AI-combined front-end js code intelligent analysis method and system based on penetration test

Abstract

The invention discloses an AI-combined front-end js code intelligent analysis method and system based on penetration testing, belongs to the technical field of artificial intelligence and penetration testing, and aims to solve the technical problem of how to realize AI-driven front-end penetration testing, improve the penetration testing efficiency, coverage and depth and improve the reliability of the penetration testing. According to the technical scheme, the method comprises the steps of intelligent attack surface surveying and mapping, wherein the structure and the function of a target application are fully perceived through an intelligent crawler, static code analysis and AST; wherein the intelligent crawler is a data acquisition tool combined with an artificial intelligence technology; according to static code analysis, the structure of the intelligent crawler is further analyzed, front-end JavaScript codes are analyzed into AST, the AST is structured representation of the codes, the AI understands the logic structure of the codes through the AST, and data flow tracking is carried out more accurately. Performing reverse analysis on the intelligent front-end code; and performing automatic vulnerability identification and attack simulation.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and penetration testing technology, specifically to a method and system for intelligent analysis of front-end JavaScript code based on penetration testing and combined with AI. Background Technology

[0002] With the surge in web application attacks, penetration testing has become a necessity for enterprise security construction. Front-end security testing of web application systems is a crucial part of penetration testing, but it also faces many challenges:

[0003] ① The explosive growth of front-end complexity: The amount of JavaScript code in the front-end is huge and the structure is complex. A large number of third-party libraries, npm packages and build tools make the real attack surface of the application blurred, making manual review extremely difficult. Traditional tools are difficult to meet the needs due to high cost, scattered functions and high false positive rate.

[0004] ② Vulnerabilities evolve rapidly and are difficult to detect: Business logic vulnerabilities are increasingly hidden in client-side JavaScript, such as insecure permission verification and bypassable payment processes. These vulnerability patterns are non-standard and difficult for traditional scanners to detect.

[0005] ③ Bottlenecks in efficiency and coverage: Penetration testing projects usually have time constraints, making it difficult for testers to read tens of thousands of lines of code line by line. Furthermore, repetitive code review work can easily lead to fatigue and omissions.

[0006] Therefore, how to implement AI-driven front-end penetration testing and improve the efficiency, coverage, and depth of penetration testing is a pressing technical problem that needs to be solved. Summary of the Invention

[0007] The technical objective of this invention is to provide a method and system for intelligent analysis of front-end JavaScript code based on penetration testing and combined with AI, in order to solve the problem of how to implement AI-driven front-end penetration testing and improve the efficiency, coverage, and depth of penetration testing.

[0008] The technical objective of this invention is achieved as follows: a front-end JavaScript code intelligent analysis method based on penetration testing and combined with AI, the specific method of which is as follows:

[0009] Intelligent Attack Surface Mapping: Fully "perceives" the structure and function of the target application through intelligent web crawling, static code parsing, and AST (Abstract Syntax Tree). Among them, intelligent web crawling is a data collection tool that combines artificial intelligence technology; static code parsing is to further analyze the structure of intelligent web crawling, and parse the front-end JavaScript code into AST. AST is a structured representation of code. AI uses AST to understand the logical structure of the code and more accurately track data flow.

[0010] Intelligent front-end code reverse engineering: Based on AST, it uses AI technology to help understand, analyze and reverse engineer obfuscated, compressed and complicated front-end code (mainly JavaScript), penetrate the code's protection layer, and quickly understand the core logic and sensitive data flow of the code;

[0011] Automated vulnerability identification and attack simulation: Automated analysis of information collected through intelligent web crawlers to identify potential vulnerabilities and generate targeted test loads.

[0012] As a preferred option, the intelligent web crawler is as follows:

[0013] Using headless browsers (such as Playwright): Explore websites using reinforcement learning or AI agents driven by headless browsers, fully render pages, and execute JS; for large-scale crawling, headless browsers consume a lot of resources, so server-side pre-rendering can be considered.

[0014] Reinforcement learning-driven: Each webpage is treated as a "state", and the click, input, and scroll operations are treated as "actions"; the goal of the AI ​​agent is to maximize the number of "states" it explores, i.e., page coverage; through a reward mechanism, the AI ​​learns to interact with complex UIs, such as drop-down menus and modals.

[0015] Computer vision assistance: For page screenshots, use OCR technology to recognize text in the images, and use CV object detection models to recognize UI elements such as buttons and input boxes to trigger interactions; identify hidden input boxes or dynamically loaded scripts in the front-end page to help find XSS injection points;

[0016] NLP analysis: Utilize the BERT model to analyze the DOM structure and API interface description, extract sensitive parameters (such as / user / {id}), and predict attack vectors (such as access control vulnerabilities).

[0017] As a preferred method, the AST is generated as follows: the source code text is lexically analyzed to output a token stream, and the token stream is lexically analyzed to output an AST.

[0018] Lexical analysis specifically involves: decomposing the source code string into meaningful tokens, scanning the character stream to identify keywords (const), identifiers (result), operators (=, +, *), literals (2), and delimiters (;), and outputting a token stream;

[0019] Syntax analysis specifically involves: organizing the token stream into a tree structure according to the syntax rules of the programming language; checking whether the order of the tokens conforms to the syntax (e.g., whether there is an expression after the assignment operator); if not, a syntax error is thrown.

[0020] As a preferred approach, the reverse engineering of the intelligent front-end code is as follows:

[0021] Dynamic Behavior Capture and Code Reconstruction: Overcoming code obfuscation and encryption protection through real-time monitoring and logic refactoring, specifically: Real-time Hook Technology: Intercepting key functions (such as `eval` and `crypto`) using dynamic injection technology, recording the encryption parameter generation process, and using XHR breakpoints to locate encryption logic, combined with stack traceback to track the call chain; AST Reconstruction: Parsing obfuscated code (such as Webpack bundled artifacts) to restore variable names and logical structures, extracting key variables and logic; Pattern Matching: Identifying encryption features in code snippets (such as AES key generation loops and RSA public key loading) using CNN models; Contextual Reasoning: Analyzing function call chains using large language models to infer encryption parameter dependencies (such as timestamp + device fingerprint combined signatures);

[0022] Sensitive information identification: AI technology improves the accuracy and depth of identification by introducing context awareness and semantic understanding;

[0023] Third-party dependency analysis: Identifies third-party library versions used in the project that contain known vulnerabilities. Specifically: Code fingerprinting: Extracts specific function names, string constants, or code structures from the library as "fingerprints"; Model matching: Uses a machine learning model to match the fingerprints of known libraries against a database of known libraries.

[0024] More specifically, the identification of sensitive information is as follows:

[0025] Enhanced pattern and format matching: Based on regular expressions, the AI ​​trains a model on millions of known keys, enabling the model to recognize key formats of various variants and different services (AWS, GitHub, SendGrid, etc.). Even if the key is partially masked (e.g., "sk_live_***"), the AI ​​infers the key risk based on the context.

[0026] Contextual semantic analysis: Determine whether a string is truly sensitive by analyzing the context of the code. Specifically, it uses NLP to analyze variable names and comments, and analyzes the usage of any key in the data stream. If a key is found to be passed to a secure, server-side API route, it is output as secure; if a key is found to be used directly to call a third-party service from the front end, the corresponding key is output as problematic.

[0027] Entropy and Structure Analysis: AI is used to calculate the entropy of strings to identify high-strength keys that appear to be randomly generated. Then, an NLP model is used to detect high-entropy strings (long and irregular strings) and to combine the key context (such as being assigned to variables named apiKey or secret, or being passed to encryption functions such as CryptoJS.AES.encrypt).

[0028] API endpoint extraction: Train a sequence model to identify the code patterns that initiate network requests (such as calls to .fetch, axios, and $.ajax) and extract the URL parameters of the code that initiates the network request, even if the corresponding URL is dynamically concatenated.

[0029] As a preferred option, automated vulnerability identification and attack simulation are as follows:

[0030] Static taint analysis based on AST: Automated analysis of static taints at the AST level, specifically: Identifying sources: Marking all user-controllable input points in the AST, such as window.location.hash, document.cookie, and FormData; Identifying receivers: Marking all dangerous functions or properties, such as innerHTML, eval(), document.write(), and axios.post() (which may contain SQL queries); Constructing a data flow graph: Analyzing the data flow path from "source" to "receiver," using NLP models to analyze the function names and code of custom cleansing functions to determine if their cleansing is sufficient: If a path exists without effective cleansing, it is marked as a potential vulnerability; for example, a function named removeScriptTags may not defend against event-based XSS (such as onerror); Reducing false positives: Using machine learning models to perform secondary classification of potential vulnerability paths, assessing the true risk of vulnerabilities based on code context features (such as variable names and function call chains), thereby filtering out a large number of false positives;

[0031] Intelligent Fuzzy Testing Payload Generation: AI dynamically optimizes test cases through reinforcement learning, generating high-quality, high-value test cases based on the target context. Specifically: Context Awareness: Before generating the payload, the AI ​​analyzes the context of the input point; it analyzes HTML tags and attribute names through NLP / pattern recognition, and parses JavaScript validation logic. For example, if the HTML tag is... <input ty pe＝"email"> AI will generate payloads that begin with "or" but have a structure similar to an email address (e.g., "..."). <script>alert(1)< / script>@evil.com) aims to bypass backend validation logic; or understand the valid JSON data format of the backend through Swagger / OpenAPI documentation or analysis of network requests; model-based payload generation: divided into two categories: syntax- and / or template-based generation and language model-based generation; among them, syntax- and / or template-based generation is the AI ​​learning the syntax rules of the target input (such as SQ). LLM (L-statements, JSON format) generates variants under the constraints of grammatical rules; language model-based generation utilizes large language models (such as the GPT series, Codex) trained on large-scale code and text, feeding the current input context (such as surrounding code, HTTP requests) as prompts to the LLM, enabling it to generate variants that may cause anomalies; feedback-driven evolutionary fuzzing: using genetic algorithms, fuzzing is upgraded from a "generate-test" loop to a "generate-test-learn-optimize" loop; if any payload triggers an error (such as a 5xx status code), the AI ​​will use the corresponding payload as a "seed" to generate variants using genetic algorithms or neural networks for deeper testing; the AI ​​model can learn which mutation strategies are more likely to produce "excellent" payloads, thereby guiding the mutation process and accelerating evolution;

[0032] Attack simulation and exploit verification: Securely execute attacks and confirm the actual existence of vulnerabilities, reducing the false positive rate.

[0033] More specifically, the attack simulation and exploit verification are as follows:

[0034] Templated Exploit Generation: The AI ​​has a library of known vulnerability exploit templates. When a potential vulnerability is identified, it selects a suitable template from the library and replaces the target URL and parameter context information. Taking SQL injection as an example, after the AI ​​detects that the parameter id in the URL is suspected of being SQL injection, it selects a Union-Based SQL injection template, automatically infers the number of columns, and attempts to extract information from the database (e.g., id = 1'UNION SELECT 1, version(), 3--+).

[0035] Reinforcement learning attacks: The exploit process is modeled as a reinforcement learning problem. By making minor adjustments to the payload (such as changing the quotation mark type, adding / bypassing spaces, or trying different comment characters), a high reward is given for successfully obtaining data (such as database version or file content); a negative reward is given if the request is blocked or returns an error; the AI ​​automatically finds the correct payload format and techniques to successfully exploit vulnerabilities or bypass simple WAF rules through trial and error.

[0036] Difference analysis verification: When the AI ​​submits an attack payload, it compares the differences between the normal response and the attack response; it also compares the HTTP status code and HTML content, and uses an NLP model to compare the semantics of the response text; for example, the normal response is "Login successful", while the response after the attack is "Database error". Even if the status code is 200, the AI ​​can identify the anomaly, thereby verifying whether the vulnerability exists.

[0037] A front-end JavaScript code intelligent analysis system based on penetration testing and combined with AI, the system being used to implement the aforementioned front-end JavaScript code intelligent analysis method based on penetration testing and combined with AI; the system includes:

[0038] The intelligent attack surface mapping module is used to fully "perceive" the structure and function of the target application through intelligent crawling, static code parsing, and AST. Among them, intelligent crawling is a data collection tool that combines artificial intelligence technology; static code parsing is to further analyze the structure of intelligent crawling, and parse the front-end JavaScript code into AST (Abstract Syntax Tree). AST is a structured representation of code. AI uses AST to understand the logical structure of the code and more accurately track data flow.

[0039] The intelligent front-end code reverse analysis module is used to understand, analyze, and reverse engineer obfuscated, compressed, and complicated front-end code (mainly JavaScript) based on AST and using AI technology. It penetrates the code's protection layer and quickly understands the core logic and sensitive data flow of the code.

[0040] The automated vulnerability identification and attack simulation module is used to automatically analyze information collected by intelligent web crawlers, identify potential vulnerabilities, and generate targeted test payloads.

[0041] An electronic device includes: a memory and at least one processor;

[0042] The memory contains computer programs;

[0043] The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the aforementioned AI-based intelligent analysis method for front-end JavaScript code based on penetration testing.

[0044] A computer-readable storage medium storing a computer program that can be executed by a processor to implement the aforementioned AI-based intelligent analysis method for front-end JavaScript code based on penetration testing.

[0045] The intelligent analysis method and system for front-end JavaScript code based on penetration testing and combined with AI of the present invention has the following advantages:

[0046] (I) This invention utilizes AI to analyze front-end code to achieve the following effects: ① Intelligent attack surface mapping: Automated analysis of front-end assets (such as subdomains and API endpoints); ② Automated vulnerability identification: Automated analysis of security flaws in front-end code (such as XSS and CSRF); ③ Intelligent front-end code reverse analysis: Automated parsing of JavaScript code, identification of encryption algorithms, key generation logic, and potential vulnerabilities, thereby realizing an AI-driven front-end penetration testing process: information collection -> intelligent analysis -> vulnerability identification and attack simulation -> result verification -> feedback learning;

[0047] (II) This invention integrates multiple technical fields such as computer science (NLP, program analysis), artificial intelligence (machine learning, representation learning) and network security (vulnerability research, attack techniques). AI-enabled automated analysis of front-end code has emerged, and the role of testers has changed from purely manual operators to "AI-assisted investigators" and "final decision verifiers". By using AI to expand their own capability boundaries, they can make up for the shortcomings of traditional tool testing, discover blind spots that are easily overlooked by manual testing, and play an important auxiliary role in penetration testing to meet the security challenges of modern complex web applications.

[0048] (III) This invention aims to empower automated analysis of front-end code in penetration testing with AI, driven by efficiency needs. Addressing issues such as front-end complexity, rapidly evolving and difficult-to-discover vulnerabilities, and bottlenecks in efficiency and coverage, it provides an innovative and effective solution. Penetration testers utilize AI to perform automated analysis of front-end code and further evaluate the results. This collaborative approach reduces time and manpower costs in front-end testing, lowers false positive rates, and enables in-depth discovery of vulnerabilities in front-end code.

[0049] (iv) This invention combines AI analysis of front-end code in penetration testing, resulting not only in increased speed but also in a qualitative leap in capability, efficiency, and depth, as detailed below:

[0050] ① In terms of efficiency, AI automatically completes tedious tasks such as code crawling, parsing, and pattern matching, freeing security testers from repetitive labor. It can also test multiple applications and modules simultaneously, greatly shortening the overall security assessment cycle and significantly improving penetration testing efficiency.

[0051] ② In terms of expanding the depth and breadth of testing, by simulating multi-step user interactions through reinforcement learning, AI can autonomously discover complex business logic vulnerabilities (such as privilege escalation and race conditions), which are blind spots of traditional scanners. Furthermore, intelligent reverse engineering technology can, to a certain extent, deobfuscate and understand the core logic of obfuscated code, discovering hidden security vulnerabilities.

[0052] ③ In terms of accuracy and quality, through contextual semantic analysis, AI can distinguish between real vulnerabilities and harmless code patterns, significantly reducing false positives. Furthermore, AI not only reports "suspected vulnerabilities" but can also automatically perform exploit verification through attack simulation, providing reproducible proofs of concept (PoC), saving security engineers a significant amount of manual verification time.

[0053] (v) This invention applies AI to front-end penetration testing, which makes up for the shortcomings of traditional testing tools, frees up manpower, increases speed and scale, and improves the quality and depth of testing. It can discover more complex and hidden vulnerabilities and can also learn to deal with unknown threats. If security capabilities are seamlessly embedded into the development process and a DevSecOps culture is created, the organization's security resilience and immunity can be fundamentally improved. Attached Figure Description

[0054] The invention will be further described below with reference to the accompanying drawings.

[0055] Appendix Figure 1 This is a schematic diagram of the structure of a front-end JavaScript code intelligent analysis system based on penetration testing and combined with AI.

[0056] Appendix Figure 2 This is a flowchart of the AST generation process. Detailed Implementation

[0057] The following detailed description of the intelligent analysis method and system for front-end JavaScript code based on penetration testing and combined with AI, with reference to the accompanying drawings and specific embodiments, is provided in this specification.

[0058] Example 1:

[0059] This embodiment provides a front-end JavaScript code intelligent analysis method based on penetration testing and combined with AI. The method is as follows:

[0060] S1. Intelligent Attack Surface Mapping: Fully "perceive" the structure and function of the target application through intelligent crawling, static code parsing, and AST. Among them, intelligent crawling is a data collection tool that combines artificial intelligence technology; static code parsing is to further analyze the structure of intelligent crawling, and parse the front-end JavaScript code into AST (Abstract Syntax Tree). AST is a structured representation of code. AI uses AST to understand the logical structure of the code and more accurately track data flow.

[0061] S2, Intelligent Front-end Code Reverse Engineering: Based on AST, it uses AI technology to assist in understanding, analyzing and reverse engineering obfuscated, compressed and complicated front-end code (mainly JavaScript), penetrating the code's protection layer to quickly understand the core logic and sensitive data flow of the code;

[0062] S3. Automated Vulnerability Identification and Attack Simulation: Automated analysis of information collected through intelligent web crawlers to identify potential vulnerabilities and generate targeted test loads.

[0063] The intelligent crawler in step S1 of this embodiment is as follows:

[0064] S101. Use headless browsers (such as Playwright): Use reinforcement learning or headless browser-driven AI agents to explore websites, fully render pages, and execute JS; for large-scale crawling, headless browsers consume a lot of resources, so server-side pre-rendering can be considered.

[0065] S102, Reinforcement Learning Driven: Each webpage is treated as a "state", and the click, input, and scroll operations are treated as "actions"; the goal of the AI ​​agent is to maximize the number of "states" it explores, i.e., page coverage; through a reward mechanism, the AI ​​learns to interact with complex UIs, such as drop-down menus and modals;

[0066] S103, Computer Vision Assistance: Take screenshots of pages and use OCR technology to recognize text in the images; use CV object detection models to recognize UI elements such as buttons and input boxes to trigger interactions; identify hidden input boxes or dynamically loaded scripts in the front-end page to help find XSS injection points;

[0067] S104, NLP analysis: Utilize the BERT model to analyze the DOM structure and API interface description, extract sensitive parameters (such as / user / {id}), and predict attack vectors (such as access control vulnerabilities).

[0068] As attached Figure 2 As shown, the generation of the AST in step S1 of this embodiment is specifically as follows: the source code text is lexically analyzed to output a token stream, and the token stream is lexically analyzed to output an AST;

[0069] Lexical analysis specifically involves: decomposing the source code string into meaningful tokens, scanning the character stream to identify keywords (const), identifiers (result), operators (=, +, *), literals (2), and delimiters (;), and outputting a token stream;

[0070] Syntax analysis specifically involves: organizing the token stream into a tree structure according to the syntax rules of the programming language; checking whether the order of the tokens conforms to the syntax (e.g., whether there is an expression after the assignment operator); if not, a syntax error is thrown.

[0071] The reverse engineering analysis of the intelligent front-end code in step S2 of this embodiment is as follows:

[0072] S201. Dynamic Behavior Capture and Code Reconstruction: Overcoming code obfuscation and encryption protection through real-time monitoring and logic refactoring, as detailed below:

[0073] S20101, Real-time Hook Technology: Intercepts key functions (such as eval, cry pto) through dynamic injection technology, records the process of generating encrypted parameters, and uses XHR breakpoints to locate the encryption logic, combined with stack backtracking to trace the call chain;

[0074] S20102, AST Reconstruction: Perform syntax tree parsing on obfuscated code (such as Webpack bundled artifacts), restore variable names and logical structure, and extract key variables and logic;

[0075] S20103, Pattern Matching: Identifying encryption features (such as AES key generation loops and RSA public key loading) in code snippets using a CNN model;

[0076] S20104, Contextual Reasoning: Analyze function call chains through large language models to infer the dependencies of encrypted parameters (such as timestamp + device fingerprint combined signature);

[0077] S202. Sensitive Information Recognition: AI technology improves the accuracy and depth of recognition by introducing context awareness and semantic understanding; specifically as follows:

[0078] S20201, Enhanced Pattern and Format Matching: Based on regular expressions, the AI ​​trains a model on millions of known keys, enabling the model to recognize key formats of various variants and different services (AWS, GitHub, SendGrid, etc.). Even if the key is partially masked (e.g., "sk_live_***"), the AI ​​infers the key risk based on the context.

[0079] S20202, Contextual Semantic Analysis: Determine whether a string is truly sensitive by analyzing the context of the code. Specifically, use NLP to analyze variable names and comments, and analyze the usage of any key in the data stream. If it is found that the key is passed to a secure, server-side API route, output "secure"; if it is found that the key is directly used to call third-party services from the front end, output the corresponding key as a problematic key.

[0080] S20203, Entropy and Structure Analysis: Utilize AI to calculate the entropy of strings, identify high-strength keys that appear to be randomly generated, then use an NLP model to detect high-entropy strings (long and irregular strings), and combine this with key context (such as being assigned to variables named apiKey or secret, or being passed to encryption functions such as CryptoJS.AES.encrypt).

[0081] S20204, API endpoint extraction: Train a sequence model to identify the code pattern that initiates network requests (such as calls to fetch, axios, and $.ajax), and extract the URL parameters of the code that initiates the network request, even if the corresponding URL is dynamically concatenated.

[0082] S203, Third-Party Dependency Analysis: Identify the versions of third-party libraries used in the project that contain known vulnerabilities, as follows:

[0083] S20301, Code fingerprint: Extracting specific function names, string constants, or code structures from a library as "fingerprints";

[0084] S20302, Model Matching: Using a machine learning model to match fingerprints from a known database.

[0085] The automated vulnerability identification and attack simulation in step S3 of this embodiment are as follows:

[0086] S301. Static taint analysis based on AST: Automated analysis of static taints at the AST level, as detailed below:

[0087] S30101, Identify the source: Mark all user-controllable input points in the AST, such as window.location.hash, document.cookie, and FormData;

[0088] S30102. Identify receivers: Mark all dangerous functions or properties, such as innerHTML, eval(), document.write(), axios.post() (which may contain SQL queries);

[0089] S30103. Construct a data flow graph: Analyze the data flow path from the "source" to the "receiver", use an NLP model to analyze the function name and code of the custom cleanup function, and determine whether its cleanup is sufficient: if there is a path and there is no effective cleanup on the path, mark it as a potential vulnerability; for example, a function named removeScriptTags may not be able to defend against event-based XSS (such as onerror).

[0090] S30104. Reduce false alarms: Use machine learning models to perform secondary classification of potential vulnerability paths and assess the true risk of vulnerabilities based on code context features (such as variable names and function call chains), thereby filtering out a large number of false alarms.

[0091] S302, Intelligent Fuzzy Testing Payload Generation: AI dynamically optimizes test cases through reinforcement learning, generating high-quality, high-value test cases based on the target context; details are as follows:

[0092] S30201, Context Awareness: Before generating the payload, the AI ​​analyzes the context of the input point; it analyzes HTML tags and attribute names through NLP / pattern recognition, and parses JavaScript validation logic. For example, if the HTML tag is...<inputtype="email"> AI will generate payloads that begin with "or" but have a structure similar to an email address (e.g., "..."). <script>alert(1)< / script> @evil.com) aims to bypass the backend's validation logic; or to understand the backend's valid JSON data format by using Swagger / OpenAPI documentation or analyzing network requests;

[0093] S30202, Model-Based Payload Generation: This is divided into two categories: syntax- and / or template-based generation and language model-based generation. Syntax- and / or template-based generation involves the AI ​​learning the grammatical rules of the target input (such as SQL statements or JSON formats) and generating variants under the constraints of these rules. Language model-based generation utilizes large language models (such as the GPT series or Codex) trained on large-scale code and text, feeding the current input context (such as surrounding code or HTTP requests) as prompts to the LLM, enabling the LLM to generate variants that may trigger exceptions.

[0094] S30203, Feedback-Driven Evolutionary Fuzzing: Using genetic algorithms, fuzzing is upgraded from a "generate-test" loop to a "generate-test-learn-optimize" loop; if any payload triggers an error (such as a 5xx status code), the AI ​​will use the corresponding payload as a "seed" to generate variants using genetic algorithms or neural networks for deeper testing; the AI ​​model can learn which mutation strategies are more likely to produce "excellent" payloads, thereby guiding the mutation process and accelerating evolution;

[0095] S303, Attack Simulation and Exploit Verification: Securely execute attacks and confirm the actual existence of vulnerabilities to reduce the false positive rate; details are as follows:

[0096] S30301, Templated Exploit Generation: The AI ​​has a library of known vulnerability exploit templates. When a potential vulnerability is identified, it selects a suitable template from the library and replaces the target URL and parameter context information. Taking SQL injection as an example, after the AI ​​detects that the parameter id in the URL is suspected of being SQL injection, it selects a Union-Based SQL injection template, automatically infers the number of columns, and attempts to extract information from the database (e.g., id = 1'UNION SELECT 1, version(), 3--+).

[0097] S30302, Reinforcement Learning Attack: The exploit process is modeled as a reinforcement learning problem. By making minor adjustments to the payload (such as changing the quotation mark type, adding / bypassing spaces, or trying different comment characters), a high reward is obtained for successfully obtaining data (such as database version or file content); a negative reward is obtained if the request is blocked or returns an error; the AI ​​automatically finds the correct payload format and techniques to successfully exploit vulnerabilities or bypass simple WAF rules through trial and error.

[0098] S30303, Difference Analysis Verification: When the AI ​​submits an attack payload, it compares the differences between the normal response and the attack response; it also compares the HTTP status code and HTML content, and uses an NLP model to compare the semantics of the response text; for example, the normal response is "Login successful", and the response after the attack is "Database error". Even if the status code is 200, the AI ​​can identify the anomaly, thereby verifying whether the vulnerability exists.

[0099] Example 2:

[0100] As attached Figure 1 As shown, this embodiment provides a front-end JavaScript code intelligent analysis system based on penetration testing and combined with AI. The system includes:

[0101] The intelligent attack surface mapping module is used to fully "perceive" the structure and function of the target application through intelligent crawling, static code parsing, and AST. Among them, intelligent crawling is a data collection tool that combines artificial intelligence technology; static code parsing is to further analyze the structure of intelligent crawling, and parse the front-end JavaScript code into AST (Abstract Syntax Tree). AST is a structured representation of code. AI uses AST to understand the logical structure of the code and more accurately track data flow.

[0102] The intelligent front-end code reverse analysis module is used to understand, analyze, and reverse engineer obfuscated, compressed, and complicated front-end code (mainly JavaScript) based on AST and using AI technology. It penetrates the code's protection layer and quickly understands the core logic and sensitive data flow of the code.

[0103] The automated vulnerability identification and attack simulation module is used to automatically analyze information collected by intelligent web crawlers, identify potential vulnerabilities, and generate targeted test payloads.

[0104] The intelligent attack surface mapping module includes an intelligent crawler submodule and a static code parsing and AST generation submodule;

[0105] The intelligent crawler submodule is a new type of data collection tool that combines artificial intelligence technology. Traditional crawlers are powerless against content dynamically rendered by JavaScript (such as React / Vue applications), but AI-enhanced crawlers can solve this problem. Specific technical details are as follows:

[0106] a) Using a headless browser (such as Playwright): This method uses reinforcement learning or a headless browser-driven AI agent to explore the website, fully render the page, and execute JavaScript. For large-scale crawling, headless browsers consume significant resources; therefore, server-side pre-rendering configuration can be considered.

[0107] b) Reinforcement Learning Driven: Each webpage is treated as a "state," and the actions that can be performed (clicking, typing, scrolling) are considered "actions." The goal of the AI ​​agent is to maximize the number of "states" it explores (i.e., page coverage). Through a reward mechanism, the AI ​​learns how to interact with complex UIs, such as drop-down menus and modals.

[0108] c) Computer Vision Assistance: Using OCR technology to recognize text in screenshots of web pages, and employing CV object detection models to identify UI elements such as buttons and input fields, thereby triggering interactions. Identifying hidden input fields or dynamically loaded scripts on the front-end page to assist in discovering XSS injection points.

[0109] d) NLP Analysis: Utilize the BERT model to analyze the DOM structure and API interface descriptions, extract sensitive parameters (such as / user / {id}), and predict attack vectors (such as access control vulnerabilities).

[0110] The static code parsing and AST generation submodule further analyzes the results of the intelligent web crawler, parsing the front-end JavaScript code into an Abstract Syntax Tree (AST). AST is a structured representation of code. AI uses AST to understand the logical structure of the code, thus enabling more accurate data flow tracking. For example, tracking a user input starts with `window.location.search`, goes through several functions, and finally assigns the complete path to `element.innerHTML`.

[0111] As attached Figure 2As shown, the source code text is lexically analyzed to output a token stream, and the token stream is then analyzed to output an Abstract Syntax Tree (AST). The specific details of lexical and syntactic analysis are as follows:

[0112] a) Lexical analysis: Decompose the source code string into meaningful tokens, and identify keywords (const), identifiers (result), operators (=, +, *), literals (2), delimiters (;) by scanning the character stream, and output a token stream.

[0113] b) Syntax Analysis: The token stream is organized into a tree structure according to the syntax rules of the programming language. The parser checks whether the order of the tokens conforms to the syntax (e.g., whether there is an expression after an assignment operator). If it does not conform, a syntax error is thrown.

[0114] The intelligent front-end code reverse analysis module includes a dynamic behavior capture and code reconstruction submodule, a sensitive information identification submodule, and a third-party dependency analysis submodule.

[0115] Among them, the dynamic behavior capture and code reconstruction submodule is the core of front-end reverse engineering. It overcomes code obfuscation and encryption protection through real-time monitoring and logic refactoring. Its technical implementation path is as follows:

[0116] a) Real-time Hook technology: Intercept key functions (such as eval and crypto) through dynamic injection technology, record the process of generating encryption parameters, locate encryption logic using XHR breakpoints, and trace the call chain by stack backtracking.

[0117] b) AST Reconstruction: Parse the obfuscated code (such as Webpack bundled products) to restore variable names and logical structure, and extract key variables and logic.

[0118] c) Pattern matching: CNN models identify encryption features in code snippets (such as AES key generation loops and RSA public key loading).

[0119] d) Contextual reasoning: Large language models analyze function call chains to infer the dependencies of encrypted parameters (such as timestamp + device fingerprint combined signature).

[0120] Traditional methods for testing sensitive information rely on regular expressions and predefined keyword lists. However, these methods suffer from drawbacks such as high false positive rates, difficulty in recognizing context, susceptibility to bypassing, and lack of semantic understanding. The sensitive information identification submodule employs AI technology, significantly improving the accuracy and depth of identification by introducing context awareness and semantic understanding. Its core workflow is as follows:

[0121] a) Enhanced pattern and format matching: Based on regular expressions, AI can train models on millions of known keys, enabling them to recognize key formats of various variants and different services (AWS, GitHub, SendGrid, etc.). Even if the key is partially masked (e.g., "sk_live_***"), AI can infer its risk based on the context.

[0122] b) Contextual semantic analysis: Determine whether a string is truly sensitive by analyzing the context of the code. Specifically, use NLP to analyze variable names and comments, and analyze how a key is used in the data flow. If the key is found to be passed to a secure, server-side API route, output "secure". If the key is found to be used directly to call third-party services from the front end, output "problem".

[0123] c) Entropy and Structure Analysis: AI is used to calculate the entropy of strings to identify high-strength keys that appear to be randomly generated. Then, an NLP model is used to detect high-entropy strings (long and irregular strings) and to combine them with their context (such as being assigned to variables named apiKey or secret, or being passed to encryption functions such as CryptoJS.AES.encrypt).

[0124] d) API endpoint extraction: Train a sequence model to identify code patterns that initiate network requests (such as fetch, axios, and $.ajax calls) and extract their URL parameters, even if these URLs are dynamically concatenated.

[0125] The third-party dependency analysis submodule identifies versions of third-party libraries used in the project that contain known vulnerabilities, even if they are heavily customized or obfuscated. Third-party libraries are identified in the following ways:

[0126] a) Code fingerprint: Extracting specific function names, string constants, or code structures from a library as "fingerprints".

[0127] b) Model matching: Use a machine learning model to match against a fingerprint database of a known library.

[0128] The automated vulnerability identification and attack simulation module automatically analyzes information collected by the intelligent crawler module to determine potential vulnerabilities and generate targeted test payloads. This module includes an AST-based static taint analysis submodule, an intelligent fuzzing Payload generation submodule, and an attack simulation and exploit verification submodule.

[0129] The static taint analysis submodule based on Abstract Syntax Trees (ASTs) involves taint analysis, a technique that tracks data from untrusted sources and checks whether this data has flowed to sensitive sinks without proper sanitization. The AST-based static taint analysis submodule automates this taint analysis process at the Abstract Syntax Tree (AST) level; the specific implementation process is as follows:

[0130] a) Identify the source: Mark all user-controllable input points in the AST, such as window.location.hash, document.cookie, and FormData.

[0131] b) Identify receivers: Mark all dangerous functions or properties, such as innerHTML, eval(), document.write(), axios.post() (which may contain SQL queries).

[0132] c) Construct a data flow graph: Analyze the data flow path from the "source" to the "sink". Use an NLP model to analyze the function name and code of the custom sanitization function to determine if its sanitization is sufficient. If a path exists without effective sanitization, mark it as a potential vulnerability. For example, a function named `removeScriptTags` might not be able to defend against event-based XSS (such as `onerror`).

[0133] d) Reduce false alarms: Use machine learning models to reclassify potential vulnerability paths and assess the true risk of vulnerabilities based on code context features (such as variable names and function call chains), thereby filtering out a large number of false alarms.

[0134] Traditional fuzzing relies on random input, randomly generating or using predefined malformed data. In contrast, the intelligent fuzzing payload generation submodule employs AI technology, dynamically optimizing test cases through reinforcement learning. It can generate high-quality, high-value test cases based on the target context. Intelligent fuzzing is not a single technology, but a combination of technologies, and its specific process is as follows:

[0135] a) Context Awareness: Before generating the payload, the AI ​​first analyzes the context of the input point. This involves analyzing HTML tags and attribute names through NLP / pattern recognition, and parsing JavaScript validation logic. For example, if the HTML tag is...<inputtype="email"> AI will generate payloads that begin with "or" but have a structure similar to an email address (e.g., "..."). <script>alert(1)< / script>@evil.com aims to bypass backend validation logic. Additionally, Swagger / OpenAPI documentation or analyzing network requests can be used to understand the valid JSON data formats used by the backend.

[0136] b) Model-based payload generation: This mainly falls into two categories: syntax / template-based generation and language model-based generation. Syntax / template-based generation involves the AI ​​learning the grammatical rules of the target input (such as SQL statements or JSON formats) and then generating variants under the constraints of these rules. Language model-based generation utilizes large language models (such as the GPT series or Codex) trained on large-scale code and text, feeding the current input context (such as surrounding code or HTTP requests) as prompts to the LLM, allowing the LLM to generate variants that may trigger exceptions.

[0137] c) Feedback-driven evolutionary fuzzing. Using genetic algorithms, fuzzing is upgraded from a "generate-test" loop to a "generate-test-learn-optimize" loop. If a payload triggers an error (such as a 5xx status code), the AI ​​uses this payload as a "seed" to generate variants using genetic algorithms or neural networks for deeper testing. The AI ​​model can learn which mutation strategies are more likely to produce "excellent" payloads, thus guiding the mutation process and accelerating evolution.

[0138] The attack simulation and exploit verification submodule is responsible for securely executing attacks and verifying the actual existence of vulnerabilities, thus reducing the false positive rate. This is achieved through two main methods: templated exploit generation, reinforcement learning attacks, and differential analysis verification, as detailed below:

[0139] a) Templated Exploit Generation: The AI ​​possesses a library of known exploit templates. When a potential vulnerability is identified, it selects a suitable template from the library and replaces the target URL, parameters, and other contextual information. For example, in the case of SQL injection, if the AI ​​detects that the parameter 'id' in the URL may be vulnerable to SQL injection, it selects a Union-Based SQL injection template, automatically infers the number of columns, and attempts to extract information from the database (e.g., id = 1'UNION SELECT 1, version(), 3--+').

[0140] b) Reinforcement Learning Attack: The exploit process is modeled as a reinforcement learning problem. By making minor adjustments to the payload (such as changing quotation mark types, adding / bypassing spaces, or trying different comment characters), a high reward is given for successfully obtaining data (such as database version or file content); a negative reward is given if the request is blocked or returns an error. Through trial and error, the AI ​​automatically finds the correct payload format and techniques to successfully exploit vulnerabilities, and can even bypass simple WAF rules.

[0141] c) Difference Analysis Verification: When the AI ​​submits an attack payload, it compares the differences between the normal response and the attack response. This involves not only comparing HTTP status codes and HTML content, but also using NLP models to compare the semantics of the response text. For example, a normal response might be "Login successful," while an attack response might be "Database error." Even if both have a 200 status code, the AI ​​can identify the anomaly, thus verifying the existence of a vulnerability.

[0142] In this embodiment, after obtaining the target web application, the intelligent crawler in the intelligent attack surface mapping module first collects information from the front end, parses the static code and generates an AST. Then, the intelligent front-end code reverse analysis module reverse-engineers the AST to quickly understand its core logic, identify sensitive information and third-party dependencies. Next, the automated vulnerability identification and attack simulation module performs the core work, mainly completing three functions: static taint analysis based on AST, intelligent fuzzing payload generation, and attack simulation and exploit verification. Finally, the results are output, and the testers manually verify the results and output the final report.

[0143] Through the three modules mentioned above—intelligent attack surface mapping, intelligent front-end code reverse engineering, and automated vulnerability identification and attack simulation—the front-end penetration testing process can be realized: information collection -> intelligent analysis -> vulnerability identification and attack simulation. After the results are output, penetration testers can further verify the results and write test reports.

[0144] Example 3:

[0145] This invention also provides an electronic device, including: a memory and a processor;

[0146] The memory stores the instructions executed by the computer.

[0147] The processor executes computer execution instructions stored in the memory, causing the processor to execute the AI-based intelligent analysis method for front-end JavaScript code based on penetration testing in any embodiment of the present invention.

[0148] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can be a microprocessor or any conventional processor.

[0149] Memory is used to store computer programs and / or modules. The processor implements various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory. Memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system, at least one application program required for a function, etc.; the data storage area can store data created based on the use of the terminal, etc. In addition, memory can also include high-speed random access memory, and can also include non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart memory cards (SMC), secure digital cards (SD cards), flash memory cards, at least one disk storage device, flash memory devices, or other volatile solid-state storage devices.

[0150] Example 4:

[0151] This embodiment also provides a computer-readable storage medium storing multiple instructions, which are loaded by a processor to cause the processor to execute the AI-based front-end JavaScript code intelligent analysis method based on penetration testing in any embodiment of the present invention. Specifically, a system or device equipped with a storage medium may be provided, on which software program code implementing the functions of any of the above embodiments is stored, and the computer (or CPU or MPU) of the system or device may read and execute the program code stored in the storage medium.

[0152] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0153] Storage media embodiments for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RYM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0154] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0155] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion unit connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion unit execute some and all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0156] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A front-end JavaScript code intelligent analysis method based on penetration testing and combined with AI, characterized in that, The method is as follows: Intelligent Attack Surface Mapping: Fully "perceives" the structure and function of the target application through intelligent web crawling, static code analysis, and AST. Among them, intelligent web crawling is a data collection tool that combines artificial intelligence technology; static code analysis is to further analyze the structure of intelligent web crawling, and parse the front-end JavaScript code into AST. AST is a structured representation of code. AI uses AST to understand the logical structure of the code and more accurately track data flow. Intelligent front-end code reverse engineering: Based on AST, it uses AI technology to help understand, analyze and reverse engineer obfuscated, compressed and complicated front-end code, penetrate the code's protection layer, and quickly understand the core logic and sensitive data flow of the code; Automated vulnerability identification and attack simulation: Automated analysis of information collected through intelligent web crawlers to identify potential vulnerabilities and generate targeted test loads.

2. The intelligent analysis method for front-end JavaScript code based on penetration testing and combined with AI as described in claim 1, characterized in that, The intelligent web crawler is as follows: Using headless browsers: Explore websites using AI agents driven by reinforcement learning or headless browsers, fully render pages, and execute JS; for large-scale crawling, server-side pre-rendering is configured. Reinforcement learning-driven: Each webpage is treated as a "state", and the click, input, and scroll operations are treated as "actions"; the goal of the AI ​​agent is to maximize the number of "states" it explores, i.e., page coverage; through a reward mechanism, the AI ​​learns to interact with complex UIs. Computer vision assistance: For page screenshots, use OCR technology to recognize text in the images, and use CV object detection models to recognize UI elements such as buttons and input boxes to trigger interactions; identify hidden input boxes or dynamically loaded scripts in the front-end page to help find XSS injection points; NLP Analysis: Utilizing the BERT model to analyze the DOM structure and API interface description, extracting sensitive parameters, and predicting attack vectors.

3. The intelligent analysis method for front-end JavaScript code based on penetration testing and combined with AI as described in claim 1, characterized in that, The AST generation process is as follows: the source code text is lexically analyzed to output a token stream, and the token stream is lexically analyzed to output an AST. Lexical analysis specifically involves: breaking down the source code string into meaningful tokens, scanning the character stream to identify keywords, identifiers, operators, literals, and delimiters, and outputting a token stream; Syntax analysis specifically involves: organizing the token stream into a tree structure according to the syntax rules of the programming language; checking whether the order of the tokens conforms to the syntax using a parser; and throwing a syntax error if the order does not conform.

4. The intelligent analysis method for front-end JavaScript code based on penetration testing and combined with AI as described in claim 1, characterized in that, The reverse engineering analysis of the intelligent front-end code is as follows: Dynamic Behavior Capture and Code Reconstruction: Breaking through code obfuscation and encryption protection through real-time monitoring and logic refactoring, specifically: Real-time Hook Technology: Intercepting key functions through dynamic injection, recording the generation process of encrypted parameters, and using XHR breakpoints to locate encrypted logic, combined with stack backtracking to trace the call chain; AST Reconstruction: Parsing the obfuscated code to restore variable names and logical structure, extracting key variables and logic; Pattern Matching: Identifying encrypted features in code snippets using a CNN model; Contextual Reasoning: Analyzing function call chains using a large language model to infer the dependencies of encrypted parameters. Sensitive information identification: AI technology improves the accuracy and depth of identification by introducing context awareness and semantic understanding; Third-party dependency analysis: Identifies third-party library versions used in the project that contain known vulnerabilities. Specifically: Code fingerprinting: Extracts specific function names, string constants, or code structures from the library as "fingerprints"; Model matching: Uses a machine learning model to match the fingerprints of known libraries against a database of known libraries.

5. The intelligent analysis method for front-end JavaScript code based on penetration testing and combined with AI according to claim 4, characterized in that, The specific identification of sensitive information is as follows: Enhanced pattern and format matching: The AI ​​trains a model on millions of known keys based on regular expressions, enabling the model to recognize key formats of various variants and different services. Even if the key is partially masked, the AI ​​infers the key risk based on the context. Contextual semantic analysis: Determine whether a string is truly sensitive by analyzing the context of the code. Specifically, it uses NLP to analyze variable names and comments, analyzes the usage of any key in the data stream, and outputs "safe" if it finds that the key is passed to a secure, server-side API route. If it is found that the key is being used directly to call third-party services from the front end, the corresponding key will be output as a problematic key. Entropy and Structure Analysis: AI is used to calculate the entropy of strings to identify high-strength keys that appear to be randomly generated. Then, an NLP model is used to detect high-entropy strings, combined with the key context. API endpoint extraction: Train a sequence model to identify the code pattern that initiates network requests and extract the URL parameters of the code that initiates the network request, even if the corresponding URL is dynamically concatenated.

6. The intelligent analysis method for front-end JavaScript code based on penetration testing and combined with AI according to claim 1, characterized in that, The automated vulnerability identification and attack simulation are detailed below: Static taint analysis based on AST: Automated analysis of static taints at the AST level, specifically: Source identification: Marking all user-controllable input points in the AST; Receiver identification: Marking all dangerous functions or attributes; Data flow graph construction: Analyzing the data flow path from "source" to "receiver", using an NLP model to analyze the function name and code of custom cleanup functions to determine if their cleanup is sufficient: If a path exists without effective cleanup, it is marked as a potential vulnerability; False positive reduction: Using a machine learning model to perform secondary classification of potential vulnerability paths, assessing the true risk of the vulnerability based on code context features, thereby filtering out a large number of false positives. Intelligent fuzzy testing payload generation: AI dynamically optimizes test cases through reinforcement learning, generating high-quality, high-value test cases based on the target context. Specifically: Context awareness: Before generating the payload, the AI ​​analyzes the context of the input point; it analyzes HTML tags and attribute names through NLP / pattern recognition, parses JavaScript validation logic, or understands the valid JSON data format of the backend through Swagger / OpenAPI documentation or network request analysis; Model-based payload generation: Divided into two categories: syntax- and / or template-based generation and language model-based generation. Syntax and / or template generation involves AI learning the grammatical rules of the target input and generating variants under the constraints of these rules. Language model-based generation utilizes a large language model trained on massive amounts of code and text, feeding the current input context as prompts to the LLM, enabling it to generate variants that may trigger anomalies. Feedback-driven evolutionary fuzzing uses genetic algorithms to upgrade fuzzing from a "generate-test" loop to a "generate-test-learn-optimize" loop. If any payload triggers an error, the AI ​​uses the corresponding payload as a "seed" to generate variants using genetic algorithms or neural networks for deeper testing. Attack simulation and exploit verification: Securely execute attacks and confirm the actual existence of vulnerabilities, reducing the false positive rate.

7. The intelligent analysis method for front-end JavaScript code based on penetration testing and combined with AI according to claim 6, characterized in that, The attack simulation and exploit verification are detailed below: Templated Exploit Generation: The AI ​​has a library of known vulnerability exploit templates. When a potential vulnerability is identified, it selects a suitable template from the library and replaces the target URL and parameter context information in it. Reinforcement learning attacks: The exploit process is modeled as a reinforcement learning problem. By making minor adjustments to the payload (such as changing the quotation mark type, adding / bypassing spaces, or trying different comment characters), a high reward is given for successfully obtaining data; a negative reward is given if the request is blocked or returns an error; the AI ​​automatically finds the correct payload format and techniques to successfully exploit the vulnerability or bypass simple WAF rules through trial and error. Difference analysis verification: When the AI ​​submits an attack payload, the differences between the normal response and the attack response are compared; the HTTP status code and HTML content are compared, and the semantics of the response text are compared using an NLP model.

8. A front-end JavaScript code intelligent analysis system based on penetration testing and combined with AI, characterized in that, This system is used to implement the AI-based intelligent analysis method for front-end JavaScript code based on penetration testing as described in any one of claims 1 to 7; the system includes: The intelligent attack surface mapping module is used to fully "perceive" the structure and function of the target application through intelligent crawling, static code parsing, and AST. Among them, intelligent crawling is a data acquisition tool that combines artificial intelligence technology; static code parsing is to further analyze the structure of intelligent crawling, and parse the front-end JavaScript code into AST. AST is a structured representation of code. AI uses AST to understand the logical structure of the code and more accurately track data flow. The intelligent front-end code reverse analysis module is used to understand, analyze, and reverse engineer obfuscated, compressed, and complicated front-end code based on AST and using AI technology. It penetrates the code's protection layer and quickly understands the core logic and sensitive data flow of the code. The automated vulnerability identification and attack simulation module is used to automatically analyze information collected by intelligent web crawlers, identify potential vulnerabilities, and generate targeted test payloads.

9. An electronic device, characterized in that, include: Memory and at least one processor; The memory contains computer programs; The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the AI-integrated front-end JavaScript code intelligent analysis method based on penetration testing as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that can be executed by a processor to implement the AI-integrated front-end JavaScript code intelligent analysis method based on penetration testing as described in any one of claims 1 to 7.

Images