Vulnerability detection method and device, equipment and medium

Abstract

The invention discloses a vulnerability detection method and apparatus, a device and a medium. The method comprises the steps of obtaining a weak feature vulnerability suspicious value corresponding to to-be-detected traffic data output by a target large model; context association analysis is carried out based on a target event node in a behavior graph, an association path corresponding to the target event node is obtained, the behavior graph is constructed based on multiple pieces of traffic data including the to-be-detected traffic data, and the target event node is an event node corresponding to the to-be-detected traffic data; determining a behavior association value corresponding to the to-be-detected traffic data based on the association path; and determining a vulnerability detection result of the to-be-detected traffic data based on the weak feature vulnerability suspicious value and the behavior association value. Therefore, the accuracy of vulnerability detection can be improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a vulnerability detection method, apparatus, device, and medium. Background Technology

[0002] Currently, methods for detecting weak-feature vulnerabilities mainly fall into two categories. One category uses rule-based detection, but due to the limited expressive power of rules, it cannot accurately distinguish between business requests and attacks, and it can only detect known vulnerabilities, not unknown ones. The other category uses machine learning to model business processes to detect vulnerabilities. While it has some ability to detect unknown vulnerabilities, its semantic understanding is weak, making it prone to false positives.

[0003] Therefore, how to improve the accuracy of vulnerability detection is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a vulnerability detection method, apparatus, device, and medium that can improve the accuracy of vulnerability detection. The specific solution is as follows:

[0005] Firstly, this application provides a vulnerability detection method, including:

[0006] Obtain the weak feature vulnerability and suspicious value corresponding to the traffic data to be detected output by the target large model;

[0007] Context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node. The behavior graph is constructed based on multiple traffic data including the traffic data to be detected, and the target event node is the event node corresponding to the traffic data to be detected.

[0008] Based on the associated path, determine the behavioral association value corresponding to the traffic data to be detected;

[0009] The vulnerability detection result of the traffic data to be detected is determined based on the weak feature vulnerability suspicion value and the behavior correlation value.

[0010] Optionally, context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node, including:

[0011] In the behavior graph, under preset constraints, forward and backward analysis are performed based on the target event node to obtain the associated path corresponding to the target event node.

[0012] Optional, also includes:

[0013] The multiple traffic data are aggregated based on the five-tuple information and session timeout to obtain a session sequence;

[0014] The behavior graph is constructed based on the session sequence and the preset behavior graph structure definition.

[0015] Optionally, context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node, including:

[0016] If the suspected value of the weak feature vulnerability meets the preset suspicious judgment conditions, then the context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node.

[0017] Optionally, obtain the weak feature vulnerability suspicion values ​​corresponding to the traffic data to be detected output by the target large model, including:

[0018] Extract the target key field information from the traffic data to be detected;

[0019] The target key field information is input into the target large model to obtain the weak feature vulnerability suspicion value corresponding to the traffic data to be detected.

[0020] Optionally, the vulnerability detection result of the traffic data to be detected is determined based on the weak feature vulnerability suspicion value and the behavior correlation value, including:

[0021] Based on the first weight coefficient corresponding to the suspected weak feature vulnerability value and the second weight coefficient corresponding to the behavior association value, the suspected weak feature vulnerability value and the behavior association value are weighted and calculated to obtain the vulnerability detection result of the traffic data to be detected.

[0022] Optional, also includes:

[0023] Based on the vulnerability detection results, a risk handling strategy is matched to obtain the target risk handling strategy;

[0024] Implement the target risk management strategy.

[0025] Secondly, this application provides a vulnerability detection device, comprising:

[0026] The model inference module is used to obtain the weak feature vulnerability suspicion values ​​corresponding to the traffic data to be detected output by the target large model;

[0027] The path analysis module is used to perform context association analysis based on the target event node in the behavior graph to obtain the associated path corresponding to the target event node. The behavior graph is constructed based on multiple traffic data including the traffic data to be detected, and the target event node is the event node corresponding to the traffic data to be detected.

[0028] The numerical determination module is used to determine the behavioral association value corresponding to the traffic data to be detected based on the association path.

[0029] The result determination module is used to determine the vulnerability detection result of the traffic data to be detected based on the weak feature vulnerability suspicion value and the behavior correlation value.

[0030] Thirdly, this application provides an electronic device, including a memory and a processor, wherein:

[0031] The memory is used to store computer programs;

[0032] The processor is used to execute the computer program to implement the aforementioned vulnerability detection method.

[0033] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned vulnerability detection method.

[0034] Fifthly, this application provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the aforementioned vulnerability detection method.

[0035] As can be seen from the above scheme, this application provides a vulnerability detection method, including: obtaining the weak feature vulnerability suspicion value corresponding to the traffic data to be detected output by the target large model; performing context association analysis based on the target event node in the behavior graph to obtain the association path corresponding to the target event node, wherein the behavior graph is constructed based on multiple traffic data including the traffic data to be detected, and the target event node is the event node corresponding to the traffic data to be detected; determining the behavior association value corresponding to the traffic data to be detected based on the association path; and determining the vulnerability detection result of the traffic data to be detected based on the weak feature vulnerability suspicion value and the behavior association value.

[0036] Therefore, the beneficial effects of this application are as follows: It utilizes a large target model to output weak-feature vulnerability suspicion values ​​from the traffic data to be detected, and performs contextual correlation analysis on the traffic data to obtain behavioral correlation values ​​corresponding to the associated paths. The weak-feature vulnerability suspicion values ​​and behavioral correlation values ​​are combined to determine the vulnerability detection result. In this way, by enhancing semantic understanding capabilities through a large model, combining behavioral graphs with contextual correlation, and processing behavioral chains, a two-layer mechanism of semantic understanding and behavioral confirmation is achieved, thereby improving the accuracy of vulnerability detection.

[0037] Correspondingly, the vulnerability detection device, equipment, and readable storage medium provided in this application also have the above-mentioned technical effects. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 A flowchart of a vulnerability detection method provided in an embodiment of this application;

[0040] Figure 2 A schematic diagram of vulnerability detection provided in an embodiment of this application;

[0041] Figure 3 This is a schematic diagram of a vulnerability detection device provided in an embodiment of this application;

[0042] Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0044] First, the terms used in this application will be explained:

[0045] LLM (Large Language Model): A natural language processing model based on deep learning techniques, capable of understanding, generating, and processing natural language. These models typically consist of millions to billions of parameters and learn language rules and patterns through massive training data, thus achieving efficient processing of natural language. Large language models are usually implemented using neural networks, including multiple layers of neurons and connections. These neurons and connections are trained using backpropagation algorithms to maximize the model's predictive accuracy. Such models can be used for various natural language processing tasks, such as language modeling, machine translation, text summarization, and question answering systems.

[0046] SSRF (Server-Side Request Forgery): SSRF is a security vulnerability where attackers construct specific HTTP (Hypertext Transfer Protocol) requests, tricking server-side applications into sending requests to internal or external resources specified by the attacker without proper verification. This attack allows attackers to bypass firewalls, access internal services, perform port scans, and execute remote code, among other malicious actions.

[0047] Fine-tuning is a machine learning technique typically used to adjust pre-trained models to suit specific downstream tasks. Fine-tuning can significantly reduce training time and computational resources while improving model performance and generalization ability. It has been widely applied in fields such as natural language processing and computer vision.

[0048] 0-day vulnerability: A 0-day vulnerability is a vulnerability that has been discovered but not yet made public, and for which there is no official patch yet; in layman's terms, it means that no one except hackers knows of its existence, and it is often highly sudden, destructive, and fatal.

[0049] Weak features are a specific type of feature in security detection. They refer to intrusion indicators that are easily altered or disguised by attackers, thereby causing detection rules to fail. They are based on the vulnerable attributes (configuration, code, data interaction, etc.) exposed by the system / application.

[0050] Weak signature vulnerabilities, also known as weak signature-based vulnerabilities, are security vulnerabilities caused by weak signatures that can be exploited by attackers.

[0051] Possible SSRF: When an internal IP address, domain name, or URL parameter appears and could be used to initiate an internal request.

[0052] Unauthorized access may occur when the request lacks authentication information (such as a token or cookie) or uses default / weak credentials.

[0053] Suspicious parameters: When parameters contain sensitive keywords (such as admin, password) or special characters (such as .. / , etc.). <script>）或异常值时。

[0054] 传统的检测弱特征类漏洞的方法及其缺陷包括：采用规则来识别并阻断攻击。这种方案检测速度快，检测方式灵活。但由于规则的表达能力有限，无法精准的区分业务请求和攻击，而且只能在已知漏洞的检测上具有高精准率，在实际的通用业务场景中无法检测0day。采用机器学习对业务建模来检测攻击。这种方案需要搜集一段时间的业务流量进行学习建模，以此识别不符合业务范式的可疑流量，有一定的0day检测能力。但这种方案对请求语义理解弱，难以捕捉潜在隐语义异常，也无法处理跨会话、跨连接的行为链条，且无法应对快速更新迭代的业务系统，在业务流量变化的情况下容易产生大量误报。为此，本申请提供了一种漏洞检测方案，能够提升漏洞检测的准确度。

[0055] 参见图1所示，本申请实施例公开了一种漏洞检测方法，包括：

[0056] 步骤S11：获取目标大模型输出的待检测流量数据对应的弱特征漏洞可疑数值。

[0057] 其中，目标大模型为训练后的大模型，大模型为参数规模大于一定规模的深度学习模型。本实施例可以利用流量数据训练样本对大模型进行训练，得到目标大模型，流量数据训练样本的标注信息可以包括弱特征漏洞可疑数值标注、漏洞类型标注，辅助解释标注，辅助解释可以为可疑字段 / token（即词元）。也即，目标大模型还可以输出漏洞类型以及辅助解释。

[0058] 并且，在可选的实施方式，在利用流量数据训练样本对大模型进行训练之前，还可以利用通用语料对初始大模型进行训练，以及利用安全领域语料，对大模型进行微调。安全领域语料可以包括公开漏洞报告、渗透测试日志、WAF（即Web Application Firewall，Web应用防火墙） / IDS（即Intrusion Detection System，入侵检测系统）规则说明、CVE（即Common Vulnerabilities & Exposures，公共漏洞和暴露）描述、渗透测试payload样例（在渗透测试中，payload是允许连接到监听器的一个可执行文件或是一段代码，目的是在受害主机和攻击者之间建立连接，从而获取到被害主机的一个Shell（正向Shell或反向Shell））、人工标注后的大量HTTP攻击样本（脱敏或自生成）、应用层异常交互对话等。通用语料可以包括自然语言语料、Web文档、API（即Application Programming Interface，应用程序编程接口）文档、HTTP / REST（即Representational State Transfer，表现层状态转移）示例等，用于提升模型基础理解能力。

[0059] 在可选的实施方式中，获取目标大模型输出的待检测流量数据对应的弱特征漏洞可疑数值，可以包括：提取所述待检测流量数据的目标关键字段信息；将所述目标关键字段信息输入所述目标大模型，得到待检测流量数据对应的弱特征漏洞可疑数值。

[0060] 其中，待检测流量数据可以为HTTP / HTTPS（即Hypertext Transfer ProtocolSecure，超文本传输安全协议）流量，目标关键字段信息可以包括请求方法、路径、参数、headers（即请求头）、请求体、响应状态码、响应头、响应体中的一种或多种。本实施例可以采用镜像或代理方式获取HTTP / HTTPS流量，解析出请求方法、路径、参数、headers、请求体、响应状态码、响应头、响应体，并保留五元组与时间戳。

[0061] 步骤S12：在行为图中基于目标事件节点进行上下文关联分析，得到所述目标事件节点对应的关联路径，其中，所述行为图基于包括所述待检测流量数据的多条流量数据构建，所述目标事件节点为所述待检测流量数据对应的事件节点。

[0062] 本实施例可以基于包括所述待检测流量数据的多条流量数据构建行为图，多条流量数据可以为在一段时间内采集的流量数据。在可选的实施方式中，可以基于所述多条流量数据的五元组信息以及会话超时时间对所述多条流量数据进行聚合，得到会话序列；基于所述会话序列以及预设行为图结构定义构建所述行为图。本实施例可以将原始流量数据组织为时间序列化的会话和跨会话行为图，实现从事件级检测向行为链检测的过渡。

[0063] 其中，预设行为图结构定义可以为行为图包括节点、边以及节点和边的属性，即可以包括节点集、边集以及属性集，节点及可以包括事件节点、实体节点以及阶段节点，边可以包括时序边、表征同会话内事件关系的边、表征同五元组或关联五元组（相同源IP（即Internet Protocol，互联网协议）或相同目的IP）关系的边以及因果关系边，时序边能够表征发生时间顺序。进一步的，行为图可以表示为，为有向带标签多重图；其中，节点集，事件节点V_evt：表示请求或响应事件，包含时间戳、五元组等属性。实体节点V_ent：表示IP、主机、用户等通信主体。阶段节点V_stage：表示攻击阶段（如Recon（即侦察）、Exploit（即漏洞利用）、C2（即命令与控制）、Exfiltration（即数据外泄）），由检测规则给出定性；边集E为带标签有向边，Temporal：时序边，先于）。Session-link：同会话内事件关系。Tuple-link：同五元组或关联五元组（相同源IP或相同目的IP）关系。Causal：因果关系（上传→执行→外联）。时序边和因果关系边可以为单向边，同会话内事件关系、同五元组或关联五元组关系对应的边可以为双向边，属性集A存储节点与边的时间、status（状态码）、path（路径）、headers等特征。行为图用于表示网络中攻击者的行为链条及其因果关系。

[0064] 在可选的实施方式中，在行为图中基于目标事件节点进行上下文关联分析，得到所述目标事件节点对应的关联路径，包括：在行为图中，在预设约束条件下，基于目标事件节点进行前向分析以及后向分析，得到所述目标事件节点对应的关联路径。

[0065] 其中，前向分析即以目标事件节点为起点，按时间向后按照约束条件遍历，收集可达节点，得到后向路径。后向分析即以目标事件节点为终点，按时间向前按照约束条件遍历，查找前置行为，得到前向路径。前向路径和后向路径构成关联路径。

[0066] 在可选的实施方式中，在行为图中基于目标事件节点进行上下文关联分析，得到所述目标事件节点对应的关联路径，包括：如果所述弱特征漏洞可疑数值满足预设可疑判定条件，则在行为图中基于目标事件节点进行上下文关联分析，得到所述目标事件节点对应的关联路径。

[0067] 也即，如果所述弱特征漏洞可疑数值满足预设可疑判定条件，则在行为图中基于目标可疑事件节点进行上下文关联分析，得到所述目标可疑事件对应的关联路径，其中，目标可疑事件节点为所述待检测流量数据对应的事件节点，即上述目标事件节点。满足预设可疑判定条件，可以为弱特征漏洞可疑数值大于预设阈值。如0.4。

[0068] 本实施例可以以目标可疑事件节点为起点，按时间向后沿允许的边类型（Temporal、Tuple、Causal等）进行有约束遍历，收集后续的可达节点。该过程发现潜在的后续链式访问，如SSRF后触发文件下载、未授权上传文件后产生加密通信等。以目标可疑事件节点为终点，按时间向前沿允许的边类型反向遍历，查找前置行为，识别攻击者的预热动作，如目录遍历、弱口令探测、认证绕过等。两者均为时间约束遍历，前向和后向仅方向不同，约束条件一致。关联路径为图中满足时间单调且边类型合法的简单有向路径，表示攻击行为链。关联分析的结果即得到关联路径。

[0069] 步骤S13：基于所述关联路径确定所述待检测流量数据对应的行为关联数值。

[0070] 本申请实施例可以基于关联路径确定各证据项的数值，进而加权计算得到行为关联数值。证据项可以包括跨网段访问、访问敏感路径、短时间高频请求、响应异常以及其它辅助证据。跨网段访问可以包括内网到外网的访问、外网到内网的访问，访问敏感路径为命中特定关键字，短时间高频请求即事件时间间隔小于预设值，响应异常为路径中存在特定响应码或特定响应码占比达到预设占比阈值或数量达到预设数量阈值，其他辅助证据可以包括头信息频繁变更以及URL（即Uniform Resource Locator，统一资源定位符）参数含预设可疑关键词，即头信息频繁变更即头信息在预设时间内发生变化的次数达到预设次数阈值。

[0071] 其中，跨网段访问，对路径中相邻事件的src_ip（源IP）与dst_ip（目的IP）所属网段做比较，若出现"内网→外网”或"外网→内网”类型访问，则该证据项的数值置1，否则为0。边连接起来事件为相邻事件。访问敏感路径，遍历路径中的请求URI（即UniformResource Identifier，统一资源标识符），若匹配敏感关键字（如 / admin, / debug, / config, / upload, / passwd等）或响应中含"Forbidden”"Unauthorized”等关键字，则该证据项置1，否则为0。短时间高频请求，统计路径中事件时间间隔Δt，若Δt平均值小于阈值（人工设定为0.5s），则该证据项的数值置1，否则为0。响应异常（3xx / 4xx / 5xx），提取路径中所有响应码集合，若存在比例高的4xx / 5xx，或多次302（跳转绕过），则该证据项的数值置1，否则为0。其它辅助证据，包括一些难以归类的弱特征，如Cookie / Header频繁变更、URL参数含可疑关键词（如 cmd、exec、shell、file等），出现则置1，否则为0。

[0072] 步骤S14：基于所述弱特征漏洞可疑数值以及所述行为关联数值确定所述待检测流量数据的漏洞检测结果。

[0073] 在可选的实施方式中，基于所述弱特征漏洞可疑数值以及所述行为关联数值确定待检测流量数据的漏洞检测结果，可以包括：基于所述弱特征漏洞可疑数值对应的第一权重系数、以及所述行为关联数值对应的第二权重系数，对所述弱特征漏洞可疑数值以及所述行为关联数值进行加权计算，得到待检测流量数据的漏洞检测结果。

[0074] 进一步的，本申请实施例，还可以包括：基于所述漏洞检测结果匹配风险处理策略，得到目标风险处理策略；执行所述目标风险处理策略。

[0075] 例如，当漏洞检测结果大于或等于第一阈值时触发告警，提醒人工复核，大于或等于第二阈值时触发阻断。漏洞检测展示结果除了对所述弱特征漏洞可疑数值以及所述行为关联数值进行加权计算得到的结果数值，还可以包括漏洞类型、辅助解释等。

[0076] 进一步的，人工复核的结果将作为模型训练语料上传至云端，帮助模型效果迭代。

[0077] 可见，本申请实施例利用目标大模型输出待检测流量数据的弱特征漏洞可疑数值，并对待检测流量数据进行上下文关联分析，得到关联路径对应的行为关联数值，弱特征漏洞可疑数值与行为关联数值结合确定漏洞检测结果。这样，通过大模型提升语义理解能力，结合行为图关联上下文，处理行为链条，实现语义理解以及行为确认的双层机制，能够提升漏洞检测的准确度。

[0078] 进一步的，参见图2所示，图2为本申请实施例提供的一种漏洞检测示意图。本申请提出了能够高精度识别弱特征0day漏洞的检测方法。使用安全领域专业语料与通用语料训练 / 微调的大语言模型（用于识别弱特征可疑HTTP流量），再基于五元组（源IP、目的IP、源端口、目的端口、协议）的上下文行为图 / 序列分析，对可疑流量进行前向 / 后向行为关联与恶意操作追溯。将由LLM提供的语义级弱特征识别能力与基于五元组的上下文行为关联分析结合，能将分散的弱证据组合为强证据链，从而提高对SSRF、未授权访问等弱特征0day的检测率；并且可解释性更强：LLM的解释输出与行为链路可为人工复核提供明确证据；易于迭代与自适应：人工复核结果可用于持续微调模型，而预先训练的LLM对不同的业务系统具有较强的语义理解和泛化能力，即使业务系统更新也不会带来误报。

[0079] 其中，通过流量采集模块，采用镜像或代理方式获取HTTP / HTTPS流量（使用TLS（即Transport Layer Security，传输层安全协议）解密设备或代理），通过HTTP解析器解析出请求方法、路径、参数、headers、请求体、响应状态码、响应头、响应体，并保留五元组与时间戳，headers中包括cookies。

[0080] 进一步的，弱特征识别可以包括以下步骤：步骤A：数据预处理与语料构建。预先收集并构建两类语料：安全专业语料：公开漏洞报告、渗透测试日志、WAF / IDS规则说明、CVE描述、渗透测试payload样例、人工标注后的大量HTTP攻击样本（脱敏或自生成）、应用层异常交互对话等。通用语料：自然语言语料、Web文档、API文档、HTTP / REST示例等，用于提升模型基础理解能力。步骤B：LLM模型训练 / 微调与弱特征识别。在通用语料上进行初始预训练，随后在安全专业语料上微调，使模型对HTTP、API语义、常见payload有更强的判断能力。之后使用人工标注后的大量流量样本进行训练，设计模型输入格式（[META]{五元组,timestamp}[REQ]{method,path, params, headers, body}[RESP]{status, rsp_header,rsp_body}），训练目标包括分类（可疑 / 正常）、弱特征类型预测（如"可能SSRF”"可能未授权访问”"参数可疑”等）以及生成辅助解释（模型标注出可疑字段 / token即payload）。输出：对每条HTTP流量给出一个弱特征可疑评分S_llm（0-1）即弱特征漏洞可疑数值，并返回payload与漏洞类型。其中，阈值设定通过本地测试集评估得到，S_llm标记为可疑的阈值设置0.4；为高危。也即，先通过搜集安全专业语料和通用语料来训练模型对HTTP协议流量的识别能力和对Web攻击的理解能力，不局限于当前的弱特征识别任务，之后利用人工标注后的大量HTTP流量样本进行训练，可以通过流量采集模块采集流量数据加入训练。本地建设了带标签的测试集，由人工标注得来,通过预训练后的模型在测试集上的测试结果来设置前述阈值。步骤C：部署模型推理服务。使用FASTAPI开源框架部署模型推理服务，输入流量采集模块解析后的格式化流量，输出S_llm、payload、解释文本即漏洞类型。

[0081] 行为构建与关联模块用于将原始流量组织为时间序列化的会话（Session）和跨会话行为图（Behavior Graph），实现从事件级检测向行为链检测的过渡。其中，行为图的结构定义：行为图G=(V，E，A)为有向带标签多重图，节点集V=V_evt ∪ V_ent ∪ V_stage，事件节点V_evt：表示请求或响应事件，包含时间戳、五元组等属性。实体节点V_ent：表示IP、主机、用户等通信主体。阶段节点V_stage：表示攻击阶段（如Recon、Exploit、C2、Exfiltration），由检测规则给出定性。边集E为带标签有向边，Temporal：时序边（）；Session-link：同会话内事件关系；Tuple-link：同五元组或关联五元组（相同源IP或相同目的IP）关系；Causal：因果关系（上传→执行→外联）。属性集A存储节点与边的时间、status、path、headers等特征。行为图用于表示网络中攻击者的行为链条及其因果关系。

[0082] 本申请实施例可以采用前向与后向分析方法：前向分析即以可疑事件节点e为起点，按时间向后沿允许的边类型（Temporal、Tuple、Causal等）进行有约束遍历，收集后续的可达节点。允许就是指这些有向边能走到节点。该过程发现潜在的后续链式访问，如SSRF后触发文件下载、未授权上传文件后产生加密通信等。后向分析即以可疑事件节点e为终点，按时间向前沿允许的边类型反向遍历，查找前置行为，识别攻击者的预热动作，如目录遍历、弱口令探测、认证绕过等。两者均为时间约束遍历，前向和后向仅方向不同，约束条件一致。即前向和后向都是按时间沿边类型来遍历，两者只是方向不同。

[0083] 关联路径的定义与作用：关联路径π为图中满足时间单调且边类型合法的简单有向路径，表示攻击行为链。关联分析的结果即为一组关联路径集合P，包括前向路径和后向路径，前向路径和后向路径可以构成关联路径。每条关联路径π对应一个行为关联得分S_beh即行为关联数值，用于量化可疑行为的强度。

[0084] 本实施例中确定行为关联得分可以包括以下步骤：

[0085] 会话构建：按五元组与会话超时τ聚合流量事件，形成Session序列。

[0086] 行为图构建：将事件、实体生成节点，依据规则生成带标签有向边（Temporal、Session、Tuple、Causal）。

[0087] 种子选取：由的可疑事件构成种子集S。一条流量可以对应一个事件。

[0088] 关联分析：对种子事件，执行前向和后向遍历，限定时间窗口、最大步长L、允许边集E_allow，得到关联路径。是人为规定的时间窗口，用来限定前向和后向遍历的范围，不能无限遍历下去；L是人为规定的步长，用来限定前向和后向至多查找多少个节点；E_allow是人为规定的允许边集，即Temporal、Session、Tuple、Causal等。

[0089] 路径打分：根据关联路径计算出证据项，再根据证据项计算S_beh：

[0090] 。

[0091] I_crossNet：跨网段访问，对路径中相邻事件的src_ip与dst_ip所属网段做比较，若出现"内网→外网”或"外网→内网”类型访问，则置1，否则为0。被边连接起来的就是相邻事件。

[0092] I_sensitive：访问敏感路径，遍历路径中的请求URI，若匹配敏感关键字（如 / admin, / debug, / config, / upload, / passwd等）或响应中含"Forbidden”、"Unauthorized”等关键字则置1，否则为0。

[0093] I_burst：短时间高频请求，统计路径中事件时间间隔 Δt，若Δt平均值小于阈值（人工设定为0.5s），则置1，否则为0。其中，事件可以为任何类型的事件，因为任何类型的HTTP请求高频发起，都可以算是短时间高频请求。

[0094] I_resp：响应异常（3xx / 4xx / 5xx），提取路径中所有响应码集合，若存在比例高的4xx / 5xx，或多次 302（跳转绕过），则置1，否则为0。

[0095] I_other：其它辅助证据，包括一些难以归类的弱特征，如Cookie / Header 频繁变更、URL 参数含可疑关键词（如cmd、exec、shell、file 等）则置1，否则为0。

[0096] 风险评估与响应模块，可以采用可配置权重将S_llm与S_beh加权合成为S_total，并根据阈值触发告警、阻断、会话隔离或人工复核。S_total的计算公式为：。初始权重为 w1=0.6, w2=0.4。当时触发告警，提醒人工复核，时触发阻断。人工复核的结果将作为模型训练语料上传至云端，帮助模型效果迭代。

[0097] 本申请通过利用安全领域专业语料与通用语料对大语言模型进行训练或微调，对HTTP流量中表现为弱特征的可疑请求进行语义级识别，并结合基于五元组的上下文行为图开展前向 / 后向关联分析，生成综合危险度评分以判断是否为疑似0day漏洞利用（例如SSRF、未授权访问等）。能够将单次弱证据串联为强证据链，提升对弱特征攻击的检测率并降低误报，且具有可解释性与持续学习能力。

[0098] 本申请提供了利用LLM对HTTP流量进行弱特征识别并生成语义解释的检测方法、基于五元组构建上下文行为图并执行前向 / 后向行为关联分析的方法以及融合语义分数与行为分数的综合危险度评分机制。这样，融合了语义级弱特征识别与上下文行为关联分析，使用安全语料驱动的领域专用大语言模型用于弱特征识别。现有LLM安全检测多停留在提示识别攻击样本层面，本发明直接将LLM融入实时流量检测流程中，并以弱特征打分（S_llm）定量输出，作为行为分析的输入信号。基于五元组的上下文行为图与前后向关联分析，通过LLM预筛选弱信号，再用五元组行为图关联上下文，实现语义触发以及行为确认的双层机制。语义分数与行为分数的加权融合判定机制，融合跨维度特征，使单点弱信号在上下文中被强化识别。任何与本申请架构和方法相似，但是增加或删减了不同的模块，比如增加流量过滤模块，在检测之前加入流量解析 / 解码模块、并行不同的检测模块等。或者应用到不同的场景，比如将此方案用作告警消减模块，只是将输入从流量数据变为安全日志，都在本申请的保护范围内。

[0099] 参见图3所示，本申请提供了一种漏洞检测装置，包括：

[0100] 模型推理模块11，用于获取目标大模型输出的待检测流量数据对应的弱特征漏洞可疑数值；

[0101] 路径分析模块12，用于在行为图中基于目标事件节点进行上下文关联分析，得到所述目标事件节点对应的关联路径，其中，所述行为图基于包括所述待检测流量数据的多条流量数据构建，所述目标事件节点为所述待检测流量数据对应的事件节点；

[0102] 数值确定模块13，用于基于所述关联路径确定所述待检测流量数据对应的行为关联数值；

[0103] 结果确定模块14，用于基于所述弱特征漏洞可疑数值以及所述行为关联数值确定所述待检测流量数据的漏洞检测结果。

[0104] 其中，路径分析模块12，具体可以用于在行为图中，在预设约束条件下，基于目标事件节点进行前向分析以及后向分析，得到所述目标事件节点对应的关联路径。

[0105] 所述装置还可以包括行为图构建模块，用于：基于所述多条流量数据的五元组信息以及会话超时时间对所述多条流量数据进行聚合，得到会话序列；基于所述会话序列以及预设行为图结构定义构建所述行为图。

[0106] 其中，路径分析模块12，具体可以用于如果所述弱特征漏洞可疑数值满足预设可疑判定条件，则在行为图中基于目标事件节点进行上下文关联分析，得到所述目标事件节点对应的关联路径。

[0107] 模型推理模块11，具体可以用于：提取所述待检测流量数据的目标关键字段信息；将所述目标关键字段信息输入所述目标大模型，得到待检测流量数据对应的弱特征漏洞可疑数值。

[0108] 结果确定模块14，具体可以用于：基于所述弱特征漏洞可疑数值对应的第一权重系数、以及所述行为关联数值对应的第二权重系数，对所述弱特征漏洞可疑数值以及所述行为关联数值进行加权计算，得到待检测流量数据的漏洞检测结果。

[0109] 进一步的，所述装置还可以包括策略处理模块，用于：基于所述漏洞检测结果匹配风险处理策略，得到目标风险处理策略；执行所述目标风险处理策略。

[0110] 可见，本申请实施例利用目标大模型输出待检测流量数据的弱特征漏洞可疑数值，并对待检测流量数据进行上下文关联分析，得到关联路径对应的行为关联数值，弱特征漏洞可疑数值与行为关联数值结合确定漏洞检测结果。这样，通过大模型提升语义理解能力，结合行为图关联上下文，处理行为链条，实现语义理解以及行为确认的双层机制，能够提升漏洞检测的准确度。

[0111] 参见图4所示，本申请实施例公开了一种电子设备20，包括处理器21和存储器22；其中，所述存储器22，用于保存计算机程序；所述处理器21，用于执行所述计算机程序，前述实施例公开的漏洞检测方法。

[0112] 关于上述漏洞检测方法的具体过程可以参考前述实施例中公开的相应内容，在此不再进行赘述。

[0113] 并且，所述存储器22作为资源存储的载体，可以是只读存储器、随机存储器、磁盘或者光盘等，存储方式可以是短暂存储或者永久存储。

[0114] 另外，所述电子设备20还包括电源23、通信接口24、输入输出接口25和通信总线26；其中，所述电源23用于为所述电子设备20上的各硬件设备提供工作电压；所述通信接口24能够为所述电子设备20创建与外界设备之间的数据传输通道，其所遵循的通信协议是能够适用于本申请技术方案的任意通信协议，在此不对其进行具体限定；所述输入输出接口25，用于获取外界输入数据或向外界输出数据，其具体的接口类型可以根据具体应用需要进行选取，在此不进行具体限定。

[0115] 进一步的，本申请实施例还公开了一种计算机可读存储介质，用于保存计算机程序，其中，所述计算机程序被处理器执行时实现前述实施例公开的漏洞检测方法。

[0116] 关于上述漏洞检测方法的具体过程可以参考前述实施例中公开的相应内容，在此不再进行赘述。

[0117] 进一步的，本申请实施例提供了一种计算机程序产品，包括计算机程序 / 指令，该计算机程序 / 指令被处理器执行时实现前述实施例公开的漏洞检测方法。

[0118] 关于上述漏洞检测方法的具体过程可以参考前述实施例中公开的相应内容，在此不再进行赘述。

[0119] 本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其它实施例的不同之处，各个实施例之间相同或相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描述的比较简单，相关之处参见方法部分说明即可。

[0120] 结合本文中所公开的实施例描述的方法或算法的步骤可以直接用硬件、处理器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器（RAM）、内存、只读存储器（ROM）、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。

[0121] 以上对本申请所提供的一种漏洞检测方法、装置、设备及介质进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。< / script>

Claims

1. A vulnerability detection method, characterized in that, include: Obtain the weak feature vulnerability and suspicious value corresponding to the traffic data to be detected output by the target large model; Context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node. The behavior graph is constructed based on multiple traffic data including the traffic data to be detected, and the target event node is the event node corresponding to the traffic data to be detected. Based on the associated path, determine the behavioral association value corresponding to the traffic data to be detected; The vulnerability detection result of the traffic data to be detected is determined based on the weak feature vulnerability suspicion value and the behavior correlation value.

2. The vulnerability detection method according to claim 1, characterized in that, Context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node, including: In the behavior graph, under preset constraints, forward and backward analysis are performed based on the target event node to obtain the associated path corresponding to the target event node.

3. The vulnerability detection method according to claim 1, characterized in that, Also includes: The multiple traffic data are aggregated based on the five-tuple information and session timeout to obtain a session sequence; The behavior graph is constructed based on the session sequence and the preset behavior graph structure definition.

4. The vulnerability detection method according to claim 1, characterized in that, Context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node, including: If the suspected value of the weak feature vulnerability meets the preset suspicious judgment conditions, then the context association analysis is performed on the target event node in the behavior graph to obtain the association path corresponding to the target event node.

5. The vulnerability detection method according to claim 1, characterized in that, Obtain the weak feature vulnerability suspicion values ​​corresponding to the traffic data to be detected output by the target large model, including: Extract the target key field information from the traffic data to be detected; The target key field information is input into the target large model to obtain the weak feature vulnerability suspicion value corresponding to the traffic data to be detected.

6. The vulnerability detection method according to claim 1, characterized in that, Based on the weak feature vulnerability suspicion value and the behavior correlation value, the vulnerability detection result of the traffic data to be detected is determined, including: Based on the first weight coefficient corresponding to the suspected weak feature vulnerability value and the second weight coefficient corresponding to the behavior association value, the suspected weak feature vulnerability value and the behavior association value are weighted and calculated to obtain the vulnerability detection result of the traffic data to be detected.

7. The vulnerability detection method according to any one of claims 1 to 6, characterized in that, Also includes: Based on the vulnerability detection results, a risk handling strategy is matched to obtain the target risk handling strategy; Implement the target risk management strategy.

8. A vulnerability detection device, characterized in that, include: The model inference module is used to obtain the weak feature vulnerability suspicion values ​​corresponding to the traffic data to be detected output by the target large model; The path analysis module is used to perform context association analysis based on the target event node in the behavior graph to obtain the associated path corresponding to the target event node. The behavior graph is constructed based on multiple traffic data including the traffic data to be detected, and the target event node is the event node corresponding to the traffic data to be detected. The numerical determination module is used to determine the behavioral association value corresponding to the traffic data to be detected based on the association path. The result determination module is used to determine the vulnerability detection result of the traffic data to be detected based on the weak feature vulnerability suspicion value and the behavior correlation value.

9. An electronic device, characterized in that, Includes memory and processor, wherein: The memory is used to store computer programs; The processor is configured to execute the computer program to implement the vulnerability detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the vulnerability detection method as described in any one of claims 1 to 7.

Images