Automatic vulnerability discovery and verification method based on multi-source signal convergence and graph-driven tool selection

Abstract

The invention discloses an automatic vulnerability discovery and verification method based on multi-source signal convergence and graph-driven tool selection. Surveying and mapping and network increment acquisition are automatically completed through a browser, and a page / component / API / parameter / identity / version-oriented graph world model is automatically constructed in combination with a heuristic and large model; the method comprises the following steps: generating a test plan on a subgraph by utilizing GraphRAG, adaptively scheduling tools such as nmap / curl / gobuster / Segrep / CodeQL and the like, and triggering RawHTTP minimum message verification for a high-risk protocol clue. Evidence (HTML / HARD / screenshot / message) content address solidification is carried out, and a Diff engine executes DOM / ARIA / JSON / pixel difference and drives regression. According to the method, a root certificate does not need to be installed, surveying and mapping-analysis-verification-reinspection closed loop is realized, the coverage is wide, the false alarm rate is low, the reproducibility is high, and the method is suitable for DevSecOps and large-scale security evaluation.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network and software security, and in particular to an automatic vulnerability discovery and verification method for Web / mobile / enterprise and Internet of Things (including multiple environments and multiple versions). The method uses browser mapping, protocol-level verification, rule / code-level signals and external intelligence as data sources, adopts a Graph as World Model for knowledge organization, and uses GraphRAG to drive tool adaptation selection and scheduling, realizing full-process automation from mapping-analysis-verification-evidence solidification-regression. BACKGROUND

[0002] Existing automated network security penetration testing mainly has two types: one relies on proxy packet capture / manual operation and fuzz testing (such as manual process based on proxy), which needs to install root certificates and configure browsers in HTTPS scenarios, and has great resistance to productization, weak scalability and replicability; the other is a general agent or script-based scanning, which usually treats targets as a set of text / URLs, lacks a sustainable world model, and is difficult to perform causal tracing at the level of "page-component-interface-parameter-identity-environment-version", and the browser mapping and protocol-level verification are coupled, the evidence reproducibility is poor, and the regression testing cost is high. On the other hand, GraphRAG has been mainly used for knowledge base question answering in recent years, and the cost of building a graph is high, structured extraction is difficult, and there is still a lack of a closed-loop framework for "automatic graph building-graph-driven action-evidence rewriting" for vulnerability discovery. The above problems result in incomplete coverage, high cost, and unverifiable conclusions, making it difficult to form an engineering and scaled capability. SUMMARY

[0003] The present application aims to provide an automatic vulnerability discovery and verification method with multi-source signal aggregation and graph-driven tool selection: (1) browser automation is used to complete mapping and network incremental collection, decoupling browser and protocol-level verification; (2) a graph world model is automatically constructed based on heuristics and large model semantic analysis, and pages / components / APIs / parameters / roles / environments / versions and evidence are uniformly organized; (3) GraphRAG is used to generate a test plan from related subgraphs, and tools such as nmap / curl / gobuster / RawHTTP / Semgrep / CodeQL are adaptively selected; (4) RawHTTP "puncher" is triggered for minimal raw packet verification on suspicious protocol paths (such as cache key anomalies, connection pool reuse, 0.CL, etc.); (5) request / response, DOM / ARIA / JSON / pixel difference, key screenshots, and other evidence are immutable and solidified, supporting cross-time / environment automatic regression and retesting.

[0004] System composition (refer to the attached Figure 1a) Orchestrator (Go): task distribution, concurrency and budget control, role switching, result aggregation and warehousing; b) Agent (based on langchain go): plan -> act -> observe -> summarize, call BrowserTools and external tools; c) BrowserTools (playwright-go wrapper): navigation, click, form filling, ARIA / operable element outline, screenshot, HAR / Trace / WebSocket frame, network delta (redirect chain, header, status, body digest); d) Extractors: extract page structure, components, API / parameter statistics and content summary from samples; e) Diff Engine: DOM / ARIA / JSON / pixel difference, generate differential nodes and reports; f) Persistence: **graph database (Neo4j)** stores metadata and relationships; object storage (MinIO) stores evidence HTML / screenshots / HAR / minimized message sequence, etc.; g) Scheduler: BFS / priority queue / backoff retry / (optional) multi-armed bandit; h) Rule / code level scanning integration: Semgrep / CodeQL, etc.; i) Protocol level verification RawHTTP: HTTP / 1.1 / HTTP2 negotiation and downgrade, Content-Length / TE boundary manipulation (including 0.CL), header normalization / rearrangement, connection pool and cache key control, output minimal reproduction experiment.

[0005] Graph world model (see Appendix A of the specification Figure 2 ). Node types: application, page (including version PageVersion and object key), component (button / form / input), interface / endpoint, parameter, identity / role (user / guest / admin, etc.), session, environment (prod / staging, etc.), evidence (request / response / screenshot / difference), discovery (vulnerability candidate / proven). Edge types: HAS_PAGE, HAS_VERSION, CALLS_API, SUBMITS, LINKS_TO, CAN_VIEW, USES_PARAM, OWNED_BY, RUNS_ON, PROVED_BY, DIFFS_WITH, etc., including source and confidence. Multi-source signals: browser network delta, port / directory enumeration, rule / code level scanning, external intelligence and historical logs, unified into graph and labeled (source, ts, cost, risk, repro).

[0006] Data flow (see Appendix B of the specification Figure 3). Action-Snapshot / Network Delta-Objects Archiving-Graph Building / Updating-Aggregation Diff-Reporting / Regression. Browsers are only responsible for mapping and collecting; once abnormal clues such as protocol / cache / connection sharing appear on the graph, the dispatcher upgrades to RawHTTP verification.

[0007] Figure-driven tool selection (refer to the description attached Figure 4 ). Retrieve trigger patterns on subgraphs with GraphRAG (such as "form -> POST -> JSON Body -> JWT-containing" or "CDN -> cache key -> variant header"), generate test plans; define the objective function U = a Severity + b Reachability + g Novelty - l Cost, sort the candidate tool sequence; when high-yield patterns such as protocol inconsistency / cache abnormalities / connection sharing are detected, directly trigger RawHTTP "punchers", and minimize the packet sequence; regular paths combine nmap / curl / gobuster with Semgrep / CodeQL, etc.

[0008] Verification and solidification (refer to Figure 5 ). Evidence is stored in an immutable object (content-addressed) manner, associated with PageVersion / environment / session; Diff Engine compares DOM / ARIA / JSON / pixels in multiple modalities, labels UI and data layer differences; generate verifiable scripts / packets and minimal screenshot sequences for auditing and reproduction; cross-version / environment regression and "difference-triggered review" are achieved through PageVersion snapshot management.

[0009] Coupling of rules / code-level scanning. The results of Semgrep / CodeQL are re-screened in terms of reachability (connectivity from entry to vulnerable point on the graph) and evidence strength (existence of corresponding packet and body difference), significantly reducing false positives; for candidates with weak static evidence but strong reachability, RawHTTP is preferred for "punching".

[0010] Security and compliance. Set up fences for dangerous commands / external write; only run on authorized targets, evidence desensitization and hierarchical export; support budget / concurrency / domain name whitelist policies.

[0011] Compared with the prior art, the present application has: 1) automatic mapping once, abstracting the website into a page / component / API / parameter / identity / environment / version graph, with significantly reduced mapping cost; 2) decoupling of mapping and verification, with the browser not bearing the original message manipulation, strong engineering and verifiability; 3) graph-driven tool selection, automatically upgrading high-value modes to RawHTTP heavy hitters with high hit rate and good interpretability; 4) immutable evidence and minimal reproduction, with audit traceability and low verification cost; 5) cross-version / environment regression, with PageVersion and object key difference triggering verification, adapting to continuous integration; 6) multi-source signal convergence, fusing rule / code-level and behavior / protocol-level evidence, with wide coverage and low false positives; 7) non-intrusive HTTPS adaptation, without the need for installing root certificates, facilitating productization and large-scale deployment. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 : System overall architecture diagram (Orchestrator, Agent, BrowserTools, Extractors, Diff, Persistence, Schedulers). Figure 2 : Graph world model diagram (application / page / version / component / API / parameter / role / environment / evidence / discovery and their relationships). Figure 3 : Core data flow diagram (Action→Snapshot / NetworkDelta→Objects→Graph→Aggregation→Diff→report / regression). Figure 4 : Graph-driven tool selection and RawHTTP heavy hitter trigger flowchart. Figure 5 : Evidence solidification and minimal reproduction link, cross-version regression flowchart. DETAILED DESCRIPTION

[0013] Terms and symbols. GraphRAG: Graph database based Retrieval Augmentation Generation, returns subgraph context for planning and action selection. PageVersion: Page version node, records html_key, screenshot_key, and observed_at. NetworkDelta: Request response delta summary for same page / session (method / url / header summary / body hash / redirect chain / state). Evidence: Raw request / response, HAR / Trace / WS frame, DOM / ARIA / JSON / pixel diff, key screenshot and reproduction script / message. RawHTTP Smasher: Raw message validation component, supports HTTP / 1.1 / 2, CL / TE boundary, 0.CL, connection pool / cache key manipulation, and ALPN / downgrade. U: Action utility function, combines severity, reachability, novelty, and cost.

[0014] Orchestrator (Go). Maintains task queue with budget, dispatches subtasks based on priority (U-value) and concurrency configuration; records input / output and object keys for each action, writes to Neo4j / MinIO; failure fallback and exponential backoff, supports session resumption and environment switching (prod / staging). Agent (langchain-go). Round-robin execution: Plan → Act → Observe → Summarize; retrieves relevant subgraphs via GraphRAG, generates tool sequences and parameters (e.g., dictionary / load / header variants); observed results are converted into multi-source signals written back to the graph, and the subsequent plan is updated. BrowserTools (playwright-go). Automatic login / navigation / form submission, extracts ARIA tree and actionable elements; collects HAR / Trace / WS and NetworkDelta; generates screenshots and replayable scripts (playwright trace). Extractors and Diff. Engine extracts pages → components → events → APIs → parameter chains from HTML / ARIA / scripts; Diff: DOM / ARIA / JSON / pixel four types of differences, output difference nodes and priority clues (e.g., sensitive field exposure, cache variant differences). RawHTTP hammer. If subgraph shows cache key instability, connection sharing, or protocol inconsistency: 1) construct minimal message sequence (including header order / case / whitespace variants); 2) perform HTTP / 2-1.1 negotiation / demotion testing according to strategy; 3) apply CL / TE / 0.CL boundaries and connection persistence; 4) collect response chain and timing metadata; 5) solidify messages and signatures (hashes), generate minimal reproduction scripts. Rule / code-level scanning integration (Semgrep / CodeQL). Label "possible defects → code location / rule ID" found by scanning on the graph, use reachability and evidence strength for secondary screening; high-confidence candidates are transferred to RawHTTP / browser playback for behavior verification. Graph-driven scheduling and regression Schedulers. Use BFS+priority queue, combined with U-value and rate limiting; take time and environment snapshots for PageVersion, trigger re-inspection for differences (e.g., login after DOM adds sensitive controls); produce audit reports and minimal reproduction links (object keys + messages + screenshot sequences). Typical embodiments.Target site first traversal: BrowserTools fetch HTML and screenshots of / login / products / profile pages, generate html / png object keys and incorporate graphs; GraphRAG discovers "form -> POST -> JSON -> JWT" patterns, first enumerates with curl / gobuster, then triggers RawHTTP to verify cache keys and connection sharing; Semgrep / CodeQL points out that certain APIs do not filter parameters sort, there are reachable paths from public entry points on the graph, triggering RawHTTP to construct minimal message verification and solidification; Diff Engine finds security-related changes in DOM / JSON / pixel differences, automatically regresses and updates the discovery state. Security and compliance implementation. Only authorized targets are executed; evidence desensitization and secret level export; dangerous operation guardrails and domain / IP whitelists; resource / budget / concurrency upper limits and rate control.

[0015] The application is suitable for: (1) pre-online security assessment and continuous regression of enterprise-level Web / microservices / mobile back-end; (2) rapid mapping, verification and evidence solidification of complex sites in network security vulnerability mining and attack and defense exercises; (3) automatic security gate in CI / CD and DevSecOps pipeline; (4) compliance audit of multi-environment / multi-version coexistence (prod / staging / grayscale); (5) security evaluation of Web management surface on Internet of Things / ICS / edge side (running under protocol whitelist). Its non-intrusive HTTPS adaptation, graph-driven tool selection and evidence immutable solidification characteristics make it have significant practical value of engineering, scaling and retesting.

Claims

1. An automated vulnerability discovery and verification method, characterized in that, include: A) Use a browser to automatically perform one or more interactive traversals of the target, collect page structure, operable elements, network trajectory and session state, and form a mapping sample. B) Structure and normalize the survey samples with multi-source information such as port / service fingerprints, directory / interface enumeration, rule scanning, logs and external intelligence to generate signals with source and confidence; C) Based on heuristic rules and large language models, automatically construct a "graph world model" for semantic parsing of page source code / ARIA / scripts. Its nodes include at least pages, components, interfaces / endpoints, parameters, sessions / identities, page versions and evidence, and its edges represent at least links, submissions, calls, data / control flow, permissions and evidence pointers; D) GraphRAG (Graph Search Enhancement) generates a test plan from a subgraph related to the current target and adaptively selects tools and loads based on subgraph features; E) The RawHTTP (Raw Protocol Level Message Construction and Replay) module is invoked to perform protocol-level verification of high-risk paths; F) Store the original requests / responses, connections and time-series metadata, DOM / pixel differences, key screenshots, etc. generated by the verification as immutable objects, and write them back to the graph world model to update the discovery state; G) Calculate the priority based on reachability, severity, confidence and availability clues, and schedule subsequent tests according to heuristic / multi-armed gambler / rollback retry strategy until the stopping condition is met.

2. The method according to claim 1, characterized in that... The browser-automated data collection method obtains higher-level network increments under TLS in a certificate-free manner, specifically including HAR / Trace fragments, request and response headers, body digests, redirection chains, WebSocket frames and event timelines, and aligns them with user operation sequences, same-origin policies, and storage states to generate NetworkDelta.

3. The method according to claim 1, characterized in that... The automatic graph construction of the graph world model satisfies at least one of the following rules: a) Using the page source code and ARIA tree traversed once as input, extract page, component, API / Endpoint, and parameter nodes through heuristics and large model; b) Create version nodes for pages, record object storage keys to reference HTML and screenshot resource files, and add timestamps; c) Create role / session nodes and "visible / available" edges; d) Create environment nodes (such as production / pre-release) and dependent edges of pages / APIs to support cross-environment difference and regression.

4. The method according to claim 1, characterized in that... The GraphRAG-driven tool selection dynamically switches between the following tool families based on subgraph patterns and cost-benefit trade-offs: network fingerprinting and port detection, directory / endpoint enumeration and crawling, semantic / fuzzy load generation, rule / code-level scanning, and protocol layer primitive verification; when signs of caching / intermediate layer or connection sharing appear in the subgraph, it is automatically promoted to protocol layer verification.

5. The method according to claim 1, characterized in that: The original protocol-level verification supports at least one of the following configurable primitives: a) negotiation and degradation between HTTP / 1.1 and HTTP / 2; b) Content-Length / Transfer-Encoding boundary manipulation and 0.CL request smuggling; c) connection reuse and connection pool poisoning; d) header normalization / line wrapping / reordering and cache key / variant control; and outputs a replayable minimal message sequence and its signature.

6. The method according to claim 1, characterized in that... Evidence and differential analysis include multimodal comparison of DOM, ARIA, structured JSON and pixel snapshots to generate Diff nodes; stable keys are constructed using request signatures, response signatures, parameter positions and rule identifiers for deduplication and regression annotation; evidence objects are stored in an immutable manner and establish a strong "evidence-proven" binding relationship with "candidate findings / confirmed findings".

7. The method according to claim 1, characterized in that... Priority calculation incorporates at least three of the following factors: path length and obstacles on the graph (accessibility), asset sensitivity and impact (severity), consistency of multi-source signals and historical hit rate (confidence), time / buffer / connection side channels (availability clues), execution cost and budget; the scheduler employs a fusion of BFS and priority queues, exponential backoff and retry rollback strategies.

8. The method according to claim 1, characterized in that: Multi-source signals further include rule-level and code-level signals, which can originate from static semantic / dataflow rule scanning tools. These tools can structure the hit locations, affected parameters, and rule identifiers, and establish one-to-many or many-to-one associations with pages / endpoints / parameter nodes to amplify the planning and verification hit rate.

9. The method according to claim 1, characterized in that... The decoupled architecture enables crawler mapping and penetration testing to interact through a graph world model and object storage. The Orchestrator is responsible for task distribution, concurrency, and role switching. The Agent executes in a loop of "planning-action-observation-summarization". BrowserTools only provides navigation / interaction and data collection capabilities. The reasoning of any agent uses the subgraph as context input, thereby achieving an auditable end-to-end closed loop.

10. The method according to claim 1, characterized in that... The system performs snapshot management of the graph world model across time and environment dimensions, and uses versioned pages and interface nodes and their object storage keys to perform automated regression comparisons across time and environment. When structural or behavioral differences are detected to exceed a threshold, the system automatically triggers the replanning of the corresponding subgraph and the verification of the protocol layer.

Images