Template cluster-based vulnerability scanning method, device and storage medium

Abstract

The application discloses a template cluster-based vulnerability scanning method and device, and a storage medium, and comprises the following steps: in response to a vulnerability scanning request initiated by a user, determining a scanning target of the vulnerability scanning request; loading at least one YAML classification template suitable for the scanning target to form a template cluster; performing global request merging and path optimization on the basis of address information of the scanning target and request specifications of each YAML classification template in the template cluster to obtain a detection request set; sending the detection request set to the scanning target, and receiving a response data set returned by the scanning target on the basis of the detection request set; extracting response matching rules of each YAML classification template in the template cluster, and performing matching analysis on the response data set by using the response matching rules; and generating a vulnerability detection report according to a matching analysis result. Through template rule encapsulation and global intelligent optimization, the application realizes scanning request order reduction and resource efficient utilization, and significantly improves detection efficiency and accuracy.

Description

Technical Field

[0001] This application relates to the fields of network security and information security technology, and in particular to a vulnerability scanning method, device and storage medium based on template clusters. Background Technology

[0002] In recent years, with the deep integration and widespread application of cloud computing, mobile internet, and big data technologies, cybersecurity has become a crucial foundation for maintaining the stable operation of various industries. However, with the continuous evolution and increasing complexity of various cyberattack methods, vulnerability exploitation security incidents occur frequently, among which attacks targeting application programming interfaces (APIs) are showing an explosive growth trend. Related statistics indicate that the annual growth rate of such attacks has increased significantly, with unauthorized access, injection attacks, and sensitive data breaches becoming the main forms of threat.

[0003] Against this backdrop, the traditional vulnerability scanning technology's strategy of full-scale traversal when dealing with increasingly large application programming interface (API) assets—applying all vulnerability detection templates to all interfaces—leads to a dramatic increase in scan requests. This scanning mode is not only inefficient but also puts immense pressure on the scanning engine's computational and memory resources. Furthermore, the long scan cycle can disrupt normal business operations. Traditional methods also lack intelligent path identification capabilities, failing to accurately correlate API paths with the applicability of corresponding vulnerability templates, resulting in a large number of invalid detections. This blind matching not only significantly reduces scanning efficiency but also wastes substantial system resources.

[0004] Furthermore, since resource consumption increases almost linearly with the scanning scale, traditional methods are prone to problems such as excessive CPU utilization and a surge in business response latency in high-concurrency scenarios, which seriously affect system stability and business availability.

[0005] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of this application is to provide a vulnerability scanning method, device and storage medium based on template clusters, which aims to solve the technical problems of low efficiency, high resource consumption and insufficient accuracy of existing API vulnerability scanning.

[0007] To achieve the above objectives, this application proposes a vulnerability scanning method based on template clusters, which includes:

[0008] In response to a vulnerability scanning request initiated by a user, determine the scanning target of the vulnerability scanning request;

[0009] Load at least one YAML category template adapted to the scanning target to form a template cluster, wherein the YAML category template is a structured text encapsulating a complete set of rules, the complete set of rules being used to verify vulnerabilities, including request specifications and response matching rules;

[0010] Based on the address information of the scanning target and the request specifications of each YAML category template in the template cluster, a global request merging and path optimization are performed to obtain a probe request set;

[0011] Send the detection request set to the scanning target and receive the response dataset returned by the scanning target based on the detection request set;

[0012] Extract the response matching rules of each YAML category template in the template cluster, and perform matching analysis on the response dataset using the response matching rules;

[0013] A vulnerability detection report is generated based on the matching analysis results.

[0014] In one embodiment, the step of obtaining a probe request set by performing global request merging and path optimization based on the address information of the scanning target and the request specifications of each YAML category template in the template cluster includes:

[0015] Calculate the path parameter edit distance of the request specification in each of the YAML category templates, and establish a path similarity matrix based on the calculation results;

[0016] In the path similarity matrix, target requests with similarity greater than or equal to a preset similarity threshold are grouped into the same request group;

[0017] Create a resource identifier template for the request group, the resource identifier template including all variable path parameters;

[0018] The probe request set is generated using the resource identifier template, and the probe request set covers all path variation cases within the request group.

[0019] In one embodiment, the step of sending the probe request set to the scanning target and receiving the response dataset returned by the scanning target based on the probe request set includes:

[0020] Real-time monitoring of the response time and error rate of the scanned target based on the detection request set;

[0021] The number of threads sending probe requests is dynamically adjusted based on the response time, and when the error rate is determined to exceed a preset error threshold, the process switches to a backup scanning target of the scanning target.

[0022] Reduce the sending frequency of the detection request set and send the detection request set to the backup scanning target.

[0023] In one embodiment, the step of sending the probe request set to the scanning target and receiving the response dataset returned by the scanning target based on the probe request set includes:

[0024] For each probe request in the probe request set, generate a random user agent identifier and Referer header information;

[0025] The detection requests in the detection request set are sent to the scanning target sequentially at pre-generated time intervals.

[0026] In one embodiment, after the step of extracting the response matching rules of each YAML category template in the template cluster and performing matching analysis on the response dataset using the response matching rules, the method further includes:

[0027] A hash algorithm is used to deduplicate vulnerability feature values ​​in the matching analysis results, and a machine learning model is used to filter false vulnerability reports from the deduplication results to obtain the target vulnerability feature values, which include response time, response length, and character distribution entropy value.

[0028] Based on the target vulnerability feature values, a vulnerability association map is generated. The vulnerability association map is used to visually display the relationship between vulnerabilities and the attack path.

[0029] In one embodiment, the step of loading at least one YAML classification template adapted to the scanning target to form a template cluster includes:

[0030] The template syntax of the YAML category template is validated, including static analysis and semantic validation.

[0031] If the template syntax contains errors, load the backup template corresponding to the YAML category template and generate syntax repair suggestions for the YAML category template.

[0032] In one embodiment, the step of generating a vulnerability detection report based on the matching analysis results includes:

[0033] Identify the target response data that successfully matches the response matching rule in the matching analysis results, and generate an initial alarm notification for the target response data to trigger a verification probe request;

[0034] If the verification probe request matches the response matching rule successfully, a vulnerability alert is generated.

[0035] In one embodiment, the step of generating a vulnerability detection report based on the matching analysis results includes:

[0036] When a single response data point simultaneously satisfies the response matching rules of multiple YAML classification templates, the association weight between each of the response matching rules is calculated.

[0037] A composite vulnerability alert is generated based on the association weights and pre-set vulnerability severity levels. The composite vulnerability alert includes a vulnerability chain relationship graph and a comprehensive risk score.

[0038] Furthermore, to achieve the above objectives, this application also proposes a template cluster-based vulnerability scanning device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the template cluster-based vulnerability scanning method described above.

[0039] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the template cluster-based vulnerability scanning method described above.

[0040] One or more technical solutions proposed in this application have at least the following technical effects:

[0041] In response to a user-initiated vulnerability scanning request, the system determines the scanning target of the vulnerability scanning request; loads at least one YAML category template adapted to the scanning target to form a template cluster, wherein the YAML category template is a structured text encapsulating a complete rule set, which is used to verify vulnerabilities and includes request specifications and response matching rules; based on the address information of the scanning target and the request specifications of each YAML category template in the template cluster, a global request merging and path optimization are performed to obtain a probe request set; the probe request set is sent to the scanning target, and the system receives the response dataset returned by the scanning target based on the probe request set; the response matching rules of each YAML category template in the template cluster are extracted, and the response dataset is matched and analyzed using the response matching rules; a vulnerability detection report is generated based on the matching analysis results.

[0042] Therefore, this application achieves a reduction in the number of scanning requests and efficient use of resources through templated rule encapsulation and global intelligent optimization, thereby significantly improving detection efficiency and accuracy. Attached Figure Description

[0043] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating an embodiment of the vulnerability scanning method based on template clusters provided in this application.

[0046] Figure 2 This is a detailed step diagram of step S30 above;

[0047] Figure 3 This is a detailed step diagram of step S40 above;

[0048] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the vulnerability scanning method based on template clusters in this application embodiment.

[0049] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0050] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0051] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0052] The main solution of this application embodiment is as follows: In response to a vulnerability scanning request initiated by a user, the scanning target of the vulnerability scanning request is determined; at least one YAML category template adapted to the scanning target is loaded to form a template cluster, wherein the YAML category template is a structured text encapsulating a complete rule set, the complete rule set being used to verify vulnerabilities, including request specifications and response matching rules; based on the address information of the scanning target and the request specifications of each YAML category template in the template cluster, global request merging and path optimization are performed to obtain a probe request set; the probe request set is sent to the scanning target, and the response dataset returned by the scanning target based on the probe request set is received; the response matching rules of each YAML category template in the template cluster are extracted, and the response dataset is matched and analyzed using the response matching rules; a vulnerability detection report is generated based on the matching analysis results.

[0053] Traditional vulnerability scanning techniques employ a full-scale traversal strategy when dealing with increasingly large application programming interface (API) assets—applying all vulnerability detection templates to all interfaces—leading to a dramatic increase in scan requests. This scanning mode is not only inefficient but also puts immense pressure on the scanning engine's computational and memory resources. Furthermore, the long scan cycle can disrupt normal business operations. Traditional methods lack intelligent path identification capabilities, failing to accurately correlate API paths with corresponding vulnerability templates, resulting in numerous invalid detections. This blind matching significantly reduces scanning efficiency and wastes substantial system resources. Moreover, since resource consumption increases almost linearly with scan size, traditional methods are prone to excessive CPU utilization and surging business response latency in high-concurrency scenarios, severely impacting system stability and business availability.

[0054] This application provides a solution that achieves precision and efficiency in the vulnerability scanning process through YAML-based template clustering technology. Employing intelligent path matching and a global request merging mechanism significantly reduces the number of scan requests, shortening the detection time for large-scale API vulnerabilities from several hours to minutes. Dynamic load balancing and resource scheduling strategies effectively control CPU, memory, and bandwidth consumption, ensuring the normal operation of business systems. Simultaneously, combining multi-dimensional response matching rules greatly improves vulnerability detection accuracy and reduces false positives and false negatives. The structured template-based design also eliminates the need for system reconstruction when adding new detection rules, greatly enhancing the system's scalability and adaptability.

[0055] Based on this, embodiments of this application provide a vulnerability scanning method based on template clusters, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the template cluster-based vulnerability scanning method of this application. In this embodiment, the template cluster-based vulnerability scanning method includes steps S10 to S50:

[0056] Step S10: In response to the vulnerability scanning request initiated by the user, determine the scanning target of the vulnerability scanning request;

[0057] In this embodiment, the user initiates a vulnerability scanning request through the system interface, and the request is received and parsed by a multi-protocol adaptation layer. During the parsing of the vulnerability scanning request, a layered processing mechanism is employed to perform syntax parsing on the request message, extracting key parameters including the target address, scan depth, protocol type, and authentication information. A parameter verification engine is then activated to perform completeness and validity checks on the extracted key parameters. The validity check process includes multi-dimensional testing such as target address format compliance checks, network reachability tests, and permission verification to ensure that the scanning task meets the basic conditions for execution.

[0058] After the key parameters are verified, the target identification and classification engine is activated. Based on the target address's feature vector (including domain name features, IP segment distribution, port open status, etc.) and the user-specified scan type, the engine combines protocol fingerprints and technical feature data from the knowledge base to perform multi-dimensional feature extraction and intelligent classification of the scanned target. Furthermore, it dynamically constructs a target profile using machine learning algorithms, identifying key characteristics such as the technical framework, middleware version, and service type used by the target system corresponding to the vulnerability scan request, and initially delineates the scan scope and security boundaries based on these key characteristics.

[0059] Furthermore, semantic network topology modeling technology is employed to construct a dynamic scanning path map based on the service dependencies and network architecture characteristics of the target system, identifying the distribution of key business nodes and sensitive resources within the target system and avoiding invalid scanning of non-critical areas. Simultaneously, by intelligently learning target feature patterns from historical scanning records, a target classification and prediction model is established to improve the accuracy and efficiency of target identification. Additionally, during the target determination process, a real-time resource assessment mechanism is used to monitor the response characteristics and network status of the target system, and the scanning strategy is dynamically adjusted to identify the load capacity of the target system, avoiding service interruptions caused by scanning operations.

[0060] In summary, the scanning results of the aforementioned scanning operation are used as the scanning targets, and a detailed target evaluation report is generated based on these targets, providing accurate input for subsequent template loading and request merging. Through a multi-layered dynamic adaptation mechanism, precise positioning and intelligent classification of scanning targets are achieved, improving the targeting and efficiency of vulnerability scanning while minimizing system resource consumption.

[0061] Step S20: Load at least one YAML classification template adapted to the scanning target to form a template cluster, wherein the YAML classification template is a structured text encapsulating a complete rule set, the complete rule set being used to verify vulnerabilities, including request specifications and response matching rules;

[0062] After identifying the scanning target, an adaptive template loading engine is activated, based on a multi-dimensional feature matching algorithm, to select a YAML classification template from a distributed template library that matches the scanning target. This YAML classification template encapsulates a complete set of vulnerability detection rules in a structured text format. The request specifications defined in the YAML classification template include technical elements such as protocol type, request method, path construction, header definition, and payload format. The response matching rules include discrimination conditions such as status code verification, content pattern recognition, feature string matching, and dynamic behavior detection. Furthermore, the YAML classification template organizes the detection logic through a clear hierarchical structure, supports conditional judgments and variable references, ensuring the integrity and executability of the vulnerability verification process.

[0063] During the adaptive loading process, deep feature extraction is performed on the scanned target, including the technology stack characteristics used by the target system, service architecture patterns, protocol support, and historical vulnerability characteristics, to construct a target technology profile. Furthermore, by analyzing the target system's response characteristics and network behavior patterns in real time, the template selection strategy is dynamically adjusted to ensure that the selected YAML classification template matches the technical characteristics of the scanned target.

[0064] Based on this, the template loading engine employs a semantic understanding-based multi-level indexing mechanism to organize the YAML categorized templates in a three-dimensional manner according to multiple dimensions such as protocol type, service version, vulnerability classification, and impact level. Furthermore, the template loading engine analyzes the semantic annotations in the template metadata to establish a template feature vector space and calculates similarity with the target technology profile. During the similarity calculation, an adaptive weight adjustment algorithm is used to dynamically adjust the feature dimension weight ratios of each YAML template according to different scanning scenarios, thereby further improving the accuracy and adaptability of the YAML categorized template selection.

[0065] A template cluster is constructed by selecting the chosen YAML classification templates, and an intelligent deduplication and optimization mechanism is implemented during the construction process. Specifically, the intelligent deduplication and optimization mechanism essentially eliminates redundant detections by analyzing the rule dependencies and detection logic overlaps between templates and using rule primitive sharing technology. Furthermore, based on dynamic combination and adjustment, specific detection rules are dynamically activated or disabled according to the real-time response characteristics of the scanned target, realizing online optimization of the detection strategy of the YAML classification templates. Based on this, the final template cluster is obtained through the optimization results. Further, the generation of the template cluster also includes an evolution mechanism, which can automatically optimize the template combination strategy by continuously learning historical detection results and target system characteristics.

[0066] Furthermore, when loading the YAML category templates using an adaptive loading mechanism based on the scanning targets, a real-time template update subsystem monitors the latest vulnerability intelligence and rule updates, dynamically generating new YAML category templates based on detected vulnerability intelligence and rule updates and injecting them into the existing template cluster. This update process uses a hot-swappable approach to avoid affecting the normal scanning tasks of the template cluster. Based on this, a version compatibility detection and rule conflict resolution mechanism enables the new YAML category templates to work collaboratively with the existing template cluster. Simultaneously, a template performance evaluation system is established to continuously optimize the template selection strategy based on feedback from detection results.

[0067] In this embodiment, the loading process of the YAML category templates adopts a distributed parallel processing architecture. A load balancing algorithm distributes the YAML category template loading tasks to multiple computing nodes to improve the construction efficiency of large-scale template clusters. Furthermore, a template caching optimization strategy is employed, establishing a multi-level caching mechanism based on template usage frequency and detection performance to accelerate the loading speed of commonly used YAML category templates.

[0068] Based on the loading of the aforementioned YAML category templates, the step of loading at least one YAML category template of the scanned target to form a template cluster includes:

[0069] The template syntax of the YAML category template is validated, including static analysis and semantic validation.

[0070] If the template syntax contains errors, load the backup template corresponding to the YAML category template and generate syntax repair suggestions for the YAML category template.

[0071] In this embodiment, during the loading of the YAML classification template, the system initiates a multi-layered validation mechanism to ensure the template's syntactic correctness. The static analysis phase uses a grammar-based parser to perform lexical and syntactic analysis on the template, detecting structural errors, formatting anomalies, and symbol matching issues. The semantic validation phase uses a rule logic validator to check the logical consistency between the request specifications and response matching rules defined in the template, identifying problems such as undefined variable references, type mismatches, and circular dependencies. Specifically, when a syntax error is detected, the system immediately triggers a repair suggestion generation engine. This engine first accurately locates and classifies the error, searching for similar cases in a historical error database using a pattern matching algorithm. Based on the error type and context, the engine extracts applicable repair patterns from the repair rule database and generates specific modification suggestions. These repair suggestions include error location, error cause analysis, suggested modification solutions, and a post-modification example, forming a complete repair guidance document.

[0072] Meanwhile, the system automatically loads the corresponding backup template to ensure the continuity of the scanning process. The backup template adopts a version management mechanism, selecting the most suitable backup version based on the timestamp and template fingerprint. During the loading process, a difference comparison is performed, recording the differences between the current template and the backup version, providing a reference for subsequent template repair.

[0073] The entire verification and remediation process is managed in a closed loop. The system automatically feeds back the generated remediation suggestions to the template management platform, records error patterns and remediation solutions, and continuously optimizes the verification rule base and remediation knowledge base. This mechanism effectively ensures the reliability and stability of the template cluster and guarantees the smooth execution of the vulnerability detection process.

[0074] Step S30: Based on the address information of the scanned target and the request specifications of each YAML category template in the template cluster, perform global request merging and path optimization to obtain a probe request set;

[0075] Based on the generated template cluster, the complete rule set of each YAML category template in the template cluster is determined. To this end, a global request merging and path optimization engine is initiated using the address information of the scanning target and the request specifications of the complete rule set of the template cluster. This engine employs a multi-stage processing pipeline. First, it performs a full-domain analysis of the original requests in all YAML category templates within the template cluster. Then, it establishes a request feature matrix, vectorizing key features such as protocol type, target path, request parameters, and request method for each request to form a computable request feature space. Based on this, a request clustering algorithm based on semantic similarity is implemented to identify requests that appear different but are semantically similar, thereby achieving deep request merging.

[0076] Furthermore, a multi-layered deduplication strategy is employed during this request merging process. The first layer uses an exact matching algorithm to identify identical request specifications, including consistent URL paths, query parameters, and request header information. The second layer implements parameterized request merging technology, parameterizing request specifications with the same path template but different parameter values ​​to generate a unified parameterized request template. The third layer uses a semantic-level merging algorithm, analyzing the semantic purpose and expected response characteristics of the request specifications to merge multiple semantically related request specifications into a composite probe request. This multi-layered merging strategy significantly reduces the number of requests while maintaining the integrity of vulnerability detection.

[0077] The path optimization module performs path optimization based on merged request specifications. This optimization employs an intelligent routing algorithm based on the target system topology, constructing a network topology model and service dependency graph of the target system through a combination of active probing and passive analysis. The optimal request sending sequence is calculated using this network topology model, grouping and sorting request specifications with the same physical path or logical service to minimize network hops and connection establishment overhead. Furthermore, this path optimization process also considers multiple factors such as network latency, bandwidth limitations, and the target system's load capacity, dynamically adjusting the request sending strategy accordingly.

[0078] Furthermore, based on the processing results of the aforementioned global request merging and path optimization, global load balancing optimization is implemented during the generation of the probe request set. A distributed scheduling algorithm is used to rationally distribute the probe request set across multiple scanning nodes, avoiding single-point overload. Simultaneously, data compression and protocol optimization techniques are employed to reduce network transmission overhead. The final generated probe request set minimizes the number of requests and maximizes scanning efficiency through intelligent sorting and scheduling, laying a solid foundation for subsequent vulnerability detection.

[0079] Step S40: Send the detection request set to the scanning target and receive the response dataset returned by the scanning target based on the detection request set;

[0080] After completing global request merging and path optimization to obtain the probe request set, a distributed request sending engine is activated to send the optimized probe request set to the scanning target. The distributed request sending engine employs an adaptive concurrent transmission architecture to dynamically adjust the request sending strategy based on the target system's network characteristics and service capacity. Intelligent traffic shaping technology is implemented during the sending process, using a token bucket algorithm to control the request sending rate and avoid causing sudden load pressure on the target system. Simultaneously, a connection reuse mechanism is employed to maintain connections for multiple requests to the same target, reducing the overhead of TCP handshakes and SSL negotiations.

[0081] Furthermore, a multi-channel asynchronous transmission mode is employed to select the optimal transmission protocol and encoding method based on the characteristics of the request and the type of the target service. Redundant transmission is implemented for critical requests, sending key probe requests simultaneously through multiple network paths to ensure the reliability of the detection task. Specifically, each request in the probe request set carries a unique tracking identifier, which includes the request sequence, timestamp, and template association information, providing a foundation for subsequent response correlation analysis.

[0082] A high-performance response acquisition cluster is deployed at the receiving end, employing an event-driven asynchronous I / O model to process massive amounts of response data. The receiver utilizes a multi-level buffer design: the first-level buffer is responsible for quickly receiving raw response data, while the second-level buffer performs preliminary data cleaning and format standardization. Real-time data integrity verification is implemented during the receiving process, ensuring the integrity and orderliness of the response data through checksum verification and sequence number checks.

[0083] A streaming analytics architecture is employed to perform real-time parsing and feature extraction on received response data. A response data classification engine is built to dynamically allocate response data to different processing pipelines based on response content characteristics, protocol type, and detection requirements. Furthermore, for large response datasets, a block processing mechanism is implemented, employing sliding window technology for streaming analysis to avoid memory overflow and improve processing efficiency.

[0084] In addition, a response data quality monitoring system is established to evaluate the integrity and availability of the response data in real time. Invalid responses or interfering data are identified through anomaly detection algorithms, and an automatic retry mechanism is initiated. For critical vulnerability detection requests, multi-copy reception and verification technology is employed to ensure the reliability of critical security data. Simultaneously, a response deduplication mechanism is implemented, using content fingerprinting and similarity calculation to eliminate duplicate response data and improve subsequent analysis efficiency.

[0085] The entire response data acquisition process is monitored and tracked end-to-end. Each response data point carries complete metadata information, including reception time, data size, and response quality metrics. A well-established response data indexing system facilitates rapid retrieval and correlation analysis. Furthermore, a distributed storage architecture ensures secure storage and efficient access to massive amounts of response data, providing a complete and reliable data foundation for subsequent vulnerability matching and analysis.

[0086] The response data processing described above yields a response dataset, containing the original response content, metadata, and quality annotations. This dataset provides multi-level, multi-dimensional analysis data for the vulnerability detection module. Intelligent data management strategies ensure high consistency and availability of the response dataset during processing, providing robust data support for generating accurate vulnerability detection reports.

[0087] Furthermore, the sending of the aforementioned detection request set is further defined, namely, the step of sending the detection request set to the scanning target and receiving the response dataset returned by the scanning target based on the detection request set includes:

[0088] For each probe request in the probe request set, generate a random user agent identifier and Referer header information;

[0089] The detection requests in the detection request set are sent to the scanning target sequentially at pre-generated time intervals.

[0090] During the process of sending a set of probe requests to the scanning target, diverse request header information is generated for each probe request. By integrating a real user agent database, random user agent identifiers are dynamically generated to simulate the access characteristics of different browsers and device types, thereby circumventing feature-based security protection mechanisms when sending the probe requests.

[0091] Simultaneously, Referer header information conforming to the target website structure is intelligently generated to construct a complete request source chain and enhance the legitimacy and concealment of the probe request. The generation of the Referer header information adopts a context-aware randomization algorithm to ensure that the header information of each probe request is different while maintaining logical rationality.

[0092] In the timing control of sending the probe requests, an intelligent scheduling engine is used to generate an optimal time interval sequence. Based on in-depth analysis of the target system's response patterns and network latency characteristics, the intelligent scheduling engine dynamically calculates the best time to send each probe request. The generation of the time interval sequence adopts a random distribution model that conforms to user operating habits, avoiding the identification of regular traffic characteristics as scanning behavior. Furthermore, the response speed of the target system is monitored in real time, and the sending interval is adaptively adjusted to minimize the impact on the target system while ensuring scanning efficiency.

[0093] Through the construction of the aforementioned probe requests and intelligent timing control, a probe request sending mode that highly simulates real user access was achieved. This sending model significantly improves the stealth and success rate of vulnerability scanning, effectively avoids security protection mechanisms triggered by abnormal request characteristics, and lays a solid foundation for subsequent response data collection. The entire request sending process demonstrates a delicate balance between scanning efficiency, stealth, and impact on the target system.

[0094] Step S50: Extract the response matching rules of each YAML category template in the template cluster, and perform matching analysis on the response dataset using the response matching rules;

[0095] After obtaining the complete response dataset, the multimodal response matching engine is launched. This engine dynamically extracts the response matching rules defined in each YAML classification template from the template cluster. This rule extraction process employs a hierarchical parsing technique, decomposing the matching rules defined in the YAML classification templates into multiple executable detection units. These detection units comprise three layers: a basic feature matching layer, a semantic analysis layer, and a behavioral pattern layer. Each layer contains multiple matching methods, forming a comprehensive detection system.

[0096] The matching rule engine employs a rule tree-based execution model, compiling the extracted matching rules into an efficient decision tree structure. This decision tree structure is optimized and organized according to the complexity and dependencies of the detection logic, ensuring the efficiency of the matching process. Furthermore, for complex rules with multiple conditions, a lazy evaluation strategy is used, immediately terminating the evaluation of subsequent conditions if the current condition is not met, thereby improving matching efficiency.

[0097] The actual matching process for the response dataset based on the aforementioned response matching rules employs a multi-level pipeline processing architecture. Specifically, the first level involves rapid filtering, using coarse-grained matching based on response header information, status codes, and basic features to filter responses that clearly do not conform to vulnerability characteristics. The second level performs deep content analysis, employing a regular expression-based pattern matching algorithm combined with natural language processing techniques to semantically parse the response text. The third level implements behavioral feature detection, identifying potential abnormal behavioral patterns by analyzing dynamic features such as response time, data packet sequences, and interaction patterns.

[0098] Furthermore, a multi-rule collaborative analysis mechanism is employed for the detection of complex vulnerabilities. A rule dependency graph is used to analyze the relationships between different response matching rules, enabling joint reasoning and comprehensive judgment. Simultaneously, machine learning is introduced to assist decision-making; a classification model trained on historical detection data is used to verify and correct matching results, reducing the false positive rate. Moreover, a confidence assessment system can be used during the matching process, assigning a confidence score to each matching result to provide a quantitative basis for subsequent vulnerability determination.

[0099] Furthermore, a dynamic rule adjustment mechanism is constructed to automatically optimize the rule execution order and parameter settings based on real-time matching results. By monitoring the effectiveness and performance metrics of each response matching rule, rule weights and execution priorities are dynamically adjusted. Response matching rules with low performance or poor results are automatically optimized or a manual review process is triggered.

[0100] Response data is distributed to multiple matching nodes using a load balancing algorithm for parallel analysis in a distributed parallel processing mode. Each matching node is equipped with a rule caching mechanism, preloading frequently used matching rules into memory to further improve matching speed. Real-time performance monitoring and resource scheduling ensure that the matching process maintains high efficiency while ensuring accuracy.

[0101] Based on the matching process described above, a final matching result set is generated. This matching rule set contains complete vulnerability feature information, matching confidence levels, and detailed evidence data. Through a multi-layered and intelligent matching analysis process, vulnerability features can be accurately identified from massive amounts of response data, while maintaining a low false positive rate and false negative rate, ensuring the reliability and usability of vulnerability detection results.

[0102] The step of extracting the response matching rules of each YAML category template in the template cluster and performing matching analysis on the response dataset using the response matching rules further includes:

[0103] A hash algorithm is used to deduplicate vulnerability feature values ​​in the matching analysis results, and a machine learning model is used to filter false vulnerability reports from the deduplication results to obtain the target vulnerability feature values, which include response time, response length, and character distribution entropy value.

[0104] Based on the target vulnerability feature values, a vulnerability association map is generated. The vulnerability association map is used to visually display the relationship between vulnerabilities and the attack path.

[0105] In this embodiment, after completing the response matching analysis, the detected vulnerability feature values ​​are refined. A multi-dimensional hash algorithm is used to deduplicate the vulnerability feature values. Specifically, a feature fingerprint database is established by calculating the feature hash values ​​of key indicators such as response time, response length, and character distribution entropy. Locality-sensitive hashing (LSH) technology is used to classify similar but not identical vulnerability feature values, eliminating duplicate detection results while retaining subtle differences.

[0106] A multi-layer machine learning filtering pipeline is initiated to remove false positives from the deduplicated vulnerability feature values. Based on this pipeline, firstly, a classification model based on historical data is used to analyze a deep neural network trained on millions of labeled samples to identify common false positive patterns for the vulnerability feature values. Secondly, an anomaly detection algorithm is used, combined with the contextual features of the current scanning environment, to contextually verify the false positive detection results for the vulnerability feature values. Finally, an ensemble learning strategy is implemented, combining the judgment results of multiple weak classifiers to generate a high-confidence vulnerability determination. The entire filtering process employs an adaptive threshold adjustment mechanism, dynamically setting filtering standards based on vulnerability type and risk level.

[0107] After obtaining accurate target vulnerability feature values, the association graph generation engine is activated. This engine constructs a vulnerability entity relationship model, analyzes the technical correlations, business logic correlations, and attack path dependencies between vulnerabilities, and establishes a multi-dimensional association rule base. Furthermore, it uses graph computing to automatically identify vulnerability clusters and attack chain patterns, transforming discrete vulnerability discoveries into a structured association network, i.e., the vulnerability association graph.

[0108] In the generation of the vulnerability association map, a force-directed layout algorithm is used to intelligently arrange vulnerability nodes and automatically optimize the visualization layout based on the correlation strength between vulnerabilities. Simultaneously, time-dimensional analysis is integrated to display the temporal characteristics of vulnerability evolution and the development trend of attack paths. The generated vulnerability association map adopts an interactive visualization design, supporting functions such as drill-down analysis, path tracing, and impact range simulation, providing intuitive vulnerability relationship display and attack path analysis capabilities.

[0109] In this embodiment, false positives and deduplication of vulnerability detection results are optimized. More importantly, it provides in-depth insights into vulnerability relationships, helping security teams understand the intrinsic connections between system vulnerabilities from a global perspective, thereby formulating more accurate and effective remediation strategies.

[0110] Step S60: Generate a vulnerability detection report based on the matching analysis results.

[0111] After completing the matching analysis of all response data, the intelligent report generation engine is activated to aggregate and fuse the analysis results generated by the distributed matching nodes. By establishing a unified result data model, matching results from different detection rules are correlated and integrated, eliminating duplicate discoveries and merging related vulnerability evidence. During the aggregation process, a deduplication algorithm based on vulnerability fingerprints is used to ensure that different manifestations of the same vulnerability can be correctly classified.

[0112] Furthermore, a multi-dimensional risk assessment system is employed to comprehensively rate each vulnerability from multiple perspectives, including exploitation difficulty, impact scope, and business criticality. Through a dynamic weighting algorithm, rating parameters are automatically adjusted based on security standards across different industries and specific enterprise needs, generating targeted risk assessments. Simultaneously, by combining the vulnerability's temporal characteristics and trend analysis, a timeliness score is assigned to each vulnerability, helping users identify security threats that require priority attention.

[0113] During the report content generation phase, natural language generation technology is used to transform technical detection results into easily understandable narrative descriptions. Through a templated report structure, complete report paragraphs are automatically generated, including a vulnerability overview, technical details, impact analysis, and remediation recommendations. For critical vulnerabilities, the system also automatically generates attack scenario simulations and potential hazard demonstrations to help users intuitively understand the vulnerability risks.

[0114] Furthermore, it supports adaptive generation of various formats, including structured documents, visual dashboards, and API data interfaces. It employs an intelligent typesetting engine that automatically optimizes content organization and presentation based on the characteristics of the output format. It also provides customized reporting capabilities, allowing users to select report depth, level of detail, and key areas of focus as needed.

[0115] In addition, an integrated continuous update mechanism ensures the effectiveness of the reports. When new vulnerability information or remediation solutions are discovered, historical reports are automatically supplemented and updated. By establishing a report version management system, the revision history and changes of each report are fully recorded, providing users with audit trail capabilities.

[0116] The final vulnerability report not only provides a detailed technical analysis but also includes actionable security recommendations and remediation priority guidance. Through an intelligent report generation process, complex technical detection results are transformed into decision support information, helping users quickly identify key issues and formulate effective remediation strategies, ultimately achieving closed-loop management of security risks.

[0117] Specifically, the step of generating a vulnerability detection report based on the matching analysis results includes:

[0118] Identify the target response data that successfully matches the response matching rule in the matching analysis results, and generate an initial alarm notification for the target response data to trigger a verification probe request;

[0119] If the verification probe request matches the response matching rule successfully, a vulnerability alert is generated.

[0120] After obtaining the initial matching analysis results, a multi-level verification mechanism is initiated to ensure the accuracy of vulnerability detection. Based on this mechanism, target response data that successfully matches the response matching rules is selected, and a signature is generated for each suspected vulnerability. Verification probe requests are dynamically constructed based on these signatures. These verification probe requests employ a differentiated detection strategy: for Web vulnerabilities, specific probe payloads are injected to verify exploitability; for service vulnerabilities, protocol-level interactive verification is used to confirm the existence of the vulnerability.

[0121] In the specific verification process of the multi-level verification mechanism, intelligent request mutation technology is implemented to perform semantically preserved mutation processing on the original probe request, generating multiple verification versions based on the mutation processing. Furthermore, each verification request carries a tracking identifier to ensure the precise association between the response and the request.

[0122] Furthermore, a multi-layered matching strategy is implemented during the verification process: first, basic feature matching at the grammatical level is performed; then, in-depth content analysis at the semantic level is conducted; and finally, abnormal pattern detection at the behavioral level is performed. Each layer has an independent confidence threshold, and vulnerabilities are ultimately confirmed only after all layers of verification have been passed.

[0123] For successfully verified vulnerabilities, an alert generation pipeline is initiated. The complete technical characteristics of the vulnerability are extracted, including key information such as vulnerability type, affected components, and attack vectors. A risk rating is generated using a risk calculation engine, considering factors such as vulnerability exploitation difficulty, impact scope, and business importance. Subsequently, a standardized template is used to generate structured vulnerability alert information from the vulnerability and the risk rating. This alert information includes technical details, remediation suggestions, and reference links.

[0124] And, the step of generating a vulnerability detection report based on the matching analysis results includes:

[0125] When a single response data point simultaneously satisfies the response matching rules of multiple YAML classification templates, the association weight between each of the response matching rules is calculated.

[0126] A composite vulnerability alert is generated based on the association weights and pre-set vulnerability severity levels. The composite vulnerability alert includes a vulnerability chain relationship graph and a comprehensive risk score.

[0127] In this embodiment, during the vulnerability detection report generation process, when a single response data is detected to simultaneously satisfy the response matching rules of multiple YAML classification templates, a composite vulnerability analysis engine is activated. The composite vulnerability analysis engine establishes a rule association model to analyze the technical correlation and logical dependency between the matching rules and calculates the association weight coefficients. Furthermore, a multi-factor evaluation algorithm is used in the weight calculation to comprehensively consider factors such as the synergistic effect between rules, the degree of conflict, and the strength of evidence support.

[0128] Subsequently, a directed relationship network between matching rules was constructed using rule association graph analysis technology. A weight calculation model based on graph neural networks was used to analyze the connection strength and influence relationships between rule nodes. Rule combinations exhibiting positive synergistic effects were assigned higher association weights; for rule combinations that might have conflicts or duplicate detections, optimization was performed through weight adjustment.

[0129] Furthermore, during the generation of composite vulnerability alerts, multi-dimensional feature fusion technology is employed to extract vulnerability features detected by various matching rules, and a unified vulnerability description is generated through a feature weighted fusion algorithm. Specifically, a comprehensive risk assessment of composite vulnerabilities is conducted by combining a vulnerability severity level database and real-time threat intelligence. This risk assessment process also considers the potential synergistic effects and chain reactions that may result from vulnerability combinations, generating a more accurate risk score.

[0130] Furthermore, a vulnerability chain relationship graph is constructed through a dynamic reasoning mechanism to analyze the technical connections and attack paths between vulnerabilities and automatically identify potential vulnerability exploitation chains. Specifically, knowledge graph technology is used to transform discrete vulnerability discoveries into a structured attack chain model, intuitively displaying the logical relationships between vulnerabilities and the attack evolution path.

[0131] The final generated composite vulnerability alert contains a multi-layered information structure: the base layer provides detailed technical information about individual vulnerabilities; the correlation layer displays the interrelationships and mechanisms of action between vulnerabilities; and the prediction layer provides simulations of potential attack scenarios and impact assessments based on vulnerability chains. The alert information is encapsulated in a standardized format, supporting both machine-readable and human-understandable expressions.

[0132] The aforementioned composite vulnerability alert mechanism effectively identifies and presents complex security threat scenarios, providing users with a more comprehensive and accurate vulnerability risk assessment, and supporting efficient security decision-making and incident response. This design not only improves the depth and breadth of vulnerability detection but also enhances the systematic and predictive nature of security protection.

[0133] In this embodiment, YAML-based template clustering technology achieves both precision and efficiency in the vulnerability scanning process. The adoption of intelligent path matching and a global request merging mechanism significantly reduces the number of scanning requests, shortening the detection time for large-scale API vulnerabilities from several hours to minutes. Dynamic load balancing and resource scheduling strategies effectively control CPU, memory, and bandwidth consumption, ensuring the normal operation of the business system. Simultaneously, the combination of multi-dimensional response matching rules greatly improves vulnerability detection accuracy and reduces false positives and false negatives. The structured template-based design also eliminates the need for system reconstruction when adding new detection rules, greatly enhancing the system's scalability and adaptability.

[0134] Further, see Figure 2 , Figure 2 This is a detailed step diagram of step S30 above, based on the above... Figure 2 As shown, the step S31-S34, which involves performing global request merging and path optimization to obtain a probe request set based on the address information of the scanned target and the request specifications of each YAML category template in the template cluster, includes:

[0135] Step S31: Calculate the edit distance of the path parameters of the request specification in each of the YAML classification templates, and establish a path similarity matrix based on the calculation results;

[0136] Step S32: In the path similarity matrix, target request specifications with similarity greater than or equal to a preset similarity threshold are grouped into the same request group;

[0137] Step S33: Create a resource identifier template for the request group, the resource identifier template including all variable path parameters;

[0138] Step S34: Generate the probe request set using the resource identifier template. The probe request set covers all path variation cases within the request group.

[0139] In this embodiment, during the global request merging and path optimization process, a refined path similarity analysis engine is constructed. This engine employs a multi-dimensional path parameter comparison algorithm to analyze the URL path structure of each request specification for the request specifications of each YAML category template in the template cluster. It extracts feature elements such as path segment sequences, parameter positions, and parameter types to establish a path feature vector space model. Based on this, the edit distance between any two request specification paths is calculated. This calculation process considers character-level differences and introduces semantic similarity analysis to identify path parameters that appear different but are functionally equivalent.

[0140] Furthermore, a distributed computing architecture is employed to create a path similarity matrix, distributing a large number of path comparison tasks to multiple computing nodes for parallel processing. Each node is responsible for calculating the similarity of a path subset with all other paths. During the filling of the path similarity matrix, an optimized dynamic programming algorithm is used to calculate the minimum edit distance, while a path weight adjustment mechanism is introduced to assign higher weight coefficients to key path segments. The calculated similarity values ​​are normalized to form a complete path similarity matrix. This matrix accurately reflects the structural similarity and semantic relevance between all request specification paths. Specifically, based on the calculated similarity of each path subset with all other paths, target request specifications with similarities greater than or equal to a preset similarity threshold are grouped into the same request group.

[0141] In the matrix analysis phase, adaptive clustering algorithms are applied. Based on a preset similarity threshold, hierarchical clustering is used to group paths according to their similarity. The similarity threshold is set considering path structural characteristics and can be dynamically adjusted by combining historical scan data and target system characteristics. Furthermore, a fuzzy clustering mechanism is introduced to define the group boundaries, and secondary verification ensures the accuracy of the grouping. Specifically, paths within each request group maintain high similarity while ensuring significant differences between groups.

[0142] Furthermore, intelligent parameterization technology is used to generate resource identifier templates, and the parameter distribution characteristics of all paths within each request group are analyzed to identify fixed path segments and variable parameter segments. Based on the extracted variation patterns and value constraints represented by the variable parameter segments, a resource identifier template containing all possible parameter combinations is constructed. This resource identifier template uses a structured representation method to clearly label required parameters, optional parameters, and their value ranges, ensuring that the generated probe requests can cover all path variation scenarios.

[0143] An optimized scheduling strategy is implemented during the generation of the probe request set. This strategy generates a minimum complete combination of request parameters based on resource identifier templates. Dependencies and constraints between path parameters are considered to avoid generating invalid or contradictory request parameters. The generated probe request set not only optimizes and reduces the number of requests but also ensures the completeness and accuracy of vulnerability detection.

[0144] Furthermore, the effectiveness of the path similarity matrix is ​​continuously monitored during this generation process, and the matrix calculation parameters are continuously optimized by learning new path patterns in real time. Request merging based on the path similarity matrix significantly improves the efficiency and coverage of vulnerability scanning, providing effective technical support for large-scale web application vulnerability detection.

[0145] Further, see Figure 3 , Figure 3 This is a detailed step diagram of step S40 above, based on the above... Figure 3 As shown, the step of sending the detection request set to the scanning target and receiving the response dataset returned by the scanning target based on the detection request set includes steps S41-S43, which includes:

[0146] Step S41: Monitor the response time and error rate of the scanned target based on the detection request set in real time;

[0147] Step S42: Dynamically adjust the number of threads sending probe requests based on the response time, and switch to the backup scanning target of the scanning target when the error rate exceeds the preset error threshold;

[0148] Step S43: Reduce the sending frequency of the detection request set and send the detection request set to the backup scanning target.

[0149] In this embodiment, during the process of sending a set of probe requests to the scanning target, an intelligent resource scheduling and fault-tolerant control mechanism is implemented, and a real-time performance monitoring system is established. A distributed probe cluster continuously collects key performance indicators such as the target's response time, error rate, and throughput to the probe requests. The monitoring data is stored and analyzed using a time-series database to track the target system's state changes with millisecond-level precision, providing data support for dynamically adjusting threads.

[0150] Specifically, the dynamic thread adjustment employs an adaptive algorithm based on control theory, establishing a mathematical model of response time and thread count, and calculating the optimal thread count in real time using a PID controller. When an increase in response time is detected, the thread count is reduced proportionally to alleviate the pressure on the target system; when the response time improves, the thread count is appropriately increased to enhance scanning efficiency. A sliding window mechanism is introduced during the dynamic adjustment process to avoid over-adjustment due to instantaneous fluctuations. Simultaneously, upper and lower limits are set for the thread count to ensure the stability of the scanning process.

[0151] Based on the calculated optimal number of threads, worker threads are dynamically created or destroyed. Each worker thread is equipped with an independent task queue and connection pool to achieve resource isolation and load balancing. Furthermore, a thread warm-up and cool-down mechanism is implemented to smoothly handle changes in the number of threads and avoid the overhead of frequent creation and destruction. A thread status monitoring module tracks the execution efficiency and resource consumption of each thread in real time, providing fine-grained data support for adjustment decisions.

[0152] Furthermore, abnormal states of the target system are identified by continuously monitoring the error rate metric. When the detected error rate exceeds a preset threshold, a failover engine is activated. The failover engine automatically diagnoses the fault type to distinguish between different scenarios such as network problems, target system overload, or security protection interception. Based on the fault type diagnosis results, the optimal backup scanning target is selected. This selection can be evaluated based on multiple factors such as historical performance data, network topology, and business relevance.

[0153] Furthermore, the system saves records of the current scan status and sent probe requests, and recalculates the request sequence when switching to the backup scan target to ensure detection continuity. It also dynamically reduces the request sending rate based on the performance characteristics of the backup scan target, employing a gradual increase strategy to progressively establish the optimal scan rhythm, thereby ensuring no data loss and uninterrupted detection throughout the backup switchover process.

[0154] Through the aforementioned dynamic adjustment mechanism, optimal scanning efficiency can be maintained in complex network environments while minimizing the impact on the target system, further ensuring the reliability of the scanning task and making the vulnerability detection process both efficient and stable, effectively responding to various network anomalies and changes in the target system.

[0155] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the vulnerability scanning method based on template clusters in this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0156] This application provides a template cluster-based vulnerability scanning device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the template cluster-based vulnerability scanning method in Embodiment 1 above.

[0157] The following is for reference. Figure 4 The diagram illustrates a structural schematic of a template cluster-based vulnerability scanning device suitable for implementing embodiments of this application. The template cluster-based vulnerability scanning device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The template cluster-based vulnerability scanning device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0158] like Figure 4As shown, the template cluster-based vulnerability scanning device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The random access memory 1004 also stores various programs and data required for the operation of the template cluster-based vulnerability scanning device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the template cluster-based vulnerability scanning device to communicate wirelessly or wiredly with other devices to exchange data. Although template cluster-based vulnerability scanning devices with various systems are shown in the figures, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0159] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0160] The template cluster-based vulnerability scanning device provided in this application, employing the template cluster-based vulnerability scanning method described in the above embodiments, can solve the technical problems of low efficiency, high resource consumption, and insufficient accuracy in existing API vulnerability scanning. Compared with the prior art, the beneficial effects of the template cluster-based vulnerability scanning device provided in this application are the same as those of the template cluster-based vulnerability scanning method provided in the above embodiments, and other technical features of this template cluster-based vulnerability scanning device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0161] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0162] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0163] This application provides a storage medium, which is a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the template cluster-based vulnerability scanning method in the above embodiments.

[0164] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), or any suitable combination thereof.

[0165] The aforementioned computer-readable storage medium may be included in a template cluster-based vulnerability scanning device; or it may exist independently and not assembled into a template cluster-based vulnerability scanning device.

[0166] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by the template cluster-based vulnerability scanning device, the template cluster-based vulnerability scanning device implements the technical content of the template cluster-based vulnerability scanning method embodiment shown above.

[0167] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0169] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0170] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described template cluster-based vulnerability scanning method. This solves the technical problems of low efficiency, high resource consumption, and insufficient accuracy in existing API vulnerability scanning methods. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the template cluster-based vulnerability scanning method provided in the above embodiments, and will not be repeated here.

Claims

1. A vulnerability scanning method based on template clusters, characterized in that, The vulnerability scanning method based on template clusters includes the following steps: In response to a vulnerability scanning request initiated by a user, determine the scanning target of the vulnerability scanning request; Load at least one YAML category template adapted to the scanning target to form a template cluster, wherein the YAML category template is a structured text encapsulating a complete set of rules, the complete set of rules being used to verify a specific vulnerability, including request specifications and response matching rules; Based on the address information of the scanned target and the request specifications of each YAML category template in the template cluster, a global request merging and path optimization are performed to obtain a probe request set. Specifically, the path parameter edit distance of the request specifications in each YAML category template is calculated, and a path similarity matrix is ​​established based on the calculation results. In the path similarity matrix, target request specifications with similarity greater than or equal to a preset similarity threshold are grouped into the same request group. A resource identifier template is created for each request group, and the resource identifier template includes all variable path parameters. The probe request set is generated using the resource identifier template, and the probe request set covers all path variations within the request group. The system sends the probe request set to the scanning target and receives the response dataset returned by the scanning target based on the probe request set. Specifically, it generates a random user agent identifier and Referer header information for each probe request in the probe request set; sequentially sends the probe requests in the probe request set to the scanning target at pre-generated time intervals; monitors the response time and error rate of the scanning target based on the probe request set in real time; dynamically adjusts the number of threads currently sending probe requests based on the response time; and switches to a backup scanning target when the error rate exceeds a preset error threshold; reduces the sending frequency of the probe request set and sends the probe request set to the backup scanning target. Extract the response matching rules of each YAML category template in the template cluster, and perform matching analysis on the response dataset using the response matching rules; A vulnerability detection report is generated based on the matching analysis results.

2. The vulnerability scanning method based on template clusters as described in claim 1, characterized in that, After the step of extracting the response matching rules of each YAML category template in the template cluster and performing matching analysis on the response dataset using the response matching rules, the method further includes: A hash algorithm is used to deduplicate vulnerability feature values ​​in the matching analysis results, and a machine learning model is used to filter false vulnerability reports from the deduplication results to obtain the target vulnerability feature values, which include response time, response length, and character distribution entropy value. Based on the target vulnerability feature values, a vulnerability association map is generated. The vulnerability association map is used to visually display the relationship between vulnerabilities and the attack path.

3. The vulnerability scanning method based on template clusters as described in claim 1, characterized in that, The step of loading at least one YAML classification template adapted to the scanning target to form a template cluster includes: The template syntax of the YAML category template is validated, including static analysis and semantic validation. If the template syntax contains errors, load the backup template corresponding to the YAML category template and generate syntax repair suggestions for the YAML category template.

4. The vulnerability scanning method based on template clusters as described in claim 1, characterized in that, The step of generating a vulnerability detection report based on the matching analysis results includes: Identify the target response data that successfully matches the response matching rule in the matching analysis results, and generate an initial alarm notification for the target response data to trigger a verification probe request; If the verification probe request matches the response matching rule successfully, a vulnerability alert is generated.

5. The vulnerability scanning method based on template clusters as described in claim 1, characterized in that, The step of generating a vulnerability detection report based on the matching analysis results includes: When a single response data point simultaneously satisfies the response matching rules of multiple YAML classification templates, the association weight between each of the response matching rules is calculated. A composite vulnerability alert is generated based on the association weights and pre-set vulnerability severity levels. The composite vulnerability alert includes a vulnerability chain relationship graph and a comprehensive risk score.

6. A vulnerability scanning device based on template clusters, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the template cluster-based vulnerability scanning method as described in any one of claims 1 to 5.

7. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the template cluster-based vulnerability scanning method as described in any one of claims 1 to 5.

Images