Interactive security test method and device based on large model

Abstract

The invention provides an interactive security testing method and device based on a large model, and can be applied to the technical field of artificial intelligence and security testing. The method comprises the following steps: preliminarily identifying a security vulnerability set of an application by using a taint analysis technology to obtain a first security vulnerability set; function information related to the first security vulnerability set is extracted, and the function information comprises at least one of function content and taint parameters related to the first security vulnerability set; performing logic analysis on at least one of the function content and the stain parameters by utilizing a large model to obtain a logic analysis result aiming at the function information; and processing the first security vulnerability set according to the logic analysis result to obtain a second security vulnerability set, and outputting the second security vulnerability set as at least one part of an interactive security test result.

Description

Interactive security testing methods and apparatus based on large models Technical Field

[0001] This application relates to the fields of artificial intelligence and security testing technology, specifically to an interactive security testing method, apparatus, electronic device, storage medium, and program product based on a large model. Background Technology

[0002] With the rapid development of information technology, application security testing has become increasingly important. Among numerous security testing technologies, Interactive Application Security Testing (IAST) has attracted widespread attention due to its ability to perform security analysis during application runtime. IAST technology uses taint analysis to track the propagation path of data flow within the application, thereby identifying potential security vulnerabilities. Compared to traditional static analysis and dynamic testing methods, it offers higher accuracy and efficiency. Currently, taint analysis has become one of the core technologies of IAST. This technology marks and tracks the propagation of data (i.e., taints) from untrusted sources during application execution, issuing security warnings when tainted data reaches sensitive operational points.

[0003] However, existing IAST technologies still have some significant limitations. First, traditional IAST tools primarily rely on the propagation path of runtime data for analysis, lacking a deep understanding of the application code's logic itself, particularly in identifying security protection mechanisms implemented at the business level. Second, when applications implement their own security logic such as input filtering, escaping, or access control, IAST technologies often fail to accurately identify these protection mechanisms, leading to a higher false positive rate. Furthermore, while there have been attempts to apply large models to security testing, most existing technologies focus on vulnerability verification or test bootstrapping, lacking in-depth analysis and understanding of the application's internal protection logic.

[0004] Therefore, how to leverage the semantic understanding capabilities of large models to enhance IAST's ability to judge security protection mechanisms at the business logic layer, reduce false positive rates, and improve the accuracy and efficiency of security testing has become a pressing technical problem that needs to be solved. Summary of the Invention

[0005] In view of at least one aspect of the above-mentioned problems, embodiments of this application provide an interactive security testing method, apparatus, electronic device, storage medium, and program product based on a large model, which can more accurately identify real vulnerabilities and improve the testing accuracy of interactive security testing.

[0006] According to a first aspect of this application, a large-model-based interactive security testing method is provided. The method includes: using taint analysis techniques to preliminarily identify security vulnerabilities in an application to obtain a first security vulnerability set, wherein the first security vulnerability set includes m security vulnerabilities, where m is a positive integer greater than or equal to 2; extracting function information related to the m security vulnerabilities, wherein the function information includes function content and tainted parameters related to the m security vulnerabilities; performing logical analysis on the function content and the tainted parameters using a large model to obtain a logical analysis result for the function information; and processing the first security vulnerability set according to the logical analysis result to obtain a second security vulnerability set, and outputting the second security vulnerability set as at least a part of the result of the interactive security test, wherein the second security vulnerability set includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m.

[0007] For example, the extraction of function information related to the m security vulnerabilities includes: extracting the function content of multiple functions involved in the propagation chain of the taint using a decompilation method; extracting the taint parameters involved in the propagation chain of the taint using instrumentation techniques; and associating the function content with the taint parameters to obtain the function information.

[0008] For example, the step of using a large model to perform logical analysis on the function content and the taint parameter to obtain logical analysis results for the function information includes: using a large model to perform semantic understanding on the function content and the taint parameter to obtain semantic understanding results; and using the large model and preset protection logic to analyze the semantic understanding results to obtain logical analysis results for the function information.

[0009] For example, the step of using a large model to perform semantic understanding on the function content and the taint parameter to obtain semantic understanding results includes: inputting the function content and the taint parameter into the large model; and using the large model to identify semantic features in the function content and the taint parameter that are semantically related to at least one of feature filtering, feature escaping, and access control.

[0010] For example, the preset protection logic includes at least one of feature filtering, feature escaping, and access control; the step of using the large model and the preset protection logic to analyze the semantic understanding result to obtain the logical analysis result for the function information includes: using the large model to match the semantic features with the feature filtering, feature escaping, and access control respectively; and in response to the semantic features successfully matching with at least one of the feature filtering, feature escaping, and access control, determining that the logical analysis result of the function information includes at least one of the feature filtering, feature escaping, and access control.

[0011] For example, the step of using taint analysis technology to initially identify security vulnerabilities in an application to obtain a first set of security vulnerabilities includes: tracking the propagation path of tainted data within the application; detecting security vulnerability points based on the propagation path of the tainted data within the application; and obtaining the first set of security vulnerabilities based on the propagation path and the security vulnerability points.

[0012] For example, the step of processing the first security vulnerability set according to the logical analysis result to obtain a second security vulnerability set, and outputting the second security vulnerability set as the result of an interactive security test, includes: for the first to m security vulnerabilities in the first security vulnerability set, iteratively executing the following process: in response to the logical analysis result of the function information of the i-th security vulnerability, which includes at least one of the feature filtering, the feature escaping, and the access control, determining that the i-th security vulnerability is a false alarm vulnerability, wherein the i-th first security vulnerability is one of the m first security vulnerabilities, and i is a positive integer greater than or equal to 1 and less than or equal to m; and removing the i-th security vulnerability from the first security vulnerability set.

[0013] For example, the step of using the large model and preset protection logic to analyze the semantic understanding results to obtain the logic analysis results for the function information further includes: using the large model to identify the overall protection logic associated with the function content and the taint parameter; and in response to the existence of protection defects in the overall protection logic, generating a protection logic improvement strategy for the function information.

[0014] A second aspect of this application provides an interactive security testing apparatus based on a large model. The apparatus includes: a first acquisition module, configured to preliminarily identify security vulnerabilities in an application using taint analysis techniques to acquire a first security vulnerability set, wherein the first security vulnerability set includes m security vulnerabilities, where m is a positive integer greater than or equal to 2; an extraction module, configured to extract function information related to the m security vulnerabilities, wherein the function information includes function content and tainted parameters related to the m security vulnerabilities; a logic analysis module, configured to perform logical analysis on the function content and the tainted parameters using a large model to acquire logical analysis results for the function information; and a second acquisition module, configured to process the first security vulnerability set according to the logical analysis results to acquire a second security vulnerability set, and output the second security vulnerability set as at least a part of the result of the interactive security test, wherein the second security vulnerability set includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m.

[0015] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0017] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0018] The method and apparatus provided in this application combine large model technology and interactive security testing technology. The large model is used to perform secondary analysis on the interactive security test results, enabling the interactive security test to perceive the security protection logic of the application, thereby more accurately identifying real vulnerabilities, minimizing false alarms of the tool, and improving the test accuracy of interactive security testing. Attached Figure Description

[0019] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 schematically illustrates an application scenario of the interactive security testing method based on a large model according to an embodiment of this application;

[0021] Figure 2 is a flowchart of an interactive security testing method based on a large model according to an embodiment of this application;

[0022] Figure 3 is a flowchart of the preliminary identification steps in the large-model-based interactive security testing method according to an embodiment of this application;

[0023] Figure 4 is a flowchart of the step of extracting function information in the interactive security testing method based on a large model according to an embodiment of this application;

[0024] Figure 5 is a flowchart of the steps of performing logical analysis using a large model in the interactive security testing method based on a large model according to an embodiment of this application;

[0025] Figure 6 is a flowchart of the steps for obtaining a second set of security vulnerabilities in a large-model-based interactive security testing method according to an embodiment of this application;

[0026] Figure 7 schematically illustrates a structural block diagram of an interactive security testing apparatus based on a large model according to an embodiment of this application; and

[0027] Figure 8 schematically illustrates a block diagram of an electronic device suitable for implementing a large-model-based interactive security testing method according to an embodiment of this application. Detailed Implementation

[0028] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0029] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0031] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0032] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0033] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0034] Figure 1 schematically illustrates an application scenario of the interactive security testing method based on a large model according to an embodiment of this application.

[0035] As shown in Figure 1, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, and a server 105. A network 104 serves as the medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0036] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0037] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0038] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0039] It should be noted that the interactive security testing method based on a large model provided in this application embodiment can generally be executed by server 105. Correspondingly, the interactive security testing device based on a large model provided in this application embodiment can generally be located in server 105. The interactive security testing method based on a large model provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the interactive security testing device based on a large model provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0040] It should be understood that the number of terminal devices, networks, and servers shown in Figure 1 is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0041] The following will describe in detail the interactive security testing method based on a large model according to the embodiments of this application, based on the scenario described in Figure 1 and Figures 2 to 6.

[0042] Some exemplary embodiments of this application provide an interactive security testing method based on a large model. The method includes: using taint analysis technology to preliminarily identify security vulnerabilities in an application to obtain a first security vulnerability set, wherein the first security vulnerability set includes m security vulnerabilities, where m is a positive integer greater than or equal to 2; extracting function information related to the m security vulnerabilities, wherein the function information includes function content and tainted parameters related to the m security vulnerabilities; using a large model to perform logical analysis on the function content and tainted parameters to obtain logical analysis results for the function information; and processing the first security vulnerability set according to the logical analysis results to obtain a second security vulnerability set, and outputting the second security vulnerability set as at least a part of the result of the interactive security test, wherein the second security vulnerability set includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m. The method provided in this application combines large model technology and interactive security testing technology. By performing secondary analysis on the interactive security test results through the large model, a leap from "mechanically tracking data" to "understanding code intent" is achieved. This enables interactive security testing to perceive the security protection logic of the application, thereby more accurately identifying real vulnerabilities, minimizing false positives of the tool, and improving the testing accuracy of interactive security testing.

[0043] Figure 2 is a flowchart of an interactive security testing method based on a large model according to an embodiment of this application. Referring to Figure 2, the method may include the following steps S210 to S240.

[0044] In step S210, taint analysis techniques are used to initially identify security vulnerabilities in the application to obtain a first set of security vulnerabilities. For example, this first set of security vulnerabilities may include m security vulnerabilities, where m is a positive integer greater than or equal to 2. It should be understood that the m security vulnerabilities here can represent potential security vulnerabilities initially identified using traditional interactive security testing techniques.

[0045] In some exemplary embodiments, step S210, which involves preliminary identification of security vulnerabilities in the application using taint analysis techniques, may include: using taint analysis techniques to identify potential security vulnerabilities by tracing the propagation path of user input data within the application. For example, using taint analysis techniques, monitoring points are first inserted at key entry points of the application. When user input data enters the application through these key entry points, taint labels can be assigned to this data. Subsequently, the propagation process of this tainted data within the application can be tracked, recording the function call chains and variable assignment operations through which the data flows. When tainted data reaches a predefined dangerous function, a potential security vulnerability is determined, and these potential security vulnerabilities are collected to form a first security vulnerability set.

[0046] Referring again to Figure 2, in step S220, extract the function information related to the m security vulnerabilities, wherein the function information includes the function content and taint parameters related to the m security vulnerabilities.

[0047] For example, for each security vulnerability in the first security vulnerability set, its associated function information is extracted. This function information may include function content and tainted parameters. The function content may include code snippets related to the security vulnerability, including but not limited to function definitions and logical implementations within the function body. The tainted parameters may include the name, type, propagation path, and transmission method of the tainted data in various functions. In some embodiments of this application, the function code related to the vulnerability in the application can be obtained through decompilation techniques, and combined with the parameter transmission information collected during taint analysis, complete function information can be constructed. This function information provides the necessary context for subsequent logical analysis.

[0048] Referring again to Figure 2, in step S230, the large model is used to perform logical analysis on the function content and the taint parameters to obtain the logical analysis results for the function information.

[0049] For example, in step S230, the extracted function content and tainted parameters related to the m security vulnerabilities can be input into a pre-trained large model. The large model first performs syntactic analysis on the function code, constructs an abstract syntax tree, and identifies elements such as variable definitions, conditional statements, and loop structures in the code. Then, the large model, combined with the tainted parameters, analyzes the processing flow of tainted data within the function, paying particular attention to the presence of security protection measures, such as input validation, feature filtering, parameter escaping, and permission checks. Through deep semantic understanding, the large model identifies whether security protection logic exists in the code and evaluates the effectiveness of these protection measures. Finally, the large model outputs the logical analysis results for each function, including but not limited to: whether effective security protection measures exist, the type of protection measures, and the completeness of the protection measures.

[0050] It should be noted that no special limitations are placed on the large models used in the embodiments of this application. For example, the large models may include various large models with deep code semantic understanding capabilities, capable of accurately parsing the logical structure and functional intent of application code. For example, the large models can be trained based on massive amounts of security code and vulnerability case sets, and can identify the syntactic features of different programming languages ​​and understand the semantic relationships of operations such as function calls, conditional judgments, and data processing. When the function code and tainted parameter information in the propagation chain of input taints are input, the large model can locate the propagation path of tainted parameters in the function through abstract syntax tree analysis and contextual reasoning, and identify whether there is protective logic such as input filtering, character escaping, or access control. For example, the large model can have a built-in industry security standard knowledge base, and can evaluate the completeness of protective logic in combination with attack vector patterns, such as discovering whether regular expression filtering has missed double-write bypass scenarios, or whether escaping processing has not covered all dangerous characters. The large model can upgrade the surface-level syntax analysis of code to deep logical understanding. It can not only identify standard protection functions, but also parse the security processing mechanisms in custom business logic. Through dynamic reasoning, it can simulate attack paths and determine whether there is a possibility of bypassing the protection, thereby providing accurate vulnerability risk calibration for interactive security testing.

[0051] Referring again to Figure 2, in step S240, the first security vulnerability set is processed according to the logical analysis result to obtain a second security vulnerability set, and the second security vulnerability set is output as at least part of the result of the interactive security test. The second security vulnerability set includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m.

[0052] For example, in step S240, each security vulnerability in the first security vulnerability set can be analyzed or evaluated based on the logical analysis results of the large model. If the evaluation or analysis results indicate that there are effective security protection measures in the function related to a security vulnerability, the security vulnerability is marked as a false alarm and removed from the first security vulnerability set. After this processing, a second security vulnerability set including n security vulnerabilities can be obtained, where n is not greater than m. The security vulnerabilities in the second security vulnerability set are real vulnerabilities verified by the logical analysis of the large model, and can be used as at least part of the output of the interactive security test results.

[0053] Figure 3 is a flowchart of the preliminary identification step in the interactive security testing method based on a large model according to an embodiment of this application. Referring to Figure 3, the preliminary identification step may further include steps S310 to S330.

[0054] In step S310, the propagation path of the taint data within the application is tracked.

[0055] For example, in the step of tracing the propagation path of tainted data within an application, user input data can first be tainted at key entry points or input points of the application (such as HTTP request parameters, file upload interfaces, command-line arguments, etc.). Then, the flow of this tainted data during application execution is monitored, recording operations such as variable assignments, function calls, and return value processing. When tainted data is passed to other functions via function parameters, the execution of these functions can be traced, and the flow of tainted data can continue to be monitored. When tainted data undergoes operations such as string concatenation, formatting, and encoding conversion, the tainted tags can be updated accordingly to ensure that tainted attributes are correctly propagated during data transformation. Through this process, a complete taint propagation graph can be constructed, which describes the flow path of user input data within the application.

[0056] In step S320, security vulnerabilities are detected based on the propagation path of the taint data within the application.

[0057] For example, detecting security vulnerabilities can include identifying where tainted data flows into sensitive operations. A predefined set of sensitive operations (e.g., system command execution, SQL queries, file operations, deserialization, etc.) could potentially lead to security vulnerabilities if they receive improperly processed tainted data. The flow of tainted data can be monitored, and when tainted data is found to be passed as a parameter to these sensitive operations, the location is marked as a potential security vulnerability. For instance, if tainted data flows into a function that executes system commands (e.g., Runtime.exec() in Java or system() in PHP), the function call point can be marked as a command injection vulnerability; if tainted data flows into an SQL (Structured Query Language) query function, the function call point can be marked as an SQL injection vulnerability.

[0058] In step S330, the first set of security vulnerabilities is obtained based on the propagation path and the security vulnerability points.

[0059] For example, obtaining a first set of security vulnerabilities may include generating a preliminary set of security vulnerabilities based on taint propagation paths and security vulnerability points. The contextual information of each security vulnerability point can be analyzed, including the source of the taint data, its propagation path, transformation operations, and final usage. A security vulnerability description is generated for each security vulnerability point, including the vulnerability type (such as SQL injection, command injection, XSS (Cross-Site Scripting), etc.), vulnerability location (filename, line number, function name, etc.), taint source (such as HTTP parameter name, cookie field, etc.), and a propagation path summary. These vulnerability descriptions can be summarized into a first set of security vulnerabilities, serving as the basis for subsequent analysis. In an exemplary embodiment, the first set of security vulnerabilities includes m security vulnerabilities, where m is a positive integer greater than or equal to 2, representing the number of initially identified potential security vulnerabilities.

[0060] In some exemplary embodiments, the m security vulnerabilities include, but are not limited to, the following types of security vulnerabilities: SQL injection vulnerabilities, cross-site scripting (XSS) attacks, command injection vulnerabilities, file upload vulnerabilities, and path traversal vulnerabilities.

[0061] For example, an SQL injection vulnerability can mean that user-input data is directly concatenated into an SQL query statement without filtering or escaping, allowing attackers to inject malicious SQL code to obtain or tamper with database data. In step S210, the tainted source of an SQL injection vulnerability can include user input (e.g., HTTP request parameters, form data, etc.), and the propagation path of the tainted data can include: user input → web application backend receiving parameters → concatenation into an SQL statement. The security vulnerability point can include the database operation interface. During the preliminary identification process, if tainted data is identified as directly participating in SQL statement concatenation without being processed by pre-compiled statements, an SQL injection vulnerability is preliminarily identified and placed in the first set of security vulnerabilities.

[0062] For example, a cross-site scripting (XSS) vulnerability can be described as follows: malicious scripts input by the user are embedded in a webpage and executed, stealing user cookies (small text data sent by the server to the user's browser and stored locally, used to track user status, store preferences, or session information, etc.) or manipulating page behavior. For XSS vulnerabilities, in step S210, the tainted source can include user input (e.g., URL (Uniform Resource Locator) parameters, form submissions, etc.), and the propagation path of the tainted data can include: user input → backend reception and storage (e.g., storage in a database) → direct output during frontend rendering. The security vulnerability point can include frontend DOM (Document Object Model) operations or HTML (Hypertext Markup Language) rendering interfaces. In the preliminary identification process, if tainted data is identified as being directly output as HTML content, a potential XSS vulnerability is determined to exist, and it is placed in the first set of security vulnerabilities.

[0063] For example, a command injection vulnerability can mean that user input is concatenated into system commands, allowing an attacker to execute arbitrary operating system commands. In step S210, for a command injection vulnerability, the taint source can include user input (e.g., file paths, command parameters, etc.), the propagation path of the tainted data can include: user input → backend reception → concatenation into system commands, and the security vulnerability point can include the system command execution interface. During the preliminary identification process, if tainted data is identified as directly participating in command concatenation, a potential command injection vulnerability is determined to exist, and it is placed in the first set of security vulnerabilities.

[0064] For example, a file upload vulnerability could mean that a user can upload a malicious file to the server, resulting in a breach of privileges. In step S210, the source of the taint could include the uploaded file content or filename, and the propagation path of the tainted data could include: file upload → server receiving file data → saving to storage. The security vulnerability point could include a file writing interface or a file parsing interface. During the initial identification process, if a dangerous file is identified as being saved to an executable path, a potential file upload vulnerability is determined to exist, and it is added to the first set of security vulnerabilities.

[0065] For example, a path traversal vulnerability can be defined as accessing sensitive files on a server by constructing a special path. For a path traversal vulnerability, in step S210, the taint source can include user-inputted file path parameters, the propagation path of the tainted data can include: user-inputted path → backend reception → file system operation, and the security vulnerability point can include file read or write interfaces. During the initial identification process, if tainted data is identified as leading to access to an unexpected path, a potential path traversal vulnerability is determined to exist and it is added to the first set of security vulnerabilities.

[0066] In the embodiments of this application, taint analysis technology is used in interactive security testing to associate user-input taints with dangerous operations through a mark-track-detect logic, which can efficiently discover various types of security vulnerabilities such as injection vulnerabilities and file operation vulnerabilities.

[0067] Figure 4 is a flowchart of the function information extraction step in the interactive security testing method based on a large model according to an embodiment of this application. Referring to Figure 4, the preliminary identification step may further include steps S410 to S430.

[0068] In step S410, the function contents of multiple functions involved in the propagation chain of the taint are extracted by decompilation.

[0069] In embodiments of this application, the taint propagation chain can include a data flow path or link from the taint source to the security vulnerability point. For example, as mentioned above, when user input is marked as tainted data, the transmission process of this data in the application can be tracked, recording how the data is passed from one function to another, which variables are assigned, calculated, or transformed, and whether it ultimately reaches an operation that may cause a security problem. The path formed by this tracking process is the taint propagation chain, which connects the complete path or link from the taint source to the security vulnerability point. For example, in an application with an SQL injection vulnerability, the content entered by the user through a web form is first received by the front end, then passed to the back end API (i.e., Application Programming Interface), the API passes the parameters to the business logic layer for processing, and finally to the database access layer to execute SQL queries. If the input is not securely processed during this process, the entire path forms a complete taint propagation chain.

[0070] After identifying the taint propagation chain through taint analysis, the next step is to obtain the specific implementation code of each function in the propagation chain. It should be understood that decompilation methods refer to the methods of converting an application's binary code or bytecode into a more readable source code format. In some exemplary embodiments, the function call chain can be identified based on the taint propagation chain extracted during taint analysis, and then the target function to be decompiled can be located based on the function call chain. For example, for Java applications, bytecode manipulation libraries can be used to parse class files and extract the bytecode of the target function; for C / C++ applications, decompilation tools can be used to analyze binary files, extract the assembly code of the target function, and convert it into a high-level language representation. Through decompilation methods, the complete code implementation of each function in the taint propagation chain can be obtained, including function signatures, parameter lists, local variable definitions, and the logic implementation within the function body.

[0071] In the embodiments of this application, the propagation chain of taints is combined with the function content obtained by decompilation methods to form a complete vulnerability analysis context. First, the propagation chain of taints identifies the functions involved in processing tainted data. Then, the specific implementations of these functions are obtained through decompilation. After this processing, large-scale modeling techniques can be used to examine how each function processes tainted data, such as identifying whether data filtering, escaping, or permission verification are performed. For example, if the propagation chain of taints shows that a certain SQL query function received unfiltered user input, the decompilation results can specifically show whether the function used prepared statements and whether special characters were escaped. If it is found that the function did not take any security measures, an SQL injection vulnerability can be accurately identified. This combined approach makes vulnerability analysis more precise, allowing for in-depth analysis at the code detail level to discover potential security risks.

[0072] In step S420, the taint parameters involved in the taint propagation chain are extracted using a studding technique.

[0073] It should be understood that instrumentation techniques can include: inserting additional monitoring code at critical locations in an application to collect dynamic information during program execution. In taint analysis, the main role of instrumentation is to track the flow path of data, starting from the taint source input by the user, and continuously monitoring the transmission process of this data within the application until they reach the operation point (i.e., the security vulnerability point) that may cause security risks. For example, monitoring code can be inserted at critical locations in the application, including but not limited to: (1) Function entry and exit: when a function is called, record the value of the passed parameter; when the function returns, record whether the return value carries taint; (2) Variable assignment point: when a variable is assigned a tainted data value, mark the new variable as tainted as well, and record the assignment operation; (3) Critical operation point: such as database query, file writing, system command execution and other operations that may cause security vulnerabilities, record the parameter state before the operation.

[0074] In some exemplary embodiments, monitoring code can be inserted at the entry and exit points of key functions along the propagation chain of tainted data. This monitoring code records the actual value, type, size, and propagation direction of tainted parameters during application runtime. For example, dynamic binary instrumentation tools or source code-level instrumentation tools can be used to insert monitoring code at parameter passing points, return value handling points, and key variable assignment points in the target function. When the application executes to these instrumentation points, the monitoring code can capture the current tainted parameters.

[0075] In step S430, the function content is associated with the taint parameter to obtain the function information.

[0076] In some exemplary embodiments, associating function content with tainted parameters may include combining static function code with dynamic parameter propagation information to construct complete function information. For example, first, a function call graph is established to represent the propagation path of tainted data between functions. Then, each function node is associated with its corresponding function content to form a call graph with code implementation. Next, tainted parameters collected through instrumentation are mapped to the corresponding positions in the call graph, annotating the specific tainted data processed by each function node. Finally, a function information model that integrates static code structure and dynamic parameter flow is generated, providing comprehensive contextual information for the logical analysis of large models.

[0077] In this embodiment, decompilation, instrumentation, and correlation analysis significantly improve the accuracy and depth of vulnerability detection in interactive security testing. Decompilation converts the application's binary or bytecode into highly readable source code, extracting the complete logic of functions in the taint propagation chain, including function signatures, parameter lists, and internal implementations. This allows security testing to overcome the limitations of runtime data and delve into the underlying code. Instrumentation deploys monitoring code at critical program locations, dynamically capturing the actual value, type, and propagation direction of tainted parameters, accurately locating the complete path of data from input to dangerous operations. Combining these two techniques, by correlating function content with tainted parameters, forms complete function information covering both code logic and data flow. This approach not only discovers custom protection logic that traditional methods easily overlook but also accurately determines the effectiveness of protection, avoiding false positives and false negatives. For example, analyzing function code can determine if an input filtering function has logical flaws; combining this with the propagation trajectory of tainted parameters, it can determine whether the flaw will lead to an actual vulnerability. Ultimately, this technical solution provides a detailed and reliable data foundation for the comprehensiveness of the protection logic and the possibility of bypassing it in subsequent analysis of the large model, greatly enhancing the ability of interactive security testing to identify security risks at the business logic layer.

[0078] Figure 5 is a flowchart of the steps of performing logical analysis using a large model in the interactive security testing method based on a large model according to an embodiment of this application. Referring to Figure 5, the steps of performing logical analysis using a large model may further include steps S510 to S520.

[0079] In step S510, the large model is used to perform semantic understanding on the function content and the taint parameters to obtain semantic understanding results.

[0080] In embodiments of this application, the step of using a large model to perform semantic understanding on the function content and the taint parameter to obtain semantic understanding results may further include: inputting the function content and the taint parameter into the large model; and using the large model to identify at least one semantic feature in the function content and the taint parameter that is semantically related to feature filtering, feature escaping, and access control.

[0081] In this embodiment, the semantic understanding capabilities of a large-scale model enable precise insight into the security logic of functions. By inputting the function content and tainted parameters into the large-scale model, the model can quickly capture semantic features in the code and identify key logic related to feature filtering, escaping, and access control. For example, it can accurately locate custom filtering functions, escaping operations, or access control code from complex code snippets, overcoming the limitations of traditional security testing that only focuses on data flow and struggles to analyze deep semantics. This process effectively improves the accuracy and depth of security detection, enabling the discovery of security protection measures hidden in business logic, avoiding misjudging correctly processed tainted data as vulnerabilities, and reducing false positives. Simultaneously, the precise identification of protection logic helps identify areas with insufficient protection or potential bypass risks, reducing the false negative rate and providing more reliable analysis results for interactive security testing, thereby enhancing the system's defense capabilities against security vulnerabilities.

[0082] For example, the semantic understanding of function content and tainted parameters by a large model can include understanding the structure, function, and intent of function content and tainted parameters through a deep learning-based large model. In some exemplary embodiments, the large model can first parse the function code into an abstract syntax tree, capturing the syntactic structure of the code. Then, the large model applies a pre-trained code understanding model to analyze the abstract syntax tree, identifying elements such as variable definitions, control flow, and function calls in the code. Next, the large model combines tainted parameters to trace the processing flow of tainted data within the function, identifying patterns of data validation, transformation, and usage. Through this process, the large model generates a semantic representation of the function code, including a functional description of the function, a data flow graph, a control dependency graph, etc., forming a semantic understanding result.

[0083] In some exemplary embodiments, inputting function content and tainted parameters into a large model may include: converting this data into a format that the large model can process and then feeding it into the model for processing. For example, first, the function code is converted into a sequence of tokens, each token corresponding to a syntactic element in the code (e.g., keyword, variable name, operator, etc.). Then, the tainted parameters are converted into structured descriptions, including attributes such as parameter name, type, source, and propagation path. Next, these two parts of information are combined into a unified input sequence, with appropriate delimiters and hints added to guide the large model's analysis direction. Finally, the input sequence is fed into the large model's inference engine, triggering the model's forward computation process to generate internal representations and preliminary analysis results.

[0084] For example, the semantic features in the content of the large model identification function and tainted parameters can include: using the large model to analyze security-related patterns and structures in the code. For example, for feature filtering, the large model is used to retrieve operations such as pattern matching, regular expressions, and blacklist / whitelist checks in the code; these operations are used to filter out potentially dangerous input content. For feature escaping, the large model is used to identify operations such as character replacement, encoding conversion, and HTML entity generation; these operations are used to escape special characters and prevent injection attacks. For access control, the large model is used to retrieve logic such as user authentication, role checks, and access control lists; this logic is used to ensure that the executor of the operation has sufficient permissions. The large model analyzes the control flow and data flow of the function to identify the existence and implementation of security protection patterns, and outputs the identification results as semantic features.

[0085] In step S520, the semantic understanding results are analyzed using the large model and preset protection logic to obtain logical analysis results for the function information.

[0086] In the embodiments of this application, the preset protection logic includes at least one of feature filtering, feature escaping, and access control.

[0087] For example, feature filtering can include filtering specific patterns or characters in input data to prevent malicious input. For instance, feature filtering can manifest as using regular expressions to match dangerous patterns, using a blacklist to filter known dangerous characters, or using a whitelist to allow only safe characters. For example, a feature filter to prevent SQL injection can check whether the input string contains SQL keywords or special characters (e.g., single quotes, double quotes, semicolons, etc.) and remove these keywords or special characters when they are found.

[0088] Feature escaping can include converting special characters into a safe form, causing them to lose their special meaning. For example, feature escaping can manifest as using specialized escape functions to process input or output data.

[0089] Access control can include verifying whether the executor of an operation has sufficient permissions. For example, access control can manifest as checking user identity, verifying user roles, and checking access control lists. For instance, a function implementing access control could first verify if the user is logged in, and then check if the user has permission to perform a specific operation.

[0090] In some exemplary embodiments, the step of using the large model and preset protection logic to analyze the semantic understanding result to obtain the logical analysis result for the function information may further include: using the large model to match the semantic features with the feature filtering, the feature escaping, and the access control respectively; and in response to the semantic features successfully matching at least one of the feature filtering, the feature escaping, and the access control, determining that the logical analysis result of the function information includes at least one of the feature filtering, the feature escaping, and the access control.

[0091] As mentioned above, the preset protection logic can include a predefined set of security protection modes used to identify security measures in the application. These protection logics include, but are not limited to: input validation (e.g., checking if input data conforms to the expected format), feature filtering (e.g., removing or converting potentially dangerous characters or patterns), feature escaping (e.g., encoding special characters), and permission checks (e.g., verifying whether the operator has sufficient permissions). The large model matches the semantic understanding results with these preset protection logics to determine whether the corresponding security protection measures are implemented in the function.

[0092] In the embodiments of this application, the process of matching semantic features with preset protection logic by the large model is a process of pattern recognition and semantic comparison. For example, the large model first compares the identified semantic features (such as filtering operations, escaped function calls, permission checks, etc.) with the standard patterns of preset protection logic. For each type of protection logic, the large model has a set of predefined feature templates that describe the typical implementation of that type of protection logic. The large model calculates the matching degree between the semantic features and these templates; if the matching degree exceeds a preset threshold, the match is considered successful. In addition, the large model also considers contextual information, such as the overall structure of the function, the usage of variables, and the organization of control flow, to improve the accuracy of the match.

[0093] For example, when a semantic feature successfully matches a certain protection logic, the large model adds that protection logic type to the logical analysis results of the function information. If a function implements multiple protection logics, then all of these protection logic types will be recorded in the analysis results.

[0094] In this embodiment, a large-scale model is used to perform in-depth logical analysis of function information, effectively compensating for the shortcomings of traditional interactive security testing in understanding business logic. Based on powerful semantic understanding capabilities, the large-scale model can accurately parse the code logic structure within function content, understand the semantic relationships between elements such as variables, function calls, and conditional judgments, and, combined with the propagation information of tainted parameters, clarify the processing path of tainted data in the program. Whether it is a standard protection function or a complex security processing logic customized by the application, the large-scale model can quickly identify its functional intent, avoiding misjudgments caused by a lack of understanding of the code logic. On this basis, the large-scale model, combined with preset protection logic, performs a secondary analysis of the semantic understanding results, evaluating the comprehensiveness and effectiveness of the protection logic from dimensions such as industry security standards and common attack patterns. For example, it determines whether the input filtering function covers all dangerous characters and whether there is a risk of bypassing access control. This layered and progressive analysis method upgrades surface-level code syntax parsing to deep logical reasoning, not only accurately identifying security vulnerabilities but also predicting potential flaws in protective measures, providing more in-depth and accurate analysis results for interactive security testing, and significantly improving the reliability and practicality of security detection.

[0095] Figure 6 is a flowchart of the steps for obtaining a second security vulnerability set in an interactive security testing method based on a large model according to an embodiment of this application. Referring to Figure 6, the step of performing logical analysis using a large model may further include steps S610 to S630.

[0096] In step S610, a first set of security vulnerabilities, including m security vulnerabilities, is obtained.

[0097] In step S620, for the first to m security vulnerabilities in the first security vulnerability set, the following process is executed iteratively: in response to the logical analysis result of the function information of the i-th security vulnerability, which includes at least one of the feature filtering, the feature escaping, and the access control, the i-th security vulnerability is determined to be a false alarm vulnerability, wherein the i-th first security vulnerability is one of the m first security vulnerabilities, and i is a positive integer greater than or equal to 1 and less than or equal to m; and the i-th security vulnerability is removed from the first security vulnerability set.

[0098] In step S630, after verifying all m security vulnerabilities, a second security vulnerability set is formed. After this process, a second security vulnerability set is obtained, which includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m, and n represents the number of verified actual vulnerabilities.

[0099] In the embodiments of this application, by iteratively processing the security vulnerabilities in the first security vulnerability set, each potential security vulnerability can be analyzed one by one to assess its authenticity. Specifically, it can start from the first security vulnerability and process it sequentially up to the m-th security vulnerability, applying the same evaluation logic to each security vulnerability.

[0100] In the embodiments of this application, determining whether a vulnerability is a false positive is based on the logical analysis results of function information. If the analysis results indicate that the function associated with the i-th security vulnerability implements at least one of the following protective logics: feature filtering, feature escaping, or access control, the vulnerability can be considered a false positive. It should be understood that these protective logics can effectively prevent the exploitation of security vulnerabilities. For example, if a function marked as an SQL injection vulnerability actually performs strict filtering of input parameters (e.g., removing all SQL keywords and special characters) or uses parameterized queries, then even if tainted data flows into the SQL query function, it will not lead to an actual SQL injection attack. As another example, if a function marked as a file operation vulnerability implements strict access control, allowing only authorized users to perform specific file operations, then even if tainted data flows into the file operation function, it will not lead to unauthorized file access.

[0101] In embodiments of this application, removing false positive vulnerabilities may include deleting security vulnerabilities identified as false positives from a first set of security vulnerabilities. For each i-th security vulnerability identified as a false positive, it can be removed from the first set of vulnerabilities and no longer included in the final security test results. This step effectively reduces the number of false positives in the security test results, improving the accuracy and reliability of the results.

[0102] Optionally, in some exemplary embodiments, referring back to FIG5, the step of performing logic analysis using a large model may further include steps S5210 to S5220.

[0103] In step S5210, the large model is used to identify the overall protection logic associated with the function content and the taint parameter.

[0104] For example, identifying overall protection logic can include leveraging a large model to analyze the overall security architecture and protection strategies of a set of functions. The large model not only analyzes the protection measures of individual functions but also considers the collaborative relationships and allocation of security responsibilities among multiple functions. For instance, in a typical web application, input validation might be distributed across multiple components such as front-end JavaScript, middleware controllers, and back-end services. The large model constructs an overall protection model for the application by analyzing the code of these components and their call relationships, including protection layers, protection coverage, and allocation of protection responsibilities. This holistic perspective helps uncover security issues that might be overlooked by analyzing individual functions, such as inconsistencies in protection logic or missing protection responsibilities.

[0105] In step S5220, in response to the existence of a protection defect in the overall protection logic, a protection logic improvement strategy for the function information is generated.

[0106] For example, protection deficiencies can include shortcomings or vulnerabilities in the overall protection logic. These deficiencies may include, but are not limited to: incomplete protection coverage (e.g., filtering only some dangerous characters), incorrect protection implementation (e.g., using insecure filtering methods), insufficient protection layers (e.g., implementing validation only on the front end, lacking back end validation), and the possibility of protection bypass (e.g., the existence of unprocessed alternative input paths). The large model identifies these potential protection deficiencies by comparing the application's overall protection logic with security best practices. For example, if the application's XSS protection only escapes HTML tags but ignores JavaScript event attributes, the large model will identify this as a deficiency in incomplete protection coverage.

[0107] For example, generating protection logic improvement strategies can include a large model proposing specific improvement suggestions based on identified protection vulnerabilities. These suggestions may include, but are not limited to: adding missing protection measures (e.g., adding validation for specific types of input), fixing incorrect protection implementations (e.g., using more secure filtering methods), enhancing protection layers (e.g., implementing validation at multiple layers), and eliminating the possibility of protection bypass (e.g., handling all possible input paths). For instance, regarding file upload vulnerabilities, the business logic might disallow file uploads with the .jsp extension, but .jspx files can also be executed as backdoor files. The large model can analyze the decompiled code logic, design protection suggestions, and display relevant alerts to the front end to prompt the user. The large model will generate detailed improvement strategies based on the specific application and security best practices, including the code locations that need modification, recommended security libraries or functions, and specific implementation examples. These improvement strategies can help developers more effectively fix security vulnerabilities and improve the overall security of the application.

[0108] Through the above steps, the interactive security testing method based on a large model provided in this embodiment can effectively identify real security vulnerabilities in applications, reduce false alarms, and provide targeted improvement suggestions, significantly improving the efficiency and accuracy of security testing.

[0109] Based on the above-described interactive security testing method based on a large model, embodiments of this application also provide an interactive security testing device based on a large model. The device will be described in detail below with reference to Figure 7.

[0110] Figure 7 schematically illustrates a structural block diagram of a large-model-based interactive security testing apparatus according to an embodiment of this application. As shown in Figure 7, the large-model-based interactive security testing apparatus 700 of this embodiment includes a first acquisition module 710, an extraction module 720, a logic analysis module 730, and a second acquisition module 740.

[0111] The first acquisition module 710 is used to perform preliminary identification of security vulnerabilities in the application using taint analysis technology to obtain a first security vulnerability set, wherein the first security vulnerability set includes m security vulnerabilities, where m is a positive integer greater than or equal to 2. In one embodiment, the first acquisition module 710 can be used to execute step S210 described above, which will not be repeated here.

[0112] For example, the first acquisition module 710 is further configured to: track the propagation path of tainted data within the application; detect security vulnerabilities based on the propagation path of the tainted data within the application; and acquire the first security vulnerability set based on the propagation path and the security vulnerabilities.

[0113] The extraction module 720 is used to extract function information related to the m security vulnerabilities, wherein the function information includes function content and tainted parameters related to the m security vulnerabilities. In one embodiment, the extraction module 720 can be used to execute step S220 described above, which will not be repeated here.

[0114] For example, the extraction module 720 is further configured to: extract the function content of multiple functions involved in the propagation chain of the taint using a decompilation method; extract the taint parameters involved in the propagation chain of the taint using instrumentation techniques; and associate the function content with the taint parameters to obtain the function information.

[0115] The logic analysis module 730 is used to perform logical analysis on the function content and the taint parameters using a large model to obtain logical analysis results for the function information. In one embodiment, the logic analysis module 730 can be used to execute step S230 described above, which will not be repeated here.

[0116] For example, the logic analysis module 730 is further configured to: use a large model to perform semantic understanding on the function content and the taint parameter to obtain a semantic understanding result; and use the large model and a preset protection logic to analyze the semantic understanding result to obtain a logic analysis result for the function information.

[0117] Furthermore, the logic analysis module 730 is also used to: input the function content and the taint parameter into the large model; and use the large model to identify semantic features in the function content and the taint parameter that are related to at least one of the semantics of feature filtering, feature escaping and access control.

[0118] For example, the preset protection logic includes at least one of feature filtering, feature escaping, and access control.

[0119] Furthermore, the logic analysis module 730 is also configured to: use the large model to match the semantic features with the feature filtering, the feature escaping, and the access control respectively; and in response to the semantic features being successfully matched with at least one of the feature filtering, the feature escaping, and the access control, determine that the logic analysis result of the function information includes at least one of the feature filtering, the feature escaping, and the access control.

[0120] For example, the logic analysis module 730 is further configured to: use the large model to identify overall protection logic associated with the function content and the taint parameter; and in response to the existence of protection defects in the overall protection logic, generate a protection logic improvement strategy for the function information.

[0121] The second acquisition module 740 is used to process the first security vulnerability set according to the logical analysis result to obtain a second security vulnerability set, and output the second security vulnerability set as at least part of the result of the interactive security test, wherein the second security vulnerability set includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m. In one embodiment, the second acquisition module 740 can be used to execute step S240 described above, which will not be repeated here.

[0122] For example, the second acquisition module 740 is further configured to: for the first to mth security vulnerabilities in the first security vulnerability set, iteratively execute the following process: in response to the logical analysis result of the function information of the i-th security vulnerability including at least one of the feature filtering, the feature escaping and the access control, determine that the i-th security vulnerability is a false alarm vulnerability, wherein the i-th first security vulnerability is one of the m first security vulnerabilities, and i is a positive integer greater than or equal to 1 and less than or equal to m; and remove the i-th security vulnerability from the first security vulnerability set.

[0123] According to embodiments of this application, any multiple modules among the first acquisition module 710, extraction module 720, logic analysis module 730, and second acquisition module 740 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the first acquisition module 710, extraction module 720, logic analysis module 730, and second acquisition module 740 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the first acquisition module 710, extraction module 720, logic analysis module 730, and second acquisition module 740 may be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0124] Figure 8 schematically illustrates a block diagram of an electronic device suitable for implementing a large-model-based interactive security testing method according to an embodiment of this application.

[0125] As shown in FIG8, an electronic device 800 according to an embodiment of the present application includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage portion 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present application.

[0126] RAM 803 stores various programs and data required for the operation of electronic device 800. Processor 801, ROM 802, and RAM 803 are interconnected via bus 804. Processor 801 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 802 and / or RAM 803. It should be noted that the programs may also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0127] According to embodiments of this application, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to a bus 804. The electronic device 800 may also include one or more of the following components connected to the input / output (I / O) interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 810 as needed so that computer programs read from it can be installed into the storage section 808 as needed.

[0128] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0129] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 802 and / or RAM 803 and / or one or more memories other than ROM 802 and RAM 803 described above.

[0130] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the interactive security testing method based on a large model provided in the embodiments of this application.

[0131] When the computer program is executed by the processor 801, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0132] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 809, and / or installed from a removable medium 811. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0133] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0134] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0135] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0136] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. An interactive security testing method based on a large model, characterized in that, The method includes: using taint analysis technology to preliminarily identify security vulnerabilities in the application to obtain a first security vulnerability set, wherein the first security vulnerability set includes m security vulnerabilities, where m is a positive integer greater than or equal to 2; extracting function information related to the m security vulnerabilities, wherein the function information includes function content and tainted parameters related to the m security vulnerabilities; using a large model to perform logical analysis on the function content and the tainted parameters to obtain logical analysis results for the function information; and processing the first security vulnerability set according to the logical analysis results to obtain a second security vulnerability set, and outputting the second security vulnerability set as at least a part of the results of an interactive security test, wherein the second security vulnerability set includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m.

2. The method according to claim 1, characterized in that, The extraction of function information related to the m security vulnerabilities includes: extracting the function content of multiple functions involved in the propagation chain of the taints through decompilation methods; extracting the taint parameters involved in the propagation chain of the taints through instrumentation techniques; and associating the function content with the taint parameters to obtain the function information.

3. The method according to claim 1 or 2, characterized in that, The step of using a large model to perform logical analysis on the function content and the taint parameters to obtain logical analysis results for the function information includes: using a large model to perform semantic understanding on the function content and the taint parameters to obtain semantic understanding results; and using the large model and preset protection logic to analyze the semantic understanding results to obtain logical analysis results for the function information.

4. The method according to claim 3, characterized in that, The step of using a large model to perform semantic understanding on the function content and the taint parameter to obtain semantic understanding results includes: inputting the function content and the taint parameter into the large model; and using the large model to identify semantic features in the function content and the taint parameter that are semantically related to at least one of feature filtering, feature escaping, and access control.

5. The method according to claim 4, characterized in that, The preset protection logic includes at least one of feature filtering, feature escaping, and access control; the step of using the large model and the preset protection logic to analyze the semantic understanding result to obtain the logical analysis result for the function information includes: using the large model to match the semantic features with the feature filtering, feature escaping, and access control respectively; and in response to the semantic features successfully matching with at least one of the feature filtering, feature escaping, and access control, determining that the logical analysis result of the function information includes at least one of the feature filtering, feature escaping, and access control.

6. The method according to claim 1, 2, 4 or 5, characterized in that, The step of using taint analysis technology to preliminarily identify security vulnerabilities in the application to obtain a first set of security vulnerabilities includes: tracking the propagation path of tainted data within the application; detecting security vulnerability points based on the propagation path of the tainted data within the application; and obtaining the first set of security vulnerabilities based on the propagation path and the security vulnerability points.

7. The method according to claim 6, characterized in that, The step of processing the first security vulnerability set according to the logical analysis result to obtain a second security vulnerability set, and outputting the second security vulnerability set as the result of interactive security testing, includes: for the first to m security vulnerabilities in the first security vulnerability set, iteratively executing the following process: in response to the logical analysis result of the function information of the i-th security vulnerability, which includes at least one of the feature filtering, the feature escaping, and the access control, determining that the i-th security vulnerability is a false alarm vulnerability, wherein the i-th first security vulnerability is one of the m first security vulnerabilities, and i is a positive integer greater than or equal to 1 and less than or equal to m; and removing the i-th security vulnerability from the first security vulnerability set.

8. The method according to claim 5, characterized in that, The step of using the large model and preset protection logic to analyze the semantic understanding results to obtain the logic analysis results for the function information also includes: using the large model to identify the overall protection logic associated with the function content and the taint parameter; and in response to the existence of protection defects in the overall protection logic, generating a protection logic improvement strategy for the function information.

9. An interactive security testing device based on a large model, characterized in that, The apparatus includes: a first acquisition module, configured to perform preliminary identification of security vulnerabilities in the application using taint analysis technology to acquire a first security vulnerability set, wherein the first security vulnerability set includes m security vulnerabilities, where m is a positive integer greater than or equal to 2; an extraction module, configured to extract function information related to the m security vulnerabilities, wherein the function information includes function content and tainted parameters related to the m security vulnerabilities; a logic analysis module, configured to perform logic analysis on the function content and the tainted parameters using a large model to acquire logic analysis results for the function information; and a second acquisition module, configured to process the first security vulnerability set according to the logic analysis results to acquire a second security vulnerability set, and output the second security vulnerability set as at least a part of the results of an interactive security test, wherein the second security vulnerability set includes n security vulnerabilities, where n is a positive integer greater than or equal to 1 and less than or equal to m.

10. An electronic device, comprising: One or more processors; A memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images