Intelligent agent-based logic vulnerability detection method, system and device, and medium

Abstract

The invention belongs to the field of information network security. The invention specifically discloses an agent-based logic vulnerability detection method, system and device, and a medium. The method comprises the following steps: capturing service system request response data through network traffic, identifying an HTTP protocol through a port and protocol features, filtering non-HTTP request data, extracting and analyzing the request data, standardizing extracted parameters, continuously collecting and analyzing through an API analysis agent, improving the semantic analysis capability of a large model, perfecting a logic relation graph, and improving the semantic analysis efficiency of the large model. A complete vulnerability life cycle data link is constructed through a vulnerability analysis agent, the system logic vulnerability mining efficiency and coverage are improved, and automatic logic vulnerability alarm and disposal can be realized and the risk disposal real-time performance is improved by accessing the agent to a network security protection product, an alarm analysis platform and other systems.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information network security, and particularly relates to a logic vulnerability detection method, system, device and medium based on an agent. BACKGROUND

[0002] In today's Internet, web and app communicate with backend services mostly in the form of interface to transfer and exchange data. Due to the weak security awareness of some backend developers, the non-implementation of security specifications, and the security vulnerabilities in existing development frameworks, a small part of the interfaces in the method may have security risks. Security testers need to use appropriate tools and methods to simulate attackers to find as many security risks as possible. The core of the interface security testing method is to inject vulnerability detection payloads into network requests, send requests, and judge whether there are security vulnerabilities according to the response data.

[0003] The common security testing methods and tools in the industry are divided into the following three types: (1) Static code analysis technology analyzes the code fragments related to business logic through static code auditing tools or manual code review, and identifies problems such as incomplete logical judgment conditions, missing permission checks, and chaotic state management. Static code analysis technology is difficult to understand business semantics and cannot analyze dynamic business activities. It is mainly applied to unit testing or code security checking and is not suitable for online running business systems.

[0004] (2) Dynamic interactive analysis technology analyzes logic vulnerabilities such as parameter tampering and flow skipping by intercepting and recording system and user interaction data (such as HTTP requests, API calls). This technology mainly uses manual or semi-automatic tools to capture front-end and back-end interaction data, analyzes the meaning, type and interaction logic of parameters by hand, relies on manual analysis, is low in efficiency, and needs to be reanalyzed when API parameters change.

[0005] (3) Dynamic testing technology simulates attack scenarios (such as parameter tampering and flow skipping), dynamically executes business processes and verifies system responses to find logic vulnerabilities, including gray box testing and fuzz testing. Gray box testing inserts monitoring points in key functions through code insertion technology to record function parameters and return result information and identify abnormal calling behavior. Fuzz testing tests whether there are logic vulnerabilities by constructing abnormal input. Dynamic testing technology relies on the completeness of test cases, and there are problems such as incomplete coverage of business logic analysis and inability to cover business-related logic vulnerabilities.

[0006] In summary, most network traffic vulnerability detection is conducted in informal trial environments. The testing is not comprehensive, and vulnerability discovery relies heavily on manual work. However, it is impossible for humans to achieve perfect testing. In formal environments, many factors affect network security, and it is not possible to have human monitoring of network security in real time. This leads to vulnerabilities going undetected, resulting in system damage, information leaks, and other incidents. Therefore, it is clear that logical vulnerabilities pose a significant threat to network security. Summary of the Invention

[0007] To address the aforementioned issues, this invention provides a logic vulnerability detection method, system, device, and medium based on intelligent agents. By setting up network traffic capture at the core switch to obtain request and response data from business systems, and using an API analysis intelligent agent to identify the API behavior, parameter meaning, and type of the requested APIs, and combining this with external online / offline API documentation to refine the logical relationship graph, a complete vulnerability lifecycle data chain is constructed through the vulnerability analysis intelligent agent. This improves the efficiency and coverage of system logic vulnerability discovery. Furthermore, by connecting the intelligent agent to network security protection products and alarm analysis platforms, automated logic vulnerability alarms and handling can be achieved, improving the real-time nature of risk handling and providing a closed-loop mechanism for discovery, detection, handling, and alarming.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: A first aspect of the present invention provides a logic vulnerability detection method based on intelligent agents, comprising the following steps: Step S1: Real-time collection of network traffic, identification of protocols to filter out non-HTTP requests, feature extraction and parsing of the filtered HTTP requests, and standardization of the results. Step S2, the steps of the API analysis agent, involves establishing a multi-dimensional parameter input system to manage the input types of parameters, then encapsulating the parameters according to API path - parameter list - response example, and submitting them to the large model framework for data analysis; at the same time, knowledge base retrieval and matching are performed to extract the core information of interface function description, detailed parameter description and error code explanation, and the retrieval results are cross-validated with the large model analysis results to output structured data; Step S3 involves identifying vulnerability characteristics during vulnerability detection and storing the detection process and results in a structured manner. It can also connect with external professional detection systems to obtain exploration results. Based on the designed professional prompt word templates, large-scale vulnerability detection and analysis are performed to obtain interpretation results and handling suggestions. Step S4 involves processing detected vulnerabilities. This process combines automation and semi-automation to handle the vulnerabilities and automatically generates handling tasks to support progress tracking and result feedback. Through a multi-dimensional result integration engine, a complete vulnerability lifecycle data chain is obtained and output in various readable file formats.

[0009] In a second aspect, the present invention provides a logic vulnerability detection system based on an intelligent agent, the system comprising a network traffic acquisition module, an API analysis intelligent agent module, a vulnerability analysis intelligent agent module, a vulnerability handling alarm module, and an automatic update module; The network traffic acquisition module collects network traffic data through port mirroring at the core switch, filters out non-HTTP protocol data, extracts IP addresses from the HTTP protocol to build a request source map to facilitate the identification of vulnerability sources, parses header information, identifies the request parameter passing type, and standardizes it for input parameters of API analysis agent and vulnerability analysis agent. The API analysis agent module includes a parameter input submodule, a large model analysis submodule, a knowledge base retrieval and matching submodule, and a result integration and output submodule. The parameter input submodule constructs a multi-dimensional parameter input system to describe network requests from multiple perspectives, facilitating the analysis of large models. A verification mechanism is set up to ensure the legality, completeness, and accuracy of the parameters. The large model analysis submodule encapsulates the input parameters according to the structured prompt template, passes them to the large model for analysis, obtains unstructured text, converts it into standard JSON format, and outputs the model confidence score. The knowledge base retrieval and matching submodule constructs an API knowledge graph, performs keyword retrieval, uses vector similarity algorithms for matching, extracts the core information of the interface, and improves the comprehensiveness of knowledge acquisition by setting multi-level retrieval strategies. The results integration and output submodule verifies the consistency of information between the large model results and the matching retrieval results through cross-validation, and then aggregates the data through a structured processing algorithm to generate structured data. The vulnerability analysis intelligent agent module includes a parameter input submodule, a logic vulnerability detection submodule, and a vulnerability large model parsing submodule; Parameter input submodule: By constructing a multi-dimensional parameter input system, it describes network requests from multiple dimensions, which facilitates the analysis of large models. The verification mechanism ensures the legality, completeness and accuracy of the parameters. The logic vulnerability detection submodule, through a layered architecture design, completes the detection of logic vulnerability nodes by basic logic vulnerability detection, response comparison analysis to identify vulnerability characteristics, and external professional detection services. The vulnerability big data model analysis submodule encapsulates the input parameters using specialized prompt word templates and then hands them over to the big data model for analysis, generating a vulnerability principle explanation, risk level assessment, and targeted handling suggestions. The vulnerability handling and alerting module includes a risk handling and alerting submodule and a result aggregation and output submodule. The risk handling and alarm submodule generates standardized instructions based on the handling suggestions given by the big model, performs security protection, and sends alarms through real-time push notifications to notify operation and maintenance personnel to handle vulnerabilities. The results aggregation and output submodule performs correlation mapping through multi-dimensional result processing to build a complete vulnerability lifecycle data chain, realizing full-link information fusion of network security incidents from data collection → analysis and interpretation → handling, providing a unified view, correlation analysis capabilities and source tracing support for security operations; The automatic update module continuously receives and updates the large-scale API analysis and vulnerability detection models through the API analysis agent and the vulnerability detection agent, and adjusts the vulnerability detection strategy in a timely manner. The vulnerability handling module improves vulnerability handling and security protection measures by autonomously crawling security-related knowledge.

[0010] A third aspect of the present invention provides an electronic device including a memory 102, a processor 101, a display module 103, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of any of the agent-based logical vulnerability detection methods.

[0011] A fourth aspect of the present invention provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the agent-based logical vulnerability detection methods.

[0012] This invention improves vulnerability detection efficiency by performing large-scale API parsing on data and using an intelligent agent to automatically generate test cases from the parsed data, thus eliminating the reliance on manual test case creation. The vulnerability analysis agent comprehensively and deeply explores various potential logical vulnerability scenarios based on the business system's profile and API call logic relationships, increasing the discovery rate of potential vulnerabilities and facilitating the improvement of the detected system or program, making it more secure. Through an automatic update module, the business profile and API call logic relationship graph are automatically updated, and vulnerability detection strategies are adjusted. The large-scale model continuously learns new business data and security knowledge, constantly improving its semantic analysis and vulnerability identification capabilities, giving vulnerability detection adaptive capabilities for better vulnerability discovery. By establishing automated or semi-automated vulnerability detection, reliance on manual intervention is reduced, enabling real-time vulnerability detection and improving efficiency. The establishment of handling tasks enables feedback and tracking of issues, facilitating timely resolution. Attached Figure Description

[0013] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a schematic flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the system of the present invention; Figure 3 This is a schematic diagram of the device structure of the present invention; Figure 4 This is a logic diagram for the interface of the present invention with an external vulnerability detection service.

[0015] Among them, 101 is the processor, 102 is the memory, and 103 is the display module. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and systems according to various embodiments of this disclosure. It should be noted that each block in a flowchart or block diagram may represent a module, segment, or portion of code, which may include one or more executable instructions for implementing the logical functions specified in the various embodiments. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutively represented blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, may be implemented using a dedicated hardware-based system that performs the specified functions or operations, or using a combination of dedicated hardware and computer instructions.

[0018] Example 1, as Figure 1As shown, a logic vulnerability detection method based on intelligent agents is implemented in the following steps: Step S1, real-time collection of network traffic, identification of protocols to filter out non-HTTP requests, feature extraction and parsing of the filtered HTTP requests, and standardization of the results; the specific steps are as follows: Step S11: Regardless of the type of business access, including front-end pages, mobile terminals, third-party interface calls, etc., the interaction data will flow through the core switch. At the core switch, network traffic data is automatically collected through port mirroring. The HTTP protocol is identified by port and protocol characteristics, and non-HTTP protocol data is filtered out. By capturing network traffic at the core switch and analyzing the traffic, the access behavior and interaction data of the business system can be collected more comprehensively, effectively solving the problems of low efficiency and incomplete coverage of manual capture. Step S12: Extract the request IP address from the collected HTTP protocol requests and construct a request source IP map; Step S13: Parse the HTTP header information, including the request method, UserAgent, Response, Cookie, etc., parse the URI, request method, request parameters, response code, response data, etc., and identify the request parameter transmission type, including URL parameters, request header parameters, request body parameters, etc. Extract the parameters according to the transmission type and standardize the parameters.

[0019] Step S2, the API analysis agent's steps, involves establishing a multi-dimensional parameter input system to manage parameter input types, then encapsulating the parameters according to API path - parameter list - response example, and submitting them to the large model framework for data analysis. Simultaneously, knowledge base retrieval and matching are performed to extract core information such as interface function descriptions, detailed parameter descriptions, and error code explanations. The retrieval results are cross-validated with the large model analysis results, outputting structured data. The specific steps are as follows: Step S21: By inputting multi-dimensional parameter types, a multi-dimensional parameter system is established. In addition to the basic URL path, API parameter list (including parameter name, data type, and constraint rules), and API response data (including status code, return fields, and format), extended parameters such as request method (GET / POST, etc.), request header information (such as Content-Type, Authorization, etc.), parameter dependency relationships (such as association rules between required and optional parameters), and historical interaction records are added. Then, according to the parameter validation mechanism, the validity of the parameter format is automatically detected, such as the standardization of the URL format and the matching degree of the parameter data type, to ensure the completeness and accuracy of the input information. Step S22: Design a structured vulnerability prompt template, such as analyzing API call sequences: 1. Entity Extraction - Extract all API nodes and their input / output attributes from the API call sequence.

[0020] 2. Data Stream Tracing - Check if the returned properties are correctly passed to the next API.

[0021] - Determine if there are any missing verifications, bypassed verifications, or unlinked user identities.

[0022] 3. Logical integrity check - Confirm whether the business process conforms to the expected logic.

[0023] - Check if there is any access to sensitive APIs by skipping a necessary step. This example is only for explaining the template and is not a constraint on the template in this invention. The large model analyzes network requests based on the set prompt template. The large model supports multiple model access such as DeepSeek and GPT. The configuration items for the model include APIKey, model version, request timeout, maximum token limit, etc. The input parameters are encapsulated in the format of API path-parameter list-response example. The input parameters are submitted to the large model for analysis, and the analysis tasks are clearly defined, such as parsing parameter semantics, identifying potential logical dependencies, and predicting abnormal response scenarios. Unstructured text is obtained through model analysis and converted into standardized JSON format through regular expression matching and semantic mapping. It includes parameter function descriptions, interface call risk points, analysis fields of logical correlation between parameters, and a model confidence score. Step S23 involves constructing an API documentation knowledge graph by integrating online documentation (Swagger API documentation) and offline documentation (locally stored Doc / Markdown manuals), which supports automatic document crawling and incremental updates. The extracted API URLs are used as search keywords, and a vector similarity algorithm (cosine similarity) is employed to match the most relevant document fragments in the knowledge base. This extracts core information such as API function descriptions (including business scenarios, permission requirements, and data flow), detailed parameter descriptions (value ranges, default values, encryption rules), and error code explanations. A multi-level search strategy is set up; when no exact match yields results, fuzzy matching and context-based extended search are enabled to improve the comprehensiveness of knowledge acquisition. Step S24 involves cross-validating the large model analysis results with the knowledge base retrieval results, comparing the consistency of the two information, marking conflicting information and prioritizing it based on confidence scores, writing structured processing code to achieve data aggregation, and generating structured data containing basic interface information, panoramic parameter analysis, behavior tags, and business identifiers.

[0024] By accurately identifying the meaning and type of API parameters, analysis efficiency can be improved. Based on the analysis results, more logical vulnerability analysis test cases or scenarios can be constructed, effectively solving problems such as low efficiency of manual analysis and parameter changes.

[0025] Step S3 involves vulnerability detection and identification of vulnerability characteristics, and the detection process and results are stored in a structured manner. It can also be integrated with external professional detection systems to obtain exploration results. Based on a professionally designed prompt template, a large-scale vulnerability detection and analysis is performed to obtain interpretation results and remediation suggestions. The specific steps are as follows: Step S31: By inputting multi-dimensional parameter types, a multi-dimensional parameter system is established, including information such as request method, request header, request parameters and URL. Parameter validation logic is designed to automatically detect the legality (URL format standardization, matching degree between request method and parameter type), completeness and accuracy of parameters. Step S32: Through a layered architecture design, a vulnerability detection service that is flexible and adaptable to both lightweight and complex scenarios is implemented. Basic logic vulnerability detection is achieved through a built-in Python code execution engine, such as simple privilege escalation and parameter tampering attempts. A request sending module is built by integrating the Requests library, and parameter mutation algorithms (numerical increment / decrement, Boolean value inversion, sensitive character injection) are written to generate test cases. Vulnerability characteristics are identified by combining response comparison analysis (status code differences, changes in returned content, changes in business status), and the detection process and results (request packets, response packets, vulnerability suspicion scores) are structured and stored. For complex logic vulnerability detection (multi-interface chained call vulnerabilities, business process bypass), a standardized API interface is designed to connect with external professional detection services. The request context is transmitted via JSON format, and in-depth analysis results returned by external services are received, such as vulnerability trigger paths, exploitation conditions, and impact scope. like Figure 4 As shown, the flowchart illustrates how an intelligent agent, when addressing complex logical vulnerabilities, invokes an external vulnerability service to connect with an external vulnerability detection service. It designs different logical vulnerability detection logic modules based on different logical vulnerability scenarios, implementing a specific vulnerability detection mode. The specific operations are as follows: Based on the API business identifier identified by the API analysis intelligent agent, it invokes the corresponding scenario's detection module, loading predefined vulnerability detection rules and test cases, such as the sensitive information regular expression library for the information query interface and the verification code test sequence for the login interface; based on the generated test cases, it invokes the external vulnerability detection service through the API interface. The external vulnerability service's modules simulate abnormal network requests, such as parameter tampering and duplicate submissions; it collects server-side response data (status codes, returned content, business status changes), and identifies vulnerability information through feature matching (response containing sensitive field regular expression matching results) and logical verification (whether authentication passes after session token reuse); it generates result data containing vulnerability type, triggering conditions, and risk level, and returns it to the API analysis intelligent agent.

[0026] Step S33: Design professional prompt templates, such as analyzing whether there are business logic vulnerabilities in the login → order placement → payment → invoice download process. 1. Entity Extraction - Extract all API nodes and their input / output attributes from the API call sequence.

[0027] 2. Data Stream Tracing - Check if the returned properties are correctly passed to the next API.

[0028] - Determine if there are any missing verifications, bypassed verifications, or unlinked user identities.

[0029] 3. Logical integrity check - Confirm that the business process conforms to the expected logic (login → place order → payment → download invoice).

[0030] - Check if there are any instances where access to sensitive APIs can be bypassed by skipping a necessary step (such as directly calling `downloadInvoice` without making a payment).

[0031] 4. Potential vulnerability identification -Example of vulnerability type: - Unauthorized access: API parameters lack user binding verification.

[0032] -Payment bypass: `order_id` allows you to download invoices directly without paying.

[0033] - Parameter tampering: `amount` can be modified between calls to `order / create` and `order / pay`. This example is only for interpreting the template and is not a constraint on the template in this invention. The large model analyzes network requests based on the set prompt word template. The large model supports access from multiple models such as DeepSeek and GPT. It encapsulates the vulnerability detection results (vulnerability type, trigger evidence, scope of impact) and business scenario information (interface function, permission level) and submits them to the large language model for interpretation. The large model generates a vulnerability principle explanation (the cause of logical defects at the technical level), a risk level assessment (combining CVSS standards and business importance), and targeted handling suggestions (such as firewall rule configuration, code-level remediation solutions, and business process optimization).

[0034] Step S4 involves processing detected vulnerabilities. This process combines automated and semi-automated methods, automatically generating remediation tasks with progress tracking and result feedback. A multi-dimensional result integration engine provides a complete vulnerability lifecycle data chain, outputting the data in various readable formats. The specific steps are as follows: Step S41: Establish a processing engine that combines automation and semi-automation. By connecting to security protection devices (firewalls, WAFs, identity authentication systems, etc.), when a logical vulnerability is detected, generate standardized specifications based on the processing suggestions output by the large model, such as IP blocking rules for firewalls and feature interception policies for WAFs. Then, execute the instructions in real time through the device API interface and push notifications to maintenance personnel. Step S42: Record the status (success or failure) and effective time of the instruction execution, and automatically generate a handling task in the work order system, including vulnerability details, suggested solutions, responsible department and other information. For complex handling that requires manual intervention (business logic reconstruction, permission system adjustment), manual intervention can understand and resolve vulnerabilities more quickly. The work order system also has handling progress tracking and result feedback, forming a closed-loop link from vulnerability detection to identification to resolution. Step S43: Based on the raw data from the detection phase (request or response packets, vulnerability characteristics), the interpretation report of the large model (principles, risks, recommendations), and the execution records from the handling phase (instruction content, execution status), a multi-dimensional result engine is built. By mapping the multi-dimensional data, a complete vulnerability lifecycle data chain is constructed. This achieves full-link information fusion of network security incidents from data collection to analysis and interpretation to handling, providing a unified view, correlation analysis capabilities, and source tracing support for security operations. Step S44: The output of vulnerability results supports JSON, HTML, or PDF format. Structured JSON is used for data interaction between systems, HTML is used for visualization, and PDF documents are used for archiving.

[0035] The technical solution of this invention captures request and response data from business systems through network traffic, automatically analyzes API behavior and parameters of the business systems, and combines this with the construction of an intelligent agent to automatically analyze and handle logical vulnerabilities. Its main advantages are: (1) High efficiency in discovering logical vulnerabilities: Traditional manual analysis requires 1-3 person-days to identify API parameters for a single system, including document review, traffic capture, rule sorting, etc. Complex business logic may take even longer. Furthermore, the generation of logical vulnerability test cases depends on experience, and it takes 2-5 person-days to cover 100 core scenarios. Automatic traffic collection + large model API parsing: Semantic recognition of APIs (including historical and new ones) can be completed in hours (e.g., batch processing of 1000 API interfaces in large models takes ≤2 hours). Automatic generation of test cases by intelligent agents: Based on business profiles and API associations, tens of thousands of combined scenarios (e.g., cross-test cases of "amount tampering + status bypass") can be generated in minutes, with coverage far exceeding manual enumeration.

[0036] (2) Fast risk response efficiency From the discovery of a vulnerability (manual inspection or user feedback) to initial handling (such as temporarily shutting down the function), it takes 1-3 days, including confirming the authenticity of the vulnerability, locating the scope of impact, and coordinating with the technical team.

[0037] The intelligent agent monitors traffic in real time, and upon detecting abnormal logic calls, can complete vulnerability verification and trigger an alarm within 1 minute. After connecting to protection devices, automated handling (such as WAF rule push and temporary interface rate limiting) takes ≤3 minutes, preventing vulnerabilities from being exploited during manual response intervals.

[0038] (3) Broad coverage of logical vulnerabilities: The intelligent agent can comprehensively and deeply explore various potential logical vulnerability scenarios based on the profile of the business system and the API call logic relationship, including vulnerabilities in low-frequency operations, hidden paths, and complex combinations of business rules. Compared with traditional technologies that can only cover some core business paths, the vulnerability coverage of this invention can be increased to more than 90%, which greatly increases the probability of discovering potential logical vulnerabilities.

[0039] Example 2, as Figure 2 As shown, a logic vulnerability detection system based on intelligent agents is disclosed. This system includes a network traffic acquisition module, an API analysis intelligent agent module, a vulnerability analysis intelligent agent module, a vulnerability handling alarm module, and an automatic update module. The network traffic acquisition module collects network traffic data through port mirroring at the core switch, filters out non-HTTP protocol data, extracts IP addresses from the HTTP protocol to build a request source map to facilitate the identification of vulnerability sources, parses header information, identifies the request parameter passing type, and standardizes it for input parameters of API analysis agent and vulnerability analysis agent. The API analysis agent module includes a parameter input submodule, a large model analysis submodule, a knowledge base retrieval and matching submodule, and a result integration and output submodule. The parameter input submodule constructs a multi-dimensional parameter input system to describe network requests from multiple perspectives, facilitating the analysis of large models. A verification mechanism is set up to ensure the legality, completeness, and accuracy of the parameters. The large model analysis submodule encapsulates the input parameters according to the structured prompt template, passes them to the large model for analysis, obtains unstructured text, converts it into standard JSON format, and outputs the model confidence score. The knowledge base retrieval and matching submodule constructs an API knowledge graph, performs keyword retrieval, uses vector similarity algorithms for matching, extracts the core information of the interface, and improves the comprehensiveness of knowledge acquisition by setting multi-level retrieval strategies. The results integration and output submodule verifies the consistency of information between the large model results and the matching retrieval results through cross-validation, and then aggregates the data through a structured processing algorithm to generate structured data. The vulnerability analysis intelligent agent module includes a parameter input submodule, a logic vulnerability detection submodule, and a vulnerability large model parsing submodule; Parameter input submodule: By constructing a multi-dimensional parameter input system, it describes network requests from multiple dimensions, which facilitates the analysis of large models. The verification mechanism ensures the legality, completeness and accuracy of the parameters. The logic vulnerability detection submodule, through a layered architecture design, completes the detection of logic vulnerability nodes by basic logic vulnerability detection, response comparison analysis to identify vulnerability characteristics, and external professional detection services. The vulnerability big data model analysis submodule encapsulates the input parameters using specialized prompt word templates and then hands them over to the big data model for analysis, generating a vulnerability principle explanation, risk level assessment, and targeted handling suggestions. The vulnerability handling and alerting module includes a risk handling and alerting submodule and a result aggregation and output submodule. The risk handling and alarm submodule generates standardized instructions based on the handling suggestions given by the big model, performs security protection, and sends alarms through real-time push notifications to notify operation and maintenance personnel to handle vulnerabilities. The results aggregation and output submodule performs correlation mapping through multi-dimensional result processing to build a complete vulnerability lifecycle data chain, realizing full-link information fusion of network security incidents from data collection → analysis and interpretation → handling, providing a unified view, correlation analysis capabilities and source tracing support for security operations; The automatic update module continuously receives and adds traffic data to the API analysis and vulnerability detection agent, improving the large-scale API analysis and vulnerability detection model. This trains more detailed vulnerability detection models for different request types, allowing for timely adjustments to vulnerability detection strategies and the establishment of a comprehensive business profile and API call logic graph. The vulnerability handling module autonomously crawls and extracts security-related knowledge to improve vulnerability handling and security protection measures.

[0040] Example 3, as Figure 3 As shown, a computer device includes a processor 101, a memory 102, a display module 103, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the agent-based logical vulnerability detection method described in Embodiment 1.

[0041] Example 4: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the agent-based logical vulnerability detection method described in Example 1.

[0042] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0043] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0044] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0045] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0046] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0047] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A logic vulnerability detection method based on intelligent agents, characterized in that: Includes the following steps: Step S1 involves real-time collection of network traffic, identification of protocols to filter out non-HTTP requests, feature extraction and parsing of the filtered HTTP requests, and standardization of the results. Step S2, the steps of the API analysis agent, involves establishing a multi-dimensional parameter input system to manage the input types of parameters, then encapsulating the parameters according to API path - parameter list - response example, and submitting them to the large model framework for data analysis; at the same time, knowledge base retrieval and matching are performed to extract the core information of interface function description, detailed parameter description and error code explanation, and the retrieval results are cross-validated with the large model analysis results to output structured data; Step S3 involves identifying vulnerability characteristics during vulnerability detection and storing the detection process and results in a structured manner. It can also connect with external professional detection systems to obtain exploration results. Based on the designed professional prompt word templates, large-scale vulnerability detection and analysis are performed to obtain interpretation results and handling suggestions. Step S4 involves processing detected vulnerabilities. This process combines automation and semi-automation to handle the vulnerabilities and automatically generates handling tasks to support progress tracking and result feedback. Through a multi-dimensional result integration engine, a complete vulnerability lifecycle data chain is obtained and output in various readable file formats.

2. The logic vulnerability detection method based on intelligent agents according to claim 1, characterized in that: The specific steps for S1 are as follows: Step S11: At the core switch, network traffic data is automatically collected through port mirroring. The HTTP protocol is identified by port and protocol characteristics, and non-HTTP protocol data is filtered out. Step S12: Extract the request IP address from the collected HTTP protocol requests and construct a request source IP map; Step S13: Parse the HTTP header information, identify the request parameter transmission type, extract the parameters according to the transmission type, and standardize the parameters.

3. The agent-based logic vulnerability detection method according to claim 2, characterized in that: The specific steps of S2 are as follows: Step S21: By inputting multi-dimensional parameter types, a multi-dimensional parameter system is established. Then, based on the parameter verification mechanism, the validity of the parameter format is automatically detected to ensure the integrity and accuracy of the input information. Step S22: Design a structured vulnerability prompt template. The large model analyzes the network request according to the set prompt template, and encapsulates the input parameters in the format of API path-parameter list-response example. The input parameters are submitted to the large model for analysis. The unstructured text obtained through model analysis is converted into a standardized JSON format through regular expression matching and semantic mapping. The JSON format includes analysis fields such as parameter function description, interface call risk points, and logical correlation between parameters, and is accompanied by model confidence score. Step S23: Construct an API document knowledge graph by integrating online and offline documents, which supports automatic document crawling and incremental update functions; use the extracted API URL as search keywords, and use a vector similarity algorithm to match the most relevant document fragments in the knowledge base to extract the core information of interface function description, parameter details and error code explanation; Set up a multi-level search strategy. When no results are found for exact matching, enable fuzzy matching and context-expanded search to improve the comprehensiveness of knowledge acquisition. Step S24 involves cross-validating the large model analysis results with the knowledge base retrieval results, comparing the consistency of the two information, marking conflicting information and prioritizing it based on confidence scores, writing structured processing code to achieve data aggregation, and generating structured data containing basic interface information, panoramic parameter analysis, behavior tags, and business identifiers.

4. The agent-based logic vulnerability detection method according to claim 3, characterized in that: The specific steps for S3 are as follows: Step S31: By inputting multi-dimensional parameter types, a multi-dimensional parameter system is established, parameter verification logic is designed, and the legality, completeness, and accuracy of parameters are automatically detected. Step S32: Through layered architecture design, a vulnerability detection service that can be flexibly adapted to both lightweight and complex scenarios is realized. Basic logic vulnerability detection is realized through the built-in Python code execution engine. Request sending is constructed by integrating the Requests library, test cases are generated by writing parameter mutation algorithms, vulnerability characteristics are identified by combining response comparison analysis, and the detection process and results are stored in a structured manner. For complex logic vulnerability detection, we design standardized API interfaces to connect with external professional detection services, transmit request context in JSON format, and receive in-depth analysis results returned by external services. Step S33: Design a professional prompt word template. The big model analyzes the network request based on the set prompt word template, encapsulates the vulnerability detection results and business scenario information, and submits them to the big language model for interpretation, generating vulnerability principle explanations, risk level assessments, and targeted handling suggestions.

5. The agent-based logic vulnerability detection method according to claim 4, characterized in that: It connects to external vulnerability detection services, which design different logical vulnerability detection logics according to different logical vulnerability scenarios; it adopts a specific vulnerability detection mode; the specific operation is as follows: based on the API business identifier identified by the API analysis agent, it calls the detection of the corresponding scenario, loads the predefined vulnerability detection rules and test cases; based on the generated test cases, it calls the external vulnerability detection service through the API interface, the external vulnerability service simulates abnormal network requests, collects server response data, and identifies vulnerability information through feature matching and logical verification; Generate result data including vulnerability type, triggering conditions, and risk level, and return it to the API analysis agent.

6. The agent-based logic vulnerability detection method according to claim 4 or 5, characterized in that: The specific steps for S4 are as follows: Step S41: Establish a processing engine that combines automation and semi-automation. By connecting with security protection devices, when a logical vulnerability is detected, generate standardized specifications based on the processing suggestions output by the large model, start the security protection devices to implement feature interception strategies, and push notifications to maintenance personnel in real time through the device API interface. Step S42: Record the status and effective time of the instruction execution, and automatically generate a handling task in the work order system, record information related to the vulnerability, and the work order system also has handling progress tracking and result feedback. Step S43: Based on the raw data from the detection phase, the interpretation report of the large model, and the execution records from the handling phase, a multi-dimensional result engine is constructed; by mapping the multiple dimensions, a complete vulnerability lifecycle data chain is built. Step S44: The output of vulnerability results supports JSON, HTML, or PDF format. Structured JSON is used for data interaction between systems, HTML is used for visualization, and PDF documents are used for archiving.

7. The agent-based logic vulnerability detection method according to claim 6, characterized in that: The API analysis agent and vulnerability detection agent continuously receive collected traffic data and add this data to the model training sample library to continuously improve the large model of API analysis and vulnerability detection. They train more detailed large model vulnerability detection for different request types, adjust vulnerability detection strategies in a timely manner, establish a complete business profile and API call logic relationship graph, and improve vulnerability handling and security protection measures by autonomously crawling and handling security-related knowledge.

8. A logic vulnerability detection system based on intelligent agents, characterized in that: It includes a network traffic collection module, an API analysis agent module, a vulnerability analysis agent module, a vulnerability handling and alarm module, and an automatic update module; The network traffic acquisition module collects network traffic data through port mirroring at the core switch, filters out non-HTTP protocol data, extracts IP addresses from the HTTP protocol to build a request source map to facilitate the identification of vulnerability sources, parses header information, identifies the request parameter passing type, and standardizes it for input parameters of API analysis agent and vulnerability analysis agent. The API analysis agent module includes a parameter input submodule, a large model analysis submodule, a knowledge base retrieval and matching submodule, and a result integration and output submodule. The parameter input submodule constructs a multi-dimensional parameter input system to describe network requests from multiple perspectives, facilitating the analysis of large models. A verification mechanism is set up to ensure the legality, completeness, and accuracy of the parameters. The large model analysis submodule encapsulates the input parameters according to the structured prompt template, passes them to the large model for analysis, obtains unstructured text, converts it into standard JSON format, and outputs the model confidence score. The knowledge base retrieval and matching submodule constructs an API knowledge graph, performs keyword retrieval, uses a vector similarity algorithm for matching, and extracts the core information of the interface. The results integration and output submodule verifies the consistency of information between the large model results and the matching retrieval results through cross-validation, and then aggregates the data through a structured processing algorithm to generate structured data. The vulnerability analysis intelligent agent module includes a parameter input submodule, a logic vulnerability detection submodule, and a vulnerability large model parsing submodule; Parameter Input Submodule: This module describes network requests from multiple perspectives by constructing a multi-dimensional parameter input system. The logic vulnerability detection submodule, through a layered architecture design, completes the detection of logic vulnerability nodes by basic logic vulnerability detection, response comparison analysis to identify vulnerability characteristics, and external professional detection services. The vulnerability big data model analysis submodule encapsulates the input parameters using specialized prompt word templates and then hands them over to the big data model for analysis, generating a vulnerability principle explanation, risk level assessment, and targeted handling suggestions. The vulnerability handling and alerting module includes a risk handling and alerting submodule and a result aggregation and output submodule. The risk handling and alarm submodule generates standardized instructions based on the handling suggestions given by the big model, performs security protection, and sends alarms through real-time push notifications to notify operation and maintenance personnel to handle vulnerabilities. The result aggregation and output submodule performs correlation mapping through multi-dimensional result processing to build a complete vulnerability lifecycle data chain. The automatic update module continuously receives and updates the large-scale API analysis and vulnerability detection models through the API analysis agent and vulnerability detection agent, and adjusts the vulnerability detection strategy in a timely manner.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, it implements the steps of the agent-based logical vulnerability detection method according to any one of claims 1-7.

10. A computer device, comprising a processor (101), a memory (102), a display module (103), and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the steps of the agent-based logic vulnerability detection method according to any one of claims 1-7.

Images