Injection test method and device for webpage security and electronic equipment

Abstract

The invention provides an injection test method and device for webpage security and electronic equipment, relates to the technical field of network security, and can solve various test problems caused by manual injection test. According to the specific technical scheme, the method comprises the steps of determining a document object model tree corresponding to a target page, and determining a node score of an element node for each element node in the document object model tree; and determining a target element node of which the node score is greater than a first score threshold value from the plurality of element nodes, and then performing an injection test on the target element node to obtain a test result. By implementing the scheme, the injection test efficiency and coverage rate can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to injection testing methods, apparatus and electronic devices for web page security. Background Technology

[0002] Currently, injection attacks targeting web pages are among the most common types of cyberattacks. Therefore, security testing against injection attacks (i.e., injection testing) has become an indispensable step in the development of web applications.

[0003] Traditional injection testing primarily relies on manual testing by testers. Testers analyze webpage code or use manual scanning tools to identify the element nodes requiring injection testing, and then perform injection tests on these element nodes based on historical experience.

[0004] This not only results in low testing efficiency but may also lead to the omission of some element nodes from being injected, resulting in low coverage of injection tests. Summary of the Invention

[0005] This application provides an injection testing method, apparatus, and electronic device for web page security, which can improve the efficiency and coverage of injection testing.

[0006] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0007] Firstly, this paper presents a method for injection testing targeting web page security. This method performs structured analysis on the target page to identify potential security risk nodes and generates targeted test cases for injection testing. For example, this method can be applied to web page security detection systems, network security assessment platforms, etc.

[0008] The injection testing method for web page security provided in this application can determine the document object model tree corresponding to the target page, which includes multiple element nodes. Element nodes include injection nodes, trigger nodes, and other nodes. Injection nodes are nodes that input information on the target page, and trigger nodes are nodes that submit information on the target page. For each element node, feature extraction can be performed on the node information and its position information in the document object model tree to obtain a feature vector for the element node. This feature vector includes feature values ​​of one or more features among the element node's input method, content source, event response method, context information, frame type, and security identifier. Then, the feature values ​​included in the feature vector can be weighted to obtain a node score for the element node. In this way, a target element node with a node score greater than a first score threshold can be determined from multiple element nodes, and injection testing can be performed on the target element node to obtain the target test result.

[0009] This approach eliminates the need for indiscriminate testing of all element nodes on the target page. By employing feature extraction and scoring mechanisms, high-risk target element nodes can be identified, thus improving testing efficiency while maintaining comprehensive coverage. Furthermore, the construction of multi-dimensional feature vectors allows for more accurate characterization of element node security attributes. Considering multiple dimensions such as element node input methods, content sources, event response methods, and contextual information, it also enables more precise identification of potentially security-risk element nodes, thereby improving injection test coverage and efficiency.

[0010] In one possible implementation of the first aspect, node information may include one or more of the following: element type, attribute information, content information, event handlers, and historical backend feedback information. The position information of the element node in the Document Object Model (DOM) tree may include whether the element node's adjacent nodes in the DOM tree are script nodes and the element node's depth information in the DOM tree.

[0011] By analyzing the content included in node information, the characteristics of element nodes can be analyzed from multiple perspectives. Introducing location information allows for analysis of the node's context within the page structure, improving the accuracy of feature extraction. This provides a more comprehensive and accurate data foundation for constructing feature vectors, enhancing the reliability of node scoring.

[0012] In another possible implementation of the first aspect, when extracting features from the node information of an element node, the feature value of the element node's input method can be determined based on the element type and attribute information. The feature value of the element node's content source can be determined by comparing the element node's content information with the target page's webpage information. The feature value of the element node's event response method can be determined based on the number and type of the element node's event handlers. The feature value of the element node's frame type can be determined based on the element node's attribute information. The feature value of the element node's security identifier can be determined based on the historical backend feedback information corresponding to the element node.

[0013] By employing various feature extraction methods, security-related features of element nodes can be extracted, thereby improving the comprehensiveness and accuracy of feature vectors.

[0014] In another possible implementation of the first aspect, when extracting features of the position information of the element node in the document object model tree, the feature value of the context information of the element node can be determined based on whether the adjacent nodes of the element node in the document object model tree are script nodes and the depth information of the element node in the document object model tree.

[0015] In this way, the extraction of contextual information can analyze the security of the environment in which the element node is located. The presence of adjacent script nodes may increase security risks, and the depth information of the node reflects its importance in the page structure, thus improving the accuracy of the feature values ​​of the contextual information.

[0016] In another possible implementation of the first aspect, after obtaining the node score of the element node by weighted calculation of the features included in the feature vector, the method can also adjust the node score of the element node according to at least one of the first adjustment method, the second adjustment method, and the third adjustment method.

[0017] The first adjustment method includes: adjusting the node score of the element node according to a first adjustment coefficient when the element type is a form; adjusting the node score of the element node according to a second adjustment coefficient when the node function is identity authentication; and adjusting the node score of the element node according to a third adjustment coefficient when the node content is related to user input information. The second adjustment method includes: determining a fourth adjustment coefficient based on the historical test results of the element node, and adjusting the node score of the element node according to the fourth adjustment coefficient. The third adjustment method includes: adjusting the node score of the element node according to a fifth adjustment coefficient corresponding to the confidence level of the element node, where the confidence level is determined based on the depth information of the element node in the document object model tree and the number of features corresponding to the feature vector of the element node.

[0018] In this way, node scores can be adjusted based on different types of element nodes. Form nodes and element nodes with authentication functions typically have higher security risks, thus improving the accuracy of node scores. Furthermore, optimizing node scores using historical test data and confidence levels further enhances their accuracy.

[0019] In another possible implementation of the first aspect, when adjusting the node score of an element node according to the adjustment method, the node score of the first element node whose node score is greater than the second score threshold can be adjusted according to at least one of the first adjustment method, the second adjustment method, and the third adjustment method, wherein the first score threshold is greater than the second score threshold.

[0020] By conducting multiple filtering processes, element nodes that do not need to participate in the injection testing process can be continuously removed, thereby improving the efficiency of injection testing.

[0021] In another possible implementation of the first aspect, when performing feature extraction for each element node, feature extraction can be performed on the node information and position information in the document object model tree for each interactive and displayable second element node in the target page to obtain the feature vector of the second element node.

[0022] By pre-screening interactive and displayable element nodes, the targeting and efficiency of testing can be improved.

[0023] In another possible implementation of the first aspect, the element node includes an injection node and a trigger node. The above-described injection test on the target element node yields test results, including:

[0024] For the first injection node and the first trigger node associated with the target element node, the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node can be determined. Based on the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node, target test cases are generated. Injection tests are performed on the target page according to the target test cases to obtain test results.

[0025] By analyzing the correlation between injection nodes and trigger nodes, test cases can be automatically built, improving the accuracy and automation of injection testing.

[0026] In another possible implementation of the first aspect, the association between the first injection node and the first trigger node means that the information input in the first injection node is the same as the information submitted by the first trigger node. The first injection node includes one or more nodes, and the first trigger node includes one or more nodes. The target test case includes one or more first injection nodes and the corresponding injection cases for each first injection node, one or more first trigger nodes and the corresponding trigger cases for each first trigger node, and an execution order, where the execution order refers to the order in which the injection cases and trigger cases included in the target test case are executed.

[0027] By clearly defining the relationship between injection nodes and triggering nodes, realistic attack scenarios can be constructed, improving the reliability of determined test cases.

[0028] In another possible implementation of the first aspect, the target test case may further include a weight coefficient, which indicates the injection success rate of the target test case. Before determining the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node, the method may also search for the first test case in the case library according to the node type of the first injection node and the node type of the first trigger node, and determine the first test case as the target test case. The first test case includes all first injection nodes and first trigger nodes, and the weight coefficient of the first test case is greater than the weight threshold. The injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node are only determined if the first test case is not included in the case library. After performing injection testing on the target page according to the target test case and obtaining the test results, the weight coefficient of the test case may be increased if the test results indicate that the injection test was successful.

[0029] In this embodiment, intelligent management of test cases can be achieved through weighting coefficients and a test case library, reusing previously generated test cases and further improving testing efficiency.

[0030] In another possible implementation of the first aspect, the injection case corresponding to the first injection node may include a structured query language injection case and a cross-site scripting (XSS) injection case.

[0031] By supporting multiple types of injection attack scenarios, the applicability of injection testing methods for web security can be improved.

[0032] Secondly, this application provides an injection testing device for web page security, comprising:

[0033] The node determination module is used to determine the document object model tree corresponding to the target page. The document object model tree includes multiple element nodes, which include injection nodes, trigger nodes, and other nodes. Injection nodes are nodes that input information on the target page, and trigger nodes are nodes that submit information on the target page.

[0034] The scoring determination module is used to extract features from the node information and / or position information in the document object model tree for each element node determined by the node determination module, to obtain the feature vector of the element node; the feature vector includes the feature value of one or more features of the element node, such as input method, content source, event response method, context information, frame type, and security identifier; and the feature values ​​included in the feature vector are weighted to obtain the node score of the element node.

[0035] The node selection module is used to determine the target element node whose score, as determined by the scoring module, is greater than a first scoring threshold from multiple element nodes; wherein, the target element node includes the injection node and the trigger node;

[0036] The injection testing module is used to perform injection tests on the target element node and obtain the test results.

[0037] This device has the capability to implement the injection testing method for web page security described in the first aspect above. This capability can be achieved through the collaboration of hardware and corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned capability.

[0038] Thirdly, an electronic device is provided that has the function of implementing the injection testing method for web page security described in the first aspect. This function can be implemented through hardware and corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned function.

[0039] Specifically, the electronic device includes a memory and at least one processor, with the memory and processor communicatively connected. The memory stores computer program code, including computer instructions, which, when executed by the processor, cause the electronic device to perform the injection testing method for web page security as described in the first aspect and any possible implementation thereof.

[0040] Fourthly, a computer-readable storage medium is provided, which stores computer instructions that, when executed by a processor, implement the injection testing method for web page security described in any of the first aspects above.

[0041] Fifthly, a computer program product is provided that, when the computer program product is run on a computer or executed by the computer's processor, implements the injection testing method for web page security described in any of the first aspects above.

[0042] It is understood that the beneficial effects achieved by the injection testing device described in the second aspect, the electronic device described in the third aspect, the computer-readable storage medium described in the fourth aspect, and the computer program product described in the fifth aspect can be referred to as the beneficial effects in the first aspect and any possible implementation thereof, which will not be repeated here. Attached Figure Description

[0043] Figure 1 This is a schematic diagram of the target page involved in an injection testing method for web page security disclosed in an embodiment of this application;

[0044] Figure 2 A flowchart illustrating an injection testing method for web page security provided in an embodiment of this application;

[0045] Figure 3 A flowchart illustrating the feature extraction process and element scoring determination process involved in an injection testing method for web page security provided in this application embodiment;

[0046] Figure 4 A flowchart illustrating the scoring adjustment process involved in an injection testing method for web page security provided in this application embodiment;

[0047] Figure 5 A schematic diagram of an injection testing device for web page security provided in an embodiment of this application;

[0048] Figure 6 A schematic diagram of an injection testing device for web page security provided in an embodiment of this application;

[0049] Figure 7AA schematic diagram illustrating the data processing of a node determination module in an injection testing device for web page security, provided in an embodiment of this application;

[0050] Figure 7B A schematic diagram illustrating the data processing of a case determination module in an injection testing device for web page security, provided as an embodiment of this application;

[0051] Figure 7C A schematic diagram illustrating the data processing process of the injection testing module in an injection testing device for web page security, provided in an embodiment of this application;

[0052] Figure 7D A schematic diagram illustrating the data processing procedure of the result analysis module in an injection testing device for web page security, provided in an embodiment of this application;

[0053] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0054] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this embodiment, unless otherwise stated, "a plurality of" means two or more.

[0055] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0056] The technical solutions provided in this application, including the collection, storage, use, processing, transmission, provision, and disclosure of node information, location information, and other related information, all comply with relevant laws and regulations and do not violate public order and good morals.

[0057] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0058] A webpage is an interface that displays information and allows interaction to users after the browser renders the document based on Hypertext Markup Language (HTML). The browser can parse each webpage into a tree structure, namely the Document Object Model (DOM) tree, based on the HTML document. Specifically, the DOM tree is another representation of a webpage, and it can include nodes of various types, such as element nodes, text nodes, attribute nodes, and comment nodes.

[0059] In an HTML document, each tag corresponds to an element node in the DOM tree. For example, tags can include input, form, button, h1-h6, p, img, a, script, and div tags, each corresponding to an element node in the DOM tree.

[0060] Penetration testing is a testing method that assesses system security by simulating malicious attacks. In the context of web application security testing, injection testing is an important component of penetration testing, used to detect whether injection vulnerabilities exist in various element nodes of a web application's web page.

[0061] Currently, the main methods used for injection testing on web pages are as follows:

[0062] The first method is manual testing. Testers manually interact with the webpage, inputting malicious code (payload) into various input boxes, text areas, and other interactive elements, then manually triggering the submission, and observing the webpage's response to determine if injection vulnerabilities exist. While this method offers high flexibility, allowing testers to adjust their testing strategies based on the specific webpage, it suffers from low testing efficiency, high labor costs, and low test coverage.

[0063] Secondly, there's the testing method based on scanning tools. Testers use scanning tools, such as Xray, to identify the element nodes to be tested within a webpage. These tools can capture the APIs corresponding to requests and responses on the webpage and determine the element nodes corresponding to those APIs, allowing testers to perform injection tests on those nodes. While this method improves upon manual testing and increases efficiency, it still relies on manual operation and cannot automate the testing process.

[0064] In summary, both manual testing and scanning tool-based testing methods rely on human intervention, resulting in low testing efficiency, and the test coverage is limited by the testers' experience and operational scope.

[0065] To address the aforementioned technical issues, this invention proposes an injection testing method for web page security. By automatically analyzing the DOM tree of the target page, identifying the target element nodes that need to be tested in the DOM tree, and then testing the target elements to obtain test results, the method can improve the efficiency and coverage of injection testing.

[0066] The target element node includes injection nodes and trigger nodes. Based on the characteristics of injection nodes and trigger nodes, corresponding test cases can be determined, including injection cases for injection nodes and trigger cases for trigger nodes. Electronic devices perform corresponding operations through test cases, which can realize automated injection testing of web pages, improve the efficiency of injection testing, and reduce reliance on manual operation.

[0067] Both injection nodes and trigger nodes are element nodes in the DOM tree. Injection nodes can be element nodes on the target page that input information, such as input boxes (the element node corresponding to the `input` tag in an HTML document), text areas (the element node corresponding to the `textarea` tag in an HTML document), editable areas, etc. In essence, injection nodes can be the entry point for injection attacks on the target page; malicious code may be injected into web applications through injection nodes. Trigger nodes are element nodes on the target page that submit information; or, in other words, trigger nodes can be element nodes that trigger the submission operation of information input into the injection node. Examples include submit buttons and login buttons. Trigger nodes can be associated with injection nodes, submitting the information input into the associated injection node to the server corresponding to the target page.

[0068] For injection nodes and trigger nodes, electronic devices can trigger operations on the corresponding nodes according to different test procedures. An injection case refers to a test procedure for an injection node, including instructions to input malicious code into the injection node. Different types of injection nodes may correspond to different types of injection cases, such as Structured Query Language (SQL) injection cases and Cross-Site Scripting (XSS) injection cases. A trigger case refers to a test procedure for a trigger node, including instructions to submit information input into the injection node associated with that trigger node, such as a click operation. For associated injection nodes and trigger nodes, a test case is a test procedure obtained by combining the corresponding injection case and the corresponding trigger case, which can indicate the complete test process from inputting malicious code into the injection node to executing the operation of submitting information to the associated trigger node.

[0069] As an example, please refer to Figure 1This illustration shows a schematic diagram of the target page involved in an injection testing method for web page security disclosed in an embodiment of this application. Figure 1 As shown in (a) and (b) above, in the target page, the account input box 101 and the password input box 102 can be injection nodes, and the register button 103 and the login button 104 can be trigger nodes. Other nodes also exist on the target page, such as text content 105. It can be understood that the account input box 101, the password input box 102, the register button 103, and the login button 104 are all target element nodes.

[0070] like Figure 1 As shown in (b), the injection case corresponding to the account input box 101 can include the operation of entering malicious code in the account input box 101, such as "aaa". The injection case corresponding to the password input box 102 can include the operation of entering malicious code in the password input box 102, such as "bbb". The login button 104 is associated with the account input box 101 and the password input box 102, and the injection button corresponding to the login button 104 can include a click operation on the login button 104. In this way, the test case can include a test program for entering "aaa" in the account input box 101, entering "bbb" in the password input box 102, and performing a click operation on the login button.

[0071] The injection testing method for web page security provided in this application can be applied to electronic devices with data processing capabilities, such as personal computers (PCs). Alternatively, the electronic device may include servers, tablets, laptops, portable computers (such as mobile phones), wearable electronic devices (such as smartwatches), augmented reality (AR) / virtual reality (VR) devices, in-vehicle computers, etc. The following embodiments do not impose special limitations on the specific form of the electronic device. The execution subject of the injection testing method for web page security provided in this application can be the aforementioned electronic device or an injection testing device for web page security, which can be integrated into the electronic device or the processor of the electronic device.

[0072] Please refer to Figure 2 The diagram illustrates a flowchart of an injection testing method for web page security provided in an embodiment of this application.

[0073] S201, The electronic device determines the document object model tree corresponding to the target page.

[0074] The electronic device can acquire the web page to be tested. For ease of explanation, in this embodiment, the web page to be tested is referred to as the target page. The target page may include web pages with user interaction elements, such as login pages, registration pages, search pages, form submission pages, etc. Specifically, the electronic device can acquire the HTML document of the target page, analyze the HTML document of the target page through a browser engine or HTML analysis tool, and construct the DOM tree corresponding to the target page.

[0075] The DOM tree comprises multiple element nodes, which can be categorized into different types based on their function: injection nodes, trigger nodes, and other nodes. Specifically, electronic devices can analyze HTML documents to determine the type of each element node.

[0076] In some embodiments, the electronic device can analyze the tag names and types of tags in an HTML document to determine the type of the element node corresponding to each tag. For example, for first tags in an HTML document with input functionality, such as input tags with types like text and password, textarea tags, and select tags, the electronic device identifies the element node corresponding to the first tag as an injection node. As another example, for second tags in an HTML document with information submission functionality, such as button tags with types like submit and input tags with types like submit, the electronic device identifies the element node corresponding to the second tag as a trigger node. For third tags in an HTML document, such as div tags, p tags, and script tags, which are used to compose page content or provide page functionality, the electronic device identifies the element node corresponding to the third tag as other nodes.

[0077] In some embodiments, the electronic device can analyze the event handlers bound to tags to determine the type of the element node corresponding to each tag. An event handler is a JavaScript function bound to a tag, used to respond to user actions and execute corresponding events. For example, for an input tag, if it is bound to event handlers such as `oninput` and `onchange` for inputting information, the electronic device can determine that the element node corresponding to that input tag is an injection node. If it is bound to event handlers such as `onclick` for submitting information, the electronic device can determine that the element node corresponding to that input tag is a trigger node.

[0078] S202, for each element node, the electronic device extracts features from the node information and / or position information in the document object model tree to obtain the feature vector of the element node; and the electronic device performs weighted calculation on the feature values ​​included in the feature vector to obtain the node score of the element node.

[0079] Electronic devices can acquire various information about element nodes for feature extraction to obtain the feature vector of the element node. The feature vector includes the feature values ​​of one or more features from the element node's input method, content source, event response method, context information, frame type, and security identifier.

[0080] Specifically, the input method characterizes how an element node receives user input. The content source identifies the source of the content displayed or processed within the element node. The event response method indicates the element node's response mechanism to user actions, including the type and number of bound event handlers. Context information indicates the element node's position within the DOM tree. The frame type indicates the type of front-end frame corresponding to the element node. Security identifiers indicate whether the server has security measures in place for the data submitted by the element node, such as explicit sanitization or pattern matching sanitization.

[0081] After determining the feature vector of an element node, the electronic device can perform a weighted calculation on the feature values ​​included in the feature vector to obtain the node score of the element node. The weight allocation of each feature in the feature vector can be as follows: input method 25%, content source 20%, event response method 30%, context information 15%, frame type 10%, and security identifier -35%.

[0082] Specifically, the calculation formula can be as follows: Node score = Feature value of input method × 0.25 + Feature value of content source × 0.20 + Feature value of event response method × 0.30 + Feature value of context information × 0.15 + Feature value of frame type × 0.10 - Feature value of security identifier × 0.35.

[0083] In some embodiments, the electronic device can normalize the node score to obtain a processed node score. Specifically, the processed node score = min(max(node ​​score, 0), 1).

[0084] S203, the electronic device determines the target element node whose node score is greater than the first score threshold from multiple element nodes.

[0085] It is important to understand that the node scores of the other nodes mentioned above are usually less than the first score threshold. Therefore, the target element node includes both the injected node and the triggering node. However, the injected and triggering nodes included in the target element node do not include all the injected and triggering nodes in the DOM input mentioned above, but only the target element nodes whose node scores are greater than the first score threshold.

[0086] The electronic device filters out target element nodes by comparing the node scores of each element node with a preset first score threshold. The setting of the first score threshold needs to balance test coverage and test efficiency; for example, it can be set to 0.45. Alternatively, the electronic device can only compare the node scores of the injected node and the triggering node with the first score threshold, without comparing the node scores of other nodes, to avoid identifying other nodes as target element nodes.

[0087] Then, the electronic device can perform an injection test on the target element node and obtain the test results. Specifically, the injection test process may include the following steps S204-S206.

[0088] S204, for the first injection node and the first trigger node associated in the target element node, the electronic device determines the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node.

[0089] In some embodiments, the association between a first injection node and a first trigger node means that the information input in the first injection node is the same as the information submitted by the first trigger node. The first injection node may include one or more nodes, and the first trigger node may include one or more nodes. For ease of description, the associated injection node and trigger node in this application embodiment are referred to as the first injection node and the first trigger node, respectively.

[0090] Electronic devices can determine the association between injection nodes and trigger nodes in various ways. For example, an electronic device can analyze the scope of a form tag to determine the association between the injection node corresponding to an input tag and the trigger node corresponding to a submit button within the same form. Another example is that an electronic device can analyze the event content of a JavaScript event to determine the association between the injection node corresponding to an input box and the trigger node corresponding to a button. Yet another example is that an electronic device can analyze the element layout and positional relationships between element nodes on the target page, determining the association between the injection node and the trigger node if the distance between them on the target page is less than a distance threshold. This application does not limit the method used to determine the associated first injection node and first trigger node.

[0091] S205, the electronic device generates a target test case based on the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node.

[0092] The electronic device assembles and generates target test cases according to predetermined rules based on the injection cases corresponding to the first injection node and the trigger cases corresponding to the first trigger node. The target test cases include one or more first injection nodes and the injection cases corresponding to each first injection node, one or more first trigger nodes and the trigger cases corresponding to each first trigger node, and the execution order.

[0093] When there are multiple first injection nodes, the electronic device needs to determine the execution order of each first injection node. The electronic device can determine the execution order based on the positional relationship of the first injection nodes in the DOM tree, arranging the first injection nodes in a top-to-bottom and left-to-right order.

[0094] When the first trigger node comprises multiple nodes, the electronic device needs to determine the execution order of each first trigger node. The electronic device determines the execution order based on the strength of the association between the first trigger node and the first injection node, prioritizing the execution of the first trigger node with a high degree of association to the already executed injection node. The association strength refers to the degree of logical connection between the first trigger node and the first injection node, a value determined by factors such as whether they are located within the same form, whether they are bound via JavaScript events, and whether they are adjacent in the page layout.

[0095] In some embodiments, when multiple first injection nodes and multiple first trigger nodes are included, the electronic device can generate a variety of possible execution order combinations. The electronic device determines the execution order of the injection cases corresponding to each first injection node and the trigger cases corresponding to each first trigger node according to permutation and combination. For example, when two first injection nodes A1 and A2 and two first trigger nodes B1 and B2 are included, the electronic device can generate the following execution orders: A1-A2-B1-B2, A1-A2-B2-B1, A2-A1-B1-B2, A2-A1-B2-B1, etc.

[0096] In some embodiments, when multiple first injection nodes and multiple first trigger nodes are associated, the electronic device can select a portion of the first injection nodes and a portion of the first trigger nodes to perform testing based on the node scores of each first injection node and each first trigger node. Specifically, the electronic device selects the top N first injection nodes and the top M first trigger nodes according to their node scores, ranked from highest to lowest, where N and M are preset integers greater than 1. Implementing this embodiment allows for priority testing of the first injection nodes and first trigger nodes with high node scores.

[0097] In some embodiments, the electronic device may determine the execution order constraints based on the association between the first injection node and the first trigger node. When the first injection node and the first trigger node are located within the same form, the electronic device determines that the first injection node corresponding to that form will be executed only after all first injection nodes within that form have been executed.

[0098] For example, when the first injection node and the first triggering node are associated through a JavaScript event, the electronic device determines the execution order based on the binding relationship of the JavaScript events. For instance, if the first injection node is bound to an onchange event that triggers the first triggering node, the electronic device determines to execute the first triggering node immediately after the first injection node has finished executing.

[0099] In some embodiments, the electronic device can generate test cases that are executed in parallel with each injection case. When there are no dependencies between the first injection nodes, the electronic device can simultaneously input injection cases to multiple first injection nodes, improving test execution efficiency.

[0100] S206, The electronic device performs injection testing on the target page according to the target test case and obtains the test results.

[0101] The electronic device generates corresponding automated test scripts based on the injection cases, trigger cases, and execution order included in the target test cases. Specifically, the electronic device uses the automated testing framework in the Selenium tool to convert the target test cases into executable test instructions.

[0102] For the injection case corresponding to the first injection node, the electronic device generates a Selenium statement to input malicious code into the first injection node. For example, based on the injection case corresponding to the first injection node, the electronic device generates the following Selenium statement: driver.find_element_by_xpath(SUBMIT_BUTTON_XPATH).send_keys(“\”><imgsrc=xonerror=alert(1)> ”).

[0103] For each trigger case corresponding to the first trigger node, the electronic device generates a Selenium statement that triggers the execution of the first trigger node. For example, based on the trigger case corresponding to the first injection node, the electronic device generates the following Selenium statement: driver.find_element_by_xpath(SUBMIT_BUTTON_XPATH).click().

[0104] The electronic device executes the generated Selenium statements sequentially according to the execution order determined by the target test case. During execution, the electronic device monitors the response of the target page and determines the test result based on the response. The test result indicates whether the injection attack was successful. The response includes page state changes, HTTP response information, JavaScript error messages, etc., without restriction.

[0105] In some embodiments, the electronic device uses different methods to determine whether an injection attack is successful, depending on the type of injection attack.

[0106] For SQL injection attacks, electronic devices determine whether the injection attack was successful using the following methods:

[0107] 1. The electronic device can detect the first change in the response time of the target page and determine whether the injection attack was successful based on this first change, thus obtaining the test result. The first change can refer to the time difference between the response time of the target page before and after the injection. If the time difference between the response time of the target page before and after the injection is greater than a preset time threshold, the electronic device can determine that the SQL injection attack was successful. If the time difference between the response time of the target page before and after the injection is not greater than the preset time threshold, the electronic device can determine that the SQL injection attack failed.

[0108] 2. The electronic device can determine that the injection attack was successful and obtain the test result upon detecting error messages on the target page. The electronic device can receive error messages returned by the backend server of the target page and determine that the injection attack was successful based on these error messages.

[0109] 3. Electronic devices can detect the second change in the page content of the target page, and determine whether the injection attack was successful based on the second change, thus obtaining the test results.

[0110] For XSS injection attacks, electronic devices determine whether the injection attack was successful using the following methods:

[0111] 1. Electronic devices can detect the execution of JavaScript code to determine whether an injection attack was successful and obtain test results. For example, after injecting JavaScript code containing the `alert()` function, an electronic device can detect whether a pop-up window exists on the target page to determine if the XSS attack was successful. If a pop-up window is detected on the target page, the electronic device can determine that the XSS injection attack was successful; if no pop-up window is detected, the electronic device can determine that the XSS injection attack failed.

[0112] 2. Electronic devices can detect changes in the DOM tree structure to determine the success of an injection attack and obtain test results. For example, if an electronic device injects JavaScript code that modifies the structure of a target page, the DOM tree structure will also change. If the electronic device detects a change in the DOM tree structure, it can determine that the XSS injection attack was successful.

[0113] In the above embodiments, the electronic device can extract features from the node information and position information in the DOM tree for each element node to obtain a feature vector of the element node. To improve testing efficiency, the electronic device can first pre-screen the element nodes to select interactive and / or displayable second element nodes in the target page, and for each interactive and / or displayable second element node in the target page, extract features from the node information and / or position information in the document object model tree to obtain a feature vector of the second element node.

[0114] To explain the feature extraction process more clearly, please refer to [link / reference]. Figure 3 It shows a flowchart illustrating the feature extraction process and element scoring determination process involved in an injection testing method for web page security provided in an embodiment of this application.

[0115] S301: Select the second interactive and / or displayable element node from multiple element nodes in the DOM tree on the target page.

[0116] S302, for each second element, extract features from the node information and / or position information in the DOM tree of the second element node to obtain the feature vector of the second element node.

[0117] It is important to understand that the feature extraction process can include input method analysis, content source analysis, event response method analysis, context information analysis, frame type analysis, and security identifier analysis.

[0118] In some embodiments, node information includes one or more of element type, attribute information, content information, event handlers, and historical backend feedback information.

[0119] Here, element type refers to the tag name, such as input, textarea, button, form, etc. Attribute information includes various tag attributes, such as type, name, id, class, value, etc. Content information refers to the text content contained in the element node. Historical backend feedback information refers to the server response information obtained by this element node in previous injection tests. Whether adjacent nodes are script nodes refers to whether there are script nodes corresponding to the `<script>` tag among the adjacent nodes of this element node in the DOM tree. Adjacent nodes can include one or more of parent, child, and sibling nodes. Depth information refers to the depth of this element node in the DOM tree.

[0120] Electronic devices can extract features from the node information of element nodes to obtain the feature vector of the element node. The following explains the process of determining the feature values ​​of each feature included in the feature vector.

[0121] 1. Input Method Feature Values. Electronic devices determine the input method and its feature values ​​for element nodes based on their element type and attribute information. Different input methods can correspond to different feature values. For example, an electronic device can determine that the input method for an element node with a `type` of `text` is text input, and the feature value for text input can be 1.0. As another example, an electronic device can determine that the input method for an element node with `contenteditable` set to `true` is rich text editor input, and the feature value for rich text editor input can be 0.9. Yet another example is that an electronic device can determine that the input method for an element node with a `type` of `hidden` is hidden field input, and the feature value for text input can be 0.3.

[0122] 2. Feature Values ​​of Content Source. Electronic devices can compare the content information of an element node with the webpage information of the target page to determine the content source of the element node and its feature values. For example, if the identical portion between the content information of an element node and the Uniform Resource Locator (URL) parameters of the target page exceeds a first preset character count, the electronic device can determine that the content source of the element node is the URL parameter, and the feature value of the URL parameter can be 0.95. As another example, if the identical portion between the content information of an element node and the cookie of the target page exceeds a second preset character count, the electronic device can determine that the content source of the element node is the cookie, and the feature value of the cookie can be 0.95. As yet another example, if the content information of an element node is user-inputted content, the electronic device can determine that the content source of the element node is user-inputted content, and the feature value of user-inputted content can be 0.75. Furthermore, if the content information of an element node is static content, such as text or images, the electronic device can determine that the content source of the element node is static content, and the feature value of static content can be 0.2.

[0123] 3. Feature Values ​​of Event Response Modes. The electronic device determines the event response mode and its feature values ​​based on the number and type of event handlers for each element node. For example, the electronic device multiplies the number of event handlers for an element node by a preset coefficient (e.g., 0.8) to obtain the feature value of the element node's event response mode. As another example, if the event handler for an element node is a preset danger type (e.g., v-html), the electronic device can add a first preset value (e.g., 0.2) corresponding to that preset danger type to the feature value of the event response mode.

[0124] 4. Frame Type Feature Values. The electronic device determines the frame type and its feature values ​​based on the element node's attribute information. Specifically, the electronic device can detect whether the element node's attribute information includes feature identifiers of various front-end frameworks to determine its frame type. For example, if the electronic device detects that the element node's attribute information includes the feature identifier of the React framework, then the element node's frame type is determined to be React, and the feature value for React can be 0.95. As another example, if the electronic device detects that the element node's attribute information includes the feature identifier of the Vue framework, then the element node's frame type is determined to be Vue, and the feature value for Vue can be 0.85. Furthermore, if the electronic device detects that the element node's attribute information does not include any front-end framework feature representation, the electronic device can determine that the element node's frame type is "no frame," and the feature value for "no frame" can be 0.5. It is important to understand that different front-end frameworks have different levels of security and varying degrees of protection against injection attacks.

[0125] 5. Security Identifier Feature Value. Based on the historical backend feedback information corresponding to the element node, the electronic device determines the security protection measures implemented by the backend server for the information submitted by the element node, thus determining the feature value of the element node's security identifier. For example, if the historical backend feedback information includes a display disinfection identifier, the electronic device can determine the element node's security identifier feature value to be -0.7. As another example, if the historical backend feedback information includes a pattern matching disinfection identifier, the electronic device can determine the element node's security identifier feature value to be -0.5. For yet another example, if the historical backend feedback information does not include any security protection measure identifier information, the electronic device can determine the element node's security identifier feature value to be 0. It should be understood that display disinfection and pattern matching disinfection are different security protection measures in the backend server, and will not be described in detail here.

[0126] In some embodiments, the position information of an element node in the DOM tree includes whether the adjacent nodes of the element node in the DOM tree are script nodes and the depth information of the element node in the document object model tree.

[0127] Electronic devices can also extract features from the position information of element nodes in the DOM tree to obtain feature vectors for the element nodes. That is, electronic devices can determine the feature values ​​of the element node's context information based on whether its adjacent nodes in the DOM tree are script nodes and the element node's depth information in the DOM tree. For example, if the adjacent node of an element node in the DOM tree has a script tag, the electronic device can increase the feature value of the element node's context information by a second preset value (e.g., 0.3). As another example, if the depth information of the element node in the DOM tree indicates that the element node's depth is greater than a first depth threshold, the electronic device can increase the feature value of the element node's context information by a third preset value (e.g., 0.1).

[0128] S303, the electronic device performs weighted calculations on the feature values ​​included in the feature vector to obtain the node score of the element node.

[0129] In this embodiment of the application, the efficiency of injection testing can be improved by pre-screening element nodes.

[0130] In the above embodiments, after the electronic device performs weighted calculations on the features included in the feature vector to obtain the node score of the element node, it can also adjust the node score of the element node according to at least one of the first adjustment method, the second adjustment method, and the third adjustment method to improve the accuracy of the node score of the element node.

[0131] To explain the adjustment process more clearly, please refer to [link / reference]. Figure 4 The diagram illustrates a flowchart of the scoring adjustment process involved in an injection testing method for web page security provided in this application embodiment. The scoring adjustment process includes steps S401-S408.

[0132] S401, the electronic device determines the feature vector corresponding to the element node.

[0133] S402, the electronic device performs weighted calculations on the features included in the feature vector to obtain the node score of the element node.

[0134] S403, the electronic device determines whether the node score is greater than the second scoring threshold. If the node score is greater than the second scoring threshold, the electronic device executes S404-S407; if the node score is not greater than the second scoring threshold, the electronic device executes S408.

[0135] S404, The electronic device adjusts the node score of the element node according to the first adjustment method.

[0136] The first adjustment method refers to the way an electronic device can adjust the node score of an element node when the element node meets certain conditions. Specifically, the first adjustment method can be based on the node state of the element node.

[0137] When the element type of the element node is a form, the electronic device adjusts the node score of the element node according to a first adjustment factor. It is understandable that forms can include multiple input fields, making them a primary target for injection attacks, thus requiring a higher node score. For example, the first adjustment factor could be 1.2; the electronic device can multiply the node score by 1.2 to obtain the adjusted node score.

[0138] Among them, the electronic device can determine whether the tag name of the element node is a form tag. If the tag name of the element node is a form tag, the element type of the element node is determined to be a form.

[0139] When the node function of an element node is authentication, the electronic device adjusts the node score of the element node according to a second adjustment coefficient. Nodes related to authentication functions (such as username and password input fields) are also key targets for injection attacks. Injection attacks on such nodes can lead to serious consequences such as identity theft, therefore, it is necessary to increase their node scores. For example, the second adjustment coefficient can be 1.3, and the electronic device can multiply the node score by 1.3 to obtain the adjusted node score.

[0140] In this context, electronic devices can perform functional logic analysis on node information such as attribute information and bound event handlers of element nodes to determine the node functions. For example, electronic devices can input the attribute information and bound event handlers of element nodes into a large language model, and obtain the node functions of the element nodes through the large language model.

[0141] When the content of an element node is related to user input information, the electronic device adjusts the node score of the element node according to a third adjustment factor. Nodes related to user input information have a higher risk of being exploited. Therefore, their node scores need to be increased. For example, the third adjustment factor can be 1.15, and the electronic device can multiply the node score by 1.15 to obtain the adjusted node score.

[0142] Specifically, the electronic device can determine whether the node content of an element node is user-inputted content, and whether the node content of an element node is generated based on user-inputted content; for example, the node content may be calculated from the user-inputted content. If the node content of an element node is user-inputted content, or if the node content of an element node is generated based on user-inputted content, the electronic device can determine that the node content of the element node is related to the user-inputted information.

[0143] S405, the electronic device adjusts the node score of the element node according to the second adjustment method.

[0144] The second adjustment method can be based on historical test results.

[0145] The electronic device determines a fourth adjustment factor based on the historical test results of the element nodes, and adjusts the node score of the element nodes according to the fourth adjustment factor. This means that if an element node has successfully performed multiple injection attacks in historical injection tests, it indicates that the element node does indeed pose a security risk, and therefore its node score needs to be increased.

[0146] Specifically, the electronic device can determine the historical success rate based on the historical test results of multiple historical injection tests, and calculate the fourth adjustment coefficient based on the historical success rate. The fourth adjustment coefficient is calculated as: +0.3 × historical success rate.

[0147] S406, The electronic device adjusts the node score of the element node according to the third adjustment method.

[0148] Next, we will introduce the third adjustment method, which can be based on the confidence level of element nodes.

[0149] The electronic device adjusts the node score of an element node according to a fifth adjustment factor corresponding to the element node's confidence level. The confidence level is determined based on the depth information of the element node in the DOM tree or the number of features corresponding to the element node's feature vector. For example, the electronic device can multiply the element node's score by the fifth adjustment factor to obtain the adjusted node score.

[0150] For example, if the depth information of an element node in the DOM tree indicates a node depth greater than a second depth threshold, the element node can be determined as a deep node, and its confidence level can be set to a first confidence level. If the depth information of an element node in the DOM tree indicates a node depth no greater than a third depth threshold, the element node can be determined as a shallow node, and its confidence level can be set to a second confidence level. Here, the second depth threshold is greater than the third depth threshold, and the first confidence level is higher than the second confidence level.

[0151] For example, an electronic device can calculate the ratio between the number of features corresponding to the feature vector of an element node and the total number of features that the feature vector can contain. If the ratio is greater than a threshold, it indicates that the feature coverage of the element node's feature vector is high, and the electronic device can determine the element node's confidence level as the third confidence level. If the ratio is not greater than the threshold, it indicates that the feature coverage of the element node's feature vector is low, and the electronic device can determine the element node's confidence level as the fourth confidence level. The third confidence level is higher than the fourth confidence level.

[0152] The electronic device can further compare the confidence level of an element node with multiple confidence thresholds to determine the confidence interval in which the element node's confidence level falls, and use the adjustment coefficient corresponding to the confidence interval as the fifth adjustment coefficient. Specifically, the multiple confidence thresholds include a first confidence threshold and a second confidence threshold, where the first confidence threshold is greater than the second confidence threshold.

[0153] If the confidence level of an element node is greater than the first confidence threshold, the confidence interval in which the element node falls can be determined as a high confidence interval. If the confidence level of an element node is greater than the second confidence threshold but not greater than the first confidence threshold, the confidence interval in which the element node falls can be determined as a medium confidence interval. If the confidence level of an element node is not greater than the second confidence threshold, the confidence interval in which the element node falls can be determined as a low confidence interval. As an example, the first confidence threshold can be 0.7, the second confidence threshold can be 0.4, the fifth adjustment factor corresponding to the high confidence interval is 1.1, the fifth adjustment factor corresponding to the medium confidence interval is 1, and the fifth adjustment factor corresponding to the low confidence interval is 0.8.

[0154] S407, the electronic device determines the target element node whose adjusted node score is greater than the first score threshold from multiple element nodes.

[0155] S408, Electronic devices add low-risk tags to element nodes.

[0156] In some embodiments, after weighting the features included in the feature vector to obtain the node score of the element node, the electronic device can first compare the node score with a second score threshold and remove some element nodes with lower scores to improve the efficiency of injection testing. Since the first, second, and third adjustment methods typically increase the node score of the element node, the first score threshold is greater than the second score threshold.

[0157] Specifically, the electronic device adjusts the node score of the first element node whose node score is greater than the second score threshold according to at least one of the first, second, and third adjustment methods. For element nodes whose node scores are not greater than the second score threshold, the electronic device can add a low-risk marker to the element node, which indicates that the element node does not need to participate in the injection test.

[0158] In this embodiment, after determining the node score of an element node, the electronic device can first filter out element nodes with a score greater than a second score threshold, and then adjust the node scores of the element nodes, including one or more of a first adjustment method, a second adjustment method, and a third adjustment method, thereby increasing the diversity of score adjustment methods. The electronic device then determines the target element node whose adjusted node score is greater than the first score threshold from multiple element nodes. This multiple filtering process can improve the testing efficiency and accuracy of injection testing.

[0159] In the above embodiments, the electronic device can generate an injection case corresponding to the first injection node and a trigger case for the first trigger node, and determine a target test case based on the injection case corresponding to the first injection node and the trigger case for the first trigger node. In some embodiments, the electronic device can also search for a suitable test case in a test case library as the target test case.

[0160] Before determining the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node, the electronic device can search for the first test case in the case library according to the node type of the first injection node and the node type of the first trigger node, and determine the first test case as the target test case.

[0161] The first test case includes all first injection nodes and first trigger nodes, and the weight coefficient of the first test case is greater than the weight threshold. It should be understood that each generated test case can be included in the test case library. The electronic device can determine from the multiple test cases included in the test case library whether the injection nodes and trigger nodes included in each test case include the aforementioned associated first injection nodes and first trigger nodes, and whether the weight coefficient of each test case is greater than the weight threshold. The electronic device can use a test case that includes the aforementioned associated first injection nodes and first trigger nodes and has a weight coefficient greater than the weight threshold as the first test case. The weight coefficient is used to indicate the injection test success rate of the test case.

[0162] However, the first test case may not exist in the case library. In this case, if the first test case is not included in the case library, the electronic device can determine the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node according to the above embodiment, and determine the target test case based on the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node.

[0163] In some embodiments, after each injection test, if the test result indicates that the injection test was successful, the electronic device can increase the weight coefficient of the test case to improve the reusability of the test case.

[0164] By implementing this embodiment, previously generated test cases can be reused to improve the testing efficiency of injection tests.

[0165] Please refer to Figure 5 , Figure 5 This is a schematic diagram of a webpage security injection testing device provided in an embodiment of this application. Figure 5 As shown, the injection testing device 500 includes: a node determination module 501, a scoring determination module 502, a node selection module 503, and an injection testing module 504.

[0166] The node determination module 501 is used to determine the document object model tree corresponding to the target page. The document object model tree includes multiple element nodes, including injection nodes, trigger nodes, and other nodes. Injection nodes are nodes that input information in the target page, and trigger nodes are nodes that submit information in the target page.

[0167] The scoring determination module 502 is used to extract features from the node information and / or position information in the document object model tree for each element node determined by the node determination module 501, to obtain the feature vector of the element node; the feature vector includes the feature value of one or more features among the element node's input method, content source, event response method, context information, frame type, and security identifier; and to perform weighted calculation on the feature values ​​included in the feature vector to obtain the node score of the element node.

[0168] The node selection module 503 is used to determine the target element node whose node score determined by the scoring determination module 502 is greater than the first scoring threshold from multiple element nodes; wherein, the target element node includes the injection node and the trigger node.

[0169] The injection test module 504 is used to perform injection tests on the target element nodes selected by the node selection module 503 and obtain the test results.

[0170] In other embodiments, node information includes one or more of element type, attribute information, content information, event handler, and historical backend feedback information, and the position information of the element node in the document object model tree includes whether the adjacent nodes of the element node in the document object model tree are script nodes and the depth information of the element node in the document object model tree.

[0171] In other embodiments, the scoring determination module 502 is further configured to: determine the feature value of the input method of the element node based on the element type and attribute information of the element node; and / or, compare the content information of the element node with the webpage information of the target page to determine the feature value of the content source of the element node; and / or, determine the feature value of the event response method of the element node based on the number and type of event handlers of the element node; and / or, determine the feature value of the frame type of the element node based on the attribute information of the element node; and / or, determine the feature value of the security identifier of the element node based on the historical backend feedback information corresponding to the element node.

[0172] In other embodiments, the scoring determination module 502 is further configured to determine the feature value of the context information of the element node based on whether the adjacent nodes of the element node in the document object model tree are script nodes and the depth information of the element node in the document object model tree.

[0173] In other embodiments, the injection testing device 500 may further include a scoring adjustment module for adjusting the node score of an element node according to at least one of a first adjustment method, a second adjustment method, and a third adjustment method. The first adjustment method includes: adjusting the node score of the element node according to a first adjustment coefficient when the element type of the element node is a form; adjusting the node score of the element node according to a second adjustment coefficient when the node function of the element node is authentication; and adjusting the node score of the element node according to a third adjustment coefficient when the node content of the element node is related to user input information. The second adjustment method includes: determining a fourth adjustment coefficient based on the historical test results of the element node, and adjusting the node score of the element node according to the fourth adjustment coefficient. The third adjustment method includes: adjusting the node score of the element node according to a fifth adjustment coefficient corresponding to the confidence level of the element node; the confidence level is determined based on the depth information of the element node in the document object model tree and the number of features corresponding to the feature vector of the element node.

[0174] In other embodiments, the scoring adjustment module is further configured to adjust the node score of a first element node whose node score is greater than a second scoring threshold according to at least one of the first adjustment method, the second adjustment method, and the third adjustment method; wherein the first scoring threshold is greater than the second scoring threshold.

[0175] In other embodiments, the scoring determination module 502 described above is further configured to extract features from the node information and / or position information in the document object model tree for each interactive and / or displayable second element node in the target page, thereby obtaining a feature vector of the second element node.

[0176] In other embodiments, the target element node includes an injection node and a trigger node; the injection test module 504 is used to determine the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node for the first injection node and the first trigger node associated in the target element node; generate a target test case based on the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node; perform injection testing on the target page according to the target test case, and obtain the test result.

[0177] In other embodiments, the association between a first injection node and a first trigger node means that the information input in the first injection node is the same as the information submitted by the first trigger node. The first injection node includes one or more nodes, and the first trigger node includes one or more nodes. The target test case includes one or more first injection nodes and their corresponding injection cases, one or more first trigger nodes and their corresponding trigger cases, and an execution order. The execution order refers to the order in which the injection cases and trigger cases included in the target test case are executed.

[0178] In other embodiments, the target test case further includes a weight coefficient, which is used to indicate the injection success rate of the target test case; the injection test module 504 is further used to search for a first test case in the case library according to the node type of the first injection node and the node type of the first trigger node, and determine the first test case as the target test case; the first test case includes all the first injection nodes and the first trigger nodes, and the weight coefficient of the first test case is greater than the weight threshold; if the first test case is not included in the case library, the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node are determined; the injection test device 500 may also include a scoring adjustment module, which is used to increase the weight coefficient of the test case when the test result indicates that the injection test is successful.

[0179] In other embodiments, the injection cases corresponding to the first injection node include structured query language injection cases and / or cross-site scripting injection cases.

[0180] The injection testing device 500 provided in this application embodiment can execute the method shown in the above method embodiment. Its implementation principle and beneficial effects can be referred to the relevant description in the method embodiment, and will not be repeated here.

[0181] Please refer to Figure 6 This illustration shows a structural schematic diagram of an injection testing device for web page security provided in an embodiment of this application. Figure 6 The injection testing device can be divided into a node determination module, a case determination module, an injection testing module, and a result analysis module. It can be understood that the node determination module is equivalent to the aforementioned... Figure 5 The node determination module 501, scoring determination module 502, and node selection module 503 in the case determination module can be equivalent to the above. Figure 5 The injection test module 504 in the above is a sub-module used to determine test cases. This injection test module can be equivalent to the one described above. Figure 5 The injection test module 504 is a submodule used for performing injection tests.

[0182] In this system, an HTML document can be input into the node determination module. This module identifies the target element node and sends it to the case determination module. The case determination module then identifies the corresponding target test case and inputs it into the case library. When injection testing begins, the injection testing module retrieves the target test case from the case library, executes the injection test according to the target test case, and sends the test results to the result analysis module. Based on the test results, the result analysis module can adjust the weight coefficient of the target test case in the case library if the test result indicates successful injection testing, and send a retest instruction to the injection testing module if the test result indicates injection testing failure, allowing the injection testing module to restart the injection test. Specific methods are detailed in the above embodiments and will not be elaborated further.

[0183] To further illustrate the various modules in this injection testing device, embodiments of this application are provided. Figures 7A-7D The data processing procedures for each module are described.

[0184] Please refer to Figure 7A This illustration shows a schematic diagram of the data processing process of the node determination module in an injection testing device for web page security provided in an embodiment of this application. The node determination module can parse an HTML document and obtain an element node pool. The multiple element nodes included in this pool can refer to multiple element nodes in the DOM tree described in the above embodiment. After determining the target element node, a feature filter can classify it into injection nodes and trigger nodes based on the characteristics of the target element node. Specific methods can be found in the above embodiments and will not be elaborated upon here.

[0185] Please refer to Figure 7BThis illustration shows a schematic diagram of the data processing process of a case determination module in an injection testing device for web page security provided in an embodiment of this application. The case determination module may include a case generation module, which can input injection nodes and trigger nodes into the case generation module. This module generates injection cases according to injection case generation rules and trigger cases according to trigger case generation rules. The injection cases and trigger cases are then assembled, and the resulting test cases are stored in a case library. Specific methods can be found in the above embodiments and will not be elaborated upon further.

[0186] Please refer to Figure 7C This illustration shows a schematic diagram of the data processing process of the injection testing module in an injection testing device for web page security provided in an embodiment of this application. The injection testing module extracts target test cases from a case library and extracts keywords from the target test cases. These keywords may include test parameters and operation instructions. The injection testing module generates executable Selenium statements using the keywords. For the generated Selenium statements, the injection testing module uses a driver to invoke a browser to execute the actual injection test operations. The driver is the driver program in the Selenium framework responsible for communicating with the browser; different types of browsers require corresponding driver programs. Specifically, the injection testing module uses the driver to control the browser to enter the target page and executes each test instruction sequentially according to a predetermined execution order. After the browser completes all test operations, the injection testing module obtains the test results and closes the browser. Specific methods can be found in the above embodiments and will not be elaborated further.

[0187] Please refer to Figure 7D This illustration shows a schematic diagram of the data processing process of the result analysis module in an injection testing device for web page security provided in an embodiment of this application. Among various injection attack types, the result analysis module can employ different result analysis methods according to different injection attack types. For SQL injection attacks, the result analysis module can determine whether the response time of the target page has changed, and if so, modify the weight coefficient of the target test case in the test case library. For XSS injection attacks, the result analysis module can determine whether a pop-up window appears on the target page, and if so, modify the weight coefficient of the target test case in the test case library. Specific methods can be found in the above embodiments and will not be elaborated further.

[0188] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device includes: a memory 801, a transceiver 802, and at least one processor 803.

[0189] The transceiver 802 is used to interact with other devices to send and receive data.

[0190] The memory 801 is used to store computer program code, which includes computer instructions. These computer instructions run in the aforementioned electronic device to implement the method shown in the above-described method embodiments. For example, the memory may include high-speed random access memory (RAM), and may also include non-volatile memory (NVM), such as at least one disk storage device, or a USB flash drive, portable hard drive, read-only memory, magnetic disk, or optical disk, etc.

[0191] Processor 803 can be a general-purpose processor, including a Central Processing Unit (CPU), a network processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Processor 803 can also be other general-purpose processors. The general-purpose processor can be a microprocessor or any conventional processor.

[0192] The memory 801, transceiver 802, and processor 803 are communicatively connected. For example, the memory 801 and transceiver 802 can be connected to the processor 803 via a system bus to complete mutual communication. The system bus can be a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, an industry standard architecture (ISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the figure, but this does not mean that there is only one bus or one type of bus.

[0193] Optionally, the memory 801 can be either standalone or integrated with the processor 803. When the memory 801 is set up independently, it is connected to the processor 803 via the system bus.

[0194] This application also provides a chip for executing instructions, which is used to execute the technical solution of the injection test method described above.

[0195] This application also provides a computer-readable storage medium storing computer instructions. When these computer instructions are executed by a processor, they are used to implement the technical solution of the injection testing method described in the above embodiments. Specifically, when the computer instructions are executed by a processor, the electronic device can perform the technical solution of the injection testing method described in the above embodiments.

[0196] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the technical solution of the injection test method in the above embodiments.

[0197] The aforementioned computer-readable storage media can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The computer-readable storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0198] An exemplary computer-readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the computer-readable storage medium can also be a component of the processor. The processor and the computer-readable storage medium can reside in an application-specific integrated circuit (ASIC). Alternatively, the processor and the computer-readable storage medium can exist as discrete components in an electronic control unit or main control device; this application does not limit this.

[0199] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0200] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0201] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0202] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0203] It should be understood that the steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

[0204] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0205] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for injection testing targeting webpage security, characterized in that, include: Determine the document object model tree corresponding to the target page. The document object model tree includes multiple element nodes, including injection nodes, trigger nodes, and other nodes. The injection node is the node in the target page where information is input, and the trigger node is the node in the target page where information is submitted; For each element node, feature extraction is performed on the node information and / or position information in the document object model tree to obtain the feature vector of the element node; the feature vector includes the feature value of one or more features among the input method, content source, event response method, context information, frame type, and security identifier of the element node; Furthermore, the feature values ​​included in the feature vector are weighted and calculated to obtain the node score of the element node; From the plurality of element nodes, determine the target element node whose node score is greater than the first score threshold; An injection test was performed on the target element node, and the test results were obtained.

2. The method according to claim 1, characterized in that, The node information includes one or more of the following: element type, attribute information, content information, event handler, and historical backend feedback information. The position information of the element node in the document object model tree includes whether the adjacent nodes of the element node in the document object model tree are script nodes and the depth information of the element node in the document object model tree.

3. The method according to claim 2, characterized in that, The step of extracting features from the node information of the element node to obtain the feature vector of the element node includes: Based on the element type and attribute information of the element node, determine the feature value of the input method of the element node; and / or, By comparing the content information of the element node with the webpage information of the target page, the feature value of the content source of the element node is determined; and / or, Based on the number and type of event handlers of the element node, determine the characteristic values ​​of the event response mode of the element node; and / or, Based on the attribute information of the element node, determine the frame type of the element node and the feature values ​​of the frame type; and / or, Based on the historical backend feedback information corresponding to the element node, the feature value of the security identifier of the element node is determined.

4. The method according to any one of claims 1-3, characterized in that, The step of extracting features from the position information of the element node in the document object model tree to obtain the feature vector of the element node includes: The feature values ​​of the context information of the element node are determined based on whether the adjacent nodes of the element node in the document object model tree are script nodes and the depth information of the element node in the document object model tree.

5. The method according to any one of claims 1-3, characterized in that, After performing a weighted calculation on the features included in the feature vector to obtain the node score of the element node, the method includes: Adjust the node score of the element node according to at least one of the first adjustment method, the second adjustment method, and the third adjustment method; The first adjustment method includes: If the element type of the element node is a form, the node score of the element node is adjusted according to the first adjustment coefficient; When the node function of the element node is identity authentication, the node score of the element node is adjusted according to the second adjustment coefficient; If the content of the element node is related to the user input information, the node score of the element node is adjusted according to the third adjustment coefficient. The second adjustment method includes: A fourth adjustment coefficient is determined based on the historical test results of the element node, and the node score of the element node is adjusted according to the fourth adjustment coefficient. The third adjustment method includes: The node score of the element node is adjusted according to the fifth adjustment coefficient corresponding to the confidence level of the element node; the confidence level is determined based on the depth information of the element node in the document object model tree and the number of features corresponding to the feature vector of the element node.

6. The method according to claim 5, characterized in that, Adjusting the node score of the element node according to at least one of the first, second, and third adjustment methods includes: Adjust the node score of the first element node whose node score is greater than the second score threshold according to at least one of the first adjustment method, the second adjustment method and the third adjustment method; Wherein, the first scoring threshold is greater than the second scoring threshold.

7. The method according to any one of claims 1-3, characterized in that, For each element node, feature extraction is performed on the node information and / or position information in the document object model tree to obtain the feature vector of the element node, including: For each interactive and / or displayable second element node in the target page, feature extraction is performed on the node information and / or position information in the document object model tree of the second element node to obtain the feature vector of the second element node.

8. The method according to any one of claims 1-3, characterized in that, The target element node includes an injection node and a trigger node; The injection test on the target element node, and the resulting test results, include: For the first injection node and the first trigger node associated with the target element node, determine the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node; Based on the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node, a target test case is generated. Injection tests were performed on the target page according to the target test case, and the test results were obtained.

9. The method according to claim 8, characterized in that, The first injection node is associated with the first trigger node, meaning that the information input in the first injection node is the same as the information submitted by the first trigger node. The first injection node includes one or more, and the first trigger node includes one or more. The target test case includes one or more first injection nodes and injection cases corresponding to each first injection node, one or more first trigger nodes and trigger cases corresponding to each first trigger node, and execution order, wherein the execution order refers to the order in which the injection cases and trigger cases included in the target test case are executed.

10. The method according to claim 9, characterized in that, The target test case also includes a weighting coefficient, which is used to indicate the injection success rate of the target test case; Before determining the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node, the method further includes: Based on the node type of the first injection node and the node type of the first trigger node, a first test case is searched in the test case library, and the first test case is determined as the target test case; the first test case includes all the first injection nodes and the first trigger nodes, and the weight coefficient of the first test case is greater than the weight threshold; Determining the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node includes: If the first test case is not included in the case library, determine the injection case corresponding to the first injection node and the trigger case corresponding to the first trigger node. After performing injection testing on the target page according to the target test case and obtaining the test results, the method further includes: If the test results indicate that the injection test was successful, the weighting coefficient of the test case is increased.

11. The method according to claim 8, characterized in that, The injection cases corresponding to the first injection node include structured query language injection cases and / or cross-site scripting injection cases.

12. An injection testing device for web page security, characterized in that, include: The node determination module is used to determine the document object model tree corresponding to the target page. The document object model tree includes multiple element nodes, including injection nodes, trigger nodes, and other nodes. The injection nodes are nodes that input information in the target page, and the trigger nodes are nodes that submit information in the target page. The scoring determination module is used to extract features from the node information and / or position information in the document object model tree for each element node determined by the node determination module, to obtain the feature vector of the element node; the feature vector includes the feature value of one or more features among the element node's input method, content source, event response method, context information, frame type, and security identifier; Furthermore, the feature values ​​included in the feature vector are weighted and calculated to obtain the node score of the element node; A node selection module is used to determine, from the plurality of element nodes, a target element node whose node score, as determined by the scoring determination module, is greater than a first scoring threshold; wherein, the target element node includes an injection node and a trigger node; The injection test module is used to perform injection tests on the target element node and obtain the test results.

13. An electronic device, characterized in that, include: A memory and at least one processor; the memory is communicatively connected to the processor; the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the electronic device performs the method as described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, are used to implement the method as described in any one of claims 1-11.

15. A computer program product, characterized in that, When the computer program product is run on a computer / executed by the computer's processor, it implements the method as described in any one of claims 1-11.

Images