving the accuracy and reliability of security detection.

[0068] In one embodiment of the security detection method based on a fingerprint feature hierarchy model in this application, the method may further include the following:

[0069] Step S201: Construct a feature association matrix, map the features of the support layer, development framework layer, application software layer, front-end framework layer, and third-party plugin layer to the feature vector space, perform dimensionality normalization on the feature vector space, calculate the similarity coefficient between feature vectors, construct a feature hierarchy relationship graph based on the similarity coefficient, input the feature hierarchy relationship graph into the feature combination model, and generate feature combination weights.

[0070] Step S202: Construct a hierarchical feature fusion network based on the feature combination weights, combine the support layer features with the development framework layer features to form an infrastructure feature sub-model, combine the application software layer features with the front-end framework layer features to form an application framework feature sub-model, map the third-party plugin layer features to the plugin feature sub-model, and perform hierarchical combination of the infrastructure feature sub-model, the application framework feature sub-model, and the plugin feature sub-model to generate a fingerprint feature hierarchical model.

[0071] Optionally, this embodiment addresses the problems of complex correlations between Web application fingerprint features and poor feature combination effects by innovatively designing a feature correlation analysis and hierarchical fusion scheme based on matrix operations. During the feature vector mapping process, features at different levels are converted into standardized vector representations. Each feature vector contains information on multiple dimensions such as feature occurrence frequency, stability, and uniqueness. This embodiment designs a feature correlation scoring formula: Feature_Correlation = (Similarity_Weight × Co_occurrence) / (Feature_Distance + ε), where Similarity_Weight represents the similarity weight, Co_occurrence represents the co-occurrence frequency, Feature_Distance is the feature distance, and ε is a smoothing factor.

[0072] This embodiment deeply optimizes the feature vector space construction process. Principal Component Analysis (PCA) is used to reduce the dimensionality of high-dimensional features, retaining the most representative feature dimensions. In the dimensionality normalization process, the MinMax standardization method is used to transform features at different scales to a unified range. This embodiment designs a feature weight calculation formula: Feature_Weight=α×(Uniqueness×Stability)+β×(Coverage×Precision)+γ×(Time_Sensitivity×Update_Frequency), where each parameter represents the uniqueness, stability, coverage, precision, time sensitivity, and update frequency of the feature, respectively, and α, β, and γ are dynamic adjustment factors. This multi-dimensional weight calculation ensures a reasonable contribution of features in the fusion process.

[0073] This embodiment innovatively implements a feature hierarchy relationship construction mechanism. By calculating the cosine similarity between feature vectors, a correlation strength matrix between features is established. Based on this matrix, the system uses a hierarchical clustering algorithm to construct a feature hierarchy relationship graph. In the graph, nodes represent features, and edges represent the correlation strength between features. The hierarchical structure of the graph intuitively displays the dependencies between features. For example, when analyzing a web application, a strong correlation may be found between specific HTTP response header features (support layer) and framework routing features (development framework layer). This correlation provides an important basis for subsequent feature combinations.

[0074] This embodiment achieves deep feature combination through a hierarchical feature fusion network. In the infrastructure feature sub-model, the TCP / IP protocol stack features of the support layer and the routing features of the development framework layer are fused together, and a more discriminative feature representation is generated through weighted combination. This fusion takes into account the complementary relationships between features; for example, some framework features may only be apparent in specific server environments. The application framework feature sub-model combines the DOM structure features of the application software layer and the JavaScript features of the front-end framework layer to form a complete characterization of the application layer.

[0075] This embodiment establishes a complete feature combination optimization mechanism. The feature combination model optimizes the combination methods of features at different levels. The model uses a gradient descent algorithm to continuously adjust the combination weights until the optimal feature representation effect is achieved. During the optimization process, the system considers the timeliness and stability of features, assigning lower weights to frequently changing features and higher weights to stable features. This adaptive weight adjustment mechanism ensures the reliability of feature combinations.

[0076] This embodiment establishes a multi-layered feature fusion framework, which not only solves the problem of poor feature combination performance in traditional methods but also provides more accurate web application fingerprinting capabilities. The system can extract the most valuable combined features from complex feature sets, and through a hierarchical fusion strategy, significantly improves the accuracy of fingerprint recognition. This intelligent feature fusion scheme has demonstrated excellent recognition performance in various web applications.

[0077] This embodiment combines feature engineering and deep learning techniques to improve feature processing efficiency while ensuring recognition accuracy. It accelerates feature association analysis through matrix operations, optimizes feature combination through a hierarchical structure, and ensures model stability through adaptive weight adjustment. This design philosophy, balancing efficiency and accuracy, allows the system to maintain excellent performance even when processing large-scale feature data. In practical applications, this solution significantly improves the quality and efficiency of fingerprint recognition for web applications.

[0078] The fingerprint feature hierarchy model in this embodiment provides a reliable feature foundation for subsequent vulnerability detection. By rationally organizing and analyzing the features hierarchically, the system can more accurately identify the version information of web applications, thereby improving the accuracy of vulnerability detection. This feature representation method based on a hierarchical model provides strong technical support for the security assessment of web applications.

[0079] In one embodiment of the security detection method based on a fingerprint feature hierarchy model in this application, the method may further include the following:

[0080] Step S301: Construct a request exception injection module, inject malformed fields into the HTTP request header, modify the HTTP request method and request parameters, generate a malformed HTTP request, send the malformed HTTP request to the target system, collect the abnormal response status code, abnormal response header and abnormal response body, construct a traffic monitoring proxy, deploy a traffic mirror node, collect user access traffic, extract the JavaScript file path and CSS file path from the user access traffic, download the JavaScript file and the CSS file, and parse the file content to obtain the version identifier;

[0081] Step S302: Construct a semantic version parser, divide the version number into major version number, minor version number, and revision number, establish a version number interval mapping table, match the error information in the abnormal response data with the version number interval mapping table, extract version features, match the version identifiers of the JavaScript file and the CSS file with the version number interval mapping table, extract version features, and generate version identification results based on the version features.

[0082] Optionally, this embodiment addresses the challenges of information acquisition and low accuracy in version parsing during Web application version identification by innovatively designing an identification scheme based on anomaly triggering and semantic version parsing. In the anomaly injection module, this embodiment designs an anomaly response scoring formula: Response_Score=α×(Status_Weight×Error_Match)+β×(Header_Weight×Field_Match)+γ×(Body_Weight×Content_Match), where each Match represents the degree of matching of the corresponding part, each Weight represents a weight coefficient, and α, β, and γ are scenario adjustment factors. This multi-dimensional scoring method can accurately evaluate the information value of anomaly responses.

[0083] This embodiment deeply optimizes the request exception injection strategy. By injecting specific malformed fields into the HTTP request header, such as setting non-standard Content-Type values ​​or inserting incorrectly formatted Accept-Encoding fields, the system can trigger the exception handling logic of the web application. Regarding request method modification, in addition to using standard methods such as GET and POST, it also attempts to use special methods such as TRACE and CONNECT, or constructs completely non-standard custom methods. The construction of request parameters is also carefully designed, including inserting special characters, using excessively long parameter values, and constructing SQL injection samples. These malformed requests can effectively trigger the target system's error handling mechanism, thereby exposing version-related information in the response.

[0084] This embodiment innovatively implements a traffic monitoring mechanism. By deploying distributed traffic mirroring nodes, the system can obtain complete user access data without affecting normal business operations. The traffic monitoring proxy uses improved pcap technology, which can parse TCP / IP packets in real time and extract HTTP layer request and response information. During file path extraction, regular expressions are used to match the URL patterns of JavaScript and CSS files, while also considering the diversity of file naming, such as compressed files and filenames with version numbers. An intelligent retry mechanism is implemented during the download process to ensure successful acquisition of the target file even under unstable network conditions.

[0085] This embodiment achieves accurate version identification through a version parser. In semantic version parsing, the system follows the SemVer specification, resolving the version number into three levels: major version number, minor version number, and revision number. This embodiment designs a version matching degree calculation formula: Version_Match = (Pattern_Weight × Version_Similarity) / (Version_Distance + ε), where Pattern_Weight represents the pattern weight, Version_Similarity is the version similarity, Version_Distance is the version distance, and ε is a smoothing factor. This refined version matching mechanism ensures the accuracy of version identification.

[0086] This embodiment establishes a complete version number range mapping mechanism. By constructing a version number range mapping table, the system can handle various forms of version representation, including exact version numbers, version ranges, and compatibility declarations. For example, when encountering a description like "compatible with version 2.x", the system can correctly parse it as a version range of ">=2.0.0<3.0.0". This flexible mapping mechanism greatly improves the adaptability of version identification.

[0087] This embodiment achieves reliable version identification through multi-source version feature extraction. In anomaly response analysis, the system not only focuses on the version number directly appearing in the error message, but also analyzes indirect clues such as stack traces and debugging information. In JavaScript and CSS file analysis, version declarations are extracted from the code through AST parsing, and build information is identified through comment analysis. These features together constitute a complete version fingerprint.

[0088] This embodiment combines active detection and passive monitoring to minimize the impact on the target system while ensuring accurate identification. Version information is obtained through carefully designed malformed requests, version characteristics are supplemented by interference-free traffic monitoring, and semantic version parsing ensures accurate results. This design philosophy, balancing security and efficiency, allows the system to obtain sufficient information during version identification without causing substantial impact on the target system.

[0089] This embodiment, through comprehensive analysis of version characteristics, not only solves the information acquisition problem in traditional methods but also provides more accurate version identification capabilities. The system can collect version information from multiple dimensions and ensure the accuracy of the identification results through semantic parsing. This intelligent version identification scheme demonstrates excellent adaptability and recognition performance in various web applications.

[0090] This embodiment provides a reliable version information foundation for subsequent vulnerability detection. Through accurate version identification, the system can more precisely determine the vulnerability risks of the target application, thereby improving the efficiency and accuracy of vulnerability detection. This security assessment method based on accurate version identification provides strong technical support for the security protection of web applications.

[0091] In one embodiment of the security detection method based on a fingerprint feature hierarchy model in this application, the method may further include the following:

[0092] Step S401: Construct a feature weight calculation matrix, calculate the accuracy coefficient, coverage coefficient, and timeliness coefficient of the support layer features, development framework layer features, application software layer features, front-end framework layer features, and third-party plugin layer features, input the accuracy coefficient, coverage coefficient, and timeliness coefficient into the weight calculation model to generate feature weight coefficients, construct feature conflict detection rules based on the feature weight coefficients, and perform conflict detection on the features in the five-layer feature library;

[0093] Step S402: Construct a multi-dimensional voting matrix, map the feature weight coefficients to the voting weight space, group the features in the five-layer feature library, calculate the voting weight of each group of features, arrange the voting weights in descending order to generate a voting priority queue, construct version verification rules based on the voting priority queue, perform multiple rounds of voting verification on the version identification results, and generate version verification results.

[0094] Optionally, this embodiment addresses the problems of unreasonable feature weight allocation and low version verification accuracy in Web application version identification by innovatively designing a feature processing scheme based on multi-dimensional weight calculation and voting verification. In the weight calculation process, this embodiment designs a feature weight scoring formula: Weight_Score=α×(Accuracy×Coverage)+β×(Timeliness×Stability)+γ×(Uniqueness×Reliability), where each parameter represents the feature's accuracy, coverage, timeliness, stability, uniqueness, and reliability, respectively, and α, β, and γ are dynamic adjustment factors. This multi-dimensional scoring method can accurately assess the importance of features.

[0095] This embodiment deeply optimizes the feature weight calculation strategy. For support layer features, the system focuses on evaluating the stability of TCP / IP protocol stack fingerprints and HTTP response header features, calculating the feature change frequency through historical data analysis, and establishing a feature reliability model. In the evaluation of development framework layer features, the system focuses on the uniqueness of framework paths and cookie naming rules, determining the feature's discriminative power through statistical analysis. For application software layer features, the system focuses on the coverage of HTML structure and resource paths, evaluating the recognition range through feature matching experiments. The evaluation of front-end framework layer features emphasizes the timeliness of JavaScript global variables and bundled features, tracking and analyzing feature validity through version updates. For third-party plugin layer features, the system mainly focuses on the accuracy of external resource features, ensuring feature reliability through multiple verifications.

[0096] This embodiment innovatively implements a feature conflict detection mechanism. Based on the calculated feature weight coefficients, the system constructs multi-level conflict detection rules. When features at different levels point to different versions, the most reliable feature set is determined by weight comparison. This embodiment designs a conflict evaluation formula: Conflict_Score=(Weight_Difference×Feature_Similarity) / (Version_Distance+ε), where Weight_Difference represents the weight difference, Feature_Similarity is the feature similarity, Version_Distance is the version difference, and ε is a smoothing factor. This sophisticated conflict handling mechanism ensures the accuracy of version identification.

[0097] This embodiment achieves reliable version verification through a multi-dimensional voting matrix. The system first maps feature weight coefficients to a standardized voting weight space, ensuring the comparability of weights for features at different levels. During feature grouping, a hierarchical clustering algorithm is used to aggregate similar features into feature groups, improving the representativeness of the vote. The voting weight of each feature group is calculated by a weighted average of the feature weights within the group; feature groups with higher weights have greater influence during the voting process.

[0098] This embodiment establishes a complete voting priority management mechanism. By sorting the voting weights in descending order, the system generates a priority voting queue. Higher-priority feature groups participate in the voting first; if the result is significant, a conclusion can be quickly reached. If the result is unclear, lower-priority feature groups are invited to participate in the voting until a clear majority result is achieved. This progressive voting mechanism ensures both the accuracy of the decision and improves processing efficiency.

[0099] This embodiment verifies the reliability of version identification results through multi-round voting. In each round of voting, the system dynamically adjusts the voting weights and evaluates the credibility of features in real time based on the voting results of previous rounds. If the voting results of a feature group frequently contradict the majority opinion, its voting weight in subsequent rounds will be reduced. This adaptive voting mechanism can effectively filter out unreliable features and improve the accuracy of the verification results.

[0100] This embodiment combines weight calculation and voting verification, improving feature processing efficiency while ensuring recognition accuracy. Scientific weight allocation ensures the influence of important features, and a multi-round voting mechanism verifies the reliability of the recognition results. This design philosophy, balancing efficiency and accuracy, enables the system to exhibit excellent performance when handling complex version recognition tasks.

[0101] This embodiment, through precise calculation of feature weights and a scientifically designed voting mechanism, not only solves the weight allocation problem in traditional methods but also provides more reliable version verification capabilities. The system can accurately assess the importance of features at each layer and effectively handle feature conflicts through the voting mechanism, significantly improving the accuracy of version identification. This intelligent feature processing scheme has demonstrated excellent recognition performance in various web applications.

[0102] This embodiment provides reliable version information assurance for subsequent vulnerability detection. Through accurate feature weight calculation and reliable voting verification, the system can more accurately determine the version information of the target application, thereby improving the accuracy of vulnerability detection. This version identification method based on multi-verification provides strong technical support for the security assessment of web applications.

[0103] In one embodiment of the security detection method based on a fingerprint feature hierarchy model in this application, the method may further include the following:

[0104] Step S501: Deploy vulnerability data collection nodes, connect to vulnerability knowledge base data sources and security bulletin data sources, collect vulnerability identifiers, vulnerability descriptions, vulnerability scores, impact scope and remediation solutions, construct a vulnerability data preprocessing module, perform text segmentation on the vulnerability knowledge base data and the security bulletin data, remove stop words, extract keywords, calculate word frequency weights, generate vulnerability keyword vectors, input the vulnerability keyword vectors into a text classification model, and extract vulnerability description information;

[0105] Step S502: Construct a vulnerability index construction module, classify the vulnerability description information according to vulnerability type, affected components, and vulnerability triggering conditions, construct vulnerability feature vectors, calculate the similarity between vulnerability feature vectors, construct a vulnerability association network based on the similarity, map the vulnerability association network to a multi-dimensional index space, and generate a vulnerability index matrix.

[0106] Optionally, this embodiment innovatively designs a vulnerability information processing scheme based on natural language processing to address the problems of scattered web application vulnerability data collection and inaccurate vulnerability feature extraction. In the data processing process, this embodiment designs a vulnerability keyword scoring formula: Keyword_Score=α×(TF×IDF)+β×(Position_Weight×Context_Relevance)+γ×(Domain_Importance×Time_Factor), where TF represents word frequency, IDF represents inverse document frequency, Position_Weight is the position weight, Context_Relevance is the context relevance, Domain_Importance is the domain importance, Time_Factor is the time factor, and α, β, and γ are dynamic adjustment factors.

[0107] This embodiment deeply optimizes the vulnerability data collection strategy. By deploying distributed collection nodes, the system monitors mainstream vulnerability databases such as CVE, NVD, and CNVD in real time, while also paying attention to security announcements and technical blogs from major vendors. The collection process adopts an incremental update mechanism, avoiding duplicate collection by comparing vulnerability identifiers. In the data cleaning stage, the system uses regular expressions to filter HTML tags, standardizes the encoding format, and handles special characters to ensure data standardization. This embodiment designs a data quality assessment formula: Quality_Score = (Completeness × Accuracy) / (Noise_Level + ε), where Completeness represents completeness, Accuracy represents accuracy, Noise_Level represents noise level, and ε is a smoothing factor.

[0108] This embodiment innovatively implements a text preprocessing mechanism. During word segmentation, the system employs an improved maximum matching algorithm, combined with a specialized dictionary to identify technical terms and proper nouns. Stop word filtering removes frequently used words that have no substantial impact on the vulnerability description, improving the efficiency of text analysis. In the keyword extraction stage, the system not only considers word frequency statistics but also analyzes the position and grammatical role of words in sentences. For example, keywords appearing at the beginning of the vulnerability description or in the section on vulnerability impact receive higher weight, and technical terms and vulnerability type vocabulary are also given greater importance.

[0109] This embodiment achieves intelligent extraction of vulnerability descriptions through a text classification model. The model employs a deep learning architecture, using a BERT pre-trained model as its foundation, and fine-tunes it to adapt to the specific needs of the security domain. During training, supervised learning is performed using a large amount of labeled vulnerability data, enabling the model to accurately understand the semantic structure of vulnerability descriptions and extract key information from complex text. The model's input includes processed text sequences, and its output is structured vulnerability description information.

[0110] This embodiment establishes a complete vulnerability index construction mechanism. Based on the extracted vulnerability description information, the system classifies vulnerabilities in multiple dimensions according to vulnerability type (such as SQL injection, XSS, file upload, etc.), affected components (such as web servers, databases, frameworks, etc.), and vulnerability triggering conditions. In the feature vector construction process, Word2Vec technology is used to convert text features into dense vector representations, and cosine similarity is used to calculate the similarity relationship between vulnerabilities.

[0111] This embodiment achieves deep organization of vulnerability knowledge through a vulnerability association network. Based on the calculated similarity, the system constructs a multi-layered vulnerability association network. Nodes in the network represent vulnerabilities, edges represent the similarity relationships between vulnerabilities, and edge weights reflect the degree of similarity. This network structure can not only demonstrate the direct associations between vulnerabilities but also discover potential associations through path analysis, providing support for vulnerability variant identification.

[0112] This embodiment combines natural language processing and knowledge graph technologies to improve the accuracy of vulnerability analysis while optimizing knowledge organization efficiency. Multi-dimensional feature extraction ensures information integrity, and correlation network analysis strengthens the relevance of vulnerability knowledge. This intelligent vulnerability analysis solution demonstrates excellent analytical results and organizational capabilities in practical applications.

[0113] This embodiment provides a reliable knowledge foundation for subsequent vulnerability detection. Through accurate vulnerability feature extraction and efficient knowledge organization, the system can more accurately identify potential security threats and improve the accuracy of vulnerability detection. This knowledge-driven vulnerability analysis approach provides strong technical support for the security assessment of web applications.

[0114] This embodiment achieves efficient retrieval and matching of vulnerability knowledge through the construction of a vulnerability index matrix. The multi-dimensional index space not only supports exact matching but also similarity queries, greatly improving the efficiency and flexibility of vulnerability analysis. This structured knowledge organization method provides comprehensive technical support for vulnerability detection and protection.

[0115] In one embodiment of the security detection method based on a fingerprint feature hierarchy model in this application, the method may further include the following:

[0116] Step S601: Perform dimensional decomposition on the vulnerability description information, extract component name, version number, and patch number information, standardize the component name to generate a component identifier, convert the version number into a version range representation, map the patch number to a patch sequence number, construct a vulnerability feature tuple based on the component identifier, the version range, and the patch sequence number, and map the vulnerability feature tuple to the corresponding dimension of the vulnerability index matrix.

[0117] Step S602: Extract version range information from the vulnerability index matrix using matrix operations, calculate the intersection and union of the version ranges, generate version constraints, convert the version constraints into version range expressions, construct version matching rules based on the version range expressions, normalize the version matching rules, and generate vulnerability version ranges.

[0118] Optionally, this embodiment innovatively designs a vulnerability version analysis scheme based on multi-dimensional decomposition and matrix operations to address the problems of information fragmentation and inaccurate version range definition in Web application vulnerability version determination. During the version analysis process, this embodiment designs a vulnerability feature correlation scoring formula: Feature_Correlation=α×(Component_Match×Version_Overlap)+β×(Patch_Sequence×Time_Weight)+γ×(Context_Similarity×Confidence), where each parameter represents component matching degree, version overlap degree, patch sequence correlation, time weight, context similarity, and confidence, respectively, and α, β, and γ are scenario adjustment factors.

[0119] This embodiment deeply optimizes the dimensional decomposition strategy for vulnerability descriptions. By constructing a professional component name dictionary, the system can accurately identify the software component names in the description, including various variations and abbreviations. For example, for "Apache HTTP Server," the system can recognize different expressions such as "httpd" and "apache2." During the standardization process, a normalized mapping table is used to unify different forms of component names into standard identifiers. This embodiment designs a component matching degree calculation formula: Component_Score=(Name_Similarity×Alias_Match) / (Ambiguity_Factor+ε), where Name_Similarity represents name similarity, Alias_Match is alias matching degree, Ambiguity_Factor is ambiguity factor, and ε is smoothing factor.

[0120] This embodiment innovatively implements a version range conversion mechanism. For different forms of version representation, the system constructs a unified version range model. For exact version numbers, it directly converts them to dotted versions; for range descriptions such as "2.x", it converts them to the range representation "[2.0.0, 3.0.0)"; for conditional expressions such as ">= 1.2.3", it converts them to the range "[1.2.3, ∞)". This standardized version representation provides a unified foundation for subsequent version calculations. Regarding patch sequence processing, the system converts patch identifiers of different formats into monotonically increasing sequence numbers, facilitating version comparison and sorting.

[0121] This embodiment achieves a unified representation of multi-dimensional information through vulnerability feature tuples. These tuples contain standardized component identifiers, normalized version range representations, and serialized patch numbers. This structured representation not only preserves the integrity of the original information but also provides a data format that facilitates computation. When these feature tuples are mapped to the vulnerability index matrix, the system selects an appropriate mapping strategy based on the semantic features of the dimensions, ensuring that information is accurately represented in high-dimensional space.

[0122] This embodiment establishes a complete matrix operation framework. By extracting version range information through matrix operations, the system can efficiently process large amounts of version data. When calculating the intersection and union of version ranges, interval algebra operations are used to handle various complex version range relationships. These operation results directly reflect the precise range of versions affected by the vulnerability, providing a reliable basis for subsequent version matching.

[0123] This embodiment achieves precise version range definition through version constraints. The system converts the extracted version information into standard constraint expressions, such as "2.3.0 <= version < 3.0.0 AND patch_level >= 5". These constraints are normalized to form a unified version range expression. When constructing version matching rules, the system comprehensively considers all parts of the version number to ensure the completeness and accuracy of the rules.

[0124] This embodiment combines version semantic analysis and matrix calculation techniques, improving the accuracy of version determination while optimizing computational efficiency. Multi-dimensional information decomposition ensures the completeness of version information, while matrix operations accelerate the calculation of version ranges. This intelligent version analysis scheme demonstrates excellent judgment performance and processing capabilities in practical applications.

[0125] This embodiment provides precise version range support for subsequent vulnerability detection. Through accurate version range definition, the system can more precisely identify affected target systems, improving the accuracy of vulnerability detection. This vulnerability detection method based on precise version analysis provides reliable technical assurance for the security assessment of web applications.

[0126] This embodiment achieves standardized expression of version information by normalizing the generated vulnerability version range. This unified expression not only facilitates version comparison and matching but also provides a clear basis for version determination for the vulnerability detection system, significantly improving the efficiency and accuracy of vulnerability detection.

[0127] In one embodiment of the security detection method based on a fingerprint feature hierarchy model in this application, the method may further include the following:

[0128] Step S701: Standardize the version identification results, convert the version identification results into version range representations, perform range operations on the version range representations and the vulnerability version ranges, calculate the intersection of the version ranges, determine the version matching degree based on the intersection, set a risk threshold, add targets with version matching degrees higher than the risk threshold to the high-risk target list, and generate a probe payload for each target in the high-risk target list.

[0129] Step S702: Send probe payloads to targets in the high-risk target list using a multi-threaded approach, collect response status codes, response header fields, and response body content, extract feature information from the response header fields, match the feature information with vulnerability feature rules, calculate the confidence level of vulnerability existence, classify the detection results based on the confidence level, and generate a vulnerability detection report.

[0130] Optionally, this embodiment addresses the problems of low version matching accuracy and poor vulnerability verification efficiency in Web application vulnerability detection by innovatively designing a version matching and vulnerability verification scheme based on interval operations. During version processing, this embodiment designs a version matching score formula: Match_Score=α×(Version_Overlap / Version_Range)+β×(Component_Match×Patch_Level)+γ×(Feature_Match×Priority_Weight), where Version_Overlap represents the version overlap, Version_Range is the version range, Component_Match is the component matching degree, Patch_Level is the patch level, Feature_Match is the feature matching degree, Priority_Weight is the priority weight, and α, β, and γ are dynamic adjustment factors.

[0131] This embodiment deeply optimizes the version range processing strategy. Various forms of version representation are parsed using regular expressions and converted into standard range formats. For example, ">=2.0.0<3.0.0" is converted to [2.0.0, 3.0.0), and "~1.2.3" is converted to [1.2.3, 1.3.0). During range operations, the system employs an improved range tree algorithm to efficiently handle the intersection and union operations of version ranges. This embodiment designs a risk assessment formula: Risk_Level = (Version_Match × Impact_Score) / (Time_Factor + ε), where Version_Match represents the version matching degree, Impact_Score is the impact score, Time_Factor is the time factor, and ε is the smoothing factor.

[0132] This embodiment innovatively implements a probe payload generation mechanism. The system dynamically generates targeted probe payloads based on the vulnerability type and target characteristics. Different probe strategies are employed for different types of vulnerabilities. For example, for SQL injection vulnerabilities, specific SQL statement fragments are constructed; for file inclusion vulnerabilities, specific file path tests are designed. These payloads are carefully designed to effectively verify the existence of vulnerabilities without causing actual harm to the target system. The payload generation process considers the characteristics of the target system, such as the web server type and application framework, to ensure the effectiveness of the probe.

[0133] This embodiment achieves efficient vulnerability verification through multi-threaded probing. The system employs thread pool technology to dynamically adjust the number of concurrent threads, avoiding excessive pressure on the target system. During response analysis, it not only focuses on status code changes but also delves into response header fields and response body content. Through a feature matching rule base, the system can accurately identify the characteristic manifestations of various vulnerabilities, such as error message disclosure and abnormal response patterns.

[0134] This embodiment establishes a complete vulnerability verification mechanism. By analyzing various features in the response, the system calculates the confidence level of the vulnerability's existence. Feature analysis considers multiple dimensions, including the degree of anomaly in the response status, the relevance of error messages, and the feature matching degree of the response content. This multi-dimensional analysis method significantly improves the accuracy of vulnerability verification and effectively reduces the false positive rate.

[0135] This embodiment achieves a clear display of detection results through a tiered reporting mechanism. Based on the vulnerability confidence level, the system categorizes the detection results into different risk levels. For high-risk vulnerabilities, the report details the triggering conditions, impact scope, and remediation recommendations. This structured reporting format provides security operations personnel with clear guidance on vulnerability remediation.

[0136] This embodiment combines version matching and vulnerability verification technologies, improving detection accuracy while optimizing verification efficiency. Precise version range calculations ensure accurate target selection, while multi-threaded verification enhances detection efficiency. This design philosophy, balancing accuracy and efficiency, enables the system to exhibit excellent performance during large-scale vulnerability detection.

[0137] This embodiment provides reliable technical support for the security assessment of web applications. Through accurate version matching and effective vulnerability verification, the system can quickly identify potential security threats, providing a basis for application security protection decisions. This vulnerability detection method based on precise verification significantly improves the security of web applications.

[0138] This embodiment provides a complete solution for security management through the generation of vulnerability detection reports. The reports not only contain detailed vulnerability information but also offer targeted remediation suggestions, effectively supporting subsequent security hardening efforts. This comprehensive vulnerability management approach provides strong protection for the continuous secure operation of web applications.

[0139] To effectively address the shortcomings of traditional technologies in fingerprint recognition, version verification, and vulnerability detection, and to significantly improve the accuracy and reliability of security detection, this application provides an embodiment of a security detection device based on a fingerprint feature hierarchy model for implementing all or part of the aforementioned security detection method. See [link to embodiment]. Figure 2 The security detection device based on the fingerprint feature hierarchy model specifically includes the following components:

[0140] Model building module 10 is used to build a multi-layer fingerprint feature library. It divides the web application into a support layer, a development framework layer, an application software layer, a front-end framework layer, and a third-party plugin layer. It collects TCP / IP protocol stack fingerprints and HTTP response header features to build a support layer feature library, collects framework paths and cookie naming rules to build a development framework layer feature library, collects HTML page structure and static resource paths to build an application software layer feature library, collects JavaScript global variables and Webpack bundling hash values ​​to build a front-end framework layer feature library, and collects external resource domain names and CSS class names to build a third-party plugin layer feature library. The five feature libraries are combined to form a fingerprint feature hierarchy model.

[0141] Version identification module 20 is used to send a malformed HTTP request to trigger an abnormal response, obtain abnormal response data, monitor user network traffic, extract version identifiers of JavaScript files and CSS files, construct semantic version range matching rules, extract features from the abnormal response data and the version identifiers based on the semantic version range matching rules, generate version identification results, and when features in the five-layer feature library conflict, calculate feature weight coefficients, start a voting mechanism based on the feature weight coefficients, and verify the version identification results.

[0142] The security detection module 30 is used to collect vulnerability knowledge base data and security announcement data, perform natural language processing on the vulnerability knowledge base data and the security announcement data to extract vulnerability description information, construct a vulnerability index matrix, map the vulnerability description information to the vulnerability index matrix, generate a vulnerability version range, match the version identification results with the vulnerability version range to generate a high-risk target list, send probe payloads to targets in the high-risk target list, obtain response header information, verify the existence of vulnerabilities based on the response header information, and output a vulnerability detection report.

[0143] As described above, the security detection device based on a fingerprint feature hierarchy model provided in this application can accurately identify Web applications by innovatively constructing a five-layer fingerprint feature library and utilizing multi-dimensional features such as protocol stack, framework path, page structure, JavaScript variables, and external resources. A version identification mechanism based on anomaly responses is designed, combining semantic version matching and feature weight voting to establish a reliable version confirmation strategy. A vulnerability knowledge processing mechanism is introduced, achieving accurate vulnerability detection through natural language analysis and probe payload verification. This method effectively solves the shortcomings of traditional technologies in fingerprint recognition, version confirmation, and vulnerability detection, significantly improving the accuracy and reliability of security detection.

[0144] From a hardware perspective, in order to effectively address the shortcomings of traditional technologies in fingerprint recognition, version verification, and vulnerability detection, and significantly improve the accuracy and reliability of security detection, this application provides an embodiment of an electronic device for implementing all or part of the security detection method based on a fingerprint feature hierarchy model. The electronic device specifically includes the following components:

[0145] The system comprises a processor, memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to realize information transmission between the security detection device based on the fingerprint feature hierarchy model and core business systems, user terminals, and related databases and other related devices; the logic controller can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the logic controller can be implemented with reference to the embodiments of the security detection method based on the fingerprint feature hierarchy model and the embodiments of the security detection device based on the fingerprint feature hierarchy model in the embodiments, the contents of which are incorporated herein, and repeated details will not be described again.

[0146] It is understood that the user terminal may include smartphones, tablet computers, network set-top boxes, portable computers, desktop computers, personal digital assistants (PDAs), in-vehicle devices, smart wearable devices, etc. Among these, the smart wearable devices may include smart glasses, smartwatches, smart bracelets, etc.

[0147] In practical applications, the security detection method based on the fingerprint feature hierarchy model can be partially executed on the electronic device side as described above, or all operations can be completed in the client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are completed in the client device, the client device may further include a processor.

[0148] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0149] Figure 3 This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 3 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 3 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0150] In one embodiment, the security detection method based on a fingerprint feature hierarchy model can be integrated into a central processing unit 9100. The central processing unit 9100 can be configured to perform the following control:

[0151] Step S101: Construct a multi-layer fingerprint feature library. Divide the web application into a support layer, development framework layer, application software layer, front-end framework layer, and third-party plugin layer. Collect TCP / IP protocol stack fingerprints and HTTP response header features to construct the support layer feature library. Collect framework paths and cookie naming rules to construct the development framework layer feature library. Collect HTML page structure and static resource paths to construct the application software layer feature library. Collect JavaScript global variables and Webpack bundling hash values ​​to construct the front-end framework layer feature library. Collect external resource domain names and CSS class names to construct the third-party plugin layer feature library. Combine the five feature libraries to form a fingerprint feature hierarchy model.

[0152] Step S102: Send a malformed HTTP request to trigger an abnormal response, obtain abnormal response data, monitor user network traffic, extract version identifiers of JavaScript and CSS files, construct semantic version range matching rules, extract features from the abnormal response data and the version identifiers based on the semantic version range matching rules, generate version identification results, and when features in the five-layer feature library conflict, calculate feature weight coefficients, start a voting mechanism based on the feature weight coefficients, and verify the version identification results.

[0153] Step S103: Collect vulnerability knowledge base data and security bulletin data; perform natural language processing on the vulnerability knowledge base data and the security bulletin data to extract vulnerability description information; construct a vulnerability index matrix; map the vulnerability description information to the vulnerability index matrix to generate a vulnerability version range; match the version identification results with the vulnerability version range to generate a high-risk target list; send probe payloads to targets in the high-risk target list to obtain response header information; verify the existence of vulnerabilities based on the response header information; and output a vulnerability detection report.

[0154] As described above, the electronic device provided in this application innovatively constructs a five-layer fingerprint feature library, achieving accurate identification of Web applications through multi-dimensional features such as protocol stack, framework path, page structure, JavaScript variables, and external resources. A version identification mechanism based on anomaly responses is designed, combining semantic version matching and feature weight voting to establish a reliable version confirmation strategy. A vulnerability knowledge processing mechanism is introduced, achieving accurate vulnerability detection through natural language analysis and probe payload verification. This method effectively solves the shortcomings of traditional technologies in fingerprint recognition, version confirmation, and vulnerability detection, significantly improving the accuracy and reliability of security detection.

[0155] In another embodiment, the security detection device based on the fingerprint feature hierarchy model can be configured separately from the central processing unit 9100. For example, the security detection device based on the fingerprint feature hierarchy model can be configured as a chip connected to the central processing unit 9100, and the security detection method based on the fingerprint feature hierarchy model can be implemented through the control of the central processing unit.

[0156] like Figure 3 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily need to include these components. Figure 3 All components shown; in addition, the electronic device 9600 may also include Figure 3 For components not shown, please refer to existing technologies.

[0157] like Figure 3 As shown, the central processing unit 9100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device, which receives inputs and controls the operation of various components of the electronic device 9600.

[0158] The memory 9140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 9100 may execute the program stored in the memory 9140 to perform information storage or processing, etc.

[0159] Input unit 9120 provides input to central processing unit 9100. Input unit 9120 may be, for example, a keypad or touch input device. Power supply 9170 provides power to electronic device 9600. Display 9160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0160] The memory 9140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 via the central processing unit 9100.

[0161] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for the electronic device's communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0162] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processing unit 9100 to provide input signals and receive output signals, which is the same as in a conventional mobile communication terminal.

[0163] Based on different communication technologies, multiple communication modules 9110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module 9110 (transmitter / receiver) is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby realizing typical telecommunications functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Additionally, the audio processor 9130 is coupled to a central processing unit 9100, enabling on-device recording via the microphone 9132 and on-device playback of stored audio via the speaker 9131.

[0164] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the security detection method based on a fingerprint feature hierarchy model, where the execution subject is a server or client, as described in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the security detection method based on a fingerprint feature hierarchy model, where the execution subject is a server or client, as described in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0165] Step S101: Construct a multi-layer fingerprint feature library. Divide the web application into a support layer, development framework layer, application software layer, front-end framework layer, and third-party plugin layer. Collect TCP / IP protocol stack fingerprints and HTTP response header features to construct the support layer feature library. Collect framework paths and cookie naming rules to construct the development framework layer feature library. Collect HTML page structure and static resource paths to construct the application software layer feature library. Collect JavaScript global variables and Webpack bundling hash values ​​to construct the front-end framework layer feature library. Collect external resource domain names and CSS class names to construct the third-party plugin layer feature library. Combine the five feature libraries to form a fingerprint feature hierarchy model.

[0166] Step S102: Send a malformed HTTP request to trigger an abnormal response, obtain abnormal response data, monitor user network traffic, extract version identifiers of JavaScript and CSS files, construct semantic version range matching rules, extract features from the abnormal response data and the version identifiers based on the semantic version range matching rules, generate version identification results, and when features in the five-layer feature library conflict, calculate feature weight coefficients, start a voting mechanism based on the feature weight coefficients, and verify the version identification results.

[0167] Step S103: Collect vulnerability knowledge base data and security bulletin data; perform natural language processing on the vulnerability knowledge base data and the security bulletin data to extract vulnerability description information; construct a vulnerability index matrix; map the vulnerability description information to the vulnerability index matrix to generate a vulnerability version range; match the version identification results with the vulnerability version range to generate a high-risk target list; send probe payloads to targets in the high-risk target list to obtain response header information; verify the existence of vulnerabilities based on the response header information; and output a vulnerability detection report.

[0168] As described above, the computer-readable storage medium provided in this application innovatively constructs a five-layer fingerprint feature library, achieving accurate identification of Web applications through multi-dimensional features such as protocol stack, framework path, page structure, JavaScript variables, and external resources. A version identification mechanism based on anomaly responses is designed, combining semantic version matching and feature weight voting to establish a reliable version confirmation strategy. A vulnerability knowledge processing mechanism is introduced, achieving accurate vulnerability detection through natural language analysis and probe payload verification. This method effectively solves the shortcomings of traditional technologies in fingerprint recognition, version confirmation, and vulnerability detection, significantly improving the accuracy and reliability of security detection.

[0169] Embodiments of this application also provide a computer program product capable of implementing all steps of the security detection method based on a fingerprint feature hierarchy model, where the execution subject is a server or client, as described in the above embodiments. When executed by a processor, this computer program / instruction implements the steps of the security detection method based on a fingerprint feature hierarchy model. For example, the computer program / instruction implements the following steps:

[0170] Step S101: Construct a multi-layer fingerprint feature library. Divide the web application into a support layer, development framework layer, application software layer, front-end framework layer, and third-party plugin layer. Collect TCP / IP protocol stack fingerprints and HTTP response header features to construct the support layer feature library. Collect framework paths and cookie naming rules to construct the development framework layer feature library. Collect HTML page structure and static resource paths to construct the application software layer feature library. Collect JavaScript global variables and Webpack bundling hash values ​​to construct the front-end framework layer feature library. Collect external resource domain names and CSS class names to construct the third-party plugin layer feature library. Combine the five feature libraries to form a fingerprint feature hierarchy model.

[0171] Step S102: Send a malformed HTTP request to trigger an abnormal response, obtain abnormal response data, monitor user network traffic, extract version identifiers of JavaScript and CSS files, construct semantic version range matching rules, extract features from the abnormal response data and the version identifiers based on the semantic version range matching rules, generate version identification results, and when features in the five-layer feature library conflict, calculate feature weight coefficients, start a voting mechanism based on the feature weight coefficients, and verify the version identification results.

[0172] Step S103: Collect vulnerability knowledge base data and security bulletin data; perform natural language processing on the vulnerability knowledge base data and the security bulletin data to extract vulnerability description information; construct a vulnerability index matrix; map the vulnerability description information to the vulnerability index matrix to generate a vulnerability version range; match the version identification results with the vulnerability version range to generate a high-risk target list; send probe payloads to targets in the high-risk target list to obtain response header information; verify the existence of vulnerabilities based on the response header information; and output a vulnerability detection report.

[0173] As described above, the computer program product provided in this application innovatively constructs a five-layer fingerprint feature library, achieving accurate identification of Web applications through multi-dimensional features such as protocol stack, framework path, page structure, JavaScript variables, and external resources. A version identification mechanism based on anomaly responses is designed, combining semantic version matching and feature weight voting to establish a reliable version confirmation strategy. A vulnerability knowledge processing mechanism is introduced, achieving accurate vulnerability detection through natural language analysis and probe payload verification. This method effectively solves the shortcomings of traditional technologies in fingerprint recognition, version confirmation, and vulnerability detection, significantly improving the accuracy and reliability of security detection.

[0174] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0175] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0176] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0177] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0178] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A security detection method based on a fingerprint feature hierarchy model, characterized in that, The method includes: A multi-layer fingerprint feature library is constructed, dividing the web application into a support layer, a development framework layer, an application software layer, a front-end framework layer, and a third-party plugin layer. The support layer feature library is constructed by collecting TCP / IP protocol stack fingerprints and HTTP response header features; the development framework layer feature library is constructed by collecting framework paths and cookie naming rules; the application software layer feature library is constructed by collecting HTML page structure and static resource paths; the front-end framework layer feature library is constructed by collecting JavaScript global variables and Webpack bundling hash values; and the third-party plugin layer feature library is constructed by collecting external resource domain names and CSS class names. The five feature libraries are combined to form a fingerprint feature hierarchy model. Sending a malformed HTTP request triggers an abnormal response, obtains the abnormal response data, monitors user network traffic, extracts version identifiers of JavaScript and CSS files, constructs semantic version range matching rules, performs feature extraction on the abnormal response data and the version identifiers based on the semantic version range matching rules, generates version identification results, and when features in the five-layer feature library conflict, calculates feature weight coefficients, initiates a voting mechanism based on the feature weight coefficients, and verifies the version identification results. Data from a vulnerability knowledge base and security announcements are collected. Natural language processing is performed on the vulnerability knowledge base data and security announcement data to extract vulnerability description information. A vulnerability index matrix is ​​constructed, and the vulnerability description information is mapped to the vulnerability index matrix to generate a vulnerability version range. The version identification results are matched with the vulnerability version range to generate a high-risk target list. Probe payloads are sent to the targets in the high-risk target list to obtain response header information. The existence of vulnerabilities is verified based on the response header information, and a vulnerability detection report is output.

2. The security detection method based on a fingerprint feature hierarchy model according to claim 1, characterized in that, The process of combining the five-layer feature database to form a fingerprint feature hierarchy model includes: Construct a feature association matrix to map the features of the support layer, development framework layer, application software layer, front-end framework layer, and third-party plugin layer to the feature vector space. Perform dimensionality normalization on the feature vector space, calculate the similarity coefficient between feature vectors, construct a feature hierarchy relationship graph based on the similarity coefficient, and input the feature hierarchy relationship graph into the feature combination model to generate feature combination weights. Based on the aforementioned feature combination weights, a hierarchical feature fusion network is constructed. The features of the support layer and the features of the development framework layer are combined to form an infrastructure feature sub-model. The features of the application software layer and the features of the front-end framework layer are combined to form an application framework feature sub-model. The features of the third-party plugin layer are mapped to the plugin feature sub-model. The infrastructure feature sub-model, the application framework feature sub-model, and the plugin feature sub-model are hierarchically combined to generate a fingerprint feature hierarchical model.

3. The security detection method based on a fingerprint feature hierarchy model according to claim 1, characterized in that, The process involves sending a malformed HTTP request to trigger an abnormal response, acquiring abnormal response data, monitoring user network traffic, extracting version identifiers from JavaScript and CSS files, constructing semantic version range matching rules, and performing feature extraction on the abnormal response data and version identifiers based on these rules to generate version identification results, including: A request exception injection module is constructed to inject malformed fields into the HTTP request header, modify the HTTP request method and request parameters, generate a malformed HTTP request, send the malformed HTTP request to the target system, collect the abnormal response status code, abnormal response header and abnormal response body, construct a traffic monitoring proxy, deploy traffic mirror nodes, collect user access traffic, extract the JavaScript file path and CSS file path from the user access traffic, download the JavaScript file and the CSS file, and parse the file content to obtain the version identifier; A semantic version parser is constructed, which divides the version number into major version number, minor version number, and revision number, establishes a version number interval mapping table, matches the error information in the abnormal response data with the version number interval mapping table, extracts version features, matches the version identifiers of the JavaScript file and the CSS file with the version number interval mapping table, extracts version features, and generates version identification results based on the version features.

4. The security detection method based on a fingerprint feature hierarchy model according to claim 1, characterized in that, When features in the five-layer feature library conflict, a feature weight coefficient is calculated, and a voting mechanism is initiated based on the feature weight coefficient to verify the version identification result, including: A feature weight calculation matrix is ​​constructed to calculate the accuracy coefficient, coverage coefficient, and timeliness coefficient of the support layer features, development framework layer features, application software layer features, front-end framework layer features, and third-party plugin layer features. The accuracy coefficient, coverage coefficient, and timeliness coefficient are input into the weight calculation model to generate feature weight coefficients. Based on the feature weight coefficients, feature conflict detection rules are constructed to perform conflict detection on the features in the five-layer feature library. A multi-dimensional voting matrix is ​​constructed, and the feature weight coefficients are mapped to the voting weight space. The features in the five-layer feature library are grouped, and the voting weight of each group of features is calculated. The voting weights are arranged in descending order to generate a voting priority queue. Based on the voting priority queue, version verification rules are constructed, and the version identification results are verified through multiple rounds of voting to generate version verification results.

5. The security detection method based on a fingerprint feature hierarchy model according to claim 1, characterized in that, The process of collecting vulnerability knowledge base data and security bulletin data, performing natural language processing on the vulnerability knowledge base data and security bulletin data to extract vulnerability description information, and constructing a vulnerability index matrix includes: Deploy vulnerability data collection nodes, connect to vulnerability knowledge base data sources and security bulletin data sources, collect vulnerability identifiers, vulnerability descriptions, vulnerability scores, impact scope and remediation plans, construct a vulnerability data preprocessing module, perform text segmentation on the vulnerability knowledge base data and the security bulletin data, remove stop words, extract keywords, calculate word frequency weights, generate vulnerability keyword vectors, input the vulnerability keyword vectors into a text classification model, and extract vulnerability description information; A vulnerability index construction module is constructed to classify the vulnerability description information according to vulnerability type, affected components, and vulnerability triggering conditions, construct vulnerability feature vectors, calculate the similarity between vulnerability feature vectors, construct a vulnerability association network based on the similarity, map the vulnerability association network to a multi-dimensional index space, and generate a vulnerability index matrix.

6. The security detection method based on a fingerprint feature hierarchy model according to claim 1, characterized in that, The step of mapping the vulnerability description information to the vulnerability index matrix to generate a vulnerability version range includes: The vulnerability description information is decomposed dimensionally to extract component name, version number, and patch number information. The component name is standardized to generate a component identifier. The version number is converted into a version range representation. The patch number is mapped to a patch sequence number. A vulnerability feature tuple is constructed based on the component identifier, the version range, and the patch sequence number. The vulnerability feature tuple is mapped to the corresponding dimension of the vulnerability index matrix. Version range information is extracted from the vulnerability index matrix using matrix operations. The intersection and union of the version ranges are calculated to generate version constraints. The version constraints are converted into version range expressions. Version matching rules are constructed based on the version range expressions. The version matching rules are normalized to generate the vulnerability version range.

7. The security detection method based on a fingerprint feature hierarchy model according to claim 1, characterized in that, The process involves matching the version identification result with the vulnerability version range to generate a high-risk target list, sending probe payloads to targets in the high-risk target list, obtaining response header information, verifying the existence of the vulnerability based on the response header information, and outputting a vulnerability detection report, including: The version identification results are standardized and converted into version range representations. The version range representations are then subjected to range operations with the vulnerability version ranges to calculate the intersection of the version ranges. Based on the intersection, the version matching degree is determined, a risk threshold is set, and targets with version matching degrees higher than the risk threshold are added to a high-risk target list. A probe payload is generated for each target in the high-risk target list. The system employs a multi-threaded approach to send probe payloads to targets in the high-risk target list, collects response status codes, response header fields, and response body content, extracts feature information from the response header fields, matches the feature information with vulnerability feature rules, calculates the confidence level of vulnerability existence, classifies the detection results based on the confidence level, and generates a vulnerability detection report.

8. A security detection device based on a fingerprint feature hierarchy model, characterized in that, The device includes: The model building module is used to construct a multi-layer fingerprint feature library. It divides the web application into a support layer, a development framework layer, an application software layer, a front-end framework layer, and a third-party plugin layer. It collects TCP / IP protocol stack fingerprints and HTTP response header features to build the support layer feature library, collects framework paths and cookie naming rules to build the development framework layer feature library, collects HTML page structure and static resource paths to build the application software layer feature library, collects JavaScript global variables and Webpack bundling hash values ​​to build the front-end framework layer feature library, and collects external resource domain names and CSS class names to build the third-party plugin layer feature library. The five feature libraries are combined to form a fingerprint feature hierarchy model. The version identification module is used to send malformed HTTP requests to trigger abnormal responses, obtain abnormal response data, monitor user network traffic, extract version identifiers of JavaScript and CSS files, construct semantic version range matching rules, extract features from the abnormal response data and the version identifiers based on the semantic version range matching rules, generate version identification results, and when features in the five-layer feature library conflict, calculate feature weight coefficients, start a voting mechanism based on the feature weight coefficients, and verify the version identification results. The security detection module is used to collect vulnerability knowledge base data and security announcement data, perform natural language processing on the vulnerability knowledge base data and security announcement data to extract vulnerability description information, construct a vulnerability index matrix, map the vulnerability description information to the vulnerability index matrix, generate vulnerability version ranges, match the version identification results with the vulnerability version ranges to generate a high-risk target list, send probe payloads to targets in the high-risk target list, obtain response header information, verify the existence of vulnerabilities based on the response header information, and output a vulnerability detection report.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the security detection method based on a fingerprint feature hierarchy model as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the security detection method based on a fingerprint feature hierarchy model as described in any one of claims 1 to 7.

Images