Security test method and test device for software interface, storage medium and processor

Abstract

The invention provides a security test method and test device for software interfaces, a storage medium and a processor. The method comprises the following steps: acquiring an interface access request, context information of the interface access request, functions of a plurality of software interfaces, data formats of the software interfaces and access behavior data of a current interface; performing a security test on the current interface at least according to the interface access request and the context information to obtain a first test result; performing a security test on the current interface at least according to the function and the data format of the software interface to obtain a second test result; inputting the access behavior data into the target neural network model to obtain a third test result, each group of historical data including a first historical target parameter and a second historical target parameter; and determining that the first test result, the second test result and the third test result are security test results of the current interface. According to the method, the access security of the software interface can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a software interface security testing method, a software interface security testing device, a computer readable storage medium and a processor. BACKGROUND

[0002] In the field of software development and integration, software interface plays a crucial role as a bridge for communication between software systems, ensuring efficient data transmission and seamless function integration. However, with the increasing complexity of software systems and external threats, software interface security issues have become increasingly prominent.

[0003] Therefore, there is an urgent need for a method to solve the problem of how to improve software interface access security. SUMMARY

[0004] The main purpose of the present application is to provide a software interface security testing method, a software interface security testing device, a computer readable storage medium and a processor to at least solve the technical problem of how to improve software interface access security in the prior art.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a software interface security testing method is provided, comprising: obtaining an interface access request, context information of the interface access request, functions of a plurality of software interfaces, data formats of the software interfaces and access behavior data of a current interface, the interface access request being used to request access to the current interface to obtain target data, the current interface being any one software interface; at least according to the interface access request and the context information, performing security testing on the current interface to obtain a first test result, wherein the first test result is used to represent whether to allow access to the current interface; at least according to the functions of the software interfaces and the data formats, performing security testing on the current interface to obtain a second test result, wherein the second test result is used to represent whether the current interface has a security vulnerability; inputting the access behavior data into a target neural network model to obtain a third test result, the third test result representing whether the access behavior data has an abnormality, the target neural network model being trained by machine learning using a plurality of sets of historical data, each set of historical data including a first historical target parameter and a second historical target parameter, the first historical target parameter being a parameter calculated according to historical access behavior data, and the second historical target parameter being a parameter representing whether the historical access behavior data has an abnormality; determining the first test result, the second test result and the third test result as the security testing result of the current interface.

[0006] Optionally, the interface access request and the context information of the interface access request are acquired, including: acquiring an interface key of the current interface, a current timestamp of the current interface, and biometric information of the current interface to obtain the interface access request; and acquiring a security state of the access device, a frequency of the interface access request, and a type of the target data to obtain the context information, the type of the target data including sensitive data and non-sensitive data, and the access device being a device requesting to access the current interface.

[0007] Optionally, the current interface is subjected to a security test according to at least the interface access request and the context information to obtain a first test result, including: determining whether the interface key is the same as a target key, wherein the target key is a unique identifier of the interface access request; in the case where the interface key is the same as the target key, determining a difference between the current timestamp and a system time of the software, and determining whether the difference is within a predetermined difference range; in the case where the difference is within the predetermined difference range, determining whether the access device requesting to access the software interface is a mobile device; in the case where the access device is a mobile device, performing identity verification on the biometric information; and in the case where the verification is successful, adjusting the access authority of the access device according to the context information to obtain the first test result.

[0008] Optionally, the access authority of the access device is adjusted according to the context information to obtain the first test result, including: determining whether the access device has a security risk according to the security state of the access device; in the case where the access device has a security risk, adjusting the access authority of the access device to read-only operation to obtain the first test result; in the case where the frequency is greater than a frequency threshold, adjusting the access authority of the access device to block access to the software interface to obtain the first test result; and in the case where the type of the target data is sensitive data, re-performing security verification on the access device to obtain the first test result.

[0009] Optionally, the software interface is tested according to at least a function of the software interface and a data format of the software interface to obtain a second test result, including: constructing a first attack behavior according to the function of the software interface and a corresponding first security risk point, wherein the first attack behavior is used to attack the first security risk point; constructing a second attack behavior according to the data format of the software interface and a corresponding second security risk point, wherein the second attack behavior is used to attack the second security risk point; constructing an attack scenario library according to a first mapping relationship between the function of the software interface and the first attack behavior and a second mapping relationship between the data format of the software interface and the second attack behavior; and selecting a corresponding attack behavior from the attack scenario library to attack the current interface according to the function of the current interface and the data format of the target data, and acquiring response information of the current interface to obtain the second test result, wherein the response information includes a response status code, returned data, and log information.

[0010] Optionally, the access behavior data of the current interface is obtained, including: obtaining an IP address of a request to access the current interface, a request time of the interface access request, a request parameter of the interface access request, a response time of the interface access request, and a return result of the interface access request, to obtain preliminary data; and performing data cleaning processing and standardization processing on the preliminary data to obtain the access behavior data.

[0011] Optionally, after the access behavior data is input into the target neural network model to obtain the third test result, the method further includes: in a case where the third test result is that the access behavior data is abnormal, outputting an abnormal signal, and obtaining a type of the access behavior data, an access time corresponding to the access behavior data, and an access device corresponding to the access behavior data.

[0012] According to another aspect of the present application, a security testing device for a software interface is provided, including: an obtaining unit configured to obtain an interface access request, context information of the interface access request, a function of a software interface, a data format of the software interface, and access behavior data of a current interface, the interface access request being configured to request to access the current interface to obtain target data, the current interface being any one of the software interfaces; a first testing unit configured to perform security testing on the current interface according to at least the interface access request and the context information to obtain a first test result, wherein the first test result is configured to represent whether to allow access to the current interface; a second testing unit configured to perform testing on the current interface according to at least the function of the software interface and the data format to obtain a second test result, wherein the second test result is configured to represent whether the current interface has a security vulnerability; an input unit configured to input the access behavior data into a target neural network model to obtain a third test result, the third test result being whether the access behavior data is abnormal, the target neural network model being trained by machine learning using a plurality of sets of historical data, each set of historical data including a first historical target parameter and a second historical target parameter, the first historical target parameter being a parameter calculated according to historical access behavior data, and the second historical target parameter being a parameter representing whether the historical access behavior data is abnormal; and a determination unit configured to determine the first test result, the second test result, and the third test result as a security testing result of the current interface.

[0013] According to still another aspect of the present application, a computer-readable storage medium is provided, including a stored program, wherein the program, when executed, controls a device in which the computer-readable storage medium is located to perform the security testing method of the software interface of any one of the above methods.

[0014] According to still another aspect of the present application, a processor is provided, configured to execute a program, wherein the program, when executed, performs the security testing method of the software interface of any one of the above methods.

[0015] This application's technical solution employs multi-factor authentication based on the interface access request, the context information of the interface access request, the function of the software interface, and the data format of the software interface. Simultaneously, machine learning algorithms are used to analyze interface access behavior data in real time to determine whether the behavior is abnormal, thereby promptly identifying and addressing potential security risks. This comprehensive approach addresses the shortcomings of existing software interface testing methods, such as their inability to comprehensively and accurately detect security flaws in software interfaces during practical applications and the lack of real-time monitoring and dynamic evaluation, thus improving software interface access security. Attached Figure Description

[0016] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 A hardware structure block diagram of a mobile terminal for performing a security testing method for a software interface according to an embodiment of this application is shown.

[0018] Figure 2 A flowchart illustrating a security testing method for a software interface according to an embodiment of this application is shown.

[0019] Figure 3 A schematic flowchart illustrating a test process for obtaining a first test result according to an embodiment of this application is shown.

[0020] Figure 4 A schematic flowchart illustrating a test to obtain a second test result according to an embodiment of this application is shown.

[0021] Figure 5 A schematic flowchart illustrating a test process for obtaining a third test result according to an embodiment of this application is shown.

[0022] Figure 6 A structural block diagram of a security testing apparatus for a software interface provided according to an embodiment of this application is shown.

[0023] The above figures include the following reference numerals:

[0024] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. Detailed Implementation

[0025] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] As described in the background section, existing technologies suffer from problems such as firewalls relying on static rules, insufficient protection against new attacks or border-bypassing attack methods, inability to detect emerging or unknown vulnerabilities in a timely manner, coarse access control, and lack of real-time monitoring. To address these issues, embodiments of this application provide a software interface security testing method, a software interface security testing device, a storage medium, a processor, and an electronic device.

[0029] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0030] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a software interface security testing method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0031] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the security testing method of the software interface in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one instance, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] This embodiment provides a security testing method for a software interface running on a mobile terminal, computer terminal, or similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] Figure 2 This is a flowchart of a security testing method for a software interface according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0034] Step S201: Obtain the interface access request, the context information of the interface access request, the functions of multiple software interfaces, the data format of the software interfaces, and the access behavior data of the current interface. The interface access request is used to request access to the current interface to obtain the target data. The current interface is any one of the software interfaces.

[0035] Specifically, an interface access request is a request received by the system to access a specific software interface to obtain the required target data. These requests may originate from internal or external systems and serve as trigger points for security testing. The context information of an interface access request includes additional information related to the request, such as the security status of the requesting device, the frequency of the request, the type of request operation, and the sensitivity of the target data, among other multi-dimensional factors. The functions of multiple software interfaces refer to the specific functions performed by all interfaces within the software system, including but not limited to data transmission, function calls, and authorization verification. The data format of the aforementioned software interfaces refers to the format in which the interface processes and exchanges data, such as JSON, XML, and data tables. Current interface access behavior data is all relevant information collected in real-time regarding the current interface access activity, including details of requests and responses, access frequency, and response time.

[0036] Step S202: Perform a security test on the current interface based at least on the interface access request and the context information to obtain a first test result, wherein the first test result is used to characterize whether access to the current interface is allowed.

[0037] Specifically, through detailed examination of interface access requests and comprehensive analysis of contextual information, the first test result directly determines whether a visitor has permission to access the current interface. The interface access request and the aforementioned contextual information can be used to assess the risk level of the access request. For example, if the request originates from an IP address that has been flagged as suspicious, or if there are signs of unauthorized software running on the device, the first test result may identify a high risk. In this case, the system will take stricter verification measures or directly deny access to prevent potential attacks. The first test result also affects the granting of permissions to the visitor, which is part of a dynamic authorization strategy. The system can dynamically adjust access permissions based on the test results.

[0038] Step S203: At least based on the functions of the software interface and the data format, perform a security test on the current interface to obtain a second test result, wherein the second test result is used to characterize whether the current interface has a security vulnerability;

[0039] Specifically, by analyzing the functionality of the interface, testing its ability to maintain security while performing its intended tasks. This includes checking whether the interface correctly handles user input, whether it implements appropriate access control for sensitive operations, and whether it implements necessary encryption and verification mechanisms during data processing. For example, for an interface involving changes to user information, testing will focus on whether it effectively prevents SQL injection and cross-site scripting attacks, ensuring data integrity and user privacy security.

[0040] Step S204: Input the above access behavior data into the target neural network model to obtain a third test result. The third test result indicates whether the access behavior data is abnormal. The target neural network model is trained by machine learning using multiple sets of historical data. Each set of historical data includes a first historical target parameter and a second historical target parameter. The first historical target parameter is a parameter calculated based on the historical access behavior data. The second historical target parameter is a parameter that indicates whether the historical access behavior data is abnormal.

[0041] Specifically, the target neural network model can be a Long Short-Term Memory (LSTM) network, a Support Vector Machine (SVM), a Convolutional Neural Network (CNN), or a Generative Adversarial Network (GAN). By inputting real-time access behavior data into the neural network model, the system can instantly analyze each access behavior and determine whether it is abnormal. The target neural network model is trained using a large amount of historical access behavior data. This historical data includes instances of normal access and known abnormal access.

[0042] Step S205: Determine the first test result, the second test result, and the third test result as the security test results of the current interface.

[0043] Specifically, the first test results based on the zero-trust principle, the second test results based on the software interface functions and data formats, and the third test results based on machine learning are first summarized. Then, the three types of test results can be cross-validated, and each test result is weighted and averaged according to a certain weight to generate a comprehensive security score or evaluation level, which is used to intuitively reflect the current security status of the interface.

[0044] This embodiment employs a multi-factor authentication approach, considering the interface access request, its context, the software interface's functionality, and its data format. Simultaneously, machine learning algorithms are used to analyze interface access behavior data in real time, determining whether the behavior is abnormal and thus promptly identifying and addressing potential security risks. This comprehensive approach addresses the shortcomings of existing software interface testing methods, which cannot comprehensively and accurately detect security flaws in software interfaces during practical applications, and lack real-time monitoring and dynamic evaluation, thereby improving software interface access security.

[0045] In specific implementation, step S201 can be achieved through the following steps: Step S2011, obtain the interface key, current timestamp, and biometric information of the current interface to obtain the interface access request; Step S2012, obtain the security status of the accessing device, the frequency of the interface access request, and the type of the target data to obtain the context information. The type of target data includes sensitive data and non-sensitive data, and the accessing device is the device requesting access to the current interface. This method allows for faster acquisition of the interface access request and context information.

[0046] In practical applications, the aforementioned interface keys are unique and updated regularly, and can be used to initially verify the source of the request. Timestamps can be used to verify the timeliness of the initial verification request. Biometric information can include two categories: physiological characteristics, including fingerprints, face, iris, retina, veins, DNA, and hand geometry; and behavioral characteristics, including voiceprints, gait, signatures, keystroke dynamics, mouse or touch behavior, and mobile phone usage habits. In addition, there is multimodal biometrics, which combines multiple biometric features such as face and fingerprint, or fingerprint and voiceprint, to improve the security and accuracy of identity verification. The system simultaneously collects the security status of the accessing device, the frequency of interface access, and the type of target data to assess the context and potential risks of the access.

[0047] In some embodiments, step S202 can be implemented through the following steps: Step S2021, determining whether the interface key and the target key are the same, wherein the target key is the unique identifier of the interface access request; Step S2022, if the interface key and the target key are the same, determining the difference between the current timestamp and the software's system time, and determining whether the difference is within a predetermined difference range; Step S2023, if the difference is within the predetermined difference range, determining whether the access device requesting access to the software interface is a mobile device; Step S2024, if the access device is a mobile device, authenticating the biometric information; Step S2025, if the authentication is successful, adjusting the access permissions of the access device according to the context information to obtain the first test result. This method can further ensure that every access request undergoes rigorous security verification, thereby protecting system resources from malicious access.

[0048] Specifically, this method uses the verification of the interface key against a preset target key as the first line of defense for verifying requests, ensuring that each request carries the correct identifier and preventing unauthorized access. If the keys match, it then verifies whether the difference between the current timestamp and the system time is within the allowed range. This step aims to prevent replay attacks and ensure the timeliness and authenticity of requests. For requests with successful timestamp verification, it further determines whether the accessing device is a mobile device, guiding whether to enable the biometric verification process. If the accessing device is confirmed to be a mobile device, the system will authenticate the received biometric information, adding a layer of security suitable for high-security requirements in mobile scenarios. For example, in a mobile medical software, when a doctor accesses a patient data interface via a mobile device, in addition to entering the interface password and carrying the timestamp, facial recognition authentication is also required to ensure that only authorized doctors can access the corresponding interface.

[0049] In some embodiments, step S2025 can be implemented through the following steps: Step S20251, determining whether the access device has a security risk based on its security status; Step S20252, if the access device has a security risk, adjusting its access permissions to read-only to obtain the first test result; Step S20253, if the frequency exceeds a frequency threshold, adjusting the access permissions to block access to the software interface to obtain the first test result; Step S20254, if the target data is sensitive data, re-verifying the access device to obtain the first test result. This method assesses the risk of the access device from multiple perspectives, dynamically adjusts access permissions, and takes more cautious security measures, especially when processing sensitive data, thereby further comprehensively improving the security protection level of the software interface.

[0050] Specifically, the system first assesses the security status of accessing devices. If a security risk is detected, the system automatically downgrades the access permission to read-only, restricting write operations to the software interface and reducing potential damage, thus generating the corresponding first test result. Next, the system monitors the access frequency to determine if it exceeds a preset threshold. If it does, depending on the severity, the system directly blocks the device's access to the software interface, ensuring the interface is not damaged by high-frequency suspicious activity. This also constitutes part of the first test result. Through security status assessment and permission adjustment, risky accessing devices are isolated from critical system functions, reducing the probability of security incidents. Monitoring and controlling abnormal access frequencies effectively prevents potential brute-force attacks, web crawlers, and other attacks, enhancing system defense capabilities.

[0051] In some embodiments, step S203 can be implemented through the following steps: Step S2031, constructing a first attack behavior based on the function of the software interface and the corresponding first security risk point, wherein the first attack behavior is used to attack the first security risk point; Step S2032, constructing a second attack behavior based on the data format of the software interface and the corresponding second security risk point, wherein the second attack behavior is used to attack the second security risk point; Step S2033, constructing an attack scenario library based on the first mapping relationship between the function of the software interface and the first attack behavior, and the second mapping relationship between the data format of the software interface and the second attack behavior; Step S2034, selecting a corresponding attack behavior from the attack scenario library to attack the current interface based on the function of the current interface and the data format of the target data, and obtaining the response information of the current interface to obtain the second test result, wherein the response information includes a response status code, returned data, and log information. This testing method can not only verify the stability of the software interface under normal operation, but also evaluate its protection capability when facing real-world attacks, further ensuring system security and reliability.

[0052] Specifically, this method identifies primary security risks associated with the specific functions of the software interface. These risks may be vulnerabilities arising from function execution, such as insufficient parameter validation or improper access control. Then, based on these risks, a primary attack behavior is constructed to simulate the methods an attacker might use to verify the interface's protection capabilities. Secondary security risks are identified for the data formats processed by the interface, typically related to data parsing, encoding, or storage. Based on these risks, secondary attack behaviors are developed, such as constructing inputs with special data formats to test the interface's ability to handle abnormal data. These function- and data-format-related attack behaviors are compiled to establish a comprehensive attack scenario library. When a specific interface needs to be tested, the corresponding attack behavior is selected from the attack scenario library based on its function and data format.

[0053] In some embodiments, step S201 can be implemented through the following steps: Step S2013, obtaining the IP address of the requesting access to the current interface, the request time of the interface access request, the request parameters of the interface access request, the response time of the interface access request, and the return result of the interface access request to obtain preliminary data; Step S2014, performing data cleaning and standardization processing on the preliminary data to obtain the access behavior data. The above method can effectively collect, prepare, and utilize interface access behavior data for subsequent real-time security monitoring and dynamic risk assessment, thereby further strengthening the security protection of software interfaces.

[0054] Specifically, after obtaining the preliminary data, the collected data is cleaned to remove duplicate and invalid data, and the data is standardized to have a unified format and measurement standard. For example, time data in different formats is converted into a standard time format, and request parameters are encoded for subsequent analysis.

[0055] In some embodiments, the method further includes step S206: if the third test result indicates that the access behavior data is abnormal, an abnormal signal is output, and the type of the access behavior data, the access time corresponding to the access behavior data, and the access device corresponding to the access behavior data are obtained. This improves the comprehensiveness of the security testing process for software interfaces and enhances the real-time response and accurate location capabilities for abnormal behavior, which is of great significance for building a software security protection system under a zero-trust architecture.

[0056] Specifically, if the third test result indicates anomalies in the access behavior data, the system will immediately trigger an anomaly signal as a timely response to potential security threats, ensuring that relevant personnel can quickly notice the situation. The system will then obtain specific information about the anomaly behavior. This allows for the immediate output of anomaly signals and the accurate acquisition of relevant information, enabling necessary measures to be taken. Through continuous monitoring and analysis of anomaly behavior, the machine learning model can be continuously improved, making it more accurate in identifying various attack patterns that may be encountered in the future, thereby enhancing overall security protection capabilities.

[0057] To enable those skilled in the art to better understand the technical solution of this application, the implementation process of the security testing method for the software interface of this application will be described in detail below with reference to specific embodiments.

[0058] Example 1

[0059] This embodiment relates to a process for obtaining a first test result, such as... Figure 3 As shown, it includes the following steps:

[0060] Step S301: Initiate a request;

[0061] Step S302: Verify the interface key. If yes, proceed to step S303; otherwise, proceed to step S304.

[0062] Step S303: Verify the validity of the timestamp; if yes, proceed to step S305; otherwise, proceed to step S304.

[0063] Step S304: Access denied;

[0064] Step S305: Is the device accessing the device? If yes, proceed to step S307; if no, proceed to step S306.

[0065] Step S306: Evaluate the dynamic authorization strategy and obtain the evaluation results. For high-risk cases, proceed to step S308; for abnormal frequency cases, proceed to step S309; ​​for sensitive data cases, proceed to step S310.

[0066] Step S307: Biometric verification; if successful, proceed to step S306; if unsuccessful, proceed to step S304.

[0067] Step S308: Restrict permissions;

[0068] Step S309: Trigger secondary verification or block;

[0069] Step S310: Trigger administrator approval;

[0070] Step S311: Execute the interface operation.

[0071] Example 2

[0072] This embodiment relates to a process for obtaining a second test result, such as... Figure 4 As shown, it includes the following steps:

[0073] Step S401: Construct an interface attack library. Scenarios include SQL injection, XX cracking, and unauthorized access.

[0074] Step S402: Start the automated testing tool;

[0075] Step S403: Select an attack type from the attack library;

[0076] Step S404: Generate the corresponding attack request;

[0077] Step S405: Send an attack request to the target interface;

[0078] Step S406: Monitor interface response: status code, returned data, system logs, etc.;

[0079] Step S407: Analyze the response results: Does it contain vulnerability signatures? If yes, proceed to step S408; if no, proceed to step S409.

[0080] Step S408: Record vulnerability details;

[0081] Step S409: Continue testing other scenarios, proceed to step S403;

[0082] Step S410: Generate a test report and notify for repair.

[0083] Example 3

[0084] This embodiment relates to a process for obtaining a third test result, such as... Figure 5As shown, it includes the following steps:

[0085] Step S501: Real-time collection of interface access data: IP address, time, parameters, response time, and returned results;

[0086] Step S502: Data preprocessing: cleaning, standardization, and coding;

[0087] Step S503: Input machine learning model: The model has been trained as a normal behavior model;

[0088] Step S504: Model output;

[0089] Step S505: Is the behavior normal? If yes, proceed to step S506; if no, proceed to step S507.

[0090] Step S506: Continuous monitoring and review: Regularly check whether the threat has been addressed;

[0091] Step S507: Calculate the anomaly probability;

[0092] Step S508: Determine whether the outlier exceeds the threshold. If yes, proceed to step S509; otherwise, proceed to step S510.

[0093] Step S509: Trigger an alarm;

[0094] Step S510: Respond according to the severity of the anomaly. If severe, proceed to step S511; if mild, proceed to step S512.

[0095] Step S512: Block IP / device access and send an administrator alert;

[0096] Step S513: Log the information and notify the security team.

[0097] This application also provides a software interface security testing device. It should be noted that this software interface security testing device can be used to execute the software interface security testing method provided in this application. This device is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0098] The following describes the security testing device for the software interface provided in the embodiments of this application.

[0099] Figure 6 This is a schematic diagram of a security testing apparatus for a software interface according to an embodiment of this application. Figure 6As shown, the device includes:

[0100] The acquisition unit 10 is used to acquire interface access request, interface access request context information, functions of multiple software interfaces, data format of the software interfaces, and access behavior data of the current interface. The interface access request is used to request access to the current interface to obtain target data. The current interface is any one of the software interfaces.

[0101] Specifically, an interface access request is a request received by the system to access a specific software interface to obtain the required target data. These requests may originate from internal or external systems and serve as trigger points for security testing. The context information of an interface access request includes additional information related to the request, such as the security status of the requesting device, the frequency of the request, the type of request operation, and the sensitivity of the target data, among other multi-dimensional factors. The functions of multiple software interfaces refer to the specific functions performed by all interfaces within the software system, including but not limited to data transmission, function calls, and authorization verification. The data format of the aforementioned software interfaces refers to the format in which the interface processes and exchanges data, such as JSON, XML, and data tables. Current interface access behavior data is all relevant information collected in real-time regarding the current interface access activity, including details of requests and responses, access frequency, and response time.

[0102] The first test unit 20 is used to perform security tests on the current interface based at least on the interface access request and the context information to obtain a first test result, wherein the first test result is used to characterize whether access to the current interface is allowed.

[0103] Specifically, through detailed examination of interface access requests and comprehensive analysis of contextual information, the first test result directly determines whether a visitor has permission to access the current interface. The interface access request and the aforementioned contextual information can be used to assess the risk level of the access request. For example, if the request originates from an IP address that has been flagged as suspicious, or if there are signs of unauthorized software running on the device, the first test result may identify a high risk. In this case, the system will take stricter verification measures or directly deny access to prevent potential attacks. The first test result also affects the granting of permissions to the visitor, which is part of a dynamic authorization strategy. The system can dynamically adjust access permissions based on the test results.

[0104] The second testing unit 30 is used to perform security testing on the current interface based at least on the functions and data formats of the software interface, and obtain a second test result, wherein the second test result is used to characterize whether the current interface has a security vulnerability.

[0105] Specifically, by analyzing the functionality of the interface, testing its ability to maintain security while performing its intended tasks. This includes checking whether the interface correctly handles user input, whether it implements appropriate access control for sensitive operations, and whether it implements necessary encryption and verification mechanisms during data processing. For example, for an interface involving changes to user information, testing will focus on whether it effectively prevents SQL injection and cross-site scripting attacks, ensuring data integrity and user privacy security.

[0106] The input unit 40 is used to input the above-mentioned access behavior data into the target neural network model to obtain a third test result. The third test result indicates whether the above-mentioned access behavior data is abnormal. The target neural network model is trained by machine learning using multiple sets of historical data. Each set of the above-mentioned historical data includes a first historical target parameter and a second historical target parameter. The first historical target parameter is a parameter calculated based on the historical access behavior data. The second historical target parameter is a parameter that indicates whether the above-mentioned historical access behavior data is abnormal.

[0107] Specifically, the target neural network model can be a Long Short-Term Memory (LSTM) network, a Support Vector Machine (SVM), a Convolutional Neural Network (CNN), or a Generative Adversarial Network (GAN). By inputting real-time access behavior data into the neural network model, the system can instantly analyze each access behavior and determine whether it is abnormal. The target neural network model is trained using a large amount of historical access behavior data. This historical data includes instances of normal access and known abnormal access.

[0108] The determining unit 50 is used to determine the first test result, the second test result, and the third test result as the security test results of the current interface.

[0109] Specifically, the first test results based on the zero-trust principle, the second test results based on the software interface functions and data formats, and the third test results based on machine learning are first summarized. Then, the three types of test results can be cross-validated, and each test result is weighted and averaged according to a certain weight to generate a comprehensive security score or evaluation level, which is used to intuitively reflect the current security status of the interface.

[0110] This embodiment employs a multi-factor authentication approach, considering the interface access request, its context, the software interface's functionality, and its data format. Simultaneously, machine learning algorithms are used to analyze interface access behavior data in real time, determining whether the behavior is abnormal and thus promptly identifying and addressing potential security risks. This comprehensive approach addresses the shortcomings of existing software interface testing methods, which cannot comprehensively and accurately detect security flaws in software interfaces during practical applications, and lack real-time monitoring and dynamic evaluation, thereby improving software interface access security.

[0111] In its specific implementation, the aforementioned acquisition unit includes a first acquisition module and a second acquisition module. The first acquisition module acquires the interface key, the current timestamp, and the biometric information of the current interface to obtain the interface access request. The second acquisition module acquires the security status of the accessing device, the frequency of the interface access request, and the type of the target data to obtain the context information. The target data type includes sensitive data and non-sensitive data, and the accessing device is the device requesting access to the current interface. This device can further and more quickly acquire the interface access request and context information.

[0112] In practical applications, the aforementioned interface keys are unique and updated regularly, and can be used to initially verify the source of the request. Timestamps can be used to verify the timeliness of the initial verification request. Biometric information can include two categories: physiological characteristics, including fingerprints, face, iris, retina, veins, DNA, and hand geometry; and behavioral characteristics, including voiceprints, gait, signatures, keystroke dynamics, mouse or touch behavior, and mobile phone usage habits. In addition, there is multimodal biometrics, which combines multiple biometric features such as face and fingerprint, or fingerprint and voiceprint, to improve the security and accuracy of identity verification. The system simultaneously collects the security status of the accessing device, the frequency of interface access, and the type of target data to assess the context and potential risks of the access.

[0113] In some embodiments, the first testing unit includes a first determining module, a second determining module, a third determining module, a verification module, and an adjustment module. The first determining module determines whether the interface key and the target key are the same, where the target key is a unique identifier for the interface access request. The second determining module, if the interface key and the target key are the same, determines the difference between the current timestamp and the software's system time, and determines whether the difference is within a predetermined range. The third determining module, if the difference is within the predetermined range, determines whether the access device requesting access to the software interface is a mobile device. The verification module, if the access device is a mobile device, authenticates the biometric information. The adjustment module, if the authentication is successful, adjusts the access permissions of the access device based on the context information to obtain the first test result. This device further ensures that every access request undergoes rigorous security verification, thereby protecting system resources from malicious access.

[0114] Specifically, this method uses the verification of the interface key against a preset target key as the first line of defense for verifying requests, ensuring that each request carries the correct identifier and preventing unauthorized access. If the keys match, it then verifies whether the difference between the current timestamp and the system time is within the allowed range. This step aims to prevent replay attacks and ensure the timeliness and authenticity of requests. For requests with successful timestamp verification, it further determines whether the accessing device is a mobile device, guiding whether to enable the biometric verification process. If the accessing device is confirmed to be a mobile device, the system will authenticate the received biometric information, adding a layer of security suitable for high-security requirements in mobile scenarios. For example, in a mobile medical software, when a doctor accesses a patient data interface via a mobile device, in addition to entering the interface password and carrying the timestamp, facial recognition authentication is also required to ensure that only authorized doctors can access the corresponding interface.

[0115] In some embodiments, the adjustment module includes a determination submodule, a first adjustment submodule, a second adjustment submodule, and a verification submodule. The determination submodule determines whether the access device poses a security risk based on its security status. The first adjustment submodule adjusts the access device's access permissions to read-only if the access device poses a security risk, obtaining the first test result. The second adjustment submodule adjusts the access device's access permissions to block access to the software interface if the frequency exceeds a frequency threshold, obtaining the first test result. The verification submodule re-verifies the access device's security if the target data is sensitive data, obtaining the first test result. This device assesses the risk of the access device from multiple angles and dynamically adjusts access permissions, especially taking more cautious security measures when processing sensitive data, thereby further comprehensively improving the security protection level of the software interface.

[0116] Specifically, the system first assesses the security status of accessing devices. If a security risk is detected, the system automatically downgrades the access permission to read-only, restricting write operations to the software interface and reducing potential damage, thus generating the corresponding first test result. Next, the system monitors the access frequency to determine if it exceeds a preset threshold. If it does, depending on the severity, the system directly blocks the device's access to the software interface, ensuring the interface is not damaged by high-frequency suspicious activity. This also constitutes part of the first test result. Through security status assessment and permission adjustment, risky accessing devices are isolated from critical system functions, reducing the probability of security incidents. Monitoring and controlling abnormal access frequencies effectively prevents potential brute-force attacks, web crawlers, and other attacks, enhancing system defense capabilities.

[0117] In some embodiments, the second testing unit includes a first construction module, a second construction module, a third construction module, and a third acquisition module. The first construction module constructs a first attack behavior based on the function of the software interface and the corresponding first security risk point, wherein the first attack behavior is used to attack the first security risk point. The second construction module constructs a second attack behavior based on the data format of the software interface and the corresponding second security risk point, wherein the second attack behavior is used to attack the second security risk point. The third construction module constructs an attack scenario library based on a first mapping relationship between the function of the software interface and the first attack behavior, and a second mapping relationship between the data format of the software interface and the second attack behavior. The third acquisition module selects a corresponding attack behavior from the attack scenario library based on the function of the current interface and the data format of the target data to attack the current interface, and acquires the response information of the current interface to obtain the second test result. The response information includes a response status code, returned data, and log information. This device can not only verify the stability of the software interface under normal operation but also evaluate its protection capability when facing real-world attacks, further ensuring system security and reliability.

[0118] Specifically, this method identifies primary security risks associated with the specific functions of the software interface. These risks may be vulnerabilities arising from function execution, such as insufficient parameter validation or improper access control. Then, based on these risks, a primary attack behavior is constructed to simulate the methods an attacker might use to verify the interface's protection capabilities. Secondary security risks are identified for the data formats processed by the interface, typically related to data parsing, encoding, or storage. Based on these risks, secondary attack behaviors are developed, such as constructing inputs with special data formats to test the interface's ability to handle abnormal data. These function- and data-format-related attack behaviors are compiled to establish a comprehensive attack scenario library. When a specific interface needs to be tested, the corresponding attack behavior is selected from the attack scenario library based on its function and data format.

[0119] In some embodiments, the acquisition unit further includes a fourth acquisition module and a processing module. The fourth acquisition module is used to acquire the IP address of the requesting access to the current interface, the request time of the interface access request, the request parameters of the interface access request, the response time of the interface access request, and the return result of the interface access request, thereby obtaining preliminary data. The processing module is used to perform data cleaning and standardization processing on the preliminary data to obtain the access behavior data. The above device can effectively collect, prepare, and utilize interface access behavior data for subsequent real-time security monitoring and dynamic risk assessment, thereby further strengthening the security protection of software interfaces.

[0120] Specifically, after obtaining the preliminary data, the collected data is cleaned to remove duplicate and invalid data, and the data is standardized to have a unified format and measurement standard. For example, time data in different formats is converted into a standard time format, and request parameters are encoded for subsequent analysis.

[0121] In some embodiments, the method further includes an output unit, configured to output an anomaly signal when the third test result indicates an anomaly in the access behavior data, and to acquire the type of the access behavior data, the access time corresponding to the access behavior data, and the access device corresponding to the access behavior data. This enhances the comprehensiveness of the security testing process for software interfaces and strengthens the real-time response and precise location capabilities for abnormal behavior, which is of great significance for building a software security protection system under a zero-trust architecture.

[0122] Specifically, if the third test result indicates anomalies in the access behavior data, the system will immediately trigger an anomaly signal as a timely response to potential security threats, ensuring that relevant personnel can quickly notice the situation. The system will then obtain specific information about the anomaly behavior. This allows for the immediate output of anomaly signals and the accurate acquisition of relevant information, enabling necessary measures to be taken. Through continuous monitoring and analysis of anomaly behavior, the machine learning model can be continuously improved, making it more accurate in identifying various attack patterns that may be encountered in the future, thereby enhancing overall security protection capabilities.

[0123] The aforementioned software interface security testing device includes a processor and a memory. The acquisition unit, first test unit, second test unit, input unit, and determination unit are all stored as program units in the memory. The processor executes these program units stored in the memory to achieve the corresponding functions. All of the above modules reside in the same processor; alternatively, the modules may be located in different processors in any combination.

[0124] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and the security of the software interface can be tested by adjusting kernel parameters.

[0125] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0126] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform a security testing method for the software interface.

[0127] This invention provides a processor for running a program, wherein the program executes a security testing method for the software interface.

[0128] This invention provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps:

[0129] Step S201: Obtain the interface access request, the context information of the interface access request, the functions of multiple software interfaces, the data format of the software interfaces, and the access behavior data of the current interface. The interface access request is used to request access to the current interface to obtain the target data. The current interface is any one of the software interfaces.

[0130] Step S202: Perform a security test on the current interface based at least on the interface access request and the context information to obtain a first test result, wherein the first test result is used to characterize whether access to the current interface is allowed.

[0131] Step S203: At least based on the functions of the software interface and the data format, perform a security test on the current interface to obtain a second test result, wherein the second test result is used to characterize whether the current interface has a security vulnerability;

[0132] Step S204: Input the above access behavior data into the target neural network model to obtain a third test result. The third test result indicates whether the access behavior data is abnormal. The target neural network model is trained by machine learning using multiple sets of historical data. Each set of historical data includes a first historical target parameter and a second historical target parameter. The first historical target parameter is a parameter calculated based on the historical access behavior data. The second historical target parameter is a parameter that indicates whether the historical access behavior data is abnormal.

[0133] Step S205: Determine the first test result, the second test result, and the third test result as the security test results of the current interface.

[0134] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0135] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps:

[0136] Step S201: Obtain the interface access request, the context information of the interface access request, the functions of multiple software interfaces, the data format of the software interfaces, and the access behavior data of the current interface. The interface access request is used to request access to the current interface to obtain the target data. The current interface is any one of the software interfaces.

[0137] Step S202: Perform a security test on the current interface based at least on the interface access request and the context information to obtain a first test result, wherein the first test result is used to characterize whether access to the current interface is allowed.

[0138] Step S203: At least based on the functions of the software interface and the data format, perform a security test on the current interface to obtain a second test result, wherein the second test result is used to characterize whether the current interface has a security vulnerability;

[0139] Step S204: Input the above access behavior data into the target neural network model to obtain a third test result. The third test result indicates whether the access behavior data is abnormal. The target neural network model is trained by machine learning using multiple sets of historical data. Each set of historical data includes a first historical target parameter and a second historical target parameter. The first historical target parameter is a parameter calculated based on the historical access behavior data. The second historical target parameter is a parameter that indicates whether the historical access behavior data is abnormal.

[0140] Step S205: Determine the first test result, the second test result, and the third test result as the security test results of the current interface.

[0141] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0142] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0143] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0144] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0145] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0146] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0147] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0148] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0149] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0151] As can be seen from the above description, the embodiments of this application achieve the following technical effects:

[0152] 1) The software interface security testing method of this application performs access authentication based on multiple factors, including the interface access request, the context information of the interface access request, the function of the software interface, and the data format of the software interface. Simultaneously, it utilizes machine learning algorithms to analyze interface access behavior data in real time to determine whether the behavior is abnormal, thereby promptly identifying and addressing potential security risks. This comprehensive approach addresses the shortcomings of existing software interface testing methods, such as their inability to comprehensively and accurately detect security defects in software interfaces during practical applications and the lack of real-time monitoring and dynamic evaluation, thus improving the security of software interface access.

[0153] 2) The software interface security testing device of this application performs access authentication based on multiple factors, including the interface access request, the context information of the interface access request, the function of the software interface, and the data format of the software interface. Simultaneously, it utilizes machine learning algorithms to analyze interface access behavior data in real time, determining whether the behavior is abnormal, thereby promptly identifying and addressing potential security risks. This comprehensive approach addresses the shortcomings of existing software interface testing methods, such as their inability to comprehensively and accurately detect security defects in software interfaces during practical applications and the lack of real-time monitoring and dynamic evaluation, thus improving the security of software interface access.

[0154] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A security testing method for a software interface, characterized in that, include: The interface access request is obtained, along with the context information of the interface access request, the functions of multiple software interfaces, the data format of the software interfaces, and the access behavior data of the current interface. The interface access request is used to request access to the current interface to obtain target data, and the current interface is any one of the software interfaces. At least based on the interface access request and the context information, a security test is performed on the current interface to obtain a first test result, wherein the first test result is used to characterize whether access to the current interface is allowed; At least based on the function of the software interface and the data format, the current interface is subjected to security testing to obtain a second test result, wherein the second test result is used to characterize whether the current interface has a security vulnerability; The access behavior data is input into the target neural network model to obtain a third test result. The third test result indicates whether the access behavior data is abnormal. The target neural network model is trained by machine learning using multiple sets of historical data. Each set of historical data includes a first historical target parameter and a second historical target parameter. The first historical target parameter is a parameter calculated based on the historical access behavior data, and the second historical target parameter is a parameter that indicates whether the historical access behavior data is abnormal. The first test result, the second test result, and the third test result are determined as the security test results of the current interface.

2. The method according to claim 1, characterized in that, Obtain the interface access request and the context information of the interface access request, including: Obtain the interface key, the current timestamp, and the biometric information of the current interface to obtain the interface access request; The security status of the accessing device, the frequency of the interface access request, and the type of the target data are obtained to obtain the context information. The type of the target data includes sensitive data and non-sensitive data. The accessing device is the device that requests access to the current interface.

3. The method according to claim 2, characterized in that, At least based on the interface access request and the context information, perform a security test on the current interface to obtain a first test result, including: Determine whether the interface key is the same as the target key, wherein the target key is a unique identifier for the interface access request; If the interface key is the same as the target key, determine the difference between the current timestamp and the system time of the software, and determine whether the difference is within a predetermined difference range; If the difference is within the predetermined difference range, determine whether the accessing device requesting access to the software interface is a mobile device; In the case where the access device is the mobile device, the biometric information is authenticated. If the verification is successful, the access permissions of the access device are adjusted according to the context information to obtain the first test result.

4. The method according to claim 3, characterized in that, Based on the context information, the access permissions of the access device are adjusted to obtain the first test result, including: Based on the security status of the access device, determine whether the access device poses a security risk; If the access device has the aforementioned security risk, adjust the access permission of the access device to read-only to obtain the first test result; When the frequency is greater than the frequency threshold, the access permissions of the access device are adjusted to block access to the software interface, and the first test result is obtained; If the type of the target data is the sensitive data, the access device is re-verified to obtain the first test result.

5. The method according to claim 1, characterized in that, The software interface is tested at least based on its functionality and data format to obtain a second test result, including: Based on the function of the software interface and the corresponding first security risk point, a first attack behavior is constructed, wherein the first attack behavior is used to attack the first security risk point; Based on the data format of the software interface and the corresponding second security risk point, a second attack behavior is constructed, wherein the second attack behavior is used to attack the second security risk point; Based on the first mapping relationship between the function of the software interface and the first attack behavior, and the second mapping relationship between the data format of the software interface and the second attack behavior, an attack scenario library is constructed. Based on the function of the current interface and the data format of the target data, a corresponding attack behavior is selected from the attack scenario library to attack the current interface, and the response information of the current interface is obtained to obtain the second test result. The response information includes the response status code, returned data, and log information.

6. The method according to claim 1, characterized in that, Retrieve the access behavior data of the current interface, including: Obtain the IP address of the request to access the current interface, the request time of the interface access request, the request parameters of the interface access request, the response time of the interface access request, and the return result of the interface access request to obtain preliminary data; The prepared data is cleaned and standardized to obtain the access behavior data.

7. The method according to claim 1, characterized in that, After inputting the access behavior data into the target neural network model to obtain the third test result, the method further includes: If the third test result indicates that the access behavior data is abnormal, an abnormal signal is output, and the type of the access behavior data, the access time corresponding to the access behavior data, and the access device corresponding to the access behavior data are obtained.

8. A security testing device for a software interface, characterized in that, include: The acquisition unit is used to acquire an interface access request, the context information of the interface access request, the function of the software interface, the data format of the software interface, and the access behavior data of the current interface. The interface access request is used to request access to the current interface to obtain target data, and the current interface is any one of the software interfaces. The first testing unit is configured to perform a security test on the current interface based at least on the interface access request and the context information, and obtain a first test result, wherein the first test result is used to characterize whether access to the current interface is allowed; The second testing unit is used to test the current interface at least according to the function of the software interface and the data format, and obtain a second test result, wherein the second test result is used to characterize whether the current interface has a security vulnerability; An input unit is used to input the access behavior data into a target neural network model to obtain a third test result. The third test result indicates whether the access behavior data is abnormal. The target neural network model is trained by machine learning using multiple sets of historical data. Each set of historical data includes a first historical target parameter and a second historical target parameter. The first historical target parameter is a parameter calculated based on the historical access behavior data, and the second historical target parameter is a parameter characterizing whether the historical access behavior data is abnormal. The determining unit is used to determine the first test result, the second test result, and the third test result as the security test results of the current interface.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the security testing method for the software interface according to any one of claims 1 to 7.

10. A processor, characterized in that, The processor is used to run a program, wherein the program executes the security testing method for the software interface according to any one of claims 1 to 7.

Images