Web application firewall vulnerability detection method, device and system based on load variation injection

Abstract

The invention belongs to the technical field of network security, and particularly relates to a Web application firewall vulnerability detection method based on load variation injection. Comprising the following steps: constructing a unified attack grammar rule base covering multiple attack types; analyzing the original attack load into an abstract syntax tree; carrying out semantic reservation load variation based on the syntax tree to generate a semantic equivalent variation load; performing protection rule detection on the Web application firewall, analyzing a detection result and performing pruning operation on the syntax tree; a Monte Carlo tree search algorithm is utilized, a rule detection mechanism is combined, and a variation path with a high success rate is dynamically evaluated and preferentially tested so as to efficiently generate an antagonistic load capable of bypassing WAF detection; according to the method, the problems of attack failure, low black box test efficiency and insufficient coverage of a single attack type caused by semantic destruction in the prior art are solved, and the WAF rule base vulnerability can be systematically evaluated.

Description

Technical Field

[0001] The invention belongs to the field of network security technology and relates to a vulnerability detection method for Web Application Firewall (WAF). Specifically, it involves a vulnerability detection method that constructs multiple types of attack payloads using context-free grammars, designs semantically preserved payload mutation strategies, and combines Monte Carlo Tree Search (MCTS) to optimize black-box testing efficiency. Background Technology

[0002] With the rapid development of internet technology, social networks, fintech, and e-commerce have also flourished. More and more people are inclined to use the internet to complete activities such as information exchange and purchasing goods. The booming development of web applications has greatly improved the convenience of people's lives; however, while bringing convenience to the public, it has also provided opportunities for cybercriminals. Many cybercriminals use phishing websites, spoofed emails, and various other methods to steal user information, attack user computers, and gain unauthorized access—all malicious acts.

[0003] Traditional network firewalls filter based on specific attributes of network packets (such as source address, destination address, port number, etc.) to determine whether to allow or deny access. Stateful inspection tracks the state of network connections, allowing only legitimate data associated with established connections to pass, thereby improving security. However, this type of firewall cannot effectively filter HTTP traffic, leading to the development of Web Application Firewalls (WAFs). Designed to address security issues at the Web application layer that previous security products could not handle, WAFs primarily protect web applications from external intrusions exploiting web application vulnerabilities. WAFs examine incoming HTTP messages and determine whether to block them or forward them to the target web application. Decisions are typically based on rules (e.g., regular expressions) designed to detect attack patterns. If an incoming message request matches an attack pattern indicated by a rule, the WAF will directly block the request from being forwarded; otherwise, it will allow the request to be forwarded to the target application.

[0004] With the widespread adoption and deep integration of Web application technologies, key sectors such as government affairs, finance, and e-commerce have fully migrated their operations online, forming a complex internet application ecosystem that handles over a hundred billion access requests daily. These applications generally feature diversified services, real-time interaction, and microservice architectures. Their data flows and business logic exhibit high complexity and openness, creating a severe security landscape characterized by "blurred boundaries and a generalized attack surface." Against this backdrop, Web application firewalls, as the core security barrier deployed at the application front line, directly impact the security of core business operations and data assets through the completeness of their rule base and the intelligence of their detection mechanisms. Currently, the mainstream Web application firewall vulnerability detection methods include the following:

[0005] 1. Signature-based rule detection: This method relies on predefined regular expression patterns or attack signature strings for precise matching and is currently the most mature and widely used technology in WAF products. Its advantages lie in its high accuracy in detecting known attack variants, low false positive rate, and low computational cost. However, the core drawback of this method is the lag in its rule base. Its maintenance and updates heavily depend on manual analysis by security experts, making it difficult to cope with new attack methods or unknown attack payloads with complex variations, and its defense capability against zero-day vulnerabilities is almost zero.

[0006] 2. Machine Learning-Based Detection: This method extracts features from massive amounts of normal and malicious traffic to train a classification model to identify potential attacks. This type of method has a certain generalization ability and can detect some unknown attacks. However, it heavily relies on the quality and completeness of the training data, lacks robustness against adversarial examples, and struggles to trace the root cause of model misjudgments, resulting in poor interpretability. Furthermore, machine learning-based WAFs experience significant performance degradation when faced with concept drift (i.e., changes in normal or malicious traffic patterns over time), requiring continuous resource investment for retraining.

[0007] 3. Fuzz-based automated tools: Specialized tools such as Sqlmap and XSSer automatically generate and send a large number of test payloads to probe for vulnerabilities in WAFs or applications. These tools are highly targeted and effective in specific domains. However, existing tools are mostly limited to a single attack type (e.g., only targeting SQL injection or XSS), lacking a unified framework for detecting multiple attack types. More importantly, their payload generation strategies are often based on predefined templates or random mutations, which can easily disrupt the semantic function of the original attack payload. This results in generated test cases that can bypass the WAF but fail to trigger vulnerabilities in real-world application environments, leading to missed vulnerability detections.

[0008] 4. Detection Optimization Based on Evolutionary Algorithms: Some studies have attempted to use evolutionary computational methods such as genetic algorithms and particle swarm optimization to optimize attack payloads in order to bypass WAFs. These methods model the payload bypass problem as a search optimization problem, finding a solution through iterative evolution. However, such algorithms are prone to getting trapped in local optima within the vast payload search space, and they are usually not combined with formalized grammar rules, resulting in a blind and inefficient search process, making it difficult to systematically guarantee the syntactic correctness and semantic equivalence of the generated payloads.

[0009] Given the inconsistent protection capabilities of existing Web Application Firewalls (WAFs), there is an urgent need for a vulnerability detection method that can ensure the semantic correctness of test payloads, cover multiple attack types, and achieve high testing efficiency in a black-box environment. This method needs to be able to systematically and automatically evaluate the completeness of the WAF rule base. Summary of the Invention

[0010] To address the shortcomings of existing technologies, this invention proposes a method, apparatus, and system for detecting vulnerabilities in web application firewalls based on payload mutation injection. The method includes: acquiring the web application firewall to be detected, sending the generated test payload to the firewall for processing, and obtaining vulnerability detection results.

[0011] The process of generating and optimizing test loads includes:

[0012] S1: Construct a unified attack syntax rule base, defining generation rules for various network attacks based on context-free grammars. This rule base serves as the grammatical foundation for all subsequent steps, guiding payload parsing, mutation, and pruning.

[0013] S2: Obtain the original attack payload and parse it into an abstract syntax tree according to the unified attack syntax rule base. This syntax tree is used as the object of subsequent mutation and pruning operations.

[0014] S3: Based on the syntax tree, perform semantically preserved node-level mutation operations on the abstract syntax tree to generate semantically equivalent mutation payloads. These mutation payloads constitute the initial search space for Monte Carlo tree search.

[0015] S4: Probe the protection rules of the Web application firewall and prune the abstract syntax tree based on the probe results;

[0016] S5: Based on the Monte Carlo tree search algorithm, optimize and explore the search space composed of the mutated payloads in the pruned search space to screen out target payloads that can bypass the detection of Web application firewalls.

[0017] S6: During the Monte Carlo tree search process, the pruning operation strategy is dynamically updated based on newly discovered bypass loads and WAF behavior changes, enabling the detection system to have continuous adaptive capabilities.

[0018] The beneficial effects of this invention are as follows:

[0019] This invention proposes a WAF vulnerability detection technology that creatively combines four techniques: Context-Free Grammar (CFG), Abstract Syntax Tree (AST) mutation, rule-based pruning, and Monte Carlo Tree Search (MCTS), constructing a new systematic, adaptive, and semantically preserving WAF vulnerability detection framework. Compared with existing technologies, the core innovation of this invention lies in solving key bottleneck problems through multi-level technical collaboration: First, through "CFG + AST parsing," the syntactic correctness and structural regularity of the payload are guaranteed from the root, overcoming the semantic destruction problem caused by random mutation in traditional fuzz testing; second, through "AST pruning + MCTS," prior rule knowledge is integrated into the search process, significantly optimizing the exploration efficiency of black-box testing and avoiding the defect of evolutionary algorithms easily getting trapped in local optima; furthermore, a dynamic pruning and update mechanism is introduced, enabling the system to adjust its strategy in real time based on test feedback, possessing continuous learning capabilities to cope with the dynamic updates of the WAF rule base.

[0020] Based on the above-mentioned technological integration, this invention achieves a triple improvement in vulnerability detection capabilities: in terms of accuracy, semantic equivalence of payloads is ensured through CFG and AST mutations; in terms of efficiency, search efficiency in black-box environments is significantly improved through the synergy of pruning and MCTS; and in terms of systemicity, a unified rule base and adaptive mechanism cover multiple attack types and adapt to complex protection environments. Therefore, this invention effectively overcomes the comprehensive shortcomings of existing technologies, such as outdated rule bases, semantic corruption, low search efficiency, and insufficient attack surface coverage, enabling faster and more comprehensive discovery of potential vulnerabilities in WAF protection systems. Attached Figure Description

[0021] Figure 1 This is a schematic diagram illustrating the workflow of the Web application firewall vulnerability detection method described in this invention; Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] The present invention proposes a method, device and system for detecting vulnerabilities in a Web application firewall based on load mutation injection, as Figure 1 shown, and the method includes the following:

[0024] Obtain the Web application firewall to be detected, send the generated test load to the firewall for processing, and obtain the vulnerability detection result.

[0025] The process of generating and optimizing the test load includes:

[0026] S1: Construct a unified attack syntax rule library, define generation rules for various network attacks based on context-free grammar. This rule library serves as the syntax basis for all subsequent steps and is used to guide load parsing, mutation and pruning.

[0027] One of the core bases of the present invention is to construct a unified and extensible attack syntax rule library. This rule library is defined using context-free grammar (CFG). Network attack loads (such as SQL injection, XSS) can be regarded as a "language" conforming to specific syntax rules. CFG is a powerful formal language generation tool that defines the composition method of all legal sentences through a series of production rules. Applying it to attack load generation, its advantage is that it can accurately describe the syntax structure of various attack loads in a structured and hierarchical manner. First, all loads generated by CFG follow predefined syntax rules, fundamentally avoiding the problem of attack failure caused by syntax errors and ensuring the "basic quality" of the generated loads. Second, the rules of CFG are hierarchical. High-level rules (such as <SQL injection>) are composed of low-level rules (such as <logical operator>, <conditional expression>). This structure makes the rule library clear, easy to maintain and extend. And CFG itself is a domain-independent mathematical tool. By collecting typical attack loads from public vulnerability libraries, analyzing their structures and extracting features such as keywords, operators, encoding patterns, etc., and defining grammar rules based on Backus-Naur Form (BNF), ensuring that the rules cover the syntax structure of attack loads, different rule sets (such as SQL-CFG, XSS-CFG, OS-Command-CFG) can be defined, thus covering multiple attack types under the same generation framework and achieving the unity and generality of technology.

[0028] BNF rule definition example (taking SQL injection as an example):

[0029] <SQL injection> ::= <logical injection> | <union query> | <blind injection> | <error injection>

[0030] <logical injection> ::= <quote> <logical operator> <conditional expression> <terminator> <comment>

[0031] <Logical operator>::="OR" | "AND" | "||" | "XOR"

[0032] <Conditional expression>::="1 = 1" | "1 = 0" | <field name> "=" <value> | <function call>

[0033] <Function call>::="database()" | "user()" | "version()"

[0034] <Comment>::="--" | " / *" <any character> "* / "

[0035] <Quotation mark>::="'" | '"'

[0036] <Terminator>::=";"

[0037] Starting from the start symbol <SQL injection>, select the <logical injection> path, and for each non-terminal symbol, select a terminal symbol in sequence: <quotation mark> -> ', <logical operator> -> OR, <conditional expression> -> 1 = 1, <terminator> -> ;, <comment> -> --. Finally, the classic payload 'OR 1 = 1; -- can be generated. By making different decisions at different selection points, a large number of syntactically correct but variously formed variant payloads can be systematically generated.

[0038] For XSS attacks, another set of CFG rules can be defined similarly, for example:

[0039] <XSS payload>::=<script tag> | <event handler>[

[0040] <Script tag>::=" <script>"<JS代码>"< / script> "

[0041] <Event handler>::="<img src=x onerror=<JS code>>"

[0042] <JS code>::="alert(1)" | "prompt(1)" |...

[0043] By expanding the BNF rule library, attacks such as XSS (such as <script>alert(1)< / script> ) and command execution (such as ; rm -rf / ) are made compatible, forming a unified attack grammar rule library.[

[0044] S2: Obtain the original attack payload, and parse it into an abstract syntax tree according to the unified attack grammar rule library. This syntax tree serves as the object for subsequent mutation and pruning operations.

[0045] The original attack payload (e.g., 'OR 1=1;--') is parsed into an Abstract Syntax Tree (AST) according to BNF rules. The payload is broken down into lexical units (tokens), such as strings, operators, and comment symbols, and the AST is constructed according to BNF rules, marking key nodes.

[0046] The input raw attack payload string undergoes lexical analysis, specifically including:

[0047] The original attack payload 'OR 1=1;-- is input into the lexical analyzer, which performs character scanning and word segmentation according to predefined lexical rules, and outputs a sequence of lexical units, including: single quote lexical unit, whose value is '; logical operator lexical unit, whose value is OR; conditional expression lexical unit, whose value is 1=1; statement terminator lexical unit, whose value is ;; and comment lexical unit, whose value is --.

[0048] SQL injection payload 'OR 1=1; --' AST structure:

[0049]

[0050] The lexical unit sequence obtained after lexical analysis is input into the parser. Parsing is performed based on predefined Backus paradigm rules. According to the logical injection production rules `<logical injection>::=<quotation mark><logical operator><conditional expression><terminator><comment>`, the lexical unit sequence is mapped into an abstract syntax tree structure conforming to the syntax rules. A tree structure of the abstract syntax tree is constructed based on the parsing results, with logical injection as the root node. The root node contains five direct child nodes: the first child node is a quotation mark with a value of '; the second child node is a logical operator with a value of OR; the third child node is a conditional expression with a value of 1=1; the fourth child node is a terminator with a value of ;; and the fifth child node is a comment with a value of --. Each node in the abstract syntax tree is labeled with attribute information, including: node type attribute, which defines the syntactic role of the node in the syntax rules; primitive value attribute, which records the original string content corresponding to the node; mutation flag attribute, which indicates whether the node can be mutated; and semantic constraint attribute, which defines the semantic constraints that must be maintained during the mutation process.

[0051] S3: Based on the syntax tree, perform semantically preserving node-level mutation operations on the abstract syntax tree to generate semantically equivalent mutation payloads. These mutation payloads constitute the initial search space for Monte Carlo tree search.

[0052] Perform node-level mutation operations on the AST, including:

[0053] Equivalent substitutions: Logical operator substitution: OR → ||, AND → &&; Function call substitution: DATABASE() → @@VERSION; Encoding conversion: Hierarchical encoding strategy: Level 1 encoding: URL encoding (' → %27); Level 2 encoding: Double URL encoding (%27 → %2527); Level 3 encoding: HTML entity encoding (< → <;); Comment insertion: Insert harmless comments at key positions (e.g., / *!12345SELECT* / ); Whitespace interference: Insert random spaces, tabs, or newlines (e.g., 'OR 1=1').

[0054] The abstract syntax tree is traversed using a depth-first search algorithm to verify that the node type and values ​​of each node conform to predefined context-free grammar rules, ensuring the syntactic correctness of the tree structure. After mutation, semantic verification ensures functional equivalence: SQL injection payloads are injected into a test database to verify bypass effectiveness, and XSS payloads are tested for browser behavior using Selenium automation.

[0055] S4: Probe the protection rules of the Web application firewall and prune the abstract syntax tree based on the probe results.

[0056] Send a preset set of probe payloads to the target WAF. The baseline probe payloads include, but are not limited to: SQL injection probe payloads: 'OR 1=1', 'UNION SELECT 1,2,3--'; 'DROP TABLE users--'; XSS probe payloads: <script>alert(1)< / script> , <img src＝x onerror＝alert(1)> javascript:alert(1); Command injection probe payloads: ls -la, |cat / etc / passwd, &&whoami. Send the probe payload set to the target Web application firewall to analyze the Web application firewall's interception mode. Encapsulate each probe payload into an independent HTTP request through the HTTP request sending module. The HTTP request includes: request method: GET, POST, PUT; parameter position: URL parameter, request body parameter, HTTP header; encoding method: raw encoding, URL encoding, Base64 encoding. Record the WAF response result corresponding to each probe payload, including: interception status: intercepted or allowed; response code: 403, 200, 500; interception rule ID: the specific rule identifier returned by the WAF.

[0057] Analyze the WAF's interception patterns and establish a rule mapping table. Specifically, this includes: statistically analyzing the interception results for each probe payload, establishing a mapping relationship between "syntax pattern - interception rule", and identifying rules containing specific keywords (such as OR 1=1, etc.).<script>)的载荷被拦截的情况；识别特定语法结构(如联合查询、事件处理器)被拦截的情况；识别特定编码方式(如双重URL编码、HTML实体编码)被拦截的情况，生成拦截规则特征库，记录每个拦截规则对应的语法特征和触发条件。

[0058] 根据拦截结果对抽象语法树进行剪枝操作：基于拦截模式分析结果对抽象语法树进行剪枝操作，遍历抽象语法树的所有节点，对每个节点执行以下判断：若节点对应的语法模式在规则映射表中被标记为高概率拦截，则将该节点标记为高风险节点；若节点所在的语法路径对应的攻击模式被确认为严格拦截，则将该路径标记为高风险路径并执行剪枝操作：移除被标记为高风险节点的所有变异子节点；禁用被标记为高风险路径的变异规则；保留未被标记风险的节点和路径作为后续变异的基础。若特定规则对应载荷被拦截，则移除AST中对应的高风险节点或变异路径，缩小后续搜索空间。

[0059] S5：在剪枝后的搜索空间中基于蒙特卡洛树搜索算法，对由所述变异载荷构成的搜索空间进行优化探索，筛选出能够绕过Web应用防火墙检测的目标载荷。

[0060] 将载荷变异过程建模为搜索树，节点代表载荷状态，记录访问次数(N)和成功次数(W)。通过四阶段迭代优化搜索：

[0061] 选择：从根节点开始，蒙特卡洛树搜索过程中的节点选择策略采用UCB1(上限置信区间)公式，该策略用于在探索未知节点和利用已知高价值节点之间实现最优平衡递归选择UCB1值最高的子节点，直至未完全展开节点。UCB1公式为：

[0062]

[0063] 其中UCB1代表当前子节点i的综合得分，智能体选择得分最高的节点进行下一步探索。Wi表示从当前节点i出发的模拟过程中，成功绕过Web应用防火墙(WAF)的累计次数。Ni表示节点i被访问(选择)的总次数。

[0064] Nparent表示父节点被访问的总次数。c表示探索系数，是一个大于0的可调参数，用于控制探索项在总得分中的权重。在本发明中，该系数优选设置为(约等于1.414)。该取值的理论依据源于多臂老虎机问题，使用一个稳健的默认值，确保算法在初期对各种变异路径(如不同的编码方式、运算符替换)都有充分的探索机会，而不是过早地锁定在少数几种早期成功的变异上。旨在保证算法在有限次试验中对累积遗憾实现对数上限的最优性能。

[0065] 该UCB1公式由两部分组成，利用项和探索项利用项计算节点的历史平均成功率。值越高，表明从该节点变异后成功绕过WAF的概率越大，鼓励智能体"利用”这条已知的有效路径。探索项评估节点的探索潜力。当节点访问次数Ni较少时，此项值会增大，从而鼓励智能体"探索”那些尚未被充分测试的变异可能性，避免陷入局部最优。

[0066] 扩展：在未展开节点随机应用变异操作(如编码转换)，生成新子节点。

[0067] 模拟：从新节点随机变异生成最终测试载荷，发送至WAF测试并记录结果(200 / 403)。

[0068] 回溯：根据测试结果沿路径更新节点统计量，成功时W＝W+1、N＝N+1，失败时N＝N+1。

[0069] 通过规则探测结果动态调整探索系数c：WAF拦截严格时提高c增强探索，拦截宽松时降低c加速收敛。

[0070] S6：在所述蒙特卡洛树搜索过程中，基于新发现的绕过载荷与WAF行为变化，动态更新所述剪枝操作策略，使检测系统具备持续自适应能力。

[0071] 实时监测MCTS模拟阶段中成功绕过WAF的载荷，将每个成功绕过载荷重新输入所述抽象语法树解析模块，生成其对应的语法树结构。通过遍历比较，精确识别出在该成功载荷的语法树中，哪些关键节点(如特定的运算符、函数调用)或变异路径(如特定的编码序列)在之前的剪枝操作中未被移除，即它们是导致绕过成功的关键因素。基于识别出的关键节点和路径，如果某些节点或路径被先前策略过度剪枝(即被错误地归类为高风险)，则将其风险等级下调，并将其重新纳入有效的变异候选集中。

[0072] 在测试过程中，一旦发现新的WAF拦截规则(例如，某个之前可绕过的变异突然被拦截)，立即更新规则映射表，并对抽象语法树进行即时剪枝，快速剔除失效路径。当系统检测到WAF的拦截模式发生显著变化(如大面积先前有效的载荷开始被拦截)，判定WAF规则库可能已更新，则自动触发一次全面的规则探测(即重新执行步骤S4)，以全局刷新剪枝策略。根据WAF行为的实时反馈(如拦截率的波动)，动态调节剪枝操作。例如，当WAF拦截趋严时，适当提高剪枝阈值，进行更积极的剪枝以聚焦搜索；当拦截放松时，则降低阈值，保留更多变异可能性以供探索。

[0073] 通过引入该动态剪枝更新步骤(S6)，本发明使得漏洞检测系统不再是一次性的静态分析，而成为一个能够在测试过程中自主学习、实时调整的自适应系统，极大地提升了对现代化、动态更新WAF的长期检测效能。

[0074] 本发明在实际应用中展现出多领域的显著价值：在金融行业可系统性评估WAF防护能力，发现潜在绕过风险；在政务平台检测中可识别规则库漏洞，提升安全防护水平；在云服务安全测试中可实现自动化漏洞探测，降低人工测试成本。

[0075] 以上所举实施例，对本发明的目的、技术方案和优点进行了进一步的详细说明，所应理解的是，以上所举实施例仅为本发明的优选实施方式而已，并不用以限制本发明，凡在本发明的精神和原则之内对本发明所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。< / script>

Claims

1. A method, apparatus, and system for detecting vulnerabilities in a web application firewall based on payload mutation injection, characterized in that, include: The system acquires the web application firewall to be tested, sends the generated test payload to the firewall for processing, and obtains the vulnerability detection results. The process of generating and optimizing test loads includes: S1: Construct a unified attack syntax rule base, defining generation rules for various network attacks based on context-free grammars. This rule base serves as the grammatical foundation for all subsequent steps, guiding payload parsing, mutation, and pruning. S2: Obtain the original attack payload and parse it into an abstract syntax tree according to the unified attack syntax rule base. This syntax tree is used as the object of subsequent mutation and pruning operations. S3: Based on the syntax tree, perform semantically preserved node-level mutation operations on the abstract syntax tree to generate semantically equivalent mutation payloads. These mutation payloads constitute the initial search space for Monte Carlo tree search. S4: Probe the protection rules of the Web application firewall and prune the abstract syntax tree based on the probe results; S5: Based on the Monte Carlo tree search algorithm, optimize and explore the search space composed of the mutated payloads in the pruned search space to screen out target payloads that can bypass the detection of the Web application firewall. S6: During the Monte Carlo tree search process, the pruning operation strategy is dynamically updated based on newly discovered bypass loads and WAF behavior changes, enabling the detection system to have continuous adaptive capabilities.

2. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 1, characterized in that, In step S1, the unified attack syntax rule base is built based on the Backus paradigm and covers network attack types including SQL injection, cross-site scripting (XSS) attacks, and command execution attacks.

3. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 2, characterized in that, In step S1, the SQL injection generation rules include at least one of logical injection, union query, blind injection, and error injection.

4. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 1, characterized in that, In step S3, the semantically preserved node-level mutation operation includes at least one of the following: equivalent substitution of operator nodes in the syntax tree; multi-level encoding conversion of string nodes in the syntax tree; and insertion of comments or whitespace before and after key nodes in the syntax tree.

5. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 1, characterized in that, Step S3 is followed by a semantic verification step: the mutated payload is injected into the test environment to verify whether it retains the semantic function of the original attack payload.

6. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 1, characterized in that, In step S4, the protection rule detection includes sending a preset set of probe payloads to the Web application firewall; the pruning operation includes removing high-risk nodes or variant paths in the abstract syntax tree that correspond to known interception rules based on the interception results of the probe payload set.

7. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 1, characterized in that, In step S5, the node attributes of the Monte Carlo tree search algorithm include: status, number of visits, and number of successes; wherein, the status is the current payload content and its mutation path.

8. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 7, characterized in that, Step S5 specifically includes: a selection phase, starting from the root node, recursively selecting the child node with the highest UCB1 value until a node that is not fully expanded is reached; an expansion phase, generating a new child node on the not fully expanded node through a mutation operation; a simulation phase, starting from the new child node, performing random mutation to generate the final test payload, and sending it to the Web Application Firewall for testing; and a backtracking phase, updating the access count and success count of relevant nodes along the search path based on the test results.

9. The method, apparatus, and system for detecting web application firewall vulnerabilities based on payload mutation injection as described in claim 8, characterized in that, In the selection phase of step S5, the exploration parameters of the Monte Carlo tree search are dynamically adjusted based on the detection and pruning results of step S4.

10. The method according to claim 1, characterized in that, Step S6 specifically includes: real-time monitoring of the payload that successfully bypasses the Web Application Firewall, parsing it into an abstract syntax tree, and identifying key nodes and variant paths that have not been pruned; based on the identified key nodes and variant paths, adjusting the pruning strategy in reverse to restore some over-pruned nodes; and dynamically adjusting the pruning intensity according to the real-time detection results, including: updating the rule mapping table when new blocking rules are discovered, re-performing the detection when WAF rule updates are detected, and dynamically adjusting the pruning threshold parameters according to changes in WAF behavior.

Images