A logic vulnerability detection method based on a large model and a multi-agent and related equipment

Abstract

The application relates to a logic vulnerability detection method based on a large model and a Multi-Agent and related equipment. The method comprises the following steps: constructing a field knowledge graph, injecting graph information into a basic large model to obtain an industry-specific large model; designing Agents of multiple logic vulnerability detection types, encapsulating operation lists executable by users of corresponding permissions for the Agents, so that the Agents can simulate the interaction behaviors of users in a business system; in response to the start of a detection task, iteratively performing the following steps: based on a preset detection strategy, using multiple Agents to concurrently execute the detection task; recording the detected path and the detection result, adjusting the next detection node corresponding to each Agent according to the recording result; reasoning the detection result based on the industry-specific large model, updating the preset detection strategy according to the reasoning result; and when the preset iteration condition is met, outputting a target detection result. The method improves the vulnerability detection coverage and detection efficiency, improves the detection effect, and expands the application scenarios of the method.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a logical vulnerability detection method based on a large model and Multi-Agent and related equipment. BACKGROUND

[0002] With the complication of enterprise business systems, logical vulnerabilities have gradually become one of the main threats to network security. Such vulnerabilities are usually hidden in business processes, permission controls or state transition logic and are difficult to discover through traditional security detection methods. For example, logical vulnerabilities such as unauthorized access, business link bypassing and parameter tampering can directly lead to data leakage, financial loss or business fraud. Since the triggering of logical vulnerabilities often depends on dynamic context environments (such as user role switching and multi-step operation combination), their detection requires higher intelligence and dynamic adaptability of technology.

[0003] In related technologies, the following methods are mainly used for logical vulnerability detection: (1) rule matching and static scanning: matching known vulnerability patterns through a predefined rule library or performing vulnerability scanning based on a static page feature library; (2) manual penetration testing: security engineers manually simulate user operations to attempt to trigger unauthorized access or business process abnormalities. The above-mentioned solutions in related technologies cannot adapt to dynamic adjustments of business logic, have low vulnerability detection coverage, low detection efficiency, poor detection effect, and are difficult to cope with scenarios such as high-frequency iteration of large-scale systems, because they rely on fixed rule libraries or feature libraries and cannot simulate dynamic changes in user roles.

[0004] At present, there is no effective solution to the problem of low vulnerability detection coverage, low detection efficiency, poor detection effect and narrow application scenarios of the vulnerability detection method in related technologies. SUMMARY

[0005] The logical vulnerability detection method based on a large model and Multi-Agent and related equipment provided by the embodiments of the present application at least solve the problem of low vulnerability detection coverage, low detection efficiency, poor detection effect and narrow application scenarios of the vulnerability detection method in related technologies.

[0006] To solve the above problems, one aspect of the embodiments of the present application provides a logical vulnerability detection method based on a large model and Multi-Agent, comprising:

[0007] A domain knowledge graph of a target industry is constructed, and graph information in the domain knowledge graph is injected into a basic large model to construct an industry-specific large model; wherein the basic large model is obtained by training a multi-modal data set constructed according to historical business cases in a target business system based on a Transformer architecture.

[0008] designing a plurality of Agent types for detecting logical vulnerabilities, and encapsulating a list of operations executable by a user with corresponding permissions for each Agent type, so that the Agent can simulate the interaction behavior of the user with corresponding permissions in the target business system according to the operation list;

[0009] In response to the start of the logical vulnerability detection task, the following steps are iteratively executed: based on the preset detection strategy, a plurality of Agents are used to perform the detection task concurrently; during the detection task execution, the context memory module set in each Agent records the detected path and the detection result, and adjusts the next detection node corresponding to each Agent according to the recording result; the detection result is inferred based on the industry-specific large model, and the preset detection strategy is updated according to the inference result;

[0010] When the preset iteration condition is met, the target detection result of the logical vulnerability detection of the target business system is output; wherein the preset iteration condition is one or more of the preset vulnerability coverage, the iteration number or the detection time length.

[0011] In some embodiments, the domain knowledge graph includes entities, relationships and business rules; the entities include permission users, interfaces, permission points, and the relationships include interface call dependency relationships and user permission mapping relationships; the step of injecting the graph information in the domain knowledge graph into the basic large model to construct the industry-specific large model includes:

[0012] The entities and relationships in the domain knowledge graph are encoded into graph embedding vectors, and the graph embedding vectors are injected into the basic large model through an adapter layer or an expert hybrid module to obtain the industry-specific large model; and the business rules in the domain knowledge graph are encoded into logical expressions, and the industry-specific large model is interacted with the rule engine module, so that the industry-specific large model can call the business rules when performing the inference task.

[0013] In some embodiments, the method further includes:

[0014] In the industry-specific large model, a reinforcement learning algorithm is introduced to optimize the detection strategy through the reinforcement learning algorithm when performing the inference task; wherein the reward function in the reinforcement learning algorithm sets a reward value for different logical vulnerability detection types.

[0015] In some embodiments, the historical business cases include business process data, user permission data, historical vulnerability data and related domain knowledge; the construction steps of the basic large model include:

[0016] Obtain historical business cases of the target business system to construct a multi-modal data set; wherein the multi-modal data set includes operation sequences of normal business processes, abnormal business processes and over-privileged processes;

[0017] Use the multi-modal data set as training data, train a general language model based on a Transformer architecture, learn the causal relationship between operation sequences and target states, and construct a basic large model with logical reasoning capability;

[0018] Design a causal reasoning head to predict whether an operation can be transferred from the current state to the target state during the training process, and realize the optimization operation of the basic large model.

[0019] In some embodiments, multiple Agents share the detection results; the context memory module set in each Agent records the detected path and detection results, and adjusts the next detection node corresponding to each Agent based on the recorded results, which includes:

[0020] Based on the context memory module, record the detected path and detection results of the current Agent, as well as the detected path and detection results shared by other Agents;

[0021] Determine the next detection node corresponding to the current Agent through a reinforcement learning algorithm; wherein the reinforcement learning algorithm increases the node weight of the undetected node and the high-risk node based on the detection results.

[0022] In some embodiments, the multiple types of logic vulnerability detection Agents include: horizontal privilege detection Agent, vertical privilege detection Agent, unauthorized access detection Agent, arbitrary parameter tampering detection Agent, and password recovery process vulnerability detection Agent; and the operation list includes: API interface calling sequence, form field input range, and page jump action set.

[0023] In some embodiments, the method further includes:

[0024] Determine the logic vulnerability type and the logic vulnerability impact level based on the output target detection results, and generate a visual report and a vulnerability repair suggestion.

[0025] To solve the above problems, in one aspect of an embodiment of the application, a logic vulnerability detection device based on a large model and Multi-Agent is provided, which includes:

[0026] The large model construction module is configured to construct a domain knowledge graph of a target industry, and inject graph information in the domain knowledge graph into a basic large model to construct an industry-specific large model; wherein the basic large model is obtained by training a multi-modal data set constructed according to historical business cases in a target business system as training data, and based on a Transformer architecture;

[0027] The Multi-Agent design module is configured to design Agents of multiple types of logical vulnerability detection, and encapsulate a list of operations executable by a user with corresponding permissions for each type of Agent, so that the Agent can simulate the interaction behavior of the user with corresponding permissions in the target business system according to the list of operations;

[0028] The logical vulnerability detection module is configured to, in response to the start of a logical vulnerability detection task, iteratively perform the following steps: based on a preset detection strategy, concurrently execute the detection task using multiple Agents; during the execution of the detection task, record the detected paths and detection results based on the context memory module set in each Agent, and adjust the next detection node corresponding to each Agent according to the recorded results; infer the detection results based on the industry-specific large model, and update the preset detection strategy according to the inference results;

[0029] The target detection result output module is configured to, when a preset iteration condition is met, output a target detection result of the logical vulnerability detection of the target business system; wherein the preset iteration condition is one or more of a preset vulnerability coverage, an iteration number, or a detection time length.

[0030] To solve the above problems, an aspect of an embodiment of the present application provides an electronic device, comprising: a processor, and a memory storing a program, the program comprising instructions which, when executed by the processor, cause the processor to perform any of the above-mentioned logical vulnerability detection methods based on a large model and Multi-Agent.

[0031] To solve the above problems, an aspect of an embodiment of the present application provides a non-transitory machine-readable medium storing computer instructions for causing a computer to perform any of the above-mentioned logical vulnerability detection methods based on a large model and Multi-Agent.

[0032] The beneficial effects of the embodiments of the present application are: by adopting the construction of the field knowledge graph of the target industry, and injecting the graph information in the field knowledge graph into the basic large model, an industry-specific large model is constructed; wherein the basic large model is obtained by training based on the multi-modal data set constructed according to the historical business cases in the target business system and based on the Transformer architecture; a plurality of Agent types of logical vulnerability detection are designed, and for each Agent type of detection, the corresponding operation list executable by the user with permission is encapsulated, so that the Agent can simulate the interaction behavior of the user with corresponding permission in the target business system according to the operation list; in response to the start of the logical vulnerability detection task, the following steps are iteratively executed: based on the preset detection strategy, a plurality of Agents are used to concurrently execute the detection task; during the execution of the detection task, the context memory module set in each Agent is used to record the detected path and the detection result, and the next detection node corresponding to each Agent is adjusted according to the recording result; the detection result is inferred based on the industry-specific large model, and the preset detection strategy is updated according to the inference result; when the preset iteration condition is met, the target detection result of the logical vulnerability detection of the target business system is output; wherein the preset iteration condition is one or more of the preset vulnerability coverage, the number of iterations or the detection time, which overcomes the problems of low vulnerability detection coverage, low detection efficiency, poor detection effect and narrow application scene of the vulnerability detection method in the related art, and achieves the industry-specific large model based on the field knowledge graph of the target industry, the Agent of multiple types of logical vulnerability detection and capable of simulating the interaction behavior of users with different permissions in the target business system, the concurrent execution of the detection task by multiple Agents, the inference of the detection result by the industry-specific large model and the update of the detection strategy, thereby realizing the real-time optimization and adaptive update of the detection strategy, and achieving the technical effects of improving the vulnerability detection coverage, improving the detection efficiency, improving the detection effect and expanding the application scene of the logical vulnerability detection method.

[0033] The details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more apparent. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other embodiments from these drawings without creative labor.

[0035] Figure 1FIG. 1 is a main flow diagram of a large model and Multi-Agent based logical vulnerability detection method according to an embodiment of the present application.

[0036] Figure 2 FIG. 2 is a main flow diagram of a large model and Multi-Agent based logical vulnerability detection method according to another embodiment of the present application.

[0037] Figure 3 FIG. 3 is a main framework diagram of a large model and Multi-Agent based logical vulnerability detection device according to an embodiment of the present application.

[0038] Figure 4 FIG. 4 is a structural diagram of an electronic device according to the present application. DETAILED DESCRIPTION

[0039] Embodiments of the present application will be described in more detail by referring to the accompanying drawings. Although certain embodiments of the present application are shown in the drawings, it is understood that the present application can be implemented in various forms and should not be interpreted as being limited to the embodiments set forth herein, but rather these embodiments are provided to more thoroughly and completely understand the present application. It is understood that the drawings and embodiments of the present application are for exemplary purposes only and are not intended to limit the scope of protection of the present application.

[0040] In the related art, for logical vulnerability detection, the following methods are mainly adopted: (1) rule matching and static scanning: known vulnerability patterns are matched through a predefined rule library (such as detecting sensitive fields in URL parameters through regular expressions), or vulnerability scanning is performed based on a static page feature library (such as HTML structure, API interface list); (2) manual penetration testing: a security engineer manually simulates user operations to attempt to trigger unauthorized or abnormal business process; (3) using simple automated tools: using script tools to send requests in batches to verify interface permissions or parameter legitimacy.

[0041] The above-mentioned solutions in the related art have significant limitations when dealing with complex business scenarios. Specifically, on the one hand, it is difficult to adapt to the dynamic changes of user roles in actual business scenarios, resulting in low coverage of unauthorized vulnerability detection, and due to the lack of understanding of the dependency relationship between business process steps, it is difficult to find link-style logical defects. On the other hand, due to the dependence on fixed rule libraries or feature libraries, it is unable to adapt to dynamic adjustments of business logic, resulting in low vulnerability detection coverage, low detection efficiency, poor detection effect, and difficulty in coping with large-scale system high-frequency iteration scenarios.

[0042] Large Model: refers to a deep learning model with a large number of parameters and a large amount of training data, usually based on advanced architectures such as Transformer. This kind of model is pre-trained through massive multi-modal data (such as text, code, image), and has strong semantic understanding, reasoning and generation ability.

[0043] Agent: an autonomous unit with independent perception, decision-making and execution capabilities.

[0044] Multi-Agent: refers to a system or architecture composed of multiple autonomous agents (Agents). The invention actually adopts a Multi-Agent execution architecture. Multi-Agent execution architecture is a system design framework that supports the collaborative work of multiple autonomous agents (Agents). Its core goal is to efficiently complete complex tasks (such as logic vulnerability detection) through the interaction and collaboration between agents.

[0045] In order to solve the above problems, the embodiment of the present application provides a logic vulnerability detection method based on large model and Multi-Agent, as shown in Figure 1 The logic vulnerability detection method based on large model and Multi-Agent mainly includes:

[0046] Step S101, construct the domain knowledge graph of the target industry, and inject the graph information in the domain knowledge graph into the basic large model to construct an industry-specific large model; wherein the basic large model is obtained by training a multi-modal data set constructed according to historical business cases in the target business system as training data and based on the Transformer architecture.

[0047] Based on the above settings, by constructing the domain knowledge graph of the target industry (such as the financial industry, the e-commerce industry), and injecting the graph information in the domain knowledge graph into the basic large model, the industry-specific large model constructed can combine specific industry domain knowledge in addition to the language understanding ability of the general application model when performing reasoning tasks, so as to more accurately identify and understand the logical relationship in the business process, which helps to improve the accuracy of logic vulnerability detection. And by injecting the domain knowledge graph, the industry-specific large model can quickly adapt to new business rules and process changes without the need to retrain the entire model, so that the industry-specific large model can adapt to the complex business needs of the target industry.

[0048] Specifically, in the construction process of the industry-specific large model, the injection of the domain knowledge graph enables the model to refer to industry-specific business rules and patterns when detecting logical vulnerabilities. For example, in the financial field, the industry-specific large model can identify which transaction operations are in compliance with regulatory requirements and which may be unauthorized operations. Since the business processes and user behaviors in complex target business systems often involve multiple steps and multiple data types, the use of the Transformer architecture enables the industry-specific large model to handle long sequence data and capture complex patterns in the data.

[0049] On the other hand, the construction process of the base large model uses a multi-modal data set constructed based on historical business cases in the target business system as training data, which increases the base large model's understanding of the business scenario. In some specific embodiments, the historical business cases include user operation logs, API (Application Programming Interface) call records, historical vulnerability reports, etc. The multi-modal data set constructed based on these data can provide rich contextual information, enabling the base large model to better understand business processes and user behavior patterns.

[0050] Among them, the above-mentioned domain knowledge graph provided by the embodiment of the present application contains entities, relationships and business rules; specifically, the above-mentioned entities include permission users, interfaces, permission points, and the above-mentioned relationships include interface call dependency relationships and user permission mapping relationships.

[0051] Based on the above settings, by taking the permission users, interfaces and permission points as entities and defining the user permission mapping relationship, the industry-specific large model can clearly understand the permission scope of each user in the business system. The entities and relationships in the domain knowledge graph provide rich contextual information for the model, enabling the model to refer to these contextual information when detecting logical vulnerabilities, thereby more accurately identifying potential logical vulnerabilities. At the same time, by defining the interface call dependency relationship and the user permission mapping relationship, the industry-specific large model can better understand the complex business logic, thereby enabling the model to detect more hidden logical vulnerabilities and improving the accuracy of logical vulnerability detection. Specifically, based on the explicit mapping relationship, the industry-specific large model can accurately determine whether a user has the right to access a specific interface or perform a specific operation; based on the interface call dependency relationship, the industry-specific large model can understand the calling order and dependency relationship between interfaces, which helps to detect whether there are vulnerabilities that bypass permission checks through illegal calling links.

[0052] In some embodiments, the step of injecting the graph information in the domain knowledge graph into the base large model to construct the industry-specific large model includes: encoding the entities and relationships in the domain knowledge graph into graph embedding vectors, injecting the graph embedding vectors into the base large model through an adapter layer or an expert mixture module to obtain the industry-specific large model; and encoding the business rules in the domain knowledge graph into logical expressions, and interacting with the industry-specific large model through a rule engine module, so that the industry-specific large model can call the business rules when performing the reasoning task.

[0053] Based on the above settings, the entities and relationships in the domain knowledge graph are encoded into graph embedding vectors, which can capture the semantic information of entities and relationships, providing rich contextual knowledge for the model, so that the industry-specific large model can understand and process this knowledge in a numerical form. The adapter layer (such as Adapter layer) provides a lightweight adaptation mechanism, and the expert mixture module (such as Mixture-of-Experts) can dynamically select and combine the outputs of multiple expert models; by injecting the graph embedding vectors into the base large model through the adapter layer or the expert mixture module, the industry-specific large model constructed can flexibly integrate domain knowledge.

[0054] Exemplarily, the business rules in the domain knowledge graph are encoded into logical expressions, which can clearly define the logical structure of the business rules, providing explicit reasoning basis for the model, so that the industry-specific large model can understand and process these rules in a formalized way. The rule engine module can dynamically evaluate the business rules according to the logical expressions, thereby providing real-time rule support for the model, and by interacting with the industry-specific large model through the rule engine module, the industry-specific large model can call the business rules when performing the reasoning task.

[0055] Through the combination of graph embedding vectors and logical expressions, the industry-specific large model constructed can utilize both domain knowledge and business rules for reasoning, thereby enabling the industry-specific large model to more efficiently handle complex logical relationships in the reasoning task, improving the accuracy and efficiency of reasoning.

[0056] Among them, the historical business cases provided by the embodiment of the present application include business process data, user permission data, historical vulnerability data and related domain knowledge.

[0057] In some embodiments, the construction of the base large model includes: obtaining historical business cases of the target business system to construct a multi-modal data set; the multi-modal data set includes operation sequences of normal business processes, abnormal business processes and over-privileged processes; using the multi-modal data set as training data, training a general language model based on a Transformer architecture, learning the causal relationship between operation sequences and target states, and constructing a base large model with logical reasoning capability; and designing a causal reasoning head to predict whether an operation can be transferred from a current state to a target state during the training process, and to optimize the operation of the base large model.

[0058] Based on the above settings, the base large model can comprehensively cover business logic by including operation sequences (multi-modal data set) of normal, abnormal and over-privileged processes, thereby more accurately identifying potential logical vulnerabilities; by learning the causal relationship between operation sequences and target states, the base large model can better understand the logical relationships in the business process, and the learning of the causal relationship enables the base large model to more accurately predict the results of operations in the reasoning task. Further, through the designed causal reasoning head, the base large model can predict whether an operation can be transferred from a current state to a target state during the training process, thereby enabling the base large model to better understand the logical relationships in the business process and improving the accuracy and efficiency of reasoning.

[0059] During the construction of the base large model, the combination of the multi-modal data set and the causal reasoning head enables the base large model to utilize rich contextual information and causal relationships for reasoning, and more accurately checks the permissions of each user, reducing false positives and false negatives, thereby enabling the base large model to be more comprehensive and accurate in handling complex business logic and user behavior.

[0060] Step S102, design a plurality of logic vulnerability detection type Agents, and encapsulate the operation list executable by the user with corresponding permissions for each detection type Agent, so that the Agent can simulate the interaction behavior of the user with corresponding permissions in the target business system according to the operation list.

[0061] Among them, the plurality of logic vulnerability detection type Agents provided by the embodiment of the application include: horizontal over-privileged detection Agent, vertical over-privileged detection Agent, unauthorized access detection Agent, arbitrary parameter tampering detection Agent, password recovery process vulnerability detection Agent; the operation list includes: API interface calling sequence, form field input range, page jump action set.

[0062] Based on the above settings, by designing multiple detection type Agents, the user behaviors of different permission levels can be covered, which helps to comprehensively detect the security and logical correctness of the target business system under various user roles. The operation list executable by the corresponding permission user of each detection type Agent is encapsulated, so that the Agent can simulate the interaction behavior of the real user in the target business system. Based on the above steps, the detection process is closer to the real scene through the simulation of the Agent, which improves the accuracy and reliability of the detection.

[0063] According to the embodiment of the application, by encapsulating the operation list, the Agent can also quickly adapt to new business rules and process changes without the need to redesign the detection strategy, thereby greatly reducing the maintenance cost of the detection system.

[0064] In step S103, in response to the start of the logical vulnerability detection task, the following steps are iteratively executed: based on the preset detection strategy, multiple Agents are used to concurrently execute the detection task; during the execution of the detection task, the context memory module set in each Agent is used to record the detected path and the detection result, and the next detection node corresponding to each Agent is adjusted according to the recording result; the industry-specific large model is used to infer the detection result, and the preset detection strategy is updated according to the inference result.

[0065] Based on the above settings, during the execution of the detection task, the detection task is executed in parallel by multiple Agents, which significantly improves the detection efficiency (each Agent can also be set to focus on a specific type of vulnerability detection to quickly cover each part of the target business system). At the same time, the context memory module in the Agent records the detected path and the detection result, and the next detection node is dynamically adjusted based on the recording result to preferentially test the uncovered process node or high-risk interface, thereby avoiding repeated detection and improving the detection efficiency. The dynamic adjustment capability provided by the embodiment of the application makes the detection process more intelligent and efficient. The industry-specific large model is used to infer the detection result, and the preset detection strategy is dynamically adjusted according to the detection result, so that the detection process is more suitable for the actual operation of the target business system, and the accuracy and adaptability of the detection are improved.

[0066] By dynamically adjusting the detection node and updating the preset detection strategy, the method can adaptively cope with different detection scenarios and business rule changes; at the same time, during the iterative execution of the detection task, the detection method provided by the embodiment of the application can continuously optimize the detection strategy, thereby improving the accuracy and efficiency of the detection.

[0067] In some embodiments, the plurality of agents share the detection results; the step of recording the detected paths and the detection results by the context memory module arranged in each agent and adjusting the next detection node corresponding to each agent based on the recorded results comprises: recording the detected paths and the detection results of the current agent and the detected paths and the detection results shared by other agents based on the context memory module; determining the next detection node corresponding to the current agent by a reinforcement learning algorithm; and wherein the reinforcement learning algorithm increases the node weight of the undetected node and the high-risk node based on the detection results.

[0068] Through the above arrangement, the plurality of agents share the detection results, so that each agent can use the detection information of other agents, the agent can avoid repeated detection of verified paths, and the detection efficiency is improved, and the comprehensiveness and accuracy of detection are improved through the cooperative work of the plurality of agents; the context memory module in the agent records the detected paths and the detection results of the current agent and the detected paths and the detection results shared by other agents, and adjusts the next detection node based on the recorded results, preferentially tests the uncovered process nodes or the high-risk interfaces, avoids repeated detection, and improves the detection efficiency; the reinforcement learning algorithm can dynamically adjust the detection strategy according to the detection results, so that the agent can more intelligently select the next detection path, and the accuracy and efficiency of detection are further improved.

[0069] According to the embodiments of the present application, by combining the shared detection results, the context memory module and the reinforcement learning algorithm, the detection method provided by the embodiments of the present application can comprehensively cover various user roles and operation scenarios of the target business system, can more accurately identify logical vulnerabilities, and is helpful to reduce false positives and omissions.

[0070] According to a specific embodiment of the present application, each agent can refer to the detection results of other agents when performing a detection task, so as to avoid repeated detection of the same path or node. For example, if an agent has detected a specific interface and determined that it is safe, other agents can skip the detection of the interface. Through the sharing of detection results, the agents can concentrate resources to detect the uncovered paths or high-risk nodes, and improve the detection efficiency.

[0071] According to still another specific embodiment of the present application, if an agent detects that a certain interface has a vulnerability, other interfaces related to the interface can be preferentially tested.

[0072] In some embodiments, the method further comprises introducing a reinforcement learning algorithm in the industry-specific large model to optimize the detection strategy through the reinforcement learning algorithm when performing the inference task; wherein the reward function in the reinforcement learning algorithm sets a reward value for different types of logical vulnerability detection.

[0073] Based on the above settings, the reinforcement learning algorithm can adaptively adjust and optimize the detection path and strategy according to the current detection result and environmental feedback. By introducing the reinforcement learning algorithm, the industry-specific large model can dynamically adjust the detection strategy when performing the inference task, so that the detection method provided by the embodiments of the present application can better adapt to complex and variable business scenarios.

[0074] Further, different vulnerability types (such as horizontal privilege escalation, vertical privilege escalation, unauthorized access, etc.) have different detection difficulty and risk levels. By setting a reward value for different types of logical vulnerability detection, the reinforcement learning algorithm can more accurately optimize the detection strategy, so that the industry-specific large model can more effectively identify and handle logical vulnerabilities.

[0075] In some embodiments, the method further comprises integrating an MCP Server to connect external data sources, tools and files through an MCP protocol to realize client behavior simulation; and integrating a Browser-agent to simulate clicking and traversing in the target business system using the Browser-agent, and performing full-link analysis based on the clicking and traversing results to determine logical vulnerabilities.

[0076] Specifically, the detection method provided by the present application connects external data sources and tools through an MCP protocol (Model Context Protocol) to support the following functions deployed in the browser: weak password detection and login page identification; batch user registration simulation; automatic URL identification and backend request packet capture. The following business logic identification functions can be achieved through the Browser-agent: simulated clicking and page traversal to identify business scenarios; full-link information analysis based on the React Agent framework; end-to-end privilege escalation and business logic vulnerability positioning.

[0077] Step S104: When the preset iteration condition is met, output a target detection result of the logical vulnerability detection for the target business system; wherein the preset iteration condition is one or more of a preset vulnerability coverage, an iteration number or a detection time length.

[0078] Through the above settings, the preset iteration condition makes the detection process controllable, and the depth and breadth of detection can be adjusted according to actual needs. For example, by setting the vulnerability coverage, it can be ensured that the detection process covers most of the potential vulnerabilities in the system. The detection result not only includes vulnerability information, but also provides repair suggestions, which provides comprehensive vulnerability information for system maintenance personnel, facilitating them to quickly locate and repair vulnerabilities and reduce security risks.

[0079] According to a specific embodiment of the present application, based on the preset vulnerability coverage, the comprehensiveness and accuracy of the detection can be ensured; based on the preset number of iterations, the detection efficiency can be ensured; and based on the preset detection time length, the timeliness of the detection can be ensured. It should be pointed out that a plurality of iteration conditions can also be selected as the termination condition of the detection process according to actual needs.

[0080] In some embodiments, the above method further includes determining the logical vulnerability type and the logical vulnerability impact level based on the output target detection result, and generating a visual report and a vulnerability repair suggestion.

[0081] Based on the above settings, the impact level of the vulnerability is evaluated according to the severity, impact range and potential risk of the vulnerability, and the generated visual report can intuitively display the target detection result, including vulnerability distribution, vulnerability type, impact level and other information. It can help maintenance personnel to quickly locate and analyze vulnerabilities, so that maintenance personnel can quickly understand the security status of the system, prioritize high-risk vulnerabilities and improve repair efficiency.

[0082] Further, according to the embodiments of the present application, the logical vulnerabilities in the target detection result can also be prioritized, so that the maintenance personnel can repair the logical vulnerabilities in a targeted manner, reducing the risk of data leakage, financial loss or business fraud.

[0083] The above-mentioned logic vulnerability detection method based on a large model and Multi-Agent provided by the embodiment of the present application, since the domain knowledge graph of the target industry is constructed, and the graph information in the domain knowledge graph is injected into the basic large model, an industry-specific large model is constructed. The basic large model is obtained by training a multi-modal data set constructed according to historical business cases in the target business system as training data based on the Transformer architecture. A plurality of Agent types for logic vulnerability detection are designed, and an operation list executable by a user with corresponding permissions for each Agent type is encapsulated, so that the Agent can simulate the interaction behavior of the user with corresponding permissions in the target business system according to the operation list. In response to the start of the logic vulnerability detection task, the following steps are iteratively executed: based on the preset detection strategy, a plurality of Agents are used to concurrently execute the detection task; during the execution of the detection task, the context memory module set in each Agent records the detected path and the detection result, and adjusts the next detection node corresponding to each Agent according to the record result; the industry-specific large model is used to reason the detection result, and the preset detection strategy is updated according to the reasoning result; when the preset iteration condition is met, the target detection result of the logic vulnerability detection for the target business system is output; wherein the preset iteration condition is one or more of the preset vulnerability coverage, the number of iterations or the detection time length, which overcomes the problems of low vulnerability detection coverage, low detection efficiency, poor detection effect and narrow application scene of the vulnerability detection method in the related art, and realizes the construction of the industry-specific large model based on the domain knowledge graph of the target industry, the design of the Agent of multiple logic vulnerability detection types and the simulation of the interaction behavior of the user with different permissions in the target business system. The detection task is executed in parallel by a plurality of Agents, and the detection result is reasoned by using the industry-specific large model, and the detection strategy is updated, forming real-time optimization and adaptive update of the detection strategy, thereby improving the vulnerability detection coverage, improving the detection efficiency, improving the detection effect, and expanding the application scene of the logic vulnerability detection method.

[0084] The embodiment of the present application also provides a logic vulnerability detection method based on a large model and Multi-Agent, which is applied to a logic vulnerability detection scene for a target business system. Optionally, as shown in Figure 2 The logic vulnerability detection method based on a large model and Multi-Agent provided by the embodiment of the present application mainly includes:

[0085] In step S201, historical business cases of a target business system are acquired to construct a multi-modal data set; the multi-modal data set includes operation sequences of normal business processes, abnormal business processes, and over-authorized processes; a general language model is trained based on a Transformer architecture using the multi-modal data set as training data, a causal relationship between operation sequences and target states is learned, and a basic large model with logical reasoning capability is constructed.

[0086] According to a specific embodiment of the embodiment of the application, typical operation sequences can be divided according to actual user permissions and actual business processes in the target business system, and three types of sample libraries of “normal process”, “abnormal process”, and “over-authorized process” are constructed; real business logs, interface call chains, and manually annotated over-authorized / logical vulnerability cases (i.e.

[0087] The above historical business cases) are acquired from the target business system, and the historical business cases are sorted according to the foregoing sample libraries, thereby forming a multi-modal data set for training and verification of the basic large model. The multi-modal data set includes operation sequences of normal business processes, abnormal business processes, and over-authorized processes.

[0088] Based on the foregoing settings, the training data of the basic large model is based on the historical business cases of the target business system, and covers specific cases corresponding to normal processes, abnormal processes, and over-authorized processes, forming a multi-modal data set (which can include text logs, API call chains, code snippets, etc.). This data composition ensures that the basic large model learns the causal relationship between operations and consequences (which can also be represented as states) (for example, “submit unverified parameters → trigger data tampering vulnerability”).

[0089] According to another specific embodiment of the embodiment of the application, after the training data is determined, a general language large model can be pre-trained using a Transformer-based architecture, and in the pre-training stage, the causal relationship between “operation → consequence” is focused on for learning. Further, a dedicated causal reasoning head (causal head) can be designed to predict whether an operation can flow from a current state to a target state during the pre-training process, thereby optimizing the operation of the basic large model.

[0090] The Transformer architecture based on the self-attention mechanism can capture long-distance dependency relationships and effectively capture the state transition logic in multi-step business processes during modeling. For example, the basic large model can infer the complete link of “user completes identity verification → initiates transfer → triggers risk control” and identify potential vulnerabilities in the intermediate links.

[0091] Step S202, a domain knowledge graph of the target industry is constructed, entities and relationships in the domain knowledge graph are coded into graph embedding vectors, the graph embedding vectors are injected into the base large model through an adapter layer or an expert mixture module to obtain an industry-specific large model; and business rules in the domain knowledge graph are coded into logical expressions, and the industry-specific large model is interacted with the rule engine module to enable the industry-specific large model to call the business rules when performing a reasoning task.

[0092] According to a specific embodiment of the embodiment of the application, by extracting entities (user roles, interfaces, permission points), relationships (interface call dependencies, permission mappings) and business rules (such as permission constraints, business processes) of the target industry (such as finance, e-commerce), scattered industry knowledge is converted into a structured knowledge graph. This representation can explicitly depict the relevance and constraints of business logic, for example:

[0093] Entity relationship: user A (ordinary user) is associated with permission point Y (only can query own order) through interface X (order query);

[0094] Business rule: user B (administrator) can access interface Z (order modification), but needs to meet the precondition (such as identity secondary verification).

[0095] Then, the graph embedding vectors (coding entity, relationship and rule semantics) are dynamically integrated into the base large model using the Adapter layer or the Mixture-of-Experts (MoE) module. While avoiding directly modifying the original parameters of the large model, the general semantic understanding ability of the pre-trained model is retained, and the field knowledge is introduced through the lightweight adaptation mechanism, realizing the balance between knowledge scalability and model stability.

[0096] Based on the above settings, through structured knowledge injection, the industry-specific large model can identify business rules such as permission boundaries and operation dependencies, and the industry-specific large model can also generate test cases (such as simulating the operation sequence after user role switching) that conform to the actual business scenario, thereby reducing false positives and false negatives in the subsequent vulnerability detection process.

[0097] In some embodiments, the above method further comprises: introducing a reinforcement learning algorithm into the industry-specific large model to optimize the detection strategy through the reinforcement learning algorithm when performing a reasoning task; wherein the reward function in the reinforcement learning algorithm sets a reward value for different logical vulnerability detection types.

[0098] According to a specific embodiment of the present application, in the process of introducing the reinforcement learning algorithm, the operation can be defined in advance: such as API call, page jump, data input; the state is defined: such as the current account role, the executed operation sequence, the context variable (such as the business order number, the order status); the reward value is defined: triggering "illegal access" returns 1 point, successfully breaking through vertical / horizontal overreach 5 points, discovering link type logic defect 10 points (the specific value setting is only an example and does not limit the present application). Then, based on the reinforcement learning algorithm (such as PPO, Proximal Policy Optimization, proximal policy optimization algorithm), the industry special large model is fine-tuned to continuously strengthen the vulnerability detection capability of the industry special large model in the complex business process.

[0099] Based on the above setting, the reinforcement learning algorithm can adaptively adjust and optimize the detection path and strategy according to the current detection result and environmental feedback. By introducing the reinforcement learning algorithm, the industry special large model can dynamically adjust the detection strategy when performing the inference task, so that the detection method provided by the embodiment of the present application can better adapt to the complex and variable business scenarios.

[0100] Further, different vulnerability types (such as horizontal overreach, vertical overreach, unauthorized access, etc.) have different detection difficulty and risk level, and by setting the reward value for different logic vulnerability detection types, the reinforcement learning algorithm can more accurately optimize the detection strategy, so that the industry special large model can more effectively identify and handle the logic vulnerability.

[0101] In some embodiments, the above can further include a model evaluation and automatic iteration step: running the pre-trained model in a sandbox environment, generating a preliminary detection strategy and evaluating the recall rate / precision rate. According to the evaluation result, the strategy parameters (such as detection coverage, reward weight) are automatically adjusted, and the closed loop iteration is performed until the preset condition (such as the preset vulnerability coverage) is reached.

[0102] Step S203, designing an Agent of a plurality of logic vulnerability detection types, and encapsulating an operation list executable by a user with corresponding permissions for each Agent of the detection type, so that the Agent can simulate the interaction behavior of the user with corresponding permissions in the target business system according to the operation list.

[0103] According to a specific embodiment of the present application, a plurality of Agents of vulnerability detection types can be designed: such as horizontal overreach detection, vertical overreach detection, unauthorized detection, arbitrary parameter tampering, password recovery, etc.; the operation list executable by the user with corresponding permissions for each Agent can include API list, form field, page jump action, etc.

[0104] Step S204: In response to the initiation of the logic vulnerability detection task, the following steps are executed iteratively: Based on the preset detection strategy, multiple agents are used to execute the detection task concurrently; during the execution of the detection task, the detected paths and detection results are recorded based on the context memory module set in each agent, and the next detection node corresponding to each agent is adjusted according to the recorded results; the detection results are inferred based on the industry-specific large model, and the preset detection strategy is updated according to the inference results.

[0105] According to a specific implementation of the present invention, detection tasks are issued based on a "large model + preset detection strategy", and each Agent executes the detection script in parallel (concurrency can reach N), exchanging key states (detection results) with each other through shared memory or message queues.

[0106] Furthermore, a context memory module (such as Transformer-XL or external KV-Memory) is introduced for each Agent to record the paths attempted and their detection results. In each iteration, the priority of the next detection node is dynamically adjusted based on the "memory" (e.g., prioritizing testing uncovered process nodes or high-risk interfaces). The "unauthorized access / logic defect" detection results generated by the Agent execution are collected and labeled with quality by a central scheduler (Coordinator). These results are then sent to a large industry-specific model for inference, updating the detection strategy in real time. The updated detection strategy is then distributed to the Agent, forming an adaptive closed loop of "detection → feedback → optimization → re-detection".

[0107] Based on the above setup, the industry-specific large-scale model provides "high-level detection direction" and causal reasoning capabilities, guiding agents on how to construct high-value test cases. Parallel execution by multiple agents significantly improves detection efficiency, and contextual memory avoids redundant attempts. Closed-loop strategy optimization ensures that the effectiveness of vulnerability detection continues to improve as detection depth and coverage increase. In other words, through the combination of the industry-specific large-scale model and Multi-Agent, the industry-specific large-scale model is responsible for "knowing"—mining business causality and generating efficient detection strategies; the multi-Agent architecture is responsible for "doing"—executing detection tasks in parallel and systematically and providing feedback on detection results, ultimately leading to real-time optimization and adaptive upgrades of the detection strategy.

[0108] In some embodiments, the above method further includes: integrating an MCP Server to connect to external data sources, tools, and files via the MCP protocol to simulate client behavior; and integrating a Browser-agent to simulate clicks and traversals in the target business system, and performing full-link analysis based on the click and traversal results to identify logical vulnerabilities.

[0109] Specifically, the detection method provided by the present application connects external data sources and tools through the MCP protocol to support the deployment of the following functions in the browser: weak password detection and login page identification; batch user registration simulation; automatic URL identification and backend request package capture. The following business logic identification functions can be achieved through Browser-agent: simulation clicks and page traversal to identify business scenarios; full-link information analysis based on the React Agent framework; end-to-end privilege violation and business logic vulnerability positioning.

[0110] In step S205, when the preset iteration condition is met, the target detection result is determined; based on the influence level of the target logic vulnerability in the industry special large model target detection result, and combined with the maintenance difficulty coefficient and the business impact coefficient, the priority and sorting result of the target logic vulnerability are determined, and a visual report and repair suggestion are output according to the target detection result and the sorting result; wherein the preset iteration condition is one or more of the preset vulnerability coverage, the iteration number or the detection time length.

[0111] Based on the above settings, the influence level of the vulnerability is evaluated according to the severity, impact range and potential risk of the vulnerability, and the generated visual report can intuitively display the target detection result, including vulnerability distribution, vulnerability type, influence level and other information. It can help maintenance personnel quickly locate and analyze vulnerabilities, so that maintenance personnel can quickly understand the security status of the system, prioritize high-risk vulnerabilities, and improve repair efficiency.

[0112] The above-mentioned logic vulnerability detection method based on a large model and Multi-Agent provided by the embodiment of the present application acquires historical business cases of a target business system to construct a multi-modal data set, wherein the multi-modal data set includes operation sequences of normal business processes, abnormal business processes and over-authorized processes; uses the multi-modal data set as training data, trains a general language model based on a Transformer architecture, learns the causal relationship between operation sequences and target states, and constructs a basic large model with logical reasoning capability; constructs a domain knowledge graph of a target industry, encodes entities and relationships in the domain knowledge graph into graph embedding vectors, injects the graph embedding vectors into the basic large model through an adapter layer or an expert hybrid module to obtain an industry-specific large model; and encodes business rules in the domain knowledge graph into logical expressions, interacts with the industry-specific large model through a rule engine module, so that the industry-specific large model can call the business rules when performing a reasoning task; designs Agents of multiple logic vulnerability detection types, and encapsulates an operation list executable by a user with corresponding permissions for each Agent of a detection type, so that the Agent can simulate the interaction behavior of the user with corresponding permissions in the target business system according to the operation list; in response to the start of a logic vulnerability detection task, iteratively execute the following steps: based on a preset detection strategy, use multiple Agents to concurrently execute a detection task; during the execution of the detection task, record the detected path and the detection result based on the context memory module set in each Agent, and adjust the next detection node corresponding to each Agent according to the recording result; reason the detection result based on the industry-specific large model, and update the preset detection strategy according to the reasoning result; when a preset iteration condition is met, determine a target detection result; based on the influence level of the target logic vulnerability in the target detection result of the industry-specific large model, and combined with the maintenance difficulty coefficient and the business impact coefficient, determine the priority and the sorting result of the target logic vulnerability, and output a visual report and a repair suggestion according to the target detection result and the sorting result; wherein the preset iteration condition is one or more of a preset vulnerability coverage, an iteration number or a detection time length. The technical effects of improving the vulnerability detection coverage, improving the detection efficiency, improving the detection effect, and expanding the applicable scenarios of the logic vulnerability detection method are achieved.

[0113] Based on the above-mentioned logic vulnerability detection method based on a large model and Multi-Agent provided by the embodiment of the present application, the embodiment of the present application further provides a logic vulnerability detection device based on a large model and Multi-Agent, which is applied to a logic vulnerability detection scene for a target business system, as shown in Figure 3 The logic vulnerability detection device 300 based on a large model and Multi-Agent includes:

[0114] The big model construction module 301 is configured to construct a domain knowledge graph of a target industry, and inject graph information in the domain knowledge graph into a basic big model to construct an industry-specific big model. The basic big model is obtained by training a multi-modal data set constructed according to historical business cases in a target business system based on a Transformer architecture.

[0115] Based on the above settings, by constructing a domain knowledge graph of a target industry (such as the financial industry or the e-commerce industry), and injecting graph information in the domain knowledge graph into a basic big model, the industry-specific big model constructed can combine specific industry domain knowledge in addition to the language understanding ability of the general application model when performing reasoning tasks, so as to more accurately identify and understand the logical relationship in the business process, which helps to improve the accuracy of logical vulnerability detection. And by injecting the domain knowledge graph, the industry-specific big model can quickly adapt to new business rules and process changes without the need to retrain the entire model, so that the industry-specific big model can adapt to the complex business needs of the target industry.

[0116] On the other hand, the construction process of the basic big model uses a multi-modal data set constructed based on historical business cases in a target business system as training data, which increases the understanding of the basic big model for business scenarios. In some specific embodiments, the historical business cases include user operation logs, API call records, historical vulnerability reports, etc. The multi-modal data set constructed based on these data can provide rich context information, so that the basic big model can better understand the business process and user behavior patterns.

[0117] In particular, the entities include permission users, interfaces, and permission points, and the relationships include interface call dependency relationships and user permission mapping relationships.

[0118] Based on the above settings, by taking the permission users, interfaces, and permission points as entities, and defining the user permission mapping relationship, the industry-specific big model can clearly understand the permission scope of each user in the business system. The entities and relationships in the domain knowledge graph provide rich context information for the model, so that the model can refer to these context information when detecting logical vulnerabilities, thereby more accurately identifying potential logical vulnerabilities. At the same time, by defining the interface call dependency relationship and the user permission mapping relationship, the industry-specific big model can better understand the complex business logic, so that the model can detect more hidden logical vulnerabilities, thereby improving the accuracy of logical vulnerability detection.

[0119] In some embodiments, the large model construction module 301 is further configured to: encode entities and relationships in the domain knowledge graph into graph embedding vectors, inject the graph embedding vectors into the base large model through an adapter layer or an expert mixing module to obtain an industry-specific large model; and encode business rules in the domain knowledge graph into logical expressions, and interact with the industry-specific large model through a rule engine module, so that the industry-specific large model can call the business rules when performing a reasoning task.

[0120] Based on the above settings, the entities and relationships in the domain knowledge graph are encoded into graph embedding vectors, which can capture the semantic information of entities and relationships, providing rich contextual knowledge for the model, so that the industry-specific large model can understand and process this knowledge in a numerical form. The graph embedding vectors are injected into the base large model through the adapter layer or the expert mixing module, so that the industry-specific large model constructed can flexibly integrate domain knowledge.

[0121] In some embodiments, the historical business cases provided by the embodiments of the present application include business process data, user permission data, historical vulnerability data, and related domain knowledge.

[0122] In some embodiments, the large model and Multi-Agent based logic vulnerability detection device 300 further comprises a construction module of a base large model, configured to: obtain historical business cases of a target business system to construct a multi-modal data set; wherein the multi-modal data set comprises operation sequences of normal business processes, abnormal business processes and unauthorized processes; use the multi-modal data set as training data, train a general language model based on a Transformer architecture, learn the causal relationship between operation sequences and target states, and construct a base large model with logic reasoning capability; and design a causal reasoning head to predict whether an operation can flow from a current state to a target state during the training process, to realize the optimization operation of the base large model.

[0123] Based on the above settings, the base large model can comprehensively cover business logic through operation sequences (multi-modal data set) containing normal, abnormal and unauthorized processes, so as to more accurately identify potential logic vulnerabilities; through learning the causal relationship between operation sequences and target states, the base large model can better understand the logical relationship in the business process, and according to the learning of the causal relationship, the base large model can more accurately predict the result of the operation in the reasoning task. Further, through the designed causal reasoning head, the base large model can predict whether an operation can flow from a current state to a target state during the training process, so that the base large model can better understand the logical relationship in the business process, and improve the accuracy and efficiency of reasoning.

[0124] The multi-agent design module 302 is used for designing agents of multiple logical vulnerability detection types, and encapsulating a list of operations executable by a corresponding authority user for each agent of a detection type, so that the agent can simulate the interaction behavior of the corresponding authority user in the target business system according to the operation list.

[0125] In the embodiment of the present application, the agents of multiple logical vulnerability detection types include horizontal privilege escalation detection agents, vertical privilege escalation detection agents, unauthorized access detection agents, arbitrary parameter tampering detection agents, and password recovery process vulnerability detection agents; and the operation list includes API interface calling sequences, form field input ranges, and page jump action sets.

[0126] Based on the above settings, by designing agents of multiple detection types, the user behaviors of different authority levels can be covered, which helps to comprehensively detect the security and logical correctness of the target business system under various user roles. The operation list executable by the corresponding authority user is encapsulated for each agent of a detection type, so that the agent can simulate the interaction behavior of the real user in the target business system. Based on the above module, the detection process is closer to the real scene through the simulation of the agent, which improves the accuracy and reliability of the detection.

[0127] The logical vulnerability detection module 303 is used for iteratively performing the following steps in response to the start of a logical vulnerability detection task: based on a preset detection strategy, using multiple agents to concurrently perform the detection task; during the detection task execution process, recording the detected path and the detection result based on the context memory module set in each agent, and adjusting the next detection node corresponding to each agent according to the recording result; reasoning the detection result based on an industry-specific large model, and updating the preset detection strategy according to the reasoning result.

[0128] Based on the above settings, during the detection task execution process, multiple agents are used to perform the detection task in parallel, which significantly improves the detection efficiency (each agent can also be set to focus on a specific type of vulnerability detection to quickly cover each part of the target business system). At the same time, the context memory module in the agent records the detected path and the detection result, and dynamically adjusts the next detection node based on the recording result to preferentially test the uncovered process nodes or high-risk interfaces, avoid repeated detection, and improve the detection efficiency. The dynamic adjustment capability provided by the embodiment of the present application makes the detection process more intelligent and efficient. The industry-specific large model is used to reason the detection result, and the preset detection strategy is dynamically adjusted according to the detection result, so that the detection process is more suitable for the actual operation of the target business system, and the accuracy and adaptability of the detection are improved.

[0129] In some embodiments, the plurality of Agents share the detection results; the logic vulnerability detection module 303 is further configured to: record, based on the context memory module, the detected path and detection result of the current Agent, and the detected path and detection result shared by other Agents; determine the next detection node corresponding to the current Agent by using a reinforcement learning algorithm; and adjust the node weight of the undetected node and the high-risk node based on the detection result.

[0130] Through the above arrangement, the plurality of Agents share the detection results, so that each Agent can use the detection information of other Agents, the Agent can avoid repeated detection of verified paths, the detection efficiency is improved, and the comprehensiveness and accuracy of detection are improved through the cooperative work of the plurality of Agents; the context memory module in the Agent records the detected path and detection result of the current Agent, and the detected path and detection result shared by other Agents, the next detection node is adjusted based on the recorded result, the uncovered process node or the high-risk interface is preferentially tested, repeated detection is avoided, and the detection efficiency is improved; the reinforcement learning algorithm can dynamically adjust the detection strategy according to the detection result, so that the Agent can more intelligently select the next detection path, and the accuracy and efficiency of detection are further improved.

[0131] In some embodiments, the logic vulnerability detection device 300 based on the large model and the Multi-Agent further comprises an industry-specific large model optimization module, configured to: introduce a reinforcement learning algorithm into the industry-specific large model, so as to optimize the detection strategy by using the reinforcement learning algorithm when performing an inference task; and set reward values for different logic vulnerability detection types in the reward function of the reinforcement learning algorithm.

[0132] Based on the above arrangement, the reinforcement learning algorithm can adaptively adjust and optimize the detection path and strategy according to the current detection result and environmental feedback. By introducing the reinforcement learning algorithm, the industry-specific large model can dynamically adjust the detection strategy when performing an inference task, so that the detection method provided by the embodiments of the present application can better adapt to complex and changeable business scenarios.

[0133] In some embodiments, the logic vulnerability detection device 300 based on the large model and the Multi-Agent further comprises an integration module, configured to: integrate the MCP Server to connect external data sources, tools and files through the MCP protocol, and realize client behavior simulation; and integrate the Browser-agent to simulate clicking and traversing in the target business system by using the Browser-agent, and perform full-link analysis based on the clicking and traversing results to determine the logic vulnerability.

[0134] The target detection result output module 304 is configured to output a target detection result of the logical vulnerability detection for the target business system when a preset iteration condition is met, wherein the preset iteration condition is one or more of a preset vulnerability coverage, an iteration number, or a detection time length.

[0135] Through the above setting, the preset iteration condition makes the detection process controllable, and the depth and breadth of the detection can be adjusted according to actual needs. For example, by setting the vulnerability coverage, it can be ensured that the detection process covers most of the potential vulnerabilities in the system. The detection result not only includes vulnerability information, but also provides repair suggestions, which provides comprehensive vulnerability information for system maintenance personnel, facilitating them to quickly locate and repair vulnerabilities and reduce security risks.

[0136] In some embodiments, the target detection result output module 304 is further configured to determine a logical vulnerability type and a logical vulnerability impact level based on the output target detection result, and generate a visual report and a vulnerability repair suggestion.

[0137] Based on the above setting, the impact level of the vulnerability is evaluated according to the severity, impact range and potential risk of the vulnerability, and the generated visual report can intuitively display the target detection result, including vulnerability distribution, vulnerability type, impact level and other information. It can help maintenance personnel to quickly locate and analyze vulnerabilities, so that maintenance personnel can quickly understand the security status of the system, prioritize high-risk vulnerabilities, and improve repair efficiency.

[0138] Further, according to the embodiment of the present application, the target detection result output module 304 can also be used to prioritize the logical vulnerabilities in the target detection result, so that the maintenance personnel can repair the logical vulnerabilities in a targeted manner, reducing the risk of data leakage, financial loss or business fraud.

[0139] The logical vulnerability detection device based on a large model and Multi-Agent provided by the embodiment of the present application, because of the sampling large model construction module, is used to construct the domain knowledge graph of the target industry, and injects the graph information in the domain knowledge graph into the basic large model to construct the industry special large model; wherein the basic large model is obtained by training based on the Transformer architecture, using the multi-modal data set constructed according to the historical business cases in the target business system as training data;

[0140] The multi-agent design module is used for designing agents of multiple logical vulnerability detection types, and encapsulating a list of operations executable by a corresponding permission user for each agent of a detection type, so that the agent can simulate the interaction behavior of the corresponding permission user in the target business system according to the operation list; the logical vulnerability detection module is used for, in response to the start of a logical vulnerability detection task, iteratively performing the following steps: based on a preset detection strategy, using multiple agents to concurrently perform the detection task; during the detection task execution, recording the detected path and the detection result based on the context memory module set in each agent, and adjusting the next detection node corresponding to each agent according to the recording result; reasoning the detection result based on the industry-specific large model, and updating the preset detection strategy according to the reasoning result; the target detection result output module is used for, when a preset iteration condition is met, outputting a target detection result of the logical vulnerability detection of the target business system; wherein the preset iteration condition is one or more of a preset vulnerability coverage, an iteration number or a detection time length. The industry-specific large model is obtained based on the target industry domain knowledge graph, the agents of multiple logical vulnerability detection types are designed, and the interaction behavior of different permission users in the target business system can be simulated, the detection task is executed in parallel by multiple agents, the detection result is reasoned by using the industry-specific large model, the detection strategy is updated, the real-time optimization and adaptive update of the detection strategy are formed, and the technical effects of improving the vulnerability detection coverage, improving the detection efficiency, improving the detection effect and expanding the applicable scene of the logical vulnerability detection method are achieved.

[0141] The embodiment of the present application also provides a non-transitory machine readable medium storing a computer program, wherein the computer program is used for causing the computer to execute the method of the embodiment of the present application when the computer program is executed by a processor of the computer.

[0142] The embodiment of the present application also provides a computer program product comprising a computer program, wherein the computer program is used for causing the computer to execute the method of the embodiment of the present application when the computer program is executed by a processor of the computer. The computer program product should be understood as a software product mainly realizing the above-mentioned method of the present application through the computer program.

[0143] The embodiment of the present application also provides an electronic device comprising: at least one processor; and a memory communicatively connected with the at least one processor. The memory stores a computer program capable of being executed by the at least one processor, and the computer program is used for causing the electronic device to execute the method of the embodiment of the present application when the computer program is executed by the at least one processor.

[0144] Reference Figure 4, a block diagram of an electronic device that can be a server or a client as an embodiment of the present application will now be described, which is an example of a hardware device that can be applied to aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer devices such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices such as personal digital assistants, cellular telephones, smart phones, wearable devices, and other similar computing devices. The components, their connections, and their functions, as shown in the figures and described herein, are meant only to be examples and are not intended to limit the implementations of the present application described and / or claimed herein.

[0145] As shown in FIG. 4, Figure 4 The electronic device includes a computing unit 401 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 402 or a computer program loaded into a random access memory (RAM) 403 from a storage unit 408. Various programs and data required for the operation of the electronic device can also be stored in the RAM 403. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0146] Various components in the electronic device are connected to the I / O interface 405, including an input unit 406, an output unit 407, the storage unit 408, and a communication unit 409. The input unit 406 can be any type of device that can input information to the electronic device, and can receive inputted digital or character information, and generate key signal inputs related to user settings and / or function controls of the electronic device. The output unit 407 can be any type of device that can present information, and can include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 can include, but is not limited to, a magnetic disk, an optical disk. The communication unit 409 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include, but is not limited to, a modem, a network card, an infrared communication device, and / or a wireless communication transceiver, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0147] The computing unit 401 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, CPUs, graphics processing units (GPUs), various specialized artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, or the like. The computing unit 401 performs various methods and processes described above. For example, in some embodiments, the method embodiments of the present application can be implemented as a computer program tangibly embodied in a machine-readable medium, such as the storage unit 408. In some embodiments, portions or all of the computer program can be loaded and / or installed onto the electronic device via the ROM 402 and / or the communication unit 409. In some embodiments, the computing unit 401 can be configured to perform the methods described above by way of other any suitable means, such as by way of firmware.

[0148] Computer programs used to implement embodiments of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer program

[0149] In the context of embodiments of the present application, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, or infrared signals, or any suitable combination thereof. More specific examples of a machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0150] It should be noted that the term "comprising" and its derivations used in the embodiments of the present application are open-ended, that is, "comprising but not limited to". The term "based on" is "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The terms "a" and "an" are intended to mean "one or more" unless otherwise indicated. The terms "including" and / or "containing", or variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises, has, or contains a list of elements is not necessarily limited to those elements, but can include additional elements not expressly listed or inherent to such process, method, article, or apparatus.

[0151] The information / data (including but not limited to information / data for analysis, stored information / data, displayed information / data, etc.) involved in the embodiments of the present application is information / data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of the country and region, and provide corresponding operation portal for user to choose authorization or refusal.

[0152] The various steps described in the method embodiments provided by the embodiments of the present application can be executed in different order and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the execution of the steps shown. The scope of protection of the present application is not limited in this respect.

[0153] The word "embodiment" in the specification refers to the specific features, structures or characteristics described in connection with the embodiments can be included in at least one embodiment of the present application. The presence of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean independence or alternative to each other. Each embodiment in the specification is described in a relevant manner, and the same or similar parts between each embodiment are referred to each other. In particular, for device, equipment, system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts are referred to the part of the method embodiment.

[0154] The above-described embodiments only express several embodiments of the present application, which are described in detail and specifically, but cannot be understood as a limitation on the scope of protection. It should be noted that for ordinary skilled in the art, without departing from the concept of the present application, a number of variations and improvements can be made, which are within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A method for logical vulnerability detection based on large models and Multi-Agent, characterized in that, The method comprises the following steps: constructing a domain knowledge graph of a target industry, and injecting graph information in the domain knowledge graph into a basic large model to construct an industry-specific large model; wherein the basic large model is obtained by training a multi-modal data set constructed according to historical business cases in a target business system based on a Transformer architecture; wherein the step of injecting the graph information in the domain knowledge graph into the basic large model to construct the industry-specific large model comprises: encoding entities and relationships in the domain knowledge graph into graph embedding vectors, injecting the graph embedding vectors into the basic large model through an adapter layer or an expert hybrid module to obtain the industry-specific large model; and encoding business rules in the domain knowledge graph into logical expressions, and interacting with the industry-specific large model through a rule engine module, so that the industry-specific large model can call the business rules when performing an inference task; designing multiple types of Agent for detecting logical vulnerabilities, and encapsulating a list of operations executable by a user with corresponding permissions for each type of Agent, so that the Agent can simulate the interaction behavior of the user with corresponding permissions in the target business system according to the operation list; in response to the start of a logical vulnerability detection task, iteratively performing the following steps: based on a preset detection strategy, using multiple Agents to concurrently perform a detection task; during the detection task execution, recording the detected path and the detection result based on the context memory module set in each Agent, and adjusting the next detection node corresponding to each Agent according to the recording result; reasoning the detection result based on the industry-specific large model, and updating the preset detection strategy according to the reasoning result; when a preset iteration condition is met, outputting a target detection result of the logical vulnerability detection of the target business system; wherein the preset iteration condition is one or more of a preset vulnerability coverage, an iteration number or a detection time length.

2. The method of claim 1, wherein, The domain knowledge graph comprises entities, relationships and business rules; the entities include permission users, interfaces, permission points, and the relationships include interface call dependency relationships and user permission mapping relationships.

3. The method of claim 2, wherein, The method further comprises: introducing a reinforcement learning algorithm into the industry-specific large model to optimize the detection strategy through the reinforcement learning algorithm when performing an inference task; wherein the reward function in the reinforcement learning algorithm sets a reward value for different types of logical vulnerability detection.

4. The method of claim 1, wherein, The historical business cases include business process data, user permission data, historical vulnerability data and related domain knowledge. The construction steps of the basic large model comprise: obtaining historical business cases of the target business system to construct a multi-modal data set; wherein the multi-modal data set comprises operation sequences of normal business processes, abnormal business processes and unauthorized processes; training a general language model based on the Transformer architecture using the multi-modal data set as training data, learning the causal relationship between operation sequences and target states, and constructing a basic large model with logical inference capability; The causal reasoning head is designed to predict whether an operation can be transferred from a current state to a target state during training, thereby optimizing the operation of the base large model.

5. The method of claim 1, wherein, The multiple Agents share the detection results; the context memory module set in each Agent records the detected path and detection results, and adjusts the next detection node corresponding to each Agent according to the recorded results, which includes: Based on the context memory module records the detected path and detection results of the current Agent, and the detected path and detection results shared by other Agents; Determine the next detection node corresponding to the current Agent through the reinforcement learning algorithm; wherein the reinforcement learning algorithm increases the node weight of the undetected node and the high-risk node based on the detection results.

6. The method of claim 1, wherein, The multiple types of logical vulnerability detection Agents include: horizontal privilege escalation detection Agent, vertical privilege escalation detection Agent, unauthorized access detection Agent, arbitrary parameter tampering detection Agent, and password recovery process vulnerability detection Agent; the operation list includes: API interface call sequence, form field input range, and page jump action set.

7. The method of claim 1, wherein, The method further includes: Determine the logical vulnerability type and the logical vulnerability impact level based on the output target detection results, and generate a visual report and vulnerability repair suggestions.

8. A large model and Multi-Agent based logical vulnerability detection apparatus, characterized by, It includes: A large model construction module is configured to construct a domain knowledge graph of a target industry and inject graph information in the domain knowledge graph into a base large model to construct an industry-specific large model; wherein the base large model is obtained by training a multi-modal data set constructed according to historical business cases in a target business system based on a Transformer architecture; wherein the large model construction module is further configured to encode entities and relationships in the domain knowledge graph into graph embedding vectors, inject the graph embedding vectors into the base large model through an adapter layer or an expert hybrid module to obtain an industry-specific large model, and encode business rules in the domain knowledge graph into logical expressions, and interact with the industry-specific large model through a rule engine module, so that the industry-specific large model can call the business rules when performing an inference task; A Multi-Agent design module is configured to design multiple types of logical vulnerability detection Agents, and encapsulate an operation list executable by a user with corresponding permissions for each type of detection Agent, so that the Agent can simulate the interaction behavior of a user with corresponding permissions in a target business system according to the operation list; The logic vulnerability detection module is configured to, in response to the start of a logic vulnerability detection task, iteratively perform the following steps: based on a preset detection strategy, concurrently perform the detection task by using a plurality of Agents; during the detection task execution, record the detected path and the detection result based on the context memory module set in each Agent, and adjust the next detection node corresponding to each Agent according to the record result; infer the detection result based on the industry-specific large model, and update the preset detection strategy according to the inference result; The target detection result output module is configured to output a target detection result of the logic vulnerability detection of the target business system when a preset iteration condition is met; wherein the preset iteration condition is one or more of a preset vulnerability coverage, an iteration number, or a detection time length.

9. An electronic device comprising: Processor, and memory for storing programs, characterized in that the programs include instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1-7.

10. A non-transitory machine-readable medium having stored thereon computer instructions, wherein: The computer instructions are used to make the computer execute the method according to any one of claims 1-7.

Images