Delay blind injection detection method, detection equipment and computer readable storage medium

Abstract

The embodiment of the invention relates to the technical field of blind beam testing, in particular to a delay blind beam detection method, and the method comprises the steps: obtaining a target request flow comprising a plurality of HTTP requests; performing dual statistical test on the plurality of HTTP requests to obtain at least one target request; generating a test request sequence comprising a plurality of delay test requests based on the target request and a preset large language model; sequentially executing the plurality of delay test requests to obtain a delay test result; judging the delay test result based on a preset large language model to obtain a judgment result including a confidence score; and when the confidence score is greater than a first preset confidence threshold, determining that the target request has the delay blind injection vulnerability. According to the embodiment of the invention, the preset large language model is flexibly guided to execute the verification task through cue word programming, so that the expandability of delay blind injection detection can be improved; flexible guidance and intelligent decision making of a verification link are realized, limitation of hard coding logic is broken through, and accuracy and reliability of detection are improved.

Description

Technical Field

[0001] This application relates to the field of blind injection detection technology, and in particular to a delayed blind injection detection method, electronic device, and computer-readable storage medium. Background Technology

[0002] Blind SQL injection detection is a web security detection technique that identifies injection points by analyzing the differences between true and false queries in a database, without explicit error responses. Delayed blind SQL injection detection is an important branch of this technique. It involves constructing a specific payload to trigger a delayed database response and determining whether the injection was successful based on the difference in response time. Current delayed blind SQL injection detection schemes use hard-coded logic and only employ a simple response time threshold for judgment; if the response time exceeds a preset threshold, it is considered an attack.

[0003] However, such solutions have inherent drawbacks: existing technologies mainly rely on single time features or fixed thresholds, which are difficult to cope with network jitter and complex filtering rules, resulting in low detection accuracy and insufficient efficiency; the judgment logic is hard-coded, lacking flexibility and unable to adapt to complex and changing attack scenarios and server response modes, such as abnormal response times caused by server load fluctuations, and once the logic is optimized or modified, it needs to be re-coded and tested, which is extremely costly and makes it difficult to meet dynamic protection requirements. Summary of the Invention

[0004] One objective of this application is to provide a delayed blind injection method, electronic device, and computer-readable storage medium to solve the technical problem of low flexibility in delayed blind injection detection in related technologies.

[0005] In a first aspect, embodiments of this application provide a delayed blind injection detection method, including: Obtain the target request traffic, which includes multiple HTTP requests; Perform double statistical tests on the multiple HTTP requests to obtain at least one target request; A test request sequence is generated based on the target request and the preset large language model. The test request sequence includes multiple delay test requests. The multiple delay test requests are executed sequentially to obtain the delay test results; The delay test results are judged based on the preset large language model to obtain a judgment result, which includes a confidence score. If the confidence score is greater than the first preset confidence threshold, it is determined that the target request has a delayed blind injection vulnerability.

[0006] Optionally, the step of performing dual statistical tests on the plurality of HTTP requests to obtain at least one target request includes: generating a corresponding target time series based on each HTTP request; performing dual statistical tests on the target time series, the dual statistical tests including a first verification condition and a second verification condition; and determining the HTTP request as the target request when the target time series simultaneously satisfies the first verification condition and the second verification condition.

[0007] Optionally, the target time series includes a first time series and a second time series. The step of generating the corresponding target time series based on each HTTP request includes: generating a corresponding probe request sequence for each HTTP request, wherein the probe request sequence includes multiple probe requests that inject delay instructions into the target parameters of the HTTP request, and the preset delay time of the delay instructions increases linearly at the same time interval; executing the probe requests sequentially, recording the actual response time of all the probe requests to obtain the first time series; and obtaining the preset delay time of all the probe requests to obtain the second time series.

[0008] Optionally, the double statistical test on the target time series includes: Calculate the target correlation coefficient between the first time series and the second time series; If the target correlation coefficient is greater than a preset threshold, the target time series is determined to meet the first verification condition; the difference between the actual response times of any two adjacent detection requests is calculated to obtain the response time difference; if all the response time differences are within the preset error range of the preset delay step, the target time series is determined to meet the second verification condition.

[0009] Optionally, generating a test request sequence based on the target request and a preset large language model includes: obtaining the original request body of the target request, the original request body including a request body with a delay instruction injected into the target parameters; obtaining a first prompt word template, the first prompt word template including a generation rule that generates a preset delay time for the delay instructions of multiple request bodies in a preset non-linear pattern; generating a first prompt word based on the original request body and the first prompt word template; sending the first prompt word to the preset large language model, so that the preset large language model generates a new request body sequence, the new request body sequence including a first number of request bodies with preset delay times in a preset non-linear pattern; and generating the test request sequence based on the new request body sequence.

[0010] Optionally, the new request body sequence includes a first request body sequence and a second request body sequence, and the generation rule for generating a preset delay time of multiple delay instructions with a preset non-linear law includes: generating a first request body sequence, the first request body sequence including a second number of request bodies with a preset delay time having a first linear relationship, the second number being half of the first number; generating a second request body sequence, the second request body sequence including a second number of request bodies with a preset delay time having a second linear relationship, the first linear relationship being the opposite of the second linear relationship.

[0011] Optionally, the first linear relationship is that the second number of preset delay times in the first request body sequence decrease by a preset multiple, and the second linear relationship is that the preset delay times of the second request body sequence increase by the same value as the preset delay times of the first linear relationship.

[0012] Optionally, the latency test result includes a first string containing the response times of all the latency test requests. The step of judging the latency test result based on the preset large language model to obtain a judgment result includes: obtaining a second prompt word template; generating a second prompt word based on the first string and the second prompt word template, wherein the second prompt word includes a judgment criterion for judging whether all response times in the first string conform to a preset nonlinear law of the generation rule; and sending the second prompt word to the preset large language model so that the preset large language model outputs the judgment result.

[0013] Secondly, embodiments of this application provide a detection device, including a memory and a processor. The memory is connected to the processor, and the processor is used to execute one or more computer programs stored in the memory. When the processor executes the one or more computer programs, it causes the detection device to implement the method described above.

[0014] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor, cause the processor to perform the method described above.

[0015] Fourthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described above.

[0016] The embodiments of this application can achieve the following technical effects: In the delayed blind injection detection method provided in the embodiments of this application, the method includes: acquiring target request traffic, the target request traffic including multiple HTTP requests; performing double statistical tests on the multiple HTTP requests to obtain at least one target request; generating a test request sequence based on the target request and a preset large language model, the test request sequence including multiple delayed test requests; sequentially executing the multiple delayed test requests to obtain delayed test results; judging the delayed test results based on the preset large language model to obtain a judgment result, the judgment result including a confidence score; when the confidence score is greater than a first preset confidence threshold, it is determined that the target request has a delayed blind injection vulnerability.

[0017] This application embodiment flexibly guides a preset large language model to perform verification tasks through prompt word programming, entrusting the verification link that most requires intelligent reasoning to the large language model, which can improve the scalability of delayed blind injection detection; realize flexible guidance and intelligent decision-making in the vulnerability verification link, transcend the limitations of traditional hard-coded logic, and avoid the interpretability defects of end-to-end black box models, ensuring the transparency and controllability of the decision-making process, and improving the accuracy and reliability of detection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A schematic diagram of the system architecture of a delayed blind injection detection system provided in this application embodiment; Figure 2 A flowchart illustrating a delayed blind injection detection method provided in an embodiment of this application; Figure 3 A flowchart illustrating a delayed blind injection detection method provided in another embodiment of this application; Figure 4 This is a schematic diagram of the structure of a delayed blind injection detection device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a testing device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0021] It should be noted that, unless there is a conflict, the various features in the embodiments of this application can be combined with each other, all of which are within the protection scope of this application. Furthermore, although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than the module division in the device or the order in the flowchart. Moreover, the terms "first," "second," and "third" used in this application do not limit the data or execution order, but only distinguish identical or similar items with essentially the same function and effect.

[0022] In addition to the limitations of the prior art pointed out in the background section, the inventors have also discovered that some existing blind injection detection schemes use a single AI model for detection, which mainly relies on an end-to-end machine learning classifier. These detection schemes take network requests as model input, aiming to have the AI ​​model directly output a binary "yes" or "no" judgment to identify security vulnerabilities in the network requests.

[0023] However, such detection schemes heavily rely on large-scale, high-quality labeled data for model training, resulting in high costs for data acquisition and labeling. The model is essentially a "black box," with opaque internal decision-making logic, leading to a lack of interpretability in the output. When the AI ​​model produces false positives or false negatives, developers struggle to pinpoint the root cause, unable to determine which part or feature of the AI ​​model led to the erroneous decision, posing significant challenges to model optimization and troubleshooting. Furthermore, these AI models have limited generalization capabilities; their detection performance significantly degrades when facing new attack patterns or variants not covered by the training data. Moreover, adjusting and updating the AI ​​model is extremely inconvenient; any adaptation to new threats requires re-preparation of data and retraining of the model, lacking flexibility.

[0024] Please see below. Figure 1 , Figure 1 This is a schematic diagram of the system architecture of a delayed blind injection detection system provided in an embodiment of this application. The delayed blind injection detection system includes a detection device 11 and a server 12. The detection device 11 and the server 12 are connected in communication.

[0025] The detection device 11 is deployed at critical link nodes of the enterprise's internal network. It uses traffic mirroring or optical splitting technology to access the enterprise's internal HTTP traffic without affecting the normal data interaction between the enterprise and server 12. Through a preset delayed blind injection detection method, it automatically and in real-time performs millisecond-level screening of the flowing HTTP requests. After initially screening and locating suspected vulnerability requests, it further confirms the authenticity of the vulnerability through a feature verification mechanism and reports the confirmed vulnerability request data to server 12. Server 12 serves as the system's data storage and operation hub, and a dedicated security operations platform is deployed there. This platform associates and stores vulnerability request data reported by detection device 11 with metadata such as timestamps, request source IPs, and the module to which the request pertains, forming a traceable vulnerability database for further analysis by security engineers.

[0026] Please see Figure 2 This application provides a delayed blind injection detection method, which includes the following steps: S21: Obtain the target request traffic, which includes multiple HTTP requests.

[0027] In step S21, specifically, the system integrates with the enterprise's existing message queue middleware (such as Kafka) to consume the flowing HTTP traffic in real time. Specifically, the system acts as a Kafka consumer, subscribing to topics that carry internal HTTP request traffic and continuously acquiring multi-dimensional HTTP request traffic from the production environment. The HTTP requests consumed in real time constitute the target request traffic required for vulnerability security detection.

[0028] S22: Perform a double statistical test on multiple HTTP requests to obtain at least one target request.

[0029] In step S22, the target request is an HTTP request that is suspected of having a vulnerability through double statistical testing. Specifically, for each HTTP request, the system will automatically generate a probe request sequence using the HTTP request as a template. The probe request sequence includes multiple probe requests. In this embodiment, the probe request sequence includes three probe requests. Specifically, the system will use the HTTP request as a template and inject linearly increasing delay instructions (such as sleep(0), sleep(5), sleep(10)) only into the target parameters in the request body of the HTTP request to generate three probe requests. The target parameters include numeric parameters and character parameters. For example, the request body of the HTTP request includes the numeric parameter "id=10". Only the numeric parameter is injected with a delay instruction, such as sleep(5), to obtain "id=10 and sleep(5)". Other content remains unchanged, resulting in a probe request with a theoretical delay of 5 seconds.

[0030] The system executes three probe requests sequentially and records the actual response time of each request. A target time series is generated based on the preset delay time and actual response time of each probe request. The target time series includes a preset delay time series and an actual response time series. Each preset delay time corresponds to an actual response time. It should be noted that the delay instruction in each probe request includes its own preset delay time. For example, if the delay instruction for a probe request is `sleep(5)`, then the preset delay time for that probe request is 5 seconds.

[0031] The system performs correlation analysis on the target time series. Specifically, the system calculates the target correlation coefficient between the preset delay time series and the actual response time series. In this embodiment, the target correlation coefficient is the Pearson correlation coefficient. The Pearson correlation coefficient is a statistic that measures the degree of linear correlation between two continuous variables, with a value range of [-1, 1]. 1 represents a perfect positive correlation, -1 represents a perfect negative correlation, and 0 represents no linear correlation. In this embodiment, the preset coefficient threshold is set to 0.9. If the target correlation coefficient is greater than the preset coefficient threshold, it indicates that there is an overall linear relationship between the actual response time and the preset delay time, and the delay instruction will affect the actual response time of the HTTP request.

[0032] After satisfying the correlation analysis verification, the system performs continuous difference analysis on the target time series. Specifically, the system calculates the time difference between two adjacent actual response times in the actual response time series and checks whether each time difference is within the preset error range of the preset delay step. The preset delay step is the time difference between two adjacent delay commands with preset delay times. For example, if the three linearly increasing delay commands in the probe request sequence are sleep(0), sleep(5), and sleep(10), it can be understood that the preset delay times are 0, 5 seconds, and 10 seconds, respectively, and the preset delay step is set to 5 seconds. The preset error range can be set according to the detection accuracy. In this embodiment, the preset error range can be set to ±0.2 seconds. It can be understood that if the preset delay step is 5 seconds and the preset error range is ±0.2 seconds, the preset error range of the time difference within the preset delay step is 4.8 to 5.2 seconds. For example, if the actual response time of the first probe request is T1=0.1 seconds and the actual response time of the second probe request is T2=5.1 seconds, the time difference between the two is T2-T1=5 seconds, which is within the preset error range of the preset delay step. If the actual response time of the first probe request is T1=0.2 seconds and the actual response time of the second probe request is T2=0.2 seconds, the time difference between the two is T2-T1=0 seconds, which is not within the preset error range of the preset delay step.

[0033] If all time differences are within the preset error range of the preset delay step, then the target time series is determined to meet the verification of differential analysis, and the HTTP request is determined to be the target request. The target request is an HTTP request that is suspected of having a vulnerability through double statistical testing.

[0034] S23: Generate a test request sequence based on the target request and the preset large language model. The test request sequence includes multiple delay test requests.

[0035] In step S23, the system parses and extracts the original request body from the target request, and generates a first prompt word by combining it with the first prompt word template. The first prompt word template includes generation rules that use the original request body as a template to generate preset delay times for delay instructions of multiple request bodies in a preset non-linear manner.

[0036] The preset nonlinear pattern is a pattern designed by pre-setting the preset delay time of the delay command. For example, if 10 request bodies need to be generated from the original request body as a template, the preset delay time of the delay command in the first 5 request bodies is set in a linearly decreasing manner, while the preset delay time of the delay command in the last 5 request bodies is set in a linearly increasing manner, presenting a V-shaped nonlinear pattern. Specifically, the preset delay time of the delay command in the first 5 request bodies is preset to decrease by a factor of 2, while the preset delay time of the delay command in the last 5 request bodies is set to the same value in an increasing manner. For example, the 10 preset delay times can be set sequentially to 10s, 5s, 2.5s, 0.125s, 0.625s, 0.625s, 0.125s, 2.5s, 5s, and 10s.

[0037] The first prompt word is input into a preset large language model, which is deployed on a detection device. This preset large language model outputs a new request body sequence that conforms to the first prompt word's requirements. The new request body sequence includes multiple request bodies with preset delay times following a preset non-linear pattern. Based on each request body and other unchanged content in the target request, the system generates a corresponding delay test request, resulting in a test request sequence.

[0038] It should be noted that setting the preset delay time in the delay instructions of multiple request bodies to a preset non-linear pattern is to generate a test request sequence that maintains the same pattern. If the actual response time of the delay test requests in the test request sequence also exhibits the preset non-linear pattern after being executed in sequence, it indicates that the delay instructions will have a delay effect on the target request.

[0039] In some embodiments, the preset large language model includes multiple existing large language models, and large language models from different providers can be accessed by calling interfaces.

[0040] S24: Execute multiple delay test requests sequentially to obtain the delay test results.

[0041] In step S24, after obtaining the test request sequence output by the preset large language model, the system will call the original user's identity credential information. This identity credential information includes, but is not limited to, session identifier cookies, authentication tokens, session keys, and other user authentication data to simulate a real user's request initiation scenario. The system will test each delayed test request in the test request sequence in a preset order to obtain the delayed test result corresponding to each delayed test request.

[0042] Specifically, during execution, the system records key parameters in real time for each latency test request. These parameters include, but are not limited to, the actual response time, the HTTP status code returned by the server (e.g., 200, 404, 500), and the response body length (Bodylen). The system then integrates these recorded key parameters according to a preset format, such as a key-value pair sequence or a JSON structure, to generate a structured text string containing all the interaction data from the latency test requests. The latency test results are based on this aggregated structured text string, comprehensively covering the execution details of each latency test request.

[0043] S25: Determine the delay test results based on the preset large language model, and obtain the determination results, which include the confidence score.

[0044] In step S25, specifically, the system combines the second prompt word template and the structured text string from the delay test results to generate a second prompt word. The second prompt word includes a judgment criterion for determining whether all actual response times in the structured text string conform to a preset nonlinear law of the generation rules. The system inputs the second prompt word into a preset large language model, allowing the model to judge the structured text string and obtain a judgment result, including a confidence score. The confidence score reflects the degree of matching between the pattern of actual response times in the structured text string and the preset nonlinear law. The higher the degree of matching, the higher the confidence score given by the preset large language model; conversely, the lower the degree of matching, the lower the confidence score given by the preset large language model.

[0045] S26: When the confidence score is greater than the first preset confidence threshold, it is determined that the target request has a delayed blind injection vulnerability.

[0046] In step S26, specifically, the first preset confidence threshold is set to 30 points. If the confidence score in the judgment result is greater than 30 points, it is determined that the target request has a delayed blind injection vulnerability.

[0047] It should be noted that if the confidence score is less than 30, it indicates that the actual response time pattern in the structured text string matches the preset non-linear pattern to a low degree. When the actual response time in the structured text string fluctuates randomly, is completely irregular, or is essentially a straight line, the confidence score will be very low, indicating that the delayed instructions injected into the target request have not taken effect and will not affect the server's response time; therefore, the target request does not contain a delayed blind SQL injection vulnerability. If the confidence score is greater than the first preset confidence threshold, i.e., a confidence score greater than 30, then a delayed blind SQL injection vulnerability is confirmed to exist in the target request.

[0048] In some embodiments, the delayed blind SQL injection detection method further includes a second preset confidence threshold, which is set to 80 points. If the confidence score in the judgment result is greater than the second preset confidence threshold, i.e., the confidence score is greater than 80 points, the probability that the target request has a delayed blind SQL injection vulnerability is high confidence, indicating that the delayed instruction can affect the server's response time. If the confidence score in the judgment result is greater than or equal to the first preset confidence threshold and less than or equal to the second preset confidence threshold, i.e., the confidence score is in the range of 30 to 80 points, the probability that the target request has a delayed blind SQL injection vulnerability is medium confidence, indicating that the target request has a delayed blind SQL injection vulnerability, but it may only be affected by unstable factors. For example, the actual response time in the structured text string mostly conforms to the preset non-linear law, but there are individual delayed test requests whose actual response time deviates significantly. For example, the actual response time of 2 out of 10 delayed test requests deviates from the preset delay time due to network fluctuations.

[0049] This application embodiment achieves agile adjustment and expansion of vulnerability detection logic by modifying prompt words and combining them with a preset large language model. This requires no code modification, significantly reducing the development and maintenance costs of logic iteration and improving detection efficiency. The preset large language model can accurately understand and execute complex judgment criteria. Compared to traditional fixed code instances, it can more effectively handle noisy and uncertain real-world testing scenarios, improving detection adaptability. This application embodiment filters out non-target requests through dual statistical checks, avoiding efficiency losses caused by excessive calls to the preset large language model, ensuring overall system detection efficiency, and simultaneously improving detection accuracy through the preset large language model, thus balancing detection efficiency and precision.

[0050] In some embodiments, performing a double statistical test on multiple HTTP requests to obtain at least one target request includes the following steps: S221: Generate the corresponding target time series based on each HTTP request.

[0051] S222: Perform a double statistical test on the target time series. The double statistical test includes a first validation condition and a second validation condition.

[0052] S223: When the target time series simultaneously meets the first verification condition and the second verification condition, the HTTP request is determined to be the target request.

[0053] In step S221, specifically, for each HTTP request, the system automatically generates a probe request sequence using that HTTP request as a template. The probe request sequence includes multiple probe requests. A delay instruction is injected into each probe request, including a preset delay time. The delay instruction is used to delay the probe request, and the theoretical value of the probe request delay is equal to the preset delay time. The system executes the probe requests in the probe request sequence sequentially and records the actual response time of each probe request. The preset delay time and actual response time of each probe request are then integrated to obtain the target time series. The target time series includes the preset delay time and actual response time of each probe request.

[0054] In step S222, specifically, the target time series includes a preset delay time series and an actual response time series. The preset delay time series includes the preset delay time of the delay command in each probe request, and the actual response time series includes the actual response time of each probe request.

[0055] The dual statistical test includes a first verification condition and a second verification condition. The first verification condition is a trend verification condition. Specifically, the system calculates the target correlation coefficient between the preset delay time series and the actual response time series in the target time series. In this embodiment, the target correlation coefficient is the Pearson correlation coefficient. The first verification condition is that the Pearson correlation coefficient of the target time series is greater than a preset coefficient threshold.

[0056] The second verification condition is a step verification condition. Specifically, the system performs continuous difference analysis on the response time series. In this embodiment, the system calculates the time difference between two adjacent actual response times in the actual response time series. The second verification condition is that each time difference is within a preset error range of a preset delay step, where the preset delay step is the time difference between preset delay times in two adjacent delay instructions.

[0057] In step S223, specifically, if the target time series meets the first verification condition and the second verification condition, then the HTTP request is determined to be the target request. The target request is an HTTP request that is suspected of having a vulnerability through double statistical testing.

[0058] It should be noted that in this embodiment of the application, continuous difference analysis will only be performed on the actual response time series after the target time series meets the first verification condition. If the first verification condition is not met, the HTTP request will be directly determined to be not the target request.

[0059] This application embodiment uses a dual statistical verification consisting of Pearson correlation analysis and continuous difference analysis to filter out non-target requests. This allows for preliminary screening of HTTP requests in advance, identifying HTTP requests suspected of having vulnerabilities for further detection. This avoids efficiency losses caused by excessive calls to the preset large language model and ensures the overall detection efficiency of the system.

[0060] In some embodiments, the target time series includes a first time series and a second time series. Generating a corresponding target time series based on each HTTP request includes the following steps: S2211: For each HTTP request, generate a corresponding probe request sequence. The probe request sequence includes multiple probe requests that inject delay instructions into the target parameters of the HTTP request. The preset delay time of the delay instructions increases linearly at the same interval.

[0061] S2212: Execute the probe requests sequentially, record the actual response time of all probe requests, and obtain the first time series.

[0062] S2213: Obtain the preset delay time for all probe requests to obtain the second time series.

[0063] In step S2211, specifically, for each HTTP request, the system automatically generates a probe request sequence using the HTTP request as a template. The probe request sequence includes multiple probe requests. In this embodiment, the probe request sequence includes three probe requests. The three probe requests are sequentially injected with linearly increasing delay instructions, such as sleep(0), sleep(5), and sleep(10). The delay instructions are used to delay the probe requests. sleep(0) indicates no delay for the probe request, sleep(5) indicates a 5s delay, and sleep(10) indicates a 10s delay.

[0064] In step S2212, the system will execute each probe request in the probe request sequence in sequence, record the actual response time of all probe requests, and obtain the first time sequence, which is the actual response time sequence.

[0065] In step S2213, the system obtains the preset delay time of the delay command in all probe requests to obtain a second time series, which is a preset delay time series.

[0066] In some embodiments, performing a double statistical test on the target time series includes the following steps: S2221: Calculate the target correlation coefficient between the first time series and the second time series.

[0067] S2222: When the target correlation coefficient is greater than the preset threshold, the target time series is determined to meet the first verification condition.

[0068] S2223: Calculate the difference between the actual response times of any two adjacent probe requests to obtain the response time difference.

[0069] S2224: When all response time differences are within the preset error range of the preset delay step, the target time series is determined to meet the second verification condition.

[0070] In step S2221, specifically, the first time series is the actual response time series, and the second time series is the preset delay time series. The system calculates the target correlation coefficient between the actual response time series and the preset delay time series. Specifically, the target correlation real number is the Pearson correlation coefficient. The Pearson correlation coefficient is a statistic that measures the degree of linear correlation between two continuous variables, and its value ranges from -1 to 1. 1 represents perfect positive correlation, -1 represents perfect negative correlation, and 0 represents no linear correlation.

[0071] In step S2222, if the Pearson correlation coefficient is greater than the preset coefficient threshold (set to 0.9), it indicates that the actual response time series and the preset delay time series are linearly positively correlated, meaning that the delay command can affect the actual response time of the probe request. Then, it is determined that the target time series meets the first verification condition.

[0072] In step S2223, the system will calculate the difference between any two adjacent actual response times in the actual response time series only after the target time series meets the first verification condition, thus obtaining the response time difference.

[0073] In step S2224, if all response time differences in the actual response time sequence are within the preset error range of the preset delay step, the target time sequence is determined to meet the second verification condition. The preset delay step is the time difference between preset delay times in two adjacent delay commands. For example, if the three linearly increasing delay commands in the detection request sequence are sleep(0), sleep(5), and sleep(10), it can be understood that the preset delay times are 0, 5 seconds, and 10 seconds, respectively, and the preset delay step is set to 5 seconds. The preset error range can be set according to the detection accuracy. In this embodiment, the preset error range can be set to ±0.2 seconds. It can be understood that if the preset delay step is 5 seconds and the preset error range is ±0.2 seconds, the preset error range of the response time difference within the preset delay step is 4.8 to 5.2 seconds.

[0074] In some embodiments, generating a test request sequence based on the target request and a preset large language model includes the following steps: S231: Obtain the original request body of the target request, which includes the request body into which a delay instruction is injected within the target parameters.

[0075] S232: Obtain the first prompt word template, which includes a generation rule that generates a preset delay time for delay instructions of multiple request bodies in a preset non-linear manner.

[0076] S233: Generate the first prompt word based on the original request body and the first prompt word template.

[0077] S234: Send the first prompt word to the preset large language model so that the preset large language model generates a new request body sequence, the new request body sequence including a first number of request bodies with preset delay times following a preset non-linear pattern.

[0078] S235: Generate a test request sequence based on the new request body sequence.

[0079] In step S231, it should be noted that the system saves the probe request sequence generated by the target request during dual authentication and the corresponding response content after executing the probe request sequence. The system extracts the original request body of the target request, which includes the request body with a delay instruction injected into the target parameters. For example, the original request body is a JSON format object, such as {"productCode":"1) or sleep(10)#1", "quantity": 1}. It can be understood that the probe request is a request that uses the target request as a template and injects a delay instruction into the target parameters. The system can obtain the original request body by extracting the request body from any probe request.

[0080] In step S232, the first prompt word template is used to generate a complete first prompt word in combination with the original request body. The first prompt word template includes a generation rule that generates a preset delay time for the delay instructions of multiple request bodies according to a preset non-linear law. The generation rule is used to prompt a preset large language model to generate a blind injection test payload that meets the requirements. The payload is a malicious code fragment constructed by the attacker and embedded in HTTP request parameters, such as URL parameters, form fields, and cookies. In this embodiment, it is the request body containing multiple injection delay instructions.

[0081] An example, the first prompt word template, is as follows: #Generate a time-based blind injection test payload based on the original payload ## Input (original body, JSON format) %s ## Generation Rules 1. Generate 5 decreasing time payloads (decreasing by a factor of 2: 10s → 5s → 2.5s → 1.25s → 0.625s) 2. Generate 5 increasing time payloads (with the same values ​​as the decreasing sequence but in ascending order). 3. Generated based on the original body 4. Keep all non-time parameters of the original body unchanged. 5. Time injection functions include delay, pg_sleep, etc. ## Output Requirements - Only output directly parsable JSON - Format: {"payloads":[decreasing sequence..., increasing sequence...]} - No non-JSON content (including Markdown, comments, code blocks, etc.) is allowed. The system will fill the original request body into the corresponding position of the first prompt word template to obtain the complete first prompt word. For example, if the original request body is a JSON format object, such as {"productCode":"1) or sleep(10)#1", "quantity":1}, then the complete first prompt word will be obtained as follows: #Generate a time-based blind injection test payload based on the original payload ## Input (original body, JSON format) {"productCode":"1) or sleep(10)#1", "quantity": 1} ## Generation Rules 1. Generate 5 decreasing time payloads (decreasing by a factor of 2: 10s → 5s → 2.5s → 1.25s → 0.625s) 2. Generate 5 increasing time payloads (with the same values ​​as the decreasing sequence but in ascending order). 3. Generated based on the original body 4. Keep all non-time parameters of the original body unchanged. 5. Time injection functions include delay, pg_sleep, etc. ## Output Requirements - Only outputs directly parsable JSON - Format: {"payloads": [decreasing sequence..., increasing sequence...]} - No non-JSON content (including Markdown, comments, code blocks, etc.) is allowed. In step S234, the system sends the first prompt word to a preset large language model, causing the preset large language model to output a new request body sequence. The new request body sequence includes a first number of request bodies with preset delay times following a preset non-linear pattern. The first number can be set according to the detection accuracy; in this embodiment, the first number is set to 10. For example, by sending the first prompt word to the preset large language model, the new request body sequence output by the preset large language model is as follows: { "payloads": [ {"productCode":"1) or sleep(10)#1", "quantity":1}, {"productCode":"1) or sleep(5)#1", "quantity":1}, {"productCode":"1) or sleep(2.5)#1", "quantity":1}, {"productCode":"1) or sleep(1.25)#1", "quantity":1}, {"productCode":"1) or sleep(0.625)#1", "quantity":1}, {"productCode":"1) or sleep(0.625)#1", "quantity":1}, {"productCode":"1) or sleep(1.25)#1", "quantity":1}, {"productCode":"1) or sleep(2.5)#1", "quantity":1}, {"productCode":"1) or sleep(5)#1", "quantity":1}, {"productCode":"1) or sleep(10)#1", "quantity":1} ]} It's important to note that, as shown in the example above, the 10 new request bodies (JSON objects) generated by the preset large language model are structurally identical. The only difference lies in the value of the `productCode` field, where the preset delay time of the `sleep()` instruction strictly follows the preset non-linear "V-shaped" pattern defined in the prompt. All other fields (such as `quantity`) remain unchanged. This ensures that the only variable in the blind SQL injection test is the delay instruction itself, guaranteeing the accuracy of subsequent actual response time analysis.

[0082] In step S235, the system generates a test request sequence based on the new request body sequence. Specifically, based on the probe request from which the original request body was extracted, the system fills each request body in the new request body sequence into the position of the original request body to obtain the corresponding delay test request, and finally generates the test request sequence.

[0083] In some embodiments, the new request body sequence includes a first request body sequence and a second request body sequence. The generation rule for generating a preset delay time of multiple delay instructions in a preset non-linear manner includes: generating a first request body sequence, the first request body sequence including a second number of request bodies whose preset delay times are in a first linear relationship, the second number being half of the first number; generating a second request body sequence, the second request body sequence including a second number of request bodies whose preset delay times are in a second linear relationship, the first linear relationship being the opposite of the second linear relationship.

[0084] In some embodiments, the new request body sequence includes a first request body sequence and a second request body sequence. The new request body sequence includes a first number of request bodies, and both the first and second request body sequences include a second number of request bodies. The second number is equal to half of the first number. For example, if the first number is set to 10, the second number is set to 5.

[0085] The first request body sequence includes a second number of request bodies with preset delay times that are linearly related to a first linear relationship, and the second request body sequence includes a second number of request bodies with preset delay times that are linearly related to a second linear relationship, where the first linear relationship is the opposite of the second linear relationship. For example, if the first linear relationship can be set to linearly increasing, then the second linear relationship is set to linearly decreasing; if the first linear relationship can be set to linearly decreasing, then the second linear relationship is set to linearly increasing. For instance, if the second number is set to 5, and the preset delay times of the delay instructions in the first request body sequence are set to 1s, 2s, 3s, 4s, and 5s respectively, then the preset delay times in the first request body sequence are set to 5s, 4s, 3s, 2s, and 1s respectively.

[0086] In some embodiments, the first linear relationship is that the second number of preset delay times in the first request body sequence decrease by a preset multiple, and the second linear relationship is that the preset delay times of the second request body sequence increase by the same value as the preset delay times of the first linear relationship.

[0087] Specifically, in this embodiment, the preset multiplier is set to 2. The first linear relationship is that the second number of preset delay times in the first request body sequence decrease by a factor of 2, and the second linear relationship is that the preset delay times in the second request body sequence increase by the same value as the preset delay times in the first linear relationship. For example, if the second number is set to 5, "decreasing by a factor of 2" can set the 5 preset delay times in the first request body sequence to 10s, 5s, 2.5s, 1.25s, and 0.625s respectively. Then, "increasing by the same value as the preset delay times in the first linear relationship" can set the 5 preset delay times in the second request body sequence to 0.625s, 1.25s, 2.5s, 5s, and 10s respectively.

[0088] In some embodiments, the latency test result includes a first string containing the response times of all latency test requests. The latency test result is then judged based on a preset large language model to obtain a judgment result, including the following steps: S251: Obtain the second prompt word template.

[0089] S252: Generate a second prompt word based on the first string and the second prompt word template. The second prompt word includes a judgment criterion for determining whether all response times in the first string conform to the preset non-linear law of the generation rules.

[0090] S253: Send the second prompt word to the preset large language model so that the preset large language model outputs the judgment result.

[0091] In step S251, the system retrieves a second prompt word template from the memory. The second prompt word template includes prompt words used for judgment by the preset large language model and prompt words specifying the output format requirements. For example, the second prompt word template is shown below: "## Input data Test payload execution results: %s ## Judgment Criteria 1. The first 5 actual response times should decrease proportionally according to a certain rule. 2. The last 5 actual response times should increase proportionally according to a certain rule. 3. If conditions 1 and 2 are not met, then there is a high probability that the delayed blind SQL injection vulnerability does not exist. 4. A confidence score of 80 or higher indicates a high probability of a delayed blind injection vulnerability. 5. A confidence score below 30 indicates the absence of delayed blind injection vulnerabilities. ## Output Requirements 1. Output format: {"confidence_score": [0-100], / / confidence score "reason": [ / / basis for judgment] "The decrease in response time for the first 5 responses is in line with expectations." The percentage increase in response time for the last five responses was in line with expectations. ] } 2. Strictly prohibit the inclusion of any non-JSON content (including Markdown, comments, code blocks, etc.) In step S252, it should be noted that during the execution of latency test requests, the system records key parameters of each latency test request's interaction process in real time. These key parameters include, but are not limited to, the actual response time, the HTTP status code returned by the server (e.g., 200, 404, 500), and the response body length (Bodylen). The system integrates these recorded parameters according to a preset format, such as a key-value pair sequence or a JSON structure, to generate a structured text string containing all latency test request interaction data. The latency test results use this summarized structured text string as the core carrier, fully covering the execution details of each latency test request.

[0092] The first string is a structured text string. The system will fill the structured text string into the corresponding position in the second prompt word template. As shown in the example above, the structured text string is filled into the "s%" position to obtain the complete second prompt word.

[0093] In step S253, the system inputs the complete second prompt word into a preset large language model. The preset large language model determines the pattern of actual response time in the structured text string and outputs the determination result, which includes a confidence score and the reason for the determination. For example, if the specific content of the structured text string is as follows: "ResponseTime:10.153S, HttpStatusCode:200 Bodylen:1234 ResponseTime:5.081S, HttpStatusCode:200 Bodylen:1234 ResponseTime:2.550S, HttpStatusCode:200 Bodylen:1234 ResponseTime:1.289S, HttpStatusCode:200 Bodylen:1234 ResponseTime:0.651S, HttpStatusCode:200 Bodylen:1234 ResponseTime:0.648S, HttpStatusCode:200 Bodylen:1234 ResponseTime:1.292S, HttpStatusCode:200 Bodylen:1234 ResponseTime:2.533S, HttpStatusCode:200 Bodylen:1234 ResponseTime:5.102S, HttpStatusCode:200 Bodylen:1234 ResponseTime:10.098S, HttpStatusCode:200 Bodylen:1234” The pre-defined large language model will determine the pattern of actual response time in this structured text string, and the output result is shown below: "{"confidence_score": 95,"reason":["The first 5 response times decreased by approximately 2 times", "The last 5 response times increased by approximately 2 times"]}" It should be noted that the second prompt word includes a criterion for determining whether all actual response times in the first string conform to the preset non-linear pattern of the generation rules. The preset large language model will analyze and judge all actual response times in the structured text string based on the judgment criteria in the second prompt word. Understandably, if all actual response times in this structured text string conform to the preset non-linear pattern of the letter "V", the preset large language model will output a high confidence score of "95" and provide the corresponding reasoning.

[0094] This application embodiment, by reasonably setting the second prompt word, enables the preset large language model to output the judgment reason, breaking through the limitations of the "black box" nature of AI models, making it easier for security engineers to understand and audit the AI ​​decision-making process, and improving the reliability and maintainability of the system.

[0095] In some embodiments, the judgment criteria for the second prompt also include prompts that combine HTTP status codes. For example, "If all request status codes are 200, analyze according to the actual response time sequence; if there is a status code of 500, reduce the confidence level and indicate that the test may be blocked by WAF or cause server abnormalities." It should be noted that HTTP status codes are not directly involved in the calculation of the confidence score, but they can prompt the preset large language model to pay attention to HTTP status codes, further making more intelligent judgments and providing more comprehensive judgment reasons.

[0096] In some embodiments, the first prompt word template and the second prompt word template are not fixed. Prompt words can be dynamically generated or the most suitable prompt word template can be selected according to different application scenarios and different request characteristics, so as to make the instructions of the preset large language model more targeted.

[0097] Please see Figure 3 , Figure 3 This is a flowchart illustrating a delayed blind SQL injection detection method according to another embodiment of this application. The delayed blind SQL injection detection method includes two stages: a rapid scanning stage and an intelligent verification stage. In the rapid scanning stage, the detection device establishes a communication connection with the enterprise's internal HTTP traffic entry point to acquire target request traffic, which is the set of HTTP requests to be detected. The system performs dual statistical tests on the target request traffic, including Pearson correlation analysis and continuous difference analysis, similar to the aforementioned dual statistical tests, and will not be elaborated further here. Through dual statistical tests, a large number of non-target requests can be quickly filtered out, and target requests can be pre-screened. Target requests are HTTP requests that pass the dual statistical tests and are suspected of having delayed blind SQL injection vulnerabilities. Non-target requests are HTTP requests that fail the dual statistical tests and do not have delayed blind SQL injection vulnerabilities. Figure 3As shown, if an HTTP request passes the double statistical test, it is determined to be a non-target request; if the HTTP request fails the double statistical test, it is determined to be a target request.

[0098] The second stage is the intelligent verification stage. In this stage, the system verifies the selected target requests using a pre-defined large language model. The intelligent verification stage includes three steps: intelligent payload generation, execution testing, and intelligent judgment. Specifically, the first step is intelligent payload generation. In delayed blind injection testing, the payload is the injection code / instruction that triggers the delayed response of the target system. In step one, the system obtains a first prompt word template and generates a first prompt word based on the original request body in the target request. The first prompt word template includes generation rules that use the original request body as a template to generate a preset non-linear delay time for the delay instructions of multiple request bodies. The preset non-linear law is a rule designed by pre-setting the preset delay time of the delay instructions. The system calls the interface of the pre-defined large language model, inputting the first prompt word into the model, so that the model generates a new request body sequence containing the preset delay times of the delay instructions of multiple request bodies according to the first prompt word, with the preset delay times exhibiting a preset non-linear law. The system then generates corresponding delayed test requests based on each request body and other unchanged content in the target request, resulting in a test request sequence.

[0099] Step two involves executing the test. Specifically, in step two, the system retrieves the original user's identity credentials, including but not limited to session identifier cookies, authentication tokens, and session keys used for user authentication, to simulate a real user's request initiation scenario. The system sequentially tests each delay test request in the test request sequence according to a preset order to obtain the delay test result for each delay test request. During execution, the system records key parameters in real time for each delay test request's interaction process. Key parameters include, but are not limited to, the actual response time and the HTTP status code returned by the server, such as 200, 404, and 500. The system integrates the recorded key parameters according to a preset format, such as a key-value pair sequence or a JSON structure, to generate a structured text string containing the test results of all delay test requests.

[0100] Step three is intelligent judgment. In step three, the system obtains the second prompt word template and generates a second prompt word by combining it with the structured text string. The second prompt word includes a judgment criterion for judging whether all actual response times in the structured text string conform to the preset nonlinear law of the generation rules. The system calls the interface of the preset large language model, inputs the second prompt word into the preset large language model, so that the preset large language model can judge the law of the actual response times in the structured text string and generate a judgment result, including a confidence score. The system checks whether the confidence score of the target request is greater than a first preset confidence threshold, which is 30 points. If the confidence score is greater than the first preset confidence threshold, it is determined that the target request has a delayed blind SQL injection vulnerability, and a vulnerability alarm message is generated. If the confidence score is less than or equal to the first preset confidence threshold, it is determined that the target request does not have a delayed blind SQL injection vulnerability.

[0101] It should be noted that in the above embodiments, there is no necessarily a certain order between the steps. Those skilled in the art can understand from the description of the embodiments of this application that the above steps may have different execution orders in different embodiments, that is, they may be executed in parallel or in turn, etc.

[0102] As another aspect of the embodiments of this application, this application provides a delayed blind betting detection device. The delayed blind betting detection device can be a software module, which includes several instructions stored in a memory. A processor can access the memory and execute the instructions to complete the delayed blind betting detection method described in the various embodiments above.

[0103] In some embodiments, the delay-blind injection detection device can also be constructed from hardware components. For example, the delay-blind injection detection device can be constructed from one or more chips, which can work in coordination to complete the delay-blind injection detection method described in the various embodiments above. As another example, the delay-blind injection detection device can also be constructed from various logic devices, such as general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), microcontrollers, ARM (Acorn RISC Machine) or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination of these components.

[0104] Please see Figure 4 , Figure 4This application provides a delayed blind injection detection device, which includes a traffic acquisition module 401, a double verification module 402, a test request generation module 403, a test request execution module 404, a test result determination module 405, and a vulnerability confirmation module 406.

[0105] The traffic acquisition module 401 acquires target request traffic, which includes multiple HTTP requests. The double verification module 402 performs double statistical verification on the multiple HTTP requests to obtain at least one target request. The test request generation module 403 generates a test request sequence based on the target request and a preset large language model, including multiple delay test requests. The test request execution module 404 executes the multiple delay test requests sequentially to obtain delay test results. The test result judgment module 405 judges the delay test results based on the preset large language model to obtain a judgment result, which includes a confidence score. The vulnerability confirmation module 406 determines that the target request has a delay blind SQL injection vulnerability if the confidence score is greater than a first preset confidence threshold.

[0106] The dual verification module 402 is also specifically used for: generating a corresponding target time series based on each HTTP request; performing dual statistical verification on the target time series, the dual statistical verification including a first verification condition and a second verification condition; and determining the HTTP request as the target request when the target time series simultaneously meets the first verification condition and the second verification condition.

[0107] The target time series includes a first time series and a second time series. The dual verification module 402 is also specifically used for: generating a corresponding probe request sequence for each HTTP request, the probe request sequence including multiple probe requests that inject delay instructions into the target parameters of the HTTP request, the preset delay time of the delay instructions increasing linearly at the same interval; executing the probe requests in sequence, recording the actual response time of all probe requests to obtain the first time series; and obtaining the preset delay time of all probe requests to obtain the second time series.

[0108] The dual verification module 402 is also specifically used for: calculating the target correlation coefficient between the first time series and the second time series; when the target correlation coefficient is greater than a preset threshold, it is determined that the target time series meets the first verification condition; calculating the difference between the actual response times of any two adjacent detection requests to obtain the response time difference; when all response time differences are within the preset error range of the preset delay step, it is determined that the target time series meets the second verification condition.

[0109] The test request generation module 403 is further specifically used for: obtaining the original request body of the target request, the original request body including a request body with a delay instruction injected into the target parameters; obtaining a first prompt word template, the first prompt word template including a generation rule that generates a preset delay time for the delay instructions of multiple request bodies in a preset non-linear manner; generating a first prompt word based on the original request body and the first prompt word template; sending the first prompt word to a preset large language model so that the preset large language model generates a new request body sequence, the new request body sequence including a first number of request bodies with preset delay times in a preset non-linear manner; and generating a test request sequence based on the new request body sequence.

[0110] The test request generation module 403 is also specifically used to: generate a first request body sequence, the first request body sequence including a second number of request bodies with a first linear relationship of preset delay times, the second number being half of the first number; and generate a second request body sequence, the second request body sequence including a second number of request bodies with a second linear relationship of preset delay times, the first linear relationship being the opposite of the second linear relationship.

[0111] The first linear relationship is that the second number of preset delay times in the first request body sequence decrease by a preset multiple, and the second linear relationship is that the preset delay times of the second request body sequence increase by the same value as the preset delay times of the first linear relationship.

[0112] The latency test result includes a first string containing the response times of all latency test requests. The test result determination module 405 is also specifically used to: obtain a second prompt word template; generate a second prompt word based on the first string and the second prompt word template, wherein the second prompt word includes a judgment criterion for judging whether all response times in the first string conform to the preset nonlinear law of the generation rule; and send the second prompt word to a preset large language model so that the preset large language model outputs the determination result.

[0113] It should be noted that the aforementioned delayed blind betting detection device can execute the delayed blind betting detection method provided in the embodiments of this application, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in the embodiments of the delayed blind betting detection device can be found in the delayed blind betting detection method provided in the embodiments of this application.

[0114] Please see Figure 5 , Figure 5 This is a schematic diagram of a detection device provided in an embodiment of this application. The detection device includes one or more processors 51 and a memory 52. ​​The memory 52 is connected to one or more processors, for example, connected to the processor 51 via a bus.

[0115] Processor 51 is configured to support the detection device in performing the corresponding functions in the methods described in the above method embodiments. Processor 51 may be a central processing unit (CPU), a network processor (NP), a hardware chip, or any combination thereof. The aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0116] Memory 52 is used to store program code, etc. Memory 52 may include volatile memory (VM), such as random access memory (RAM); memory 52 may also include non-volatile memory (NVM), such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); memory 52 may also include combinations of the above types of memory.

[0117] The memory 52 can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the program instructions / modules corresponding to the delayed blind injection detection method in the embodiments of this application. The processor 51 executes various functional applications and data processing of the delayed blind injection detection method and the delayed blind injection detection device by running the non-volatile software programs, instructions, and modules stored in the memory, that is, it realizes the functions of each module or unit of the delayed blind injection detection method and the delayed blind injection detection device provided in the above method embodiments.

[0118] The memory 52 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and application programs required for at least one function. The data storage area may store data created based on the use of the delay-based blind betting detection device. In some embodiments, the memory 52 may optionally include memory remotely located relative to the processor, which can be connected to the delay-based blind betting detection device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0119] The one or more modules are stored in the memory. When executed by the one or more processors 51, they perform the delayed blind injection detection method in any of the above method embodiments. For example, they perform the method steps described in the above method embodiments to realize the functions of the modules described in the above device embodiments.

[0120] This application also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method as described in the foregoing embodiments.

[0121] This application also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the method described in the foregoing embodiments.

[0122] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0123] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A delayed blind injection detection method, characterized in that, include: Obtain the target request traffic, which includes multiple HTTP requests; Perform double statistical tests on the multiple HTTP requests to obtain at least one target request; A test request sequence is generated based on the target request and the preset large language model. The test request sequence includes multiple delay test requests. The multiple delay test requests are executed sequentially to obtain the delay test results; The delay test results are judged based on the preset large language model to obtain a judgment result, which includes a confidence score. If the confidence score is greater than the first preset confidence threshold, it is determined that the target request has a delayed blind injection vulnerability.

2. The method according to claim 1, characterized in that, The process of performing a double statistical test on the multiple HTTP requests to obtain at least one target request includes: Generate a corresponding target time series based on each HTTP request; The target time series is subjected to a dual statistical test, which includes a first verification condition and a second verification condition. If the target time series simultaneously satisfies the first verification condition and the second verification condition, then the HTTP request is determined to be the target request.

3. The method according to claim 2, characterized in that, The target time series includes a first time series and a second time series, and the generation of the corresponding target time series based on each HTTP request includes: For each HTTP request, a corresponding probe request sequence is generated. The probe request sequence includes multiple probe requests that inject delay instructions into the target parameters of the HTTP request. The preset delay time of the delay instructions increases linearly at the same time interval. The detection requests are executed sequentially, and the actual response time of all the detection requests is recorded to obtain a first time series. Obtain the preset delay time for all the probe requests to obtain a second time series.

4. The method according to claim 3, characterized in that, The dual statistical test on the target time series includes: Calculate the target correlation coefficient between the first time series and the second time series; If the target correlation coefficient is greater than a preset threshold, then the target time series is determined to meet the first verification condition. Calculate the difference in actual response time between any two adjacent detection requests to obtain the response time difference; If all the response time differences are within the preset error range of the preset delay step, then the target time series is determined to meet the second verification condition.

5. The method according to claim 1, characterized in that, The step of generating a test request sequence based on the target request and a preset large language model includes: Obtain the original request body of the target request, the original request body including the request body into which a delay instruction is injected within the target parameters; Obtain a first prompt word template, the first prompt word template including a generation rule for generating a preset delay time that causes the delay instructions of multiple request bodies to follow a preset non-linear pattern; A first prompt word is generated based on the original request body and the first prompt word template; The first prompt word is sent to the preset large language model so that the preset large language model generates a new request body sequence, the new request body sequence including a first number of request bodies with preset delay times following a preset nonlinear pattern; The test request sequence is generated based on the new request body sequence.

6. The method according to claim 5, characterized in that, The new request body sequence includes a first request body sequence and a second request body sequence, and the generation rule for generating a preset delay time that makes the preset delay time of multiple delay instructions exhibit a preset non-linear pattern includes: Generate a first request body sequence, the first request body sequence comprising a second number of request bodies with a preset delay time that are linearly related to a first number, the second number being half of the first number; Generate a second request body sequence, the second request body sequence including a second number of request bodies with a second linear relationship of preset delay time, the first linear relationship being the opposite of the second linear relationship.

7. The method according to claim 6, characterized in that, The first linear relationship is that the second number of preset delay times in the first request body sequence decrease by a preset multiple, and the second linear relationship is that the preset delay times of the second request body sequence increase by the same value as the preset delay times of the first linear relationship.

8. The method according to any one of claims 5-7, characterized in that, The latency test result includes a first string containing the response times of all the latency test requests. The determination of the latency test result based on the preset large language model to obtain a determination result includes: Get the second prompt word template; A second prompt word is generated based on the first string and the second prompt word template. The second prompt word includes a judgment criterion for determining whether all response times in the first string conform to a preset nonlinear law of the generation rule. The second prompt word is sent to the preset large language model so that the preset large language model outputs a judgment result.

9. A testing device, characterized in that, The device includes a memory and a processor, the memory being connected to the processor, the processor being configured to execute one or more computer programs stored in the memory, the processor causing the detection device to perform the method as described in any one of claims 1-8 when executing the one or more computer programs.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method as described in any one of claims 1-8.

Images