Interactive application security test method, system and equipment based on hybrid expert model and medium

Abstract

The invention discloses an interactive application security test method, system and device based on a hybrid expert model and a medium, and belongs to the technical field of application security tests.The interactive application security test method comprises the steps that when it is detected that data flows from a data source to a sensitive sink, input data and a runtime context are captured, and a security event object is generated; preprocessing a security event object, serializing the security event object into a security event slice, converting the security event slice into a vector representation, performing similarity matching with a historical vector representation, and adopting a historical judgment result when the similarity meets a condition; a plurality of special sub-models are scheduled through a gating network for analysis and weighted fusion to obtain a vulnerability judgment result; and triggering automatic response operation according to the risk level of the detection result. According to the invention, intelligent inheritance of historical detection results is realized, and consumption of computing resources is reduced; through cooperative judgment of the hybrid expert model, the detection accuracy of a complex attack mode is improved; and a DevSecOps safe closed loop is realized through automatic response.

Description

Technical Field

[0001] This invention relates to the field of application security testing technology, and specifically to an interactive application security testing method, system, device, and medium based on a hybrid expert model. Background Technology

[0002] As the DevSecOps concept gains wider acceptance and software delivery speeds continue to increase, traditional static (SAST) and dynamic (DAST) application security testing tools are showing limitations, such as low detection efficiency, a high number of false positives, and difficulty in integrating tightly with the development process. This makes them unsuitable for meeting the security design requirements of modern rapid development. In contrast, interactive application security testing (IAST), by inserting monitoring points during application runtime to monitor data flow in real time, achieves higher precision vulnerability detection and is gradually becoming an important direction in application security testing.

[0003] However, current IAST technology still faces several challenges. Most detection rules rely on regular expressions or simple semantic analysis, offering limited support for complex code obfuscation, logical vulnerabilities, and emerging attack methods. This creates a trade-off between improving detection accuracy and reducing false positives. Furthermore, IAST generates a large number of security events during runtime, many of which are repetitive or similar. Analyzing these events requires significant computational resources, severely impacting application performance and testing efficiency. In addition, traditional IAST systems typically only act as detection tools; high-confidence vulnerabilities still require manual judgment and handling by security experts, failing to achieve an automated security closed loop. This also limits the speed and efficiency of security feedback, making it difficult to seamlessly integrate with enterprise defect management, security operations, and continuous integration / continuous delivery processes.

[0004] To better address the aforementioned issues, this invention proposes a scheme to improve the accuracy of IAST vulnerability detection using a hybrid expert model. A vectorized knowledge base is introduced, enabling deduplication and decision inheritance of past detection results, thereby avoiding repeated analysis of the same events and significantly improving detection efficiency. This invention employs a hybrid expert model (MoE) architecture, composed of multiple sub-models specializing in different vulnerability types, such as SQL injection experts and Remote Code Execution (RCE) experts. These sub-models collaborate to analyze new attack methods, effectively reducing false positives and enhancing the ability to detect unknown vulnerabilities. Through an intelligent scheduling agent, high-confidence detection results are automatically converted into security tickets or risk events, triggering automated CI / CD processes. From vulnerability detection to remediation, this constitutes a complete DevSecOps security closed loop, truly achieving fully automated management. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention provides an interactive application security testing method, system, device and medium based on a hybrid expert model.

[0006] Therefore, the technical problem solved by this invention is: to collect data streams and runtime contexts in real time through IAST probes; to achieve deduplication and inheritance of detection results using a vectorized knowledge base, thereby greatly improving detection efficiency; to accurately determine complex attack patterns using a hybrid expert model, thereby effectively reducing false alarm rates; and to achieve automated linkage with the enterprise security system through intelligent agents, thereby constructing a complete security operation closed loop.

[0007] To address the aforementioned technical problems, this invention provides the following technical solution: an interactive application security testing method based on a hybrid expert model, comprising, Deploy security test probes in the application to be tested, configure monitoring rules for data sources and sensitive sinks, and capture input data and runtime context when data is detected flowing from the data source to the sensitive sink, and generate security event objects. After preprocessing the security event object, it is serialized into a security event slice. The security event slice is converted into a vector representation. The similarity between the vector representation and the historical vector representation in the vector database is calculated. When the similarity meets the preset conditions, the historical judgment result is obtained from the vector database as the detection result. When the similarity does not meet the preset conditions, the security event slice is input into a hybrid expert model for analysis. The hybrid expert model includes a gating network and multiple sub-models dedicated to the analysis of different vulnerability types. The gating network calculates the weight of each sub-model according to the characteristics of the security event slice, schedules the relevant sub-models for analysis, and performs weighted fusion of the outputs of each sub-model to obtain the vulnerability determination result. The detection results, their confidence levels, and corresponding vector representations are associated with security event slices and stored in the vector database. Automated response actions are triggered based on the risk level of the detection results.

[0008] As a preferred embodiment of the interactive application security testing method based on a hybrid expert model described in this invention, the step of preprocessing the security event object and serializing it into security event slices includes: The security event objects are subjected to data cleaning and standardization processing; The processed data is serialized into security event slices according to a predetermined format.

[0009] As a preferred embodiment of the interactive application security testing method based on a hybrid expert model described in this invention, the step of obtaining historical judgment results from the vector database as the current detection result when the similarity meets a preset condition includes: Calculate the similarity value between the vector representation and each historical vector representation in the vector database; Filter out the values ​​with the highest similarity; Determine whether the maximum similarity value is greater than or equal to a preset similarity threshold; When the maximum similarity value is greater than or equal to the preset similarity threshold, the historical judgment result corresponding to the maximum similarity value is retrieved as the detection result for this time.

[0010] The beneficial effects of this preferred technical solution are as follows: by calculating the similarity between the vector representation of a security event and the historical vector representation in the vector database, when the maximum similarity value exceeds a preset threshold, the historical judgment result is directly retrieved and returned, skipping the reasoning process of the hybrid expert model, and avoiding repeated calls to the large language model for in-depth analysis of the same or similar events; since the time complexity of vector similarity calculation is much lower than that of large model reasoning, the processing time for repeated events is reduced from seconds to milliseconds, reducing the consumption of computing resources and reducing the performance interference to the application under test.

[0011] As a preferred embodiment of the interactive application security testing method based on a hybrid expert model described in this invention, the gating network calculates the weights of each sub-model according to the characteristics of the security event slice, and schedules relevant sub-models for analysis, including: The gating network analyzes the characteristics of the security event slices through a weighted calculation mechanism, identifies potential vulnerability types, and calculates the weight values ​​of each sub-model. Based on the weight values, the relevant sub-models are scheduled to perform parallel analysis on the security event slices. The sub-models implement specialized analysis capabilities for different vulnerability types on the shared model through dedicated analysis instructions. Each sub-model outputs a confidence score for its corresponding vulnerability type.

[0012] The beneficial effects of this preferred technical solution are as follows: By using a gating network to identify potential vulnerability types based on the characteristics of security event slices and dynamically calculate the weight values ​​of each sub-model, it enables the adaptive activation of corresponding vulnerability type experts for analysis based on different inputs, avoiding the accumulation of misjudgments caused by all models participating in each detection; by using dedicated analysis instructions on a shared model to achieve specialized analysis capabilities for various types of vulnerabilities, the detection of each type of vulnerability is handled by a specialized model, which has a higher accuracy rate in identifying complex coding obfuscation and logical vulnerabilities compared to traditional detection methods that rely on a single rule set or fixed weight model integration.

[0013] As a preferred embodiment of the interactive application security testing method based on a hybrid expert model described in this invention, the dedicated analysis capabilities include: SQL injection analysis capability is used to analyze whether the input data contains unconventional SQL statement structures, SQL operator combinations, or instruction combinations. Remote code execution analysis capability is used to detect whether the input data contains operating system command separators, command redirection characters, or environment variable manipulation characteristics; Deserialization analysis capabilities are used to identify abnormal serialized object structures, serialization feature characters, or malicious chained call patterns in input data; Cross-site scripting (XSS) analysis capabilities are used to detect whether input data contains unvalidated HTML tags, JavaScript script fragments, or event handlers.

[0014] As a preferred embodiment of the interactive application security testing method based on a hybrid expert model described in this invention, it includes: Obtain the confidence scores output by each sub-model; The final confidence score is obtained by weighting and summing the weight values ​​corresponding to each sub-model with their confidence scores. The vulnerability type and confidence level are determined based on the comparison between the final confidence score and the preset decision threshold.

[0015] As a preferred embodiment of the interactive application security testing method based on a hybrid expert model described in this invention, it includes: Determine whether the risk level and confidence level of the detection result meet the response triggering conditions; When the aforementioned response triggering conditions are met, a work order containing vulnerability details is created through the project management platform's interface and assigned to the appropriate responsible person. Generate standard-format threat intelligence data packets and send them to the security operations platform; The deployment process of the current build task can be terminated through the interruption interface of the continuous integration and continuous deployment process.

[0016] This invention provides an interactive application security testing system based on a hybrid expert model.

[0017] To address the aforementioned technical problems, this invention provides the following technical solution: an interactive application security testing system based on a hybrid expert model, comprising: a probe deployment module, used to deploy security test probes in the application to be tested, configure monitoring rules for data sources and sensitive sinks, and capture input data and runtime context when data is detected flowing from the data source to the sensitive sink, thereby generating a security event object; The vectorization processing module is used to preprocess the security event object and serialize it into a security event slice, and then convert the security event slice into a vector representation. The similarity matching module is used to calculate the similarity between the vector representation and the historical vector representation in the vector database. When the similarity meets the preset conditions, the historical judgment result is obtained from the vector database as the detection result for this time. The vulnerability determination module is used to input the security event slice into a hybrid expert model for analysis when the similarity does not meet the preset conditions. The hybrid expert model includes a gating network and multiple sub-models dedicated to the analysis of different vulnerability types. The gating network calculates the weight of each sub-model according to the characteristics of the security event slice, schedules the relevant sub-models for analysis, and performs weighted fusion of the outputs of each sub-model to obtain the vulnerability determination result. The knowledge base management module is used to associate the detection results, their confidence levels, and corresponding vector representations with security event slices and store them in the vector database. An automated response module is used to trigger automated response operations based on the risk level of the detection results.

[0018] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the interactive application security testing method based on a hybrid expert model.

[0019] The present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the interactive application security testing method based on a hybrid expert model.

[0020] The beneficial effects of this invention are as follows: It adopts a hybrid expert model (MoE) architecture, in which multiple sub-expert models specializing in specific vulnerability types work together to make judgments. Compared with the single detection rule of traditional IAST, it can more accurately identify complex coding obfuscation and logical vulnerabilities, and significantly reduce the false alarm rate. By deduplicating historical detection events through a vectorized knowledge base, the system directly inherits historical judgment results for duplicate or similar security events, avoiding repeated calls to large models and significantly reducing resource consumption and impact on the performance of the tested application. The system has continuous learning capabilities, storing each detection result, whether a false positive or a vulnerability, into the knowledge base, enabling the model to continuously adapt to new application code and attack methods, and the detection capability to evolve over time. By automatically completing the entire process from vulnerability discovery to handling through intelligent scheduling agents, it achieves deep integration with development and security operations processes, greatly improving security operation and maintenance efficiency and truly realizing DevSecOps. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 The present invention provides an overall flowchart of an interactive application security testing method based on a hybrid expert model, which is one embodiment of the present invention.

[0023] Figure 2 The present invention provides a prediction flowchart for an interactive application security testing method based on a hybrid expert model, as an embodiment of the present invention. Detailed Implementation

[0024] To make the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0025] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides an interactive application security testing method based on a hybrid expert model, comprising: Step 101: Deploy a security test probe in the application to be tested, configure monitoring rules for the data source and sensitive sink, and capture the input data and runtime context when data is detected flowing from the data source to the sensitive sink to generate a security event object; Step 102: After preprocessing the security event object, serialize it into a security event slice, convert the security event slice into a vector representation, calculate the similarity between the vector representation and the historical vector representation in the vector database, and when the similarity meets the preset conditions, obtain the historical judgment result from the vector database as the detection result for this time. Step 103: When the similarity does not meet the preset conditions, the security event slice is input into the hybrid expert model for analysis. The hybrid expert model includes a gating network and multiple sub-models dedicated to the analysis of different vulnerability types. The gating network calculates the weight of each sub-model according to the characteristics of the security event slice, schedules the relevant sub-models for analysis, and performs weighted fusion of the outputs of each sub-model to obtain the vulnerability determination result. Step 104: After associating the detection results, their confidence levels, and the corresponding vector representations with the security event slices, store them in the vector database; Step 105: Trigger an automated response operation based on the risk level of the detection results.

[0026] Traditional interactive application security testing faces three core technical challenges: First, a large number of repetitive or similar security events require repeated calls to the detection model for analysis, resulting in huge computational resource consumption and severely impacting application performance. Second, traditional detection rules rely on regular expressions or simple semantic analysis, which have limited ability to identify complex code obfuscation, logical vulnerabilities, and new attack methods, leading to a high false positive rate. Finally, traditional systems only provide detection functions; high-confidence vulnerabilities still require manual judgment and handling by security experts, making it difficult to seamlessly integrate with enterprise defect management, security operations, and continuous integration and continuous deployment processes, thus hindering the achievement of an automated security closed loop. This method deploys probes in the application under test to monitor data flow in real time and capture runtime context. The captured security events are vectorized and matched with historical detection records for similarity, enabling intelligent deduplication and decision inheritance for repetitive events. For novel events, a hybrid expert model is activated for in-depth analysis, and multiple dedicated sub-models are dynamically scheduled through a gating network for collaborative judgment. Finally, based on the risk level of the detection results, response operations such as work order creation, alarm reporting, and deployment blocking are automatically triggered.

[0027] This method achieves intelligent deduplication and decision inheritance of historical detection results by constructing a vectorized knowledge base. When the similarity between the vector representation of a security event and historical records exceeds a preset threshold, the historical judgment result is directly adopted, avoiding repeated calls to the hybrid expert model and significantly reducing computational resource consumption and impact on the performance of the tested application. For novel security events, the weights of each sub-model are dynamically calculated based on event characteristics through a gating network of the hybrid expert model, and relevant experts are scheduled for analysis. Compared with traditional fixed rule or single-model detection methods, this method can more accurately identify complex attack patterns and unknown vulnerability types, effectively reducing the false positive rate and improving the detection accuracy. By associating and storing each detection result and its corresponding vector representation and security event slice in a vector database, the system has continuous learning capabilities, and the detection performance continuously improves with knowledge accumulation. Through intelligent scheduling agents, the system automatically triggers work order creation on the project management platform, alarm reporting in the security operations center, and blocking operations in the continuous integration and continuous deployment process based on the risk level of the detection results. This achieves a fully automated closed loop from vulnerability detection to handling, truly realizing the DevSecOps security operations model.

[0028] Example 2, an embodiment of the present invention, provides an interactive application security testing method based on a hybrid expert model, based on the previous embodiment, comprising: Step 102: After preprocessing the security event object, it is serialized into a security event slice. The security event slice is converted into a vector representation. The similarity between the vector representation and the historical vector representation in the vector database is calculated. When the similarity meets a preset condition, the historical judgment result is obtained from the vector database as the current detection result. This includes the following steps 102.1-102.6: Step 102.1: Perform data cleaning and standardization on the security event objects; Step 102.2: Serialize the processed data into security event slices according to a predetermined format.

[0029] Step 102.3: Calculate the similarity value between the vector representation and each historical vector representation in the vector database; Step 102.4: Filter out the maximum similarity value; Step 102.5: Determine whether the maximum similarity value is greater than or equal to a preset similarity threshold; Step 102.6: When the maximum similarity value is greater than or equal to the preset similarity threshold, retrieve the historical judgment result corresponding to the maximum similarity value as the detection result for this time.

[0030] In this embodiment, step 102 converts the security event slice into a vector representation by: using the all-MiniLM-L6-v2 version of the Sentence-BERT model, which is based on the Transformer architecture and contains a 6-layer encoder with a hidden dimension of 768 in each layer, equipped with 12 attention heads, and fine-tuned using the DeepSec corpus for cybersecurity. The training parameters include a batch size of 16, a learning rate of 2e-5, and 10 training epochs. The optimizer is AdamW with a weight decay of 0.01. The model input is the security event slice text with a maximum length of 256 tokens. The input format is [CLS] + security event description + [SEP] + context label + [SEP], where the context label is used to indicate the vulnerability type. The model output generates a 768-dimensional floating-point vector through an average pooling layer, and each dimension of the vector represents the semantic features of the security event.

[0031] In an optional implementation, in step 102, converting the security event slice into a vector representation can be achieved by: using the TF-IDF feature extraction method, statistically analyzing the term frequency-inverse document frequency values ​​of each term in the security event slice, constructing a vocabulary, calculating the TF-IDF weight of each term in the vocabulary for each security event slice, and generating a sparse feature vector representation. This method is computationally simple but has limited semantic understanding capabilities.

[0032] In another alternative implementation, in step 102, converting the security event slice into a vector representation can also be achieved by using a locality-sensitive hashing method, which maps the security event slice to a fixed-length binary code through multiple independent hash functions. Similar security event slices are mapped to similar hash values. This method is suitable for fast approximate matching of large-scale data, but its accuracy is slightly lower than that of deep learning models.

[0033] In this embodiment of the application, in step 102, the similarity between the vector representation and the historical vector representation in the vector database is calculated by: using the cosine similarity calculation method to calculate the cosine value of the angle between the new vector and the historical vector. The calculation formula is that the similarity is equal to the dot product of vector A and vector B divided by the product of the magnitude of vector A and the magnitude of vector B. The value range is from negative one to positive one. The closer the value is to positive one, the more similar the two vectors are. By traversing all historical vectors in the vector database to calculate the cosine similarity value, the maximum similarity value is selected and compared with a preset similarity threshold. When the maximum similarity value is greater than or equal to the threshold, it is determined to be a historical recurrence event.

[0034] In an optional implementation, in step 102, the similarity between the vector representation and the historical vector representation in the vector database can be calculated by: using the Euclidean distance calculation method to calculate the straight-line distance between the two vectors in the high-dimensional space. The smaller the distance, the more similar the two vectors are. By calculating the Euclidean distance between the new vector and each historical vector, the minimum distance value is selected and compared with a preset distance threshold. When the minimum distance value is less than or equal to the threshold, it is determined to be a historical recurrence event.

[0035] In another optional implementation, in step 102, the similarity between the vector representation and the historical vector representation in the vector database can also be calculated by: using the Manhattan distance calculation method to calculate the sum of the absolute values ​​of the differences in each dimension of the two vectors. The smaller the distance, the more similar the two vectors are. By calculating the Manhattan distance between the new vector and each historical vector, the minimum distance value is selected and compared with a preset distance threshold.

[0036] Step 103: When the similarity does not meet the preset conditions, the security event slice is input into a hybrid expert model for analysis. The hybrid expert model includes a gating network and multiple sub-models dedicated to analyzing different vulnerability types. The gating network calculates the weights of each sub-model based on the characteristics of the security event slice, schedules relevant sub-models for analysis, and performs weighted fusion of the outputs of each sub-model to obtain the vulnerability determination result. This includes the following steps 103.1-103.6: Step 103.1: The gating network analyzes the characteristics of the security event slices through a weighted calculation mechanism, identifies potential vulnerability types, and calculates the weight values ​​of each sub-model; Step 103.2: Based on the weight value, schedule the relevant sub-models to perform parallel analysis on the security event slices. The sub-models implement specialized analysis capabilities for different vulnerability types on the shared model through dedicated analysis instructions. Step 103.3: Each sub-model outputs its corresponding vulnerability type confidence score.

[0037] Step 103.4: Obtain the confidence scores of each sub-model output; Step 103.5: Calculate the weight values ​​of each sub-model and their confidence scores by weighted summation to obtain the final confidence score; Step 103.6: Determine the vulnerability type and confidence level based on the comparison result between the final confidence score and the preset decision threshold.

[0038] In this embodiment of the application, in step 103.1, the weight calculation mechanism is as follows: the gating network uses the Softmax function to normalize the input features. The gating network first extracts features from the vector representation of the security event slice, maps the input vector to the output space of the same dimension as the number of sub-models through a fully connected layer, and then applies the Softmax function to each dimension of the output vector to calculate the normalized probability distribution, thereby obtaining the weight value of each sub-model. The sum of all weight values ​​is one. The weight value represents the relevance strength of each sub-model to the current input, and the sub-model with higher weight is given greater influence.

[0039] In an optional implementation, in step 103.1, the weight calculation mechanism can be achieved by: adopting a weight allocation method based on an attention mechanism, dynamically determining the weight allocation by calculating the attention score between the query vector and the key vector of each sub-model, firstly using the vector representation of the security event slice as the query vector, and the feature vector of each sub-model as the key vector, calculating the dot product of the query vector and each key vector to obtain the attention score, and normalizing the attention score to obtain the weight value of each sub-model.

[0040] In another optional implementation, in step 103.1, the weight calculation mechanism can also be achieved by: adopting a fixed weight allocation strategy, pre-setting fixed weight values ​​for each sub-model based on historical statistical data or expert experience, for example, setting the weight of SQL injection expert to 0.3, the weight of remote code execution expert to 0.25, the weight of deserialization expert to 0.2, the weight of cross-site scripting expert to 0.15, and the weight of other experts to 0.1. The fixed weights are not dynamically adjusted with the input. This method is simple to implement but has low flexibility.

[0041] In this implementation, in step 103.2, the dedicated analysis instruction is implemented as follows: each sub-model shares a unified LLM backbone network using the Minimax-m2 model. Expert functions are differentiated through differentiated prompt engineering. Each expert prompt adopts a structured design, including four parts: role definition, task description, analysis framework, and output format. Taking SQL injection expert as an example, the role is defined as senior SQL security analyst, the task description is to analyze the SQL injection risk in the input, the analysis framework includes identifying user input points, detecting unfiltered parameters, analyzing SQL concatenation patterns, and assessing the injection probability, and the output format is a standardized JSON structure containing confidence level, risk level, and evidence chain. Through the LangChain framework, the intelligent routing module determines the most relevant vulnerability type and selects the corresponding expert prompt based on the semantic features of security event slices through a classifier. Each expert obtains the same temperature parameter of 0.3 and a maximum generation length of 2500.

[0042] In an optional implementation, in step 103.2, the dedicated analysis instructions can be implemented by: training an independent deep learning classification model for each vulnerability type, with each model employing a different network architecture and parameters; using a BERT-based sequence classification model for SQL injection experts, a CNN-based text classification model for remote code execution experts, and an RNN-based sequence labeling model for deserialization experts; each model is trained and deployed independently; after inputting security event slices, each model processes them in parallel and outputs the confidence score for the corresponding vulnerability type.

[0043] In another optional implementation, in step 103.2, the dedicated analysis instructions can also be implemented by: building an expert system based on a rule engine, predefining a set of detection rules for each vulnerability type, including regular expression matching, keyword detection, syntax analysis, and context judgment. The rules for SQL injection experts include detecting features such as SQL keywords, single quotes, and comment characters, while the rules for remote code execution experts include detecting features such as command separators, pipe characters, and redirection characters. The rule engine is used to perform pattern matching on security event slices, and the more rules that are met, the higher the confidence level.

[0044] It should be noted that the specialized analysis capabilities include: SQL injection analysis capabilities, used to analyze whether the input data contains unconventional SQL statement structures, SQL operator combinations, or instruction combinations; Remote code execution analysis capability is used to detect whether the input data contains operating system command separators, command redirection characters, or environment variable manipulation characteristics; Deserialization analysis capabilities are used to identify abnormal serialized object structures, serialization feature characters, or malicious chained call patterns in input data; Cross-site scripting (XSS) analysis capabilities are used to detect whether input data contains unvalidated HTML tags, JavaScript script fragments, or event handlers.

[0045] Step 105: Triggering an automated response operation based on the risk level of the detection results includes the following steps 105.1-105.4: Step 105.1: Determine whether the risk level and confidence level of the detection result meet the response triggering conditions; Step 105.2: When the response triggering condition is met, create a work order containing vulnerability details through the project management platform interface and assign it to the corresponding person in charge; Step 105.3: Generate a standard-format threat intelligence data packet and send it to the security operations platform; Step 105.4: Terminate the deployment process of the current build task through the interruption interface of the continuous integration and continuous deployment process.

[0046] Example 3, an embodiment of the present invention, provides an interactive application security testing method based on a hybrid expert model, based on the previous embodiment, comprising: Step 201: Deploy an interactive application security test probe on the application server to be tested, and configure monitoring rules for the data source and sensitive nodes.

[0047] Step 201.1: Configure the interactive application security test management platform and define the source rule set and sink rule set.

[0048] The source point rule set includes, but is not limited to, the methods javax.servlet.http.HttpServletRequest.getParameter() and java.io.InputStream.read().

[0049] The remittance rule set includes, but is not limited to, the methods java.sql.Statement.execute(), java.lang.Runtime.exec(), and javax.script.ScriptEngine.eval().

[0050] Step 201.2: Based on the source and sink rule sets, a collection probe is non-destructively implanted into the bytecode of the target Java application using JavaAgent technology.

[0051] Step 201.3: Start the Java application, and the probe will then take effect and begin monitoring the data flow.

[0052] Step 202: The probe monitors the data flow during application runtime. When it detects data flowing from the data source to the sensitive sink, it triggers the detection process as follows.

[0053] Step 202.1: When the probe detects that data flows in from any defined source and eventually arrives at any defined sink, the data flow tracking mechanism is triggered.

[0054] Step 202.2: The probe immediately suspends the current thread and intercepts the input data that is about to be passed to the sink.

[0055] Step 202.3: Simultaneously, capture the current runtime context and generate a snapshot, which includes at least: call stack backtrace information, parameter values ​​passed to the sink, and the local variable table of the current thread.

[0056] Step 202.4: Encapsulate the input data and the runtime context snapshot together into a raw security event object.

[0057] Step 203: Standardize and vectorize the original security event objects. The specific process is as follows.

[0058] Step 203.1: Perform data cleaning and standardization preprocessing on the original security event objects.

[0059] Redundant content such as irrelevant whitespace characters and newlines in the original data is removed to reduce noise interference; all characters are converted to lowercase to ensure text format consistency; URL encoding (e.g., %20 is converted to a space) and Unicode escape sequences (e.g., \u003c is converted to <) are decoded to restore their readable text form. This step aims to eliminate data heterogeneity and lay the foundation for subsequent vectorization processing.

[0060] Step 203.2: Serialize the preprocessed structured data into a standardized, fixed-format plaintext security event slice.

[0061] The serialization process follows a predefined template, organizing key elements of a security event (such as HTTP request methods, parameters, call stack information, and vulnerability context) into text fragments of a uniform format. For example, an SQL injection event is serialized into the following data slice: This fixed format ensures that all security event slices have a consistent structure, facilitating model parsing.

[0062] Step 203.3: This solution is based on the open-source Sentence-BERT model (specifically using the all-MiniLM-L6-v2 version). This model adopts a Transformer architecture, contains a 6-layer encoder, each layer has a hidden dimension of 768, and is equipped with 12 attention heads. Considering the specificities of the cybersecurity field, the model has been improved and adapted as follows.

[0063] Step 203.3a: Domain-specific training.

[0064] The model was fine-tuned using the DeepSec corpus, a dedicated dataset for cybersecurity. Training parameters included a batch size of 16, a learning rate of 2e-5, 10 training epochs, and the AdamW optimizer with a weight decay of 0.01. After fine-tuning, the model's semantic understanding of security terms (such as injection and dessertization) was significantly improved.

[0065] Step 203.3b: Input / output design.

[0066] The model input consists of security event slices of text, with a maximum length of 256 tokens. The input format is [CLS] + security event description + [SEP] + context label + [SEP], where the context label indicates the vulnerability type (e.g., SQLi, RCE). The model output is a 768-dimensional floating-point vector generated through a mean pooling layer. Each dimension of the vector represents the semantic features of the security event; for example, dimensions 0-255 capture grammatical patterns, dimensions 256-511 associate attack techniques, and dimensions 512-767 encode the context risk level.

[0067] Step 204: Convert the data slices into high-dimensional vector representations and perform similarity matching with historical vectors stored in the vector database. The process is as follows.

[0068] Step 204.1: Calculate the cosine similarity between the new vector obtained in step 203.3 and all existing vector representations in the vector database.

[0069] Step 204.2: Filter out the maximum similarity value Sim_max; determine whether Sim_max is greater than or equal to the preset similarity threshold θ.

[0070] Step 204.3: If the determination is yes, then the event is determined to be a historical recurrence event. The historical determination results and confidence levels associated with the vector corresponding to Sim_max are directly retrieved from the vector database and used as the final output of this detection. Then, the process jumps to step 207.

[0071] Step 204.4: If the determination is negative, then the event is determined to be a novel event, and step 205 is executed.

[0072] It should be noted that the similarity threshold is between 95% and 99%. The confidence threshold used in this system was determined through empirical threshold optimization. A comprehensive threshold scanning experiment was conducted on the validation set. After three rounds of testing, totaling (29+21+6)*3=168 experiments, the average similarity of the slices from the appropriate vector database was found to be 0.973220578, 0.983106857, and 0.963717512, respectively. In practical applications, the threshold similarity will be dynamically selected based on the testers' level of concern regarding false positives and false negatives.

[0073] Step 205: Call the hybrid expert model to determine the data slice, as follows.

[0074] Step 205.1: Input the security event slices obtained in step 203.2 into the hybrid expert model; the specific processing is as follows.

[0075] Step 205.1a: Model architecture design.

[0076] The hybrid expert model is based on a unified LLM backbone network (using the Minimax-m2 model) and achieves expert function differentiation through a prompt project. The architecture comprises three core components: an intelligent routing module that uses the semantic features of security event slices to determine the most relevant vulnerability types through a classifier and selects the corresponding expert prompts; an expert prompt set containing specially designed prompt templates for different vulnerability types, such as SQL injection expert prompts containing instructions for SQL syntax analysis and injection pattern recognition, and command execution expert prompts containing instructions for system command parsing and dangerous function detection; and a results integration module that weights and fuses the outputs of each expert to generate the final vulnerability detection results.

[0077] Step 205.1b: Expert prompt design mechanism.

[0078] Each expert prompt employs a structured design, comprising four parts: role definition, task description, analysis framework, and output format. Taking an SQL injection expert as an example, the role is defined as a senior SQL security analyst; the task description is to analyze SQL injection risks in input; the analysis framework includes identifying user input points, detecting unfiltered parameters, analyzing SQL concatenation patterns, and assessing the likelihood of injection; and the output format is a standardized JSON structure containing confidence levels, risk grades, and chains of evidence. All expert prompts share the same LLM parameters, with functional specialization achieved through differentiated instructions.

[0079] Step 205.1c: Model processing adopts a serialization workflow.

[0080] First, the routing module analyzes the input vector and selects the top-k relevant experts; then, the corresponding expert prompts are called in parallel, and each expert obtains the same temperature parameter (temperature=0.3) and maximum generation length (max_tokens=2500).

[0081] Step 205.2: The gating network of the hybrid expert model first learns the input features and calculates a set of expert weight vectors through a Softmax function. ,in .

[0082] Step 205.3: The LangChain framework orchestrates and schedules multiple sub-expert models specializing in different vulnerability types to process the same input in parallel; each sub-expert model is driven by a dedicated prompt word project or fine-tuned version built for a large language model or deep learning model, including but not limited to the following expert models.

[0083] SQL injection expert models analyze input to identify SQL syntax obfuscation attacks by analyzing whether the input contains unconventional SQL statement structures, operator or instruction combinations.

[0084] The RCE (Remote Code Execution) expert model detects whether operating system command delimiters (such as |, &, ;) or subcommands are mixed in in a non-command execution context, and whether there are suspicious redirection characters or environment variable manipulations.

[0085] Deserialization expert models identify abnormal serialized object structures, characteristic characters, or chained calls in data streams that may trigger malicious code execution.

[0086] The XSS (Cross-Site Scripting) expert model analyzes whether the input contains unvalidated HTML, JavaScript script fragments, or event handlers.

[0087] The SSRF (Server-Side Request Forgery) expert model detects whether the input contains an internal IP address, a special URL schema, or parameters that can be used to manipulate the server to issue internal requests.

[0088] The path traversal and file upload expert model analyzes the input for the presence of .. / sequences, absolute paths, null byte injections, or suspicious file extensions to identify unauthorized file access or malicious file upload behavior.

[0089] Step 205.4: Each sub-expert model outputs its confidence score for its specialized vulnerability type. .

[0090] Step 205.5: The gated network performs weighted fusion of the confidence scores to calculate the final confidence score. The vulnerability type with the highest confidence level is selected as the candidate judgment result.

[0091] Step 205.6: If S is higher than the preset decision threshold, output the candidate decision result as the final decision result; otherwise, output a false alarm.

[0092] Step 206: Record the final result of this test and update the knowledge base. The process is as follows.

[0093] Step 206.1: Associate the final judgment result generated in step 205 or step 204, its confidence score, the vector representation in step 203.3, and the security event slice in step 203.2 to form a quadruple knowledge entry.

[0094] Step 206.2: Unconditionally persist the quadruple knowledge entries to the vector database.

[0095] Step 207: The intelligent scheduling agent executes subsequent security closed-loop linkage based on the final judgment result, as follows.

[0096] Step 207.1: The intelligent scheduling agent receives the final judgment result and confidence score.

[0097] Step 207.2: If the final determination result is a high-risk vulnerability and the confidence score exceeds the operation threshold, the Agent executes the following automated response.

[0098] Step 207.2a: Automatically create a ticket containing vulnerability details via JiraRESTAPI and assign it to the appropriate development manager.

[0099] Step 207.2b: Generate a threat intelligence data packet conforming to the STIX 2.1 standard format and report it to the security operations center platform.

[0100] Step 207.2c: In the Jenkins CI / CD pipeline, invoke the interrupt plugin to force the current build task to fail and terminate the deployment process.

[0101] Example 4, refer to Figure 2 This invention provides an interactive application security testing method based on a hybrid expert model, as one embodiment of the present invention.

[0102] This embodiment implements the invention on a Java Web application (version 2.7.0) developed based on the Spring Boot framework. This application provides functions such as user login, data query, and file upload, and is deployed on a Linux application server with OpenJDK 11 installed. The management agent and analysis engine of this invention are deployed on another dedicated server within the same local area network, and the two communicate with each other at high performance via the gRPC protocol.

[0103] Step 301: IAST probe deployment and data flow monitoring: Step 3011: Operations personnel configure source and sink rules through the management platform. In this embodiment, key source points include: (Used to retrieve HTTP parameters) (Used to obtain file upload streams). Key rendezvous points include: (For SQL execution) (Used for system command execution) (Used for file writing).

[0104] The packaged IAST probe (a JAR file) is loaded as a JavaAgent in the application startup command: After the application starts, the probe, based on the ASM bytecode manipulation framework, instrumentes the configured source and sink methods to inject monitoring logic.

[0105] Step 302: Data Stream Tracing and Context Capture: When a user submits a query parameter via a web interface When a request is made, this parameter is... (Source point) is obtained and ultimately passed in. (Huidian) Execution.

[0106] Upon detecting this data stream, the probe immediately suspends the current HTTP thread and intercepts the SQL string passed to the execute() method. and parameter values At the same time, it captures the current call stack (including class names and method names of the Service layer and DAO layer), local variables, and other information, and encapsulates them into a SecurityEvent object.

[0107] Step 303: Security Incident Preprocessing and Vectorization: The data preprocessing module receives the SecurityEvent object. The preprocessing unit first processes the input... Standardize it: convert it to lowercase. Then, the serialization unit performs URL decoding (no decoding is needed in this example). Subsequently, the serialization unit combines the input data with the call stack context (e.g., ...). Combine these elements to generate a plaintext security event slice, in the following format: .

[0108] Vectorization units load pre-trained The model (a lightweight version of Sentence-BERT) converts the above plaintext slices into a 384-dimensional floating-point vector (e.g.: ).

[0109] Step 304: Vector Similarity Matching and Decision Inheritance The similarity calculation unit calculates the cosine similarity between the new vector and all existing vectors in the vector database (e.g., 100,000 vectors from historical records). After calculation, the highest similarity value is selected. =0.92. Since 0.92 > 0.8 (preset threshold θ), it is determined to be a historical recurrence event. The system directly retrieves the historical judgment results associated with this high similarity vector from the database: This result is then used as the final output of this detection, and the process proceeds to step 307. This process avoids calling computationally intensive models and takes only 5 milliseconds.

[0110] Step 305: Hybrid Expert Model Arbitration Analysis (Novel Event Path): Suppose another new input If a file path operation is triggered and its vector has a similarity of only 0.65 (<0.8) to the most similar historical vector in the database, it is considered a novel event.

[0111] Step 3051: The gating network calculates weights and analyzes the type of vulnerability of the current input to determine which expert should be trusted more.

[0112] The security event slices are input into a hybrid expert model. This embodiment uses a MoE system built on the LangChain framework. A gating network (a small neural network) analyzes the input features and calculates expert weight vectors, for example: .

[0113] This means the model believes there is an 85% chance that the current input is a path traversal, a 10% chance that it is an XSS, and a 5% chance that it is an RCE.

[0114] Step 3052: Each expert model independently calculates its confidence score. Each expert focuses only on its own domain and outputs a score representing its level of confidence.

[0115] Each expert outputs a confidence score (usually between 0 and 1).

[0116] SQLi expert: Output 0.95 (it is very certain that this is SQL injection); RCE expert: Output 0.20 (it doesn't think this is very likely command execution); Deserialization expert: Output 0.01 (which almost completely rules out the possibility of deserialization).

[0117] Step 3053: Based on this weight, the LangChain framework prioritizes the path traversal expert model for analysis. This expert model is driven by the CodeBERT model, which has been fine-tuned through numerous path traversal vulnerability samples. Its dedicated prompt template is: Analyze if the input '{input}' contains path traversal sequences (e.g., '..%2f', '\\..\\') to escape the intended directory. Output confidence score between 0 and 1. After model analysis, the gating network performs weighted fusion of the outputs. Detailed process of weighted fusion: The final overall confidence score S is the weighted sum of each expert's confidence score and its corresponding weight. Calculation: S = in, It is the weight assigned to the nth expert by the gating network. This is the confidence score output by the nth expert. Substituting into an example: S = The system obtained a final confidence score after fusion. This score is compared to a preset decision threshold (e.g., 0.7). If it exceeds the decision threshold (0.7), the final determination is a path traversal vulnerability. If the error occurs, it is considered a false alarm or a security breach. The decision threshold here is recommended based on the average Mixconfidence of the test cases. .

[0118] Step 306: Unsupervised incremental learning of the knowledge base Regardless of whether the result is inherited (step 304) or determined by the model (step 305), the system will perform a learning operation. The quadruple of this event will be: Unconditionally and asynchronously persist the data to the Chroma vector database to expand the knowledge base.

[0119] Step 307: Intelligent Response and Security Closed-Loop Linkage: The intelligent scheduling agent receives the final judgment result: {SQL injection, 0.828}. Since the confidence level of 0.828 > 0.8 (operation threshold), and SQL injection is a high-risk vulnerability, the agent automatically triggers the following actions: Create a high-priority vulnerability ticket using the Jira Python library, with the title: The work order will then be assigned to the corresponding development team leader.

[0120] Generate a matching Standard JSON data packets, via The request was sent to the deployment. The platform generates an alert in the console.

[0121] Query the currently executing build task ID via Jenkins' REST API and call it immediately. The interface terminates the deployment process of this task.

[0122] Thus, this invention completes a fully automated closed loop from vulnerability detection, analysis, learning to handling.

[0123] In summary, to address the issues of high false positives, low efficiency, and insufficient automation in interactive application security testing, this invention designs an intelligent vulnerability detection method and device based on a hybrid expert model and a vectorized knowledge base. In this invention, the IAST probe monitors the application's runtime data flow in real time using non-destructive instrumentation technology, accurately capturing the complete propagation path and runtime context from the source to the sink, forming standardized security event slices. A pre-trained model converts these security event slices into high-dimensional vector representations, and a vectorized knowledge base is used for similarity matching, enabling intelligent inheritance of historical detection results and significantly avoiding redundant model calculations, thus improving detection performance. For novel attack patterns, a gated network schedules sub-expert models specializing in different vulnerability types for collaborative in-depth analysis, employing a weighted fusion mechanism to generate high-confidence judgment results, significantly reducing the false positive rate and improving the ability to detect unknown vulnerabilities. An intelligent scheduling agent automatically converts high-confidence vulnerabilities into security work orders, risk event reports, and CI / CD pipeline blocking operations, achieving a fully automated DevSecOps closed loop from vulnerability discovery to resolution, effectively improving enterprise security operation efficiency.

[0124] Example 5 is an embodiment of the present invention. This embodiment provides an interactive application security testing system based on a hybrid expert model, including: a probe deployment module, used to deploy security test probes in the application to be tested, configure monitoring rules for data sources and sensitive sinks, capture input data and runtime context when data is detected flowing from the data source to the sensitive sink, and generate a security event object; The vectorization processing module is used to preprocess the security event object and serialize it into a security event slice, and then convert the security event slice into a vector representation. The similarity matching module is used to calculate the similarity between the vector representation and the historical vector representation in the vector database. When the similarity meets the preset conditions, the historical judgment result is obtained from the vector database as the detection result for this time. The vulnerability determination module is used to input the security event slice into a hybrid expert model for analysis when the similarity does not meet the preset conditions. The hybrid expert model includes a gating network and multiple sub-models dedicated to the analysis of different vulnerability types. The gating network calculates the weight of each sub-model according to the characteristics of the security event slice, schedules the relevant sub-models for analysis, and performs weighted fusion of the outputs of each sub-model to obtain the vulnerability determination result. The knowledge base management module is used to associate the detection results, their confidence levels, and corresponding vector representations with security event slices and store them in the vector database. An automated response module is used to trigger automated response operations based on the risk level of the detection results.

[0125] This embodiment also provides an electronic device applicable to an interactive application security testing method based on a hybrid expert model, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the interactive application security testing method based on a hybrid expert model as proposed in the above embodiment.

[0126] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements an interactive application security testing method based on a hybrid expert model as proposed in the above embodiments.

[0127] The storage medium proposed in this embodiment and the method for implementing an interactive application security testing method based on a hybrid expert model proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0128] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0129] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for interactive application security testing based on hybrid expert models, characterized in that: The application relates to a security event detection method and device. In a to-be-detected application, a security test probe is deployed, a data source and a monitoring rule of a sensitive sink are configured, input data and a runtime context are captured when data is detected to flow from the data source to the sensitive sink, a security event object is generated, the security event object is preprocessed and then serialized into a security event slice, the security event slice is converted into a vector representation, similarity between the vector representation and historical vector representations in a vector database is calculated, and a historical judgment result is obtained from the vector database as a detection result of this time when the similarity meets a preset condition. When the similarity does not meet the preset condition, the security event slice is input into a mixed expert model for analysis, the mixed expert model comprises a gating network and a plurality of sub-models that are specially used for analysis of different vulnerability types, the gating network calculates weights of the sub-models according to features of the security event slice, relevant sub-models are scheduled for analysis, and a vulnerability judgment result is obtained by weighted fusion of outputs of the sub-models. The detection result, a confidence thereof and corresponding vector representation and security event slice are associated and stored into the vector database. An automatic response operation is triggered according to a risk level of the detection result. The preprocessing of the security event object and the serialization into the security event slice comprise the following steps.

2. The method of claim 1, wherein the method is based on a hybrid expert model. The preprocessed data is serialized into the security event slice in a predetermined format. The obtaining of the historical judgment result as the detection result of this time when the similarity meets the preset condition comprises the following steps. Similarity values between the vector representation and historical vector representations in the vector database are calculated.

3. The interactive application security testing method based on a hybrid expert model as described in claim 2, characterized in that: The maximum similarity value is screened out. It is judged whether the maximum similarity value is greater than or equal to a preset similarity threshold. When the maximum similarity value is greater than or equal to the preset similarity threshold, a historical judgment result corresponding to the maximum similarity value is retrieved as the detection result of this time. The gating network calculates the weights of the sub-models according to the features of the security event slice and schedules relevant sub-models for analysis, which comprises the following steps. The gating network analyzes the features of the security event slice through a weight calculation mechanism, identifies potential vulnerability types and calculates weight values of the sub-models.

4. The method of claim 3, wherein the method further comprises: Relevant sub-models are scheduled for parallel analysis of the security event slice according to the weight values, the sub-models realize special analysis capabilities for different vulnerability types on a shared model through special analysis instructions. Each sub-model outputs a confidence score of a corresponding vulnerability type. The special analysis capabilities comprise the following capabilities. SQL injection analysis capability is used for analyzing whether irregular SQL statement structures, SQL operator combinations or instruction combinations are contained in input data.

5. The method of claim 4, wherein the method further comprises: determining whether the application is a malicious application based on the result of the testing. 5 Remote code execution analysis capability is used for detecting whether operating system command separators, command redirection symbols or environment variable manipulation features are contained in input data. Deserialization analysis capability is used for identifying abnormal serialization object structures, serialization feature characters or malicious chain call patterns in input data. ​ ​ Cross-site scripting analysis capability for detecting whether unverified HTML tags, JavaScript script fragments, or event handlers are included in input data.

6. The method of claim 5, wherein the method further comprises: The outputs of the sub-models are weighted and fused to obtain a vulnerability determination result, including: Obtaining confidence scores output by each sub-model; Weighted sum of the weight value corresponding to each sub-model and its confidence score to obtain a final confidence score; According to the comparison result of the final confidence score and the preset decision threshold, determine the vulnerability type and confidence.

7. The interactive application security testing method based on a hybrid expert model as described in claim 6, characterized in that: The risk level of the detection result triggers an automatic response operation, including: Determine whether the risk level and confidence of the detection result meet the response trigger condition; When the response trigger condition is met, create a work order containing vulnerability details through the interface of the project management platform and assign it to the corresponding responsible person; Generate a threat intelligence data packet in a standard format and send it to a security operations platform; Terminate the deployment process of the current build task through the interruption interface of the continuous integration continuous deployment process.

8. A system for interactive application security testing based on hybrid expert model, applying a method for interactive application security testing based on hybrid expert model as claimed in any one of claims 1 to 7, characterized in that, Including: A probe deployment module for deploying security test probes in the application to be detected, configuring monitoring rules for data sources and sensitive sinks, capturing input data and runtime context when detecting data flowing from data sources to sensitive sinks, and generating security event objects; A vectorization processing module for pre-processing the security event objects and serializing them into security event slices, and converting the security event slices into vector representations; A similarity matching module for calculating the similarity between the vector representation and the historical vector representation in the vector database, and obtaining the historical determination result from the vector database as the detection result when the similarity meets the preset condition; A vulnerability determination module for inputting the security event slice into a hybrid expert model for analysis when the similarity does not meet the preset condition, the hybrid expert model including a gating network and a plurality of sub-models dedicated to analysis of different vulnerability types, the gating network calculating the weight of each sub-model according to the characteristics of the security event slice, scheduling related sub-models for analysis and weighting and fusing the outputs of each sub-model to obtain a vulnerability determination result; A knowledge base management module for associating the detection result, its confidence and corresponding vector representation and security event slice and storing them in the vector database; An automatic response module for triggering an automatic response operation according to the risk level of the detection result. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to realize the steps of the interactive application security testing method based on the hybrid expert model in any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the interactive application security testing method based on the hybrid expert model in any one of claims 1 to 7.

Images