Webpage vulnerability identification method and device, electronic equipment and program product

Abstract

The invention discloses a webpage vulnerability identification method and device, electronic equipment and a program product, and relates to the technical field of artificial intelligence, and the identification method comprises the following steps: obtaining a page structure and interface information of a target page; performing feature extraction on the page structure to obtain a target vector, converting the interface information into a text sequence, and performing feature extraction on the text sequence to generate an interface semantic feature vector; the target vector and the interface semantic feature vector are input into a preset multi-modal model, a vulnerability attack request is generated, and the vulnerability attack request corresponds to response data; and performing semantic recognition on the response data by adopting a preset language model to obtain a vulnerability recognition result of the target page. According to the invention, the technical problem of low vulnerability identification accuracy in related technologies is solved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and more specifically, to a method, apparatus, electronic device, and program product for identifying web page vulnerabilities. Background Technology

[0002] With the rapid development of internet technology and the widespread deployment of Web (World Wide Web) applications, Web security vulnerabilities have become a significant entry point for cyberattacks. Web vulnerability detection primarily employs proactive scanning methods, which involve sending specially crafted requests to the target system and analyzing the response results to determine vulnerability risk.

[0003] However, current tools typically rely on manually written rule bases, analyzing response messages through keyword matching, feature matching, and other methods. They mostly only provide users with the locations of suspected vulnerabilities, requiring users to manually review each vulnerability in the report. Therefore, they suffer from problems such as difficulty in covering emerging vulnerabilities and high false positives and false negatives.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and program product for identifying web page vulnerabilities, in order to at least solve the technical problem of low accuracy in vulnerability identification in related technologies.

[0006] According to one aspect of the embodiments of this application, a method for identifying web page vulnerabilities is provided, comprising: acquiring target information of a target page, wherein the target information includes at least: page structure and interface information; extracting features from the page structure to obtain a target vector, converting the interface information into a text sequence, extracting features from the text sequence to generate an interface semantic feature vector; inputting the target vector and the interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request, wherein the vulnerability attack request corresponds to response data; and performing semantic recognition on the response data using a preset language model to obtain a vulnerability identification result for the target page.

[0007] Furthermore, the steps for obtaining target information of the target page include: accessing the target page using a page crawler to obtain the source code of the target page; listening to network requests initiated by the source code and extracting interface information from the network requests; rendering the target page based on the source code to obtain the rendered target page; and extracting the page structure of the rendered target page based on the programming interface.

[0008] Furthermore, the page structure includes at least multiple nodes. The steps for extracting features from the page structure to obtain the target vector include: encoding the preset labels of each node to obtain label codes, and encoding the attributes of each node to obtain attribute codes; encoding the text content within each node to obtain text codes, and recording the depth of each node in the page structure to obtain position codes; determining the node code of each node based on the label codes, attribute codes, text codes, and position codes; inputting all node codes into a preset recurrent neural model to extract the features of the page structure, and determining the target vector based on all features.

[0009] Furthermore, before inputting the target vector and interface semantic feature vector into the preset multimodal model to generate a vulnerability attack request, the process includes: obtaining the historical page structure and historical interface information of multiple historical pages; extracting features from each historical page structure to obtain a historical target vector; converting each historical interface information into a historical text sequence and extracting features from the historical text sequence to generate a historical interface semantic feature vector; for each historical page, concatenating the historical target vector with the historical interface semantic feature vector to obtain a concatenated sample; and training an initial multimodal model based on all concatenated samples to obtain the preset multimodal model.

[0010] Furthermore, the step of inputting the target vector and interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request includes: concatenating the target vector and interface semantic feature vector to obtain an input sequence; and inputting the input sequence into the preset multimodal model to generate a vulnerability attack request.

[0011] Furthermore, the step of using a preset language model to perform semantic recognition on the response data to obtain the vulnerability identification result of the target page includes: sending a vulnerability attack request to the server, wherein the server responds to the vulnerability attack request and returns response data; processing the response data to obtain a response sequence; and using a preset language model to perform semantic recognition on the response sequence to obtain the vulnerability identification result.

[0012] Furthermore, the vulnerability identification result includes at least: vulnerability category. After obtaining the vulnerability identification result by performing semantic recognition on the response sequence using a preset language model, it also includes: verifying the vulnerability identification result to obtain a verification result; if the verification result indicates that the vulnerability category is incorrect, correcting the vulnerability category and labeling the response data based on the corrected vulnerability category to obtain a first labeled sample; if the verification result indicates that the vulnerability category is correct, labeling the response data based on the vulnerability category to obtain a second labeled sample; constructing feedback samples based on the first labeled sample and the second labeled sample, and incrementally training the preset language model based on the feedback sample.

[0013] According to another aspect of the embodiments of this application, a webpage vulnerability identification device is also provided, comprising: an acquisition unit, configured to acquire target information of a target page, wherein the target information includes at least: page structure and interface information; an extraction unit, configured to extract features from the page structure to obtain a target vector, convert the interface information into a text sequence, extract features from the text sequence, and generate an interface semantic feature vector; a generation unit, configured to input the target vector and the interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request, wherein the vulnerability attack request corresponds to response data; and an identification unit, configured to perform semantic recognition on the response data using a preset language model to obtain a vulnerability identification result for the target page.

[0014] Furthermore, the acquisition unit includes: a first acquisition module, used to access the target page according to the page collector and acquire the source code of the target page; a first extraction module, used to listen to the network requests initiated by the source code and extract the interface information in the network requests; a first rendering module, used to render the target page according to the source code and obtain the rendered target page; and a second extraction module, used to extract the page structure of the rendered target page according to the programming interface.

[0015] Furthermore, the page structure includes at least multiple nodes, and the extraction unit includes: a first encoding module, used to encode the preset labels of each node to obtain label encoding, and to encode the attributes of each node to obtain attribute encoding; a second encoding module, used to encode the text content within each node to obtain text encoding, and to record the depth of each node in the page structure to obtain position encoding; a first determination module, used to determine the node encoding of each node based on label encoding, attribute encoding, text encoding, and position encoding; and a second determination module, used to input all node encodings into a preset recurrent neural model, extract the features of the page structure, and determine the target vector based on all features.

[0016] Furthermore, the webpage vulnerability identification device also includes: a second acquisition module, used to acquire the historical page structure and historical interface information of multiple historical pages before inputting the target vector and interface semantic feature vector into the preset multimodal model to generate a vulnerability attack request; a third extraction module, used to extract the features of each historical page structure to obtain a historical target vector; a fourth extraction module, used to convert each historical interface information into a historical text sequence and extract the features of the historical text sequence to generate a historical interface semantic feature vector; a first concatenation module, used to concatenate the historical target vector and the historical interface semantic feature vector for each historical page to obtain a concatenated sample; and a first training module, used to train an initial multimodal model based on all concatenated samples to obtain a preset multimodal model.

[0017] Furthermore, the generation unit includes: a second concatenation module, used to concatenate the target vector and the interface semantic feature vector to obtain an input sequence; and a first generation module, used to input the input sequence into a preset multimodal model to generate a vulnerability attack request.

[0018] Furthermore, the identification unit includes: a first sending module, used to send a vulnerability attack request to a server, wherein the server responds to the vulnerability attack request and returns response data; a first processing module, used to process the response data to obtain a response sequence; and a first identification module, used to perform semantic recognition on the response sequence using a preset language model to obtain a vulnerability identification result.

[0019] Furthermore, the vulnerability identification result includes at least: vulnerability category. The webpage vulnerability identification device also includes: a first verification module, used to verify the vulnerability identification result after semantic recognition of the response sequence using a preset language model to obtain the vulnerability identification result; a first annotation module, used to correct the vulnerability category if the verification result indicates an incorrect vulnerability category, and to annotate the response data based on the corrected vulnerability category to obtain a first annotation sample; a second annotation module, used to annotate the response data based on the vulnerability category if the verification result indicates a correct vulnerability category, to obtain a second annotation sample; and a first construction module, used to construct feedback samples based on the first and second annotation samples, and to incrementally train the preset language model based on the feedback samples.

[0020] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements any of the above-described methods for identifying web page vulnerabilities.

[0021] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-described methods for identifying web page vulnerabilities.

[0022] In this invention, target information of the target page is obtained, features of the page structure are extracted to obtain a target vector, and interface information is converted into a text sequence. Features of the text sequence are extracted to generate an interface semantic feature vector. The target vector and the interface semantic feature vector are input into a preset multimodal model to generate a vulnerability attack request. A preset language model is used to perform semantic recognition on the response data to obtain the vulnerability identification result of the target page, thus solving the technical problem of low vulnerability identification accuracy in related technologies.

[0023] In this invention, target information of the target page is obtained, including but not limited to its page structure and interface information. Features of the page structure can be extracted and transformed into target vectors that reflect the page layout and interaction logic. At the same time, interface information can be converted into text sequences, and features can be extracted from the text sequences to generate interface semantic feature vectors. The target vector and interface semantic feature vectors are input into a preset multimodal model to generate a vulnerability attack request. When the vulnerability attack request is sent to the server, the server returns response data based on the vulnerability attack request. A preset language model can be used to perform semantic recognition on the response data to obtain the vulnerability identification result of the target page. This not only improves the intelligent generation level of attack requests but also optimizes the vulnerability identification capability. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for identifying web page vulnerabilities is shown.

[0026] Figure 2 This is a flowchart of a webpage vulnerability identification method according to Embodiment 1 of this application;

[0027] Figure 3 This is a flowchart illustrating an optional page scanning platform performing a page scan according to an embodiment of this application;

[0028] Figure 4 This is a flowchart illustrating an optional webpage vulnerability identification method according to an embodiment of this application;

[0029] Figure 5 This is a schematic diagram of an optional webpage vulnerability identification device according to an embodiment of this application;

[0030] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] It should be noted that all related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and it does not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0034] This invention employs a multimodal Transformer (a neural network architecture) model, integrating the structural features of the page's DOM (Document Object Model) with the semantic features of the API (Application Programming Interface) to achieve context-aware attack request generation. This replaces the current scanner's method of constructing attack requests based on a static rule base. It can dynamically generate more targeted attack requests according to the actual business logic of the target page and interface, improving the success rate of vulnerability triggering, reducing the consumption of server resources and the impact on normal business, while also reducing manual configuration and rule maintenance work, and improving the intelligence level of vulnerability scanning. Furthermore, a response analysis model based on the Transformer architecture is used to perform semantic understanding and abnormal pattern recognition on the HTTP (Hypertext Transfer Protocol) responses returned by the target system, enabling vulnerability type determination and confidence scoring. This replaces keyword matching or regular expression methods, improving the accuracy and robustness of response analysis, reducing the risk of false positives and false negatives, and enhancing the credibility and interpretability of the scan results. Furthermore, through the online joint optimization mechanism of the attack request generation module and the response analysis module, the model has the ability to self-evolve, dynamically adapt to new vulnerability types, new web frameworks, and new protocols, enhance the detection coverage of new vulnerabilities, and improve the detection effect and adaptability in long-term use.

[0035] The present invention will now be described in detail with reference to various embodiments.

[0036] Example 1

[0037] According to an embodiment of this application, an embodiment of a method for identifying web page vulnerabilities is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0038] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method to identify web page vulnerabilities is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0039] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0040] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the webpage vulnerability identification method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned webpage vulnerability identification method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0041] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0042] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0043] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for identifying webpage vulnerabilities is shown. Figure 2 This is a flowchart of a webpage vulnerability identification method according to Embodiment 1 of this application, such as... Figure 2 As shown, the method includes the following steps:

[0044] Step S201: Obtain the target information of the target page, wherein the target information includes at least: page structure and interface information.

[0045] In this embodiment of the invention, the page structure (i.e., DOM tree structure) and interface information of the target page (i.e., the specific web page for security vulnerability detection) are obtained. For example, if the target page is a login interface, the DOM tree may contain form elements (such as username and password input boxes), submit buttons, and other information, and may also obtain the API interface used to submit login requests.

[0046] Step S202: Extract features from the page structure to obtain the target vector, convert the interface information into a text sequence, extract features from the text sequence, and generate the interface semantic feature vector.

[0047] Optionally, since the DOM tree is an ordered tree structure with hierarchical relationships, sequence models suffer from information loss or insufficient sequential encoding when directly processing tree structures. Tree-LSTM (Tree-based Long Short-Term Memory, recurrent neural network), as a recurrent neural network that can naturally model tree-like data, has better structural information preservation capabilities and can model parent-child dependencies and sibling node interactions in the DOM tree. Therefore, the Tree-LSTM model can be used as the DOM feature encoder.

[0048] In this embodiment of the invention, in order to capture the contextual information such as the layout hierarchy, input field distribution, and interaction logic of the page, and to provide structured semantic support for the generation of subsequent attack requests, it is necessary to transform the raw data into a form and features that can be processed by the machine learning model. The Tree-LSTM model can be used to extract features from the page structure to obtain the target vector, and the API semantic understanding model can be used to convert the interface information into a text sequence, extract features from the text sequence, and generate an interface semantic feature vector.

[0049] Step S203: Input the target vector and the interface semantic feature vector into the preset multimodal model to generate a vulnerability attack request, wherein the vulnerability attack request corresponds to response data.

[0050] In this embodiment of the invention, the target vector and interface semantic feature vector can be input into a preset multimodal model (such as a cross-modal Transformer, which first uses an encoding module to encode the input data to obtain a feature vector sequence, then enhances the information between the feature vector sequences of different modalities through a cross-modal attention mechanism and fuses them, and then sends the fused multimodal feature vector sequence to a decoding module to generate the output sequence of the target modality. Depending on the specific task requirements, the output sequence is sent to a task layer, such as a classification layer, a regression layer, and a sequence generation layer, to generate a vulnerability attack request), generating a targeted vulnerability attack request. For example, a vulnerability attack request targeting a login interface might include constructing SQL (Structured Query Language, a standard data query language) injection payloads as input for username or password fields, simulating clicks on the submit button, or making out-of-bounds requests to the login interface. The vulnerability attack request can then be sent to a server to obtain response data, which may include HTTP response codes, response headers, and response body content.

[0051] Step S204: Use a preset language model to perform semantic recognition on the response data to obtain the vulnerability identification results of the target page.

[0052] Natural language models are primarily designed for natural language tasks (such as text classification and reading comprehension). Their pre-training corpora are mostly natural language text, which differs significantly in structure from HTTP response text used in web vulnerability scanning. HTTP responses contain mixed formats such as HTML (HyperText Markup Language), JSON (JavaScript Object Notation), and XML (eXtensible Markup Language), exhibiting high levels of structure and strong protocol-related and weak natural language characteristics. Directly transferring general-purpose natural language models presents performance bottlenecks. Furthermore, the feature distribution of vulnerability responses differs significantly from natural language, including error messages, exception stack traces, specific response headers, and server echo patterns. Therefore, dedicated self-trained corpus models are needed to improve the ability to identify vulnerability patterns.

[0053] Optionally, a self-made vocabulary for vulnerability analysis tasks can effectively compress the model input length, reduce information loss, and improve response coding efficiency and accuracy. To achieve effective self-training, a large-scale vulnerability response pre-training dataset needs to be constructed. Data sources can include data collected from real vulnerability ranges, publicly available samples, and historical vulnerability scanning records from within financial institutions. This data should be labeled with the corresponding vulnerability types and combined with normal business response responses as the pre-training dataset. Based on the pre-training dataset, the model can be trained to obtain a pre-defined language model.

[0054] In this embodiment of the invention, a preset language model can be used to perform semantic recognition on the response data to obtain the vulnerability identification result of the target page. A tokenizer can be used to segment the text, preserving key protocol information identifiers such as "HTTP / 1.1", "Set-Cookie", and "Content-Type", ensuring the model understands the basic structure of the HTTP response. This also optimizes the processing of HTML tags, JSON key-value pairs, and database error keywords. After being processed by the tokenizer, the response data can be transformed into a model-readable token sequence (i.e., words, numbers, punctuation marks, or smaller units). The token sequence enters the Transformer encoder of the preset language model, undergoes processing through multiple layers of self-attention mechanisms and feedforward neural network layers, generating a hidden vector representation for each token. The hidden vector is mapped to the vulnerability classification space through one or more fully connected layers to obtain the possible vulnerability types of the interface. The Softmax activation function is used to output the vulnerability category probability distribution as the vulnerability confidence.

[0055] Figure 3 This is a flowchart illustrating an optional page scanning platform performing page scanning according to an embodiment of this application, such as... Figure 3 As shown, firstly, the user inputs a URL (Uniform Resource Locator) configuration. The page scheduling module calls the target page according to the URL configuration input by the user. The scanning module scans the target page to obtain the vulnerability identification results of the target page, and can generate a report based on the vulnerability identification results.

[0056] In summary, feature extraction is performed on the web page structure to generate the page's target vector. Simultaneously, interface information is converted into a text sequence, and feature extraction is performed on the text sequence to generate interface semantic feature vectors. These two vectors are input into a cross-modal Transformer model to dynamically generate vulnerability attack requests targeting the page and interface. Response data is obtained by actually sending vulnerability attack requests. In the response analysis phase, the pre-trained Transformer model can perform semantic recognition on the response data to obtain recognition results. This not only determines whether a security vulnerability exists but also outputs the vulnerability type and confidence score. This achieves accurate generation of vulnerability attack requests and semantic recognition of response data, thereby solving the technical problem of low vulnerability identification accuracy in related technologies.

[0057] In order to accurately extract the page structure of the rendered target page, the webpage vulnerability identification method provided in Embodiment 1 of this application involves accessing the target page using a page collector to obtain the source code of the target page; monitoring network requests initiated by the source code and extracting interface information from the network requests; rendering the target page based on the source code to obtain the rendered target page; and extracting the page structure of the rendered target page based on the programming interface.

[0058] In this embodiment of the invention, the target page is first accessed via a page crawler to obtain its source code. The JavaScript code (i.e., the source code) within the page is then executed using an integrated browser kernel to ensure that dynamically rendered content (such as DOM nodes generated by the front-end framework and dynamically loaded API data) is fully displayed. During this process, network requests initiated by the source code can be monitored, and interface information from these requests can be extracted. After rendering is complete, the original DOM tree data (i.e., the rendered target page structure) can be extracted via the DOM API interface (i.e., the programming interface). Simultaneously, the browser debugging protocol interface can be called to further collect attribute information, event binding information, node depth, sibling node relationships, and parent-child hierarchical structure of each DOM node, forming complete DOM structure data. The DOM structure can be a tree-like JSON structure.

[0059] The page structure includes at least multiple nodes. To accurately determine the target vector, in the webpage vulnerability identification method provided in Embodiment 1 of this application, the preset tags of each node are encoded to obtain tag codes, and the attributes of each node are encoded to obtain attribute codes; the text content within each node is encoded to obtain text codes, and the depth of each node in the page structure is recorded to obtain position codes; based on the tag codes, attribute codes, text codes, and position codes, the node codes of each node are determined; all node codes are input into a preset recurrent neural model to extract the features of the page structure, and the target vector is determined based on all features.

[0060] In this embodiment of the invention, to enable the Tree-LSTM model to effectively process DOM tree data, the DOM node information needs to be vectorized and encoded. A word vector generation model can be used to map HTML tags to fixed-dimensional vectors (e.g., 128-dimensional), obtaining tag encoding (tag_embedding). Bag-of-words encoding + embedding layer mapping can be performed on node attributes (e.g., id, class, name, type, etc.) to obtain attribute encoding (attribute_embedding). The text content within a node (e.g., button text) can be encoded into a context-aware vector, obtaining text encoding (text_embedding). The position of each node within the page structure (i.e., the DOM tree) is also recorded. The depth is calculated to obtain the position encoding (position_encoding). Based on the tag encoding, attribute encoding, text encoding, and position encoding, the node encoding (node_embedding=[tag_embedding, attribute_embedding, text_embedding, position_encoding]) is determined. This vector (i.e., the node encoding) is processed by the Tree-LSTM model (i.e., the pre-defined recurrent neural model) and outputs a hidden state vector, which is the semantic representation of the node. The root node (i.e., the top-level node of the page) will eventually gather the information of the entire page and output the overall representation vector of the entire tree (i.e., the target vector).

[0061] To accurately obtain the preset multimodal model, in the webpage vulnerability identification method provided in Embodiment 1 of this application, the historical page structure and historical interface information of multiple historical pages are obtained; the features of each historical page structure are extracted to obtain the historical target vector; each historical interface information is converted into a historical text sequence, and the features of the historical text sequence are extracted to generate a historical interface semantic feature vector; for each historical page, the historical target vector and the historical interface semantic feature vector are concatenated to obtain a concatenated sample; based on all concatenated samples, an initial multimodal model is trained to obtain the preset multimodal model.

[0062] In this embodiment of the invention, the historical page structure and historical interface information of multiple historical pages are obtained (e.g., the historical page structure, historical interface information, and attack requests that have triggered vulnerabilities recorded in historical scans of web pages). The historical scan records, vulnerability test scan case sets, and page DOM trees + security expert annotation data in real business systems can be used as training sets to extract features of each historical page structure to obtain a historical target vector. Each historical interface information is converted into a historical text sequence, and the features of the historical text sequence are extracted to generate a historical interface semantic feature vector. For each historical page, the historical target vector and the historical interface semantic feature vector are concatenated to obtain a concatenated sample. Based on all concatenated samples, an initial multimodal model is trained to obtain a preset multimodal model.

[0063] In order to accurately generate vulnerability attack requests, in the webpage vulnerability identification method provided in Embodiment 1 of this application, the target vector and the interface semantic feature vector are concatenated to obtain an input sequence; the input sequence is input into a preset multimodal model to generate a vulnerability attack request.

[0064] Optionally, multiple API calls can exist on the page, meaning that the information from each API call can be converted into a text sequence, and features can be extracted from the text sequence to generate an API semantic feature vector.

[0065] In this embodiment of the invention, the semantic feature vectors of each interface can be concatenated to obtain an interface concatenation sequence. The target vector can be concatenated with the interface concatenation sequence to obtain an input sequence. The input sequence can be input into a preset multimodal model to generate a vulnerability attack request.

[0066] In order to accurately obtain vulnerability identification results, in the webpage vulnerability identification method provided in Embodiment 1 of this application, a vulnerability attack request is sent to a server, wherein the server responds to the vulnerability attack request and returns response data; the response data is processed to obtain a response sequence; and a preset language model is used to perform semantic recognition on the response sequence to obtain the vulnerability identification result.

[0067] In this embodiment of the invention, the vulnerability attack request is intelligently generated based on the DOM structure features and interface semantic features of the target web page. The vulnerability attack request is sent to the server to simulate attack behavior. The server responds to the vulnerability attack request and returns response data. The existence of a security vulnerability is determined by the response data.

[0068] In this embodiment of the invention, the response data is processed by converting the server-returned response data into a model-readable text sequence to obtain a response sequence. Then, a preset language model is used to perform semantic recognition on the response sequence, analyzing error information and abnormal patterns to obtain vulnerability identification results. For example, if the model identifies SQL error keywords, it can output a high-probability SQL injection vulnerability identification result, along with a confidence score. By employing a preset language model to deeply understand and analyze the complex content of the response data, compared to keyword matching or regular expression methods, it can more accurately capture abnormal information and vulnerability clues in the response, improving the accuracy and coverage of vulnerability identification while reducing the false positive rate.

[0069] The vulnerability identification result includes at least: vulnerability category. To improve the accuracy of the preset language model, in the webpage vulnerability identification method provided in Embodiment 1 of this application, the vulnerability identification result is verified to obtain a verification result; if the verification result indicates that the vulnerability category is incorrect, the vulnerability category is corrected, and the response data is labeled based on the corrected vulnerability category to obtain a first labeled sample; if the verification result indicates that the vulnerability category is correct, the response data is labeled based on the vulnerability category to obtain a second labeled sample; based on the first labeled sample and the second labeled sample, a feedback sample is constructed, and the preset language model is incrementally trained based on the feedback sample.

[0070] In this embodiment of the invention, the vulnerability identification result includes at least the vulnerability category (such as SQL injection, XSS (Cross-Site Scripting) etc.). The entire process of each attack request and vulnerability identification result can be recorded, and a scan log can be established. The vulnerability identification result can be verified (e.g., manual review, vulnerability management platform verification, or third-party security tool verification) to obtain a verification result. If the verification result indicates an incorrect vulnerability category, the vulnerability category is corrected, and the response data is labeled based on the corrected vulnerability category to obtain a first labeled sample. If the verification result indicates a correct vulnerability category, the response data is labeled based on the vulnerability category to obtain a second labeled sample. Based on the first and second labeled samples, a feedback sample is constructed. The generated attack request can also be verified to obtain a verification sample. Based on the feedback sample and the verification sample, incremental training of the preset language model and the preset recursive neural model can be performed through periodic or online fine-tuning strategies to dynamically optimize the model weights, enabling the model to continuously learn new attack patterns and vulnerability characteristics.

[0071] Alternatively, a reinforcement learning mechanism can be used to automatically adjust the direction of attack strategy generation based on the difference between the confidence level of the vulnerability determined by the model and the actual verification results, thereby optimizing the quality of attack request generation. Through a feedback closed-loop mechanism, rapid adaptation to new vulnerabilities and new attack techniques can be achieved, reducing the cost and delay of manually maintaining and updating the preset rule base.

[0072] Figure 4 This is a flowchart of an optional webpage vulnerability identification method according to an embodiment of this application, such as... Figure 4 As shown, the system first obtains the page structure (DOM structure) and interface information of the scanned page (i.e., the target page), and extracts DOM features to obtain the overall vector representation (target vector). At the same time, API features are extracted to obtain API semantic feature vector (i.e., interface semantic feature vector). Through a preset multimodal model, the target vector and interface semantic feature vector are subjected to context-aware analysis to intelligently generate attack requests, send the attack requests to the target server, and receive the target server's response to the attack requests. Through a self-trained Transformer model, the response data returned by the target server is semantically understood (i.e., response analysis), and the vulnerability category and confidence level are output. Furthermore, through a feedback closed-loop mechanism, it can achieve rapid adaptation to new vulnerabilities and new attack techniques.

[0073] The webpage vulnerability identification method provided in this application can generate target vectors and interface semantic feature vectors by integrating feature extraction from historical page structure and interface information. It can intelligently generate vulnerability attack requests by combining a cross-modal large language model, and then perform semantic recognition on the server's response data to the vulnerability attack requests through a self-trained language model to accurately determine the vulnerability category. With the help of a feedback mechanism, the model prediction is adjusted according to the verification results, and feedback samples are constructed for incremental training, thereby realizing rapid adaptation to new vulnerabilities and continuous optimization of detection capabilities.

[0074] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0075] Example 2

[0076] This application also provides a webpage vulnerability identification device. It should be noted that the webpage vulnerability identification device of this application can be used to execute the webpage vulnerability identification method provided in this application. The webpage vulnerability identification device provided in this application will be described below.

[0077] According to an embodiment of this application, an apparatus for implementing the above-described method for identifying web page vulnerabilities is also provided. Figure 5 This is a schematic diagram of an optional webpage vulnerability identification device according to an embodiment of this application, such as... Figure 5 As shown, the device for identifying webpage vulnerabilities may include: an acquisition unit 50, an extraction unit 51, a generation unit 52, and an identification unit 53.

[0078] The acquisition unit 50 is used to acquire target information of the target page, wherein the target information includes at least: page structure and interface information;

[0079] Extraction unit 51 is used to extract features from the page structure to obtain the target vector, convert the interface information into a text sequence, extract features from the text sequence, and generate an interface semantic feature vector.

[0080] The generation unit 52 is used to input the target vector and the interface semantic feature vector into the preset multimodal model to generate a vulnerability attack request, wherein the vulnerability attack request corresponds to response data.

[0081] The identification unit 53 is used to perform semantic recognition on the response data using a preset language model to obtain the vulnerability identification result of the target page.

[0082] The webpage vulnerability identification device provided in this application embodiment can acquire target information of the target page through the acquisition unit 50, extract features of the page structure through the extraction unit 51 to obtain the target vector, convert the interface information into a text sequence, extract features of the text sequence to generate an interface semantic feature vector, input the target vector and the interface semantic feature vector into a preset multimodal model through the generation unit 52 to generate a vulnerability attack request, and use a preset language model to perform semantic recognition on the response data through the identification unit 53 to obtain the vulnerability identification result of the target page.

[0083] Optionally, the acquisition unit 50 includes: a first acquisition module, used to access the target page according to the page collector and acquire the source code of the target page; a first extraction module, used to listen to the network requests initiated by the source code and extract the interface information in the network requests; a first rendering module, used to render the target page according to the source code and obtain the rendered target page; and a second extraction module, used to extract the page structure of the rendered target page according to the programming interface.

[0084] Optionally, the page structure includes at least: multiple nodes, and the extraction unit 51 includes: a first encoding module, used to encode the preset label of each node to obtain a label encoding, and to encode the attributes of each node to obtain an attribute encoding; a second encoding module, used to encode the text content within each node to obtain a text encoding, and to record the depth of each node in the page structure to obtain a position encoding; a first determining module, used to determine the node encoding of each node based on the label encoding, attribute encoding, text encoding, and position encoding; and a second determining module, used to input all node encodings into a preset recurrent neural model, extract the features of the page structure, and determine the target vector based on all features.

[0085] Optionally, the webpage vulnerability identification device further includes: a second acquisition module, used to acquire the historical page structure and historical interface information of multiple historical pages before inputting the target vector and interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request; a third extraction module, used to extract the features of each historical page structure to obtain a historical target vector; a fourth extraction module, used to convert each historical interface information into a historical text sequence and extract the features of the historical text sequence to generate a historical interface semantic feature vector; a first concatenation module, used to concatenate the historical target vector and the historical interface semantic feature vector for each historical page to obtain a concatenated sample; and a first training module, used to train an initial multimodal model based on all concatenated samples to obtain a preset multimodal model.

[0086] Optionally, the generation unit 52 includes: a second concatenation module for concatenating the target vector and the interface semantic feature vector to obtain an input sequence; and a first generation module for inputting the input sequence into a preset multimodal model to generate a vulnerability attack request.

[0087] Optionally, the identification unit 53 includes: a first sending module, used to send a vulnerability attack request to a server, wherein the server responds to the vulnerability attack request and returns response data; a first processing module, used to process the response data to obtain a response sequence; and a first identification module, used to perform semantic recognition on the response sequence using a preset language model to obtain a vulnerability identification result.

[0088] Optionally, the vulnerability identification result includes at least: vulnerability category. The webpage vulnerability identification device further includes: a first verification module, used to verify the vulnerability identification result after semantic recognition of the response sequence using a preset language model to obtain the vulnerability identification result, and obtain a verification result; a first annotation module, used to correct the vulnerability category if the verification result indicates that the vulnerability category is incorrect, and to annotate the response data based on the corrected vulnerability category to obtain a first annotation sample; a second annotation module, used to annotate the response data based on the vulnerability category if the verification result indicates that the vulnerability category is correct, and obtain a second annotation sample; and a first construction module, used to construct feedback samples based on the first annotation sample and the second annotation sample, and to incrementally train the preset language model based on the feedback sample.

[0089] The aforementioned webpage vulnerability identification device may also include a processor and a memory. The aforementioned acquisition unit 50, extraction unit 51, generation unit 52, identification unit 53, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0090] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, a preset language model can be used to perform semantic recognition on the response data to obtain the vulnerability identification results for the target page.

[0091] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0092] It should be noted that the acquisition unit 50, extraction unit 51, generation unit 52, and identification unit 53 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0093] Example 3

[0094] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0095] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0096] In this embodiment, the computer terminal described above can execute the program code for the following steps in the webpage vulnerability identification method: obtaining target information of the target page, wherein the target information includes at least: page structure and interface information; extracting features from the page structure to obtain a target vector, converting the interface information into a text sequence, extracting features from the text sequence to generate an interface semantic feature vector; inputting the target vector and the interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request, wherein the vulnerability attack request corresponds to response data; and using a preset language model to perform semantic recognition on the response data to obtain the vulnerability identification result of the target page.

[0097] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the webpage vulnerability identification method: accessing the target page using a page crawler to obtain the source code of the target page; listening to network requests initiated by the source code and extracting interface information from the network requests; rendering the target page based on the source code to obtain the rendered target page; and extracting the page structure of the rendered target page based on the programming interface.

[0098] Optionally, the aforementioned computer terminal can execute the following steps in the webpage vulnerability identification method: encoding the preset label of each node to obtain the label code, and encoding the attributes of each node to obtain the attribute code; encoding the text content within each node to obtain the text code, and recording the depth of each node in the page structure to obtain the position code; determining the node code of each node based on the label code, attribute code, text code, and position code; inputting all node codes into a preset recurrent neural model to extract the features of the page structure, and determining the target vector based on all features.

[0099] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the webpage vulnerability identification method: obtaining the historical page structure and historical interface information of multiple historical pages; extracting features from each historical page structure to obtain a historical target vector; converting each historical interface information into a historical text sequence, and extracting features from the historical text sequence to generate a historical interface semantic feature vector; for each historical page, concatenating the historical target vector with the historical interface semantic feature vector to obtain a concatenated sample; and training an initial multimodal model based on all concatenated samples to obtain a preset multimodal model.

[0100] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the webpage vulnerability identification method: concatenating the target vector and the interface semantic feature vector to obtain an input sequence; inputting the input sequence into a preset multimodal model to generate a vulnerability attack request.

[0101] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the webpage vulnerability identification method: sending a vulnerability attack request to a server, wherein the server responds to the vulnerability attack request and returns response data; processing the response data to obtain a response sequence; and using a preset language model to perform semantic recognition on the response sequence to obtain a vulnerability identification result.

[0102] Optionally, the aforementioned computer terminal may execute program code for the following steps in the webpage vulnerability identification method: verifying the vulnerability identification result to obtain a verification result; if the verification result indicates an incorrect vulnerability category, correcting the vulnerability category and labeling the response data based on the corrected vulnerability category to obtain a first labeled sample; if the verification result indicates a correct vulnerability category, labeling the response data based on the vulnerability category to obtain a second labeled sample; constructing feedback samples based on the first and second labeled samples, and incrementally training a preset language model based on the feedback samples.

[0103] Optionally, Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) Processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0104] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the webpage vulnerability identification method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned webpage vulnerability identification method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0105] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the method for identifying web page vulnerabilities.

[0106] This application provides a scheme for identifying web page vulnerabilities. By capturing the contextual dependencies in the DOM tree structure and understanding the code semantics of API interfaces, it can intelligently analyze the DOM structure features and API interface semantics of web pages using a cross-modal Transformer model to generate vulnerability attack requests. The large language model trained on the response data can analyze the server's response data to the vulnerability attack requests, performing semantic-level vulnerability identification, effectively improving the identification accuracy and reducing false positives and false negatives. Furthermore, by continuously collecting and analyzing actual identification data and manual review results, the model parameters can be dynamically adjusted, enabling the model to continuously learn new vulnerability patterns and attack strategies, gradually improving its generalization ability and the ability to identify unknown vulnerabilities. This solves the technical problem of low vulnerability identification accuracy in related technologies.

[0107] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0108] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0109] Example 4

[0110] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the webpage vulnerability identification method provided in Embodiment 1.

[0111] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0112] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing steps of a method for identifying web page vulnerabilities.

[0113] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0114] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0116] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0119] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for identifying webpage vulnerabilities, characterized in that, include: Obtain target information of the target page, wherein the target information includes at least: page structure and interface information; Feature extraction is performed on the page structure to obtain the target vector, and the interface information is converted into a text sequence. Feature extraction is performed on the text sequence to generate an interface semantic feature vector. The target vector and the interface semantic feature vector are input into a preset multimodal model to generate a vulnerability attack request, wherein the vulnerability attack request corresponds to response data; The response data is semantically identified using a preset language model to obtain the vulnerability identification results of the target page.

2. The method for identifying webpage vulnerabilities according to claim 1, characterized in that, The steps to obtain target information from the target page include: The target page is accessed using a page crawler to obtain the source code of the target page; Listen to network requests initiated by the source code and extract the interface information from the network requests; Based on the source code, the target page is rendered to obtain the rendered target page; Based on the programming interface, extract the page structure of the rendered target page.

3. The method for identifying webpage vulnerabilities according to claim 1, characterized in that, The page structure includes at least multiple nodes. The step of extracting features from the page structure to obtain a target vector includes: Encode the preset label of each node to obtain the label code, and encode the attribute of each node to obtain the attribute code; The text content within each node is encoded to obtain a text encoding, and the depth of each node in the page structure is recorded to obtain a position encoding; Based on the tag encoding, the attribute encoding, the text encoding, and the position encoding, the node encoding of each node is determined; All the node codes are input into a preset recurrent neural model to extract the features of the page structure, and the target vector is determined based on all the features.

4. The method for identifying webpage vulnerabilities according to claim 1, characterized in that, Before inputting the target vector and the interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request, the process also includes: Retrieve the historical page structure and historical interface information of multiple historical pages; Extract the features of each historical page structure to obtain the historical target vector; Each historical interface information is converted into a historical text sequence, and the features of the historical text sequence are extracted to generate a historical interface semantic feature vector; For each historical page, the historical target vector and the historical interface semantic feature vector are concatenated to obtain a concatenated sample; Based on all the spliced ​​samples, an initial multimodal model is trained to obtain the preset multimodal model.

5. The method for identifying webpage vulnerabilities according to claim 1, characterized in that, The step of inputting the target vector and the interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request includes: The target vector and the interface semantic feature vector are concatenated to obtain the input sequence; The input sequence is input into the preset multimodal model to generate the vulnerability attack request.

6. The method for identifying webpage vulnerabilities according to claim 5, characterized in that, The step of performing semantic recognition on the response data using a preset language model to obtain the vulnerability identification result of the target page includes: The vulnerability attack request is sent to the server, wherein the server responds to the vulnerability attack request and returns the response data; The response data is processed to obtain a response sequence; The vulnerability identification result is obtained by semantically recognizing the response sequence using the preset language model.

7. The method for identifying webpage vulnerabilities according to claim 6, characterized in that, The vulnerability identification result includes at least: vulnerability category; after obtaining the vulnerability identification result by performing semantic recognition on the response sequence using a preset language model, it also includes: The vulnerability identification results are verified to obtain the verification results; If the verification result indicates that the vulnerability category is incorrect, the vulnerability category is corrected, and the response data is labeled based on the corrected vulnerability category to obtain a first labeled sample; If the verification result indicates that the vulnerability category is correct, the response data is labeled based on the vulnerability category to obtain a second labeled sample; Based on the first labeled sample and the second labeled sample, a feedback sample is constructed, and based on the feedback sample, the preset language model is incrementally trained.

8. A device for identifying webpage vulnerabilities, characterized in that, include: The acquisition unit is used to acquire target information of the target page, wherein the target information includes at least: page structure and interface information; The extraction unit is used to extract features from the page structure to obtain a target vector, convert the interface information into a text sequence, extract features from the text sequence, and generate an interface semantic feature vector. The generation unit is used to input the target vector and the interface semantic feature vector into a preset multimodal model to generate a vulnerability attack request, wherein the vulnerability attack request corresponds to response data; The identification unit is used to perform semantic recognition on the response data using a preset language model to obtain the vulnerability identification result of the target page.

9. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the webpage vulnerability identification method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the webpage vulnerability identification method according to any one of claims 1 to 7.

Images