Artificial intelligence network asset vulnerability scanning method, device, equipment, medium and program product

Abstract

The application provides an AI network asset vulnerability scanning method and device, equipment, medium and program product, and relates to the technical field of network security automation and artificial intelligence. The method comprises the following steps: obtaining a vulnerability scanning request, wherein the vulnerability scanning request at least comprises a target unit name; obtaining a network asset list corresponding to the target unit based on the target unit name, wherein the network asset list is used for recording network asset information visible to the public network of the target unit; obtaining external script files cited in a corresponding webpage based on the network asset information; performing reverse analysis on the external script files by using a large model, identifying interface calling information and corresponding encryption logic information in the external script files; and performing network asset vulnerability scanning on the target unit based on the interface calling information and the encryption logic information.

Description

Technical Field

[0001] This application relates to the fields of network security automation and artificial intelligence technology, and more specifically to an AI network asset vulnerability scanning method, apparatus, device, medium and program product. Background Technology

[0002] In current cybersecurity practices, security assessments for specific entities (such as enterprises or institutions) typically follow a process of "asset discovery - vulnerability detection and verification - report writing." This process suffers from several pain points during its implementation:

[0003] (1) In terms of asset collection, security engineers need to check the main domain name from different open source channels, then use tools to enumerate subdomains, and finally manually import them into the asset mapping platform. This collection process is fragmented, involving manual switching of multiple independent tools and platforms, which is inefficient. Furthermore, the comprehensiveness of the collection results depends heavily on the engineer's experience and the coverage of the tools used, which is prone to omissions.

[0004] (2) In terms of API (Application Programming Interface) analysis, modern applications often adopt a front-end and back-end separation architecture. The front-end calls the API to interact with the back-end. After being packaged, compressed, and obfuscated, the front-end code has poor readability. Security engineers need to manually set breakpoints, trace requests, and analyze the code using browser debugging tools to reverse engineer the API endpoints, parameters, and data structures. If the code contains APIs with custom encryption, decryption, or signature logic, security engineers also need to study the algorithms and manually reproduce them before testing. This entire process is time-consuming and technically demanding. Purely manual analysis is extremely inefficient and prone to errors. At the same time, traditional dynamic / static analysis tools have difficulty understanding the obfuscated code logic and cannot automatically handle non-standard encryption and signature algorithms, resulting in a large number of APIs being unable to be effectively tested.

[0005] In summary, existing security assessment processes have low levels of automation and high reliance on manual labor, which not only significantly increases the investment of manpower and time, but also seriously restricts the accuracy and comprehensiveness of vulnerability detection. Summary of the Invention

[0006] In view of the above problems, embodiments of this application provide an AI network asset vulnerability scanning method, apparatus, device, medium, and program product.

[0007] According to the first aspect of this application, an AI-based network asset vulnerability scanning method is provided, comprising: obtaining a vulnerability scanning request, the vulnerability scanning request including at least the name of a target entity; obtaining a network asset list corresponding to the target entity based on the target entity name, wherein the network asset list is used to record network asset information publicly visible to the target entity; obtaining external script files referenced in the corresponding web pages based on the network asset information; performing reverse engineering analysis on the external script files using a large model to identify interface call information and corresponding encryption logic information in the external script files, wherein the interface call information includes the request address and request parameters of the called interface, and the encryption logic information includes the data encryption method, encryption key, and encryption / decryption processing logic; and performing network asset vulnerability scanning on the target entity based on the interface call information and the encryption logic information.

[0008] According to embodiments of this application, reverse engineering an external script file using a large model to identify interface call information and corresponding encryption logic information in the external script file includes: reconstructing the original code of the external script file using a large model; identifying target code segments in the original code that initiate network request operations based on preset network request feature rules, wherein the network request feature rules are used to characterize the code syntax structure of the code initiating the network request operation; parsing the target code segments to obtain interface call information in the network request operation; and identifying the corresponding encryption logic information in response to detecting that an encryption operation exists before the network request operation is triggered.

[0009] According to an embodiment of this application, performing network asset vulnerability scanning on a target entity based on interface call information and encryption logic information includes: converting the encryption logic information into an encryption software class conforming to a preset programming language specification, wherein the encryption software class is used to centrally manage and encapsulate encryption logic; obtaining a preset vulnerability scanning tool and generating corresponding scanning configuration information based on the interface call information; and using the vulnerability scanning tool to perform network asset vulnerability scanning on the target entity based on the scanning configuration information and the encryption software class.

[0010] According to embodiments of this application, performing network asset vulnerability scanning on a target entity using a vulnerability scanning tool based on scanning configuration information and encryption software class includes: intercepting network request operations initiated by the vulnerability scanning tool and obtaining the corresponding target call interface; determining whether the target call interface belongs to a preset monitoring interface range; in response to the target call interface belonging to the preset monitoring interface range, locating and extracting the encrypted code fragment corresponding to the target call interface from the encryption software class; encrypting the request data of the target call interface based on the extracted encrypted code fragment; and restoring the intercepted network request operation and performing network asset vulnerability scanning based on the encrypted request data.

[0011] According to an embodiment of this application, obtaining the network asset list corresponding to the target entity based on the target entity name includes: obtaining all main domain names registered by the target entity based on the target entity name, and generating a main domain name list; querying all subdomains associated with each main domain name based on the main domain name list, and generating a subdomain list; merging and deduplicating the main domain name list and the subdomain list to generate a domain name list of the target entity; and obtaining the network asset list of the target entity based on the domain name list.

[0012] According to embodiments of this application, the method further includes: obtaining vulnerability scanning results; inputting the vulnerability scanning results into a large model, the large model being used to analyze the vulnerability scanning results and generate vulnerability descriptions and remediation suggestions in conjunction with vulnerability principles; and encapsulating the vulnerability descriptions and remediation suggestions into a vulnerability report based on a preset output template format and outputting it.

[0013] According to an embodiment of this application, the method further includes: in response to detecting that the target unit has historical vulnerability scan results, determining whether the target unit has added network asset information, wherein the added network asset information includes added domain name, added external script file or added call interface; in response to detecting that the target unit has added network asset information, obtaining the interface call information and encryption logic information corresponding to the added network asset information; and performing vulnerability scanning on the added network asset information based on the interface call information and encryption logic information.

[0014] The second aspect of this application provides an AI-powered network asset vulnerability scanning device, comprising: a request acquisition module for acquiring vulnerability scanning requests, the vulnerability scanning requests including at least the name of the target entity; an asset collection module for acquiring a network asset list corresponding to the target entity based on the target entity name, wherein the network asset list records network asset information publicly visible to the target entity; an external script file acquisition module for acquiring external script files referenced in corresponding web pages based on the network asset information; a reverse engineering module for performing reverse engineering analysis on the external script files using a large model to identify interface call information and corresponding encryption logic information in the external script files, wherein the interface call information includes the request address and request parameters of the called interface, and the encryption logic information includes the data encryption method, encryption key, and encryption / decryption processing logic; and a vulnerability scanning module for performing network asset vulnerability scanning on the target entity based on the interface call information and encryption logic information.

[0015] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0017] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0018] The above-mentioned contents, as well as other objects, features, and advantages of this application, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 The illustrations depict application scenarios of AI network asset vulnerability scanning methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0020] Figure 2 A flowchart illustrating an AI network asset vulnerability scanning method according to an embodiment of this application is shown schematically.

[0021] Figure 3 A flowchart illustrating the generation of a network asset inventory according to an embodiment of this application is shown schematically;

[0022] Figure 4 The flowchart illustrating reverse engineering of an external script file using a large model is shown schematically according to an embodiment of this application;

[0023] Figure 5 A flowchart illustrating a vulnerability scan according to an embodiment of this application is shown schematically;

[0024] Figure 6 This illustration schematically shows another flowchart of a vulnerability scan according to an embodiment of the present application;

[0025] Figure 7 Another flowchart illustrating an AI network asset vulnerability scanning method according to an embodiment of this application is shown schematically;

[0026] Figure 8 A schematic diagram illustrating the structure of an AI network asset vulnerability scanning apparatus according to an embodiment of this application is provided.

[0027] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an AI network asset vulnerability scanning method according to an embodiment of this application. Detailed Implementation

[0028] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0029] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0031] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0032] In one or more embodiments described herein, the term "large model" can refer to a deep learning model with a large number of model parameters, which can include hundreds of millions, tens of billions, hundreds of billions, trillions, or even tens of trillions of model parameters. Large models can also be called foundational models or basic models. They are pre-trained using large-scale unlabeled corpora to produce pre-trained models with hundreds of millions of parameters. Such models can adapt to a wide range of downstream tasks and have good generalization ability, such as large language models and multimodal pre-trained models. It should be understood that in practical applications, large models only require a small number of samples to fine-tune the pre-trained model before being applied to different tasks. Large models can be widely used in natural language processing, computer vision, and other fields. Specifically, they can be applied to computer vision tasks such as visual question answering, image captioning, and image generation, as well as natural language processing tasks such as text-based sentiment classification, text summarization, and machine translation. Major application scenarios for large models can include digital assistants, intelligent robots, search, online education, office software, e-commerce, and intelligent design.

[0033] Figure 1 The illustrations depict application scenarios of AI network asset vulnerability scanning methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0034] like Figure 1 As shown, application scenario 100 according to an embodiment of this application may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send information, etc.

[0035] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be electronic devices such as smartphones, wearable devices, personal computers, intelligent voice interaction devices, smart home appliances, intelligent vehicles, in-vehicle terminals, aircraft, unmanned vending terminals, and extended reality devices. Extended reality devices can include virtual reality devices, augmented reality devices, and mixed reality devices. A client application for the target application can be installed and run on the terminal devices. This target application can include, but is not limited to, financial transaction applications, payment applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, and social media platform software (these are just examples). Furthermore, this application embodiment does not limit the form of the target application, and it can include, but is not limited to, applications, mini-programs, etc., installed on the terminal devices, and can also be in the form of web pages.

[0036] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and basic cloud computing services such as big data. The server can be the backend server of the aforementioned target application, used to provide backend services to the clients of the target application.

[0037] It should be noted that the AI ​​network asset vulnerability scanning method provided in this application embodiment can generally be executed by server 105 and / or terminal devices 101-103. Accordingly, the AI ​​network asset vulnerability scanning device provided in this application embodiment can generally be installed in server 105 and / or terminal devices 101-103.

[0038] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0039] Figure 2 A flowchart illustrating an AI network asset vulnerability scanning method according to an embodiment of this application is shown. Figure 2 As shown, the AI ​​network asset vulnerability scanning method 200 according to the embodiments of this application may include steps S210 to S250.

[0040] In step S210, a vulnerability scanning request is obtained, which includes at least the name of the target organization.

[0041] In the embodiments of this application, a vulnerability scanning request from a user or upper-layer platform is first received and parsed. This request serves as a trigger instruction for the vulnerability scanning task and includes at least the target organization name. This target organization name is used to uniquely identify the object that needs to be scanned for vulnerabilities. The target organization name may include, but is not limited to, enterprises, public institutions, government departments, social organizations, research institutions, educational institutions, medical institutions, financial institutions, etc.

[0042] It should be noted that all target entities were included in the security assessment only after obtaining their explicit and formal written authorization in advance.

[0043] In step S220, based on the target entity's name, a network asset list corresponding to the target entity is obtained. This network asset list records information about the target entity's publicly visible network assets.

[0044] In the embodiments of this application, based on the target entity's name, all network asset information belonging to that target entity can be filtered and aggregated within the public internet space. Here, publicly visible network asset information refers to various digital assets that can be directly accessed via the internet or detected externally. Network asset information typically includes domain names and their corresponding IP addresses, open ports, webpage service titles, and the specific access addresses of related webpages.

[0045] For example, if the target entity is Company A, the corresponding network asset list may include the following categories: (1) Domain name assets, such as the main domain name, subdomains at all levels, wildcard domains and registered domain names held by Company A and used to provide services to the public, such as the main domain name acompany.com, the email subdomain mail.acompany.com, the interface subdomain api.acompany.com, the management backend subdomain admin.acompany.com, etc.; (2) IP assets, such as the specific IPs within the public IP address range 100.0.113.0 / 24 allocated to Company A, and the open ports on each IP, such as 80, 443, 3306, etc.; (3) Web application assets, such as the website title and specific web page address corresponding to each domain name.

[0046] Optionally, the network asset inventory can be recorded in a hierarchical manner, organizing asset elements such as domain names, IP addresses, open ports, and web applications according to their dependencies. Upper-level assets can be drilled down to obtain more detailed asset information.

[0047] Optionally, to define the scope of vulnerability scanning for a target organization, the vulnerability scanning request can include the target organization's associated information as a scope constraint, such as the main domain name or IP (Internet Protocol Address) range. For example, when the vulnerability scanning request includes the main domain name, this will serve as the boundary constraint for the scan. Only a list of network assets under that main domain name will be obtained, and vulnerability scans will be performed on its associated assets. This ensures that the vulnerability scanning task is focused on the specified scope, avoiding resource waste and irrelevant detection.

[0048] In step S230, based on the network asset information, the external script files referenced in the corresponding web page are obtained.

[0049] In the embodiments of this application, external script files can refer to script files referenced by tags in the target entity's public webpage and stored outside the main code of the webpage, such as JS (JavaScript, a just-in-time programming language) files. These script files are typically used to implement the interactive functions of the page, dynamic content loading, and other business logic, and are the core part of the webpage front-end operation.

[0050] A headless browser is a complete browser engine that removes the "visual interface" that displays web pages, allowing all operations (such as page loading, clicking, typing, executing JavaScript, etc.) to be driven by code via command line or API.

[0051] For example, in the embodiments of this application, a headless browser can be used to simulate real user access and download all external script files referenced in the webpage. Specifically, the webpage addresses in the asset list can be traversed, and for each webpage address, a headless browser can be used to simulate the access behavior of a real user, thereby fully loading the page and downloading all external script files referenced by the page.

[0052] In step S240, the large model is used to perform reverse engineering analysis on the external script file to identify the interface call information and corresponding encryption logic information in the external script file. The interface call information includes the request address and request parameters of the called interface, and the encryption logic information includes the data encryption method, encryption key, and encryption / decryption processing logic.

[0053] In embodiments of this application, the interface call information may include the request address and request parameters (such as request method, request parameters, etc.) of the called interface. The encryption logic information may include the data encryption method, encryption key, and encryption / decryption processing logic. The data encryption method describes the type of encryption algorithm used (such as symmetric encryption method, asymmetric encryption method, etc.); the encryption key refers to the key data used for encryption / decryption operations (such as symmetric key, public / private key, etc.); and the encryption / decryption processing logic describes the specific encryption and decryption process, including data padding methods, operation modes, etc.

[0054] Website owners often compress or obfuscate script files to improve network transmission efficiency and optimize performance. Compression significantly reduces file size and speeds up loading; obfuscating script files can enhance security and prevent easy reading or modification of the source code by renaming variables and scrambling code structure. Script files processed in this way lose their original readability, making them difficult for traditional manual review or automated analysis tools to directly analyze. This results in hidden security vulnerabilities or malicious code being difficult to detect, creating blind spots in security assessments.

[0055] In the embodiments of this application, a Prompt is an instruction or input text given to the large model to guide it in generating the required response, such as: "Retrieve this code segment and find the insert statement." For these downloaded external script files, they can be submitted to the large model for processing along with the Prompt (i.e., the prompt word instruction). The large model leads the reverse engineering process based on the Prompt instruction, which may include locating API calls, parsing the API structure, and identifying encryption / signatures. By performing reverse engineering on external script files through the large model, the interface call information and corresponding encryption logic information within the external script files can be identified.

[0056] In step S250, based on interface call information and encryption logic information, a network asset vulnerability scan is performed on the target unit.

[0057] In the embodiments of this application, network asset vulnerability scanning can be achieved based on interface call information and encryption logic information identified from external script files.

[0058] According to the embodiments of this application, by linking network asset collection, script file reverse analysis, and vulnerability scanning, one-click automated vulnerability scanning can be achieved. Compared with traditional manual methods, this is more efficient and less reliant on human experience, making large-scale, high-frequency security assessments possible. At the same time, by performing automated reverse analysis on obfuscated script files and encrypted code, the vulnerability detection coverage for complex applications is effectively improved, and potential risks that are difficult for traditional tools to identify can be discovered. In addition, by making reverse analysis, which requires a lot of manpower from senior security experts, intelligent and automated, engineers with less experience can also perform complex application assessments, effectively reducing the technical threshold and implementation costs.

[0059] Figure 3 A flowchart illustrating the generation of a network asset inventory according to an embodiment of this application is shown schematically. Figure 3 As shown, this embodiment is one embodiment of step S220, which includes steps S221 to S224.

[0060] In step S221, based on the target entity name, query all the main domain names registered by the target entity and generate a list of main domain names.

[0061] In the embodiments of this application, the enterprise information query API of the enterprise information query platform can be automatically invoked. This API will return structured data containing basic enterprise information, from which a list of all registered main domain names of the enterprise can be extracted. For example, by entering "A Technology Co., Ltd.", a list of its main domain names can be retrieved, which may include example1.com, example2.com, etc.

[0062] Optionally, to ensure the accuracy of the target entity being queried, a pre-verification step can be introduced: since the target entity name may contain abbreviations, misspellings, or ambiguities, the authenticity of the target entity name can be verified by using an authoritative enterprise information verification service, and the non-standard user input can be accurately mapped to a unique and standard entity name in the publicly available business database through algorithm (such as similarity algorithm).

[0063] For example, firstly, the target organization name in the vulnerability scanning request can be preliminarily cleaned. This cleaning process may include removing extra spaces and special characters to standardize the name format. Then, an authoritative enterprise information verification service (such as a licensed third-party data service provider) is invoked, using the cleaned target organization name as a query condition, and the return result is determined to be unique and a complete match. If the query result is unique and has a 100% match, the target organization name is directly returned, and its main domain name is used for the query. If no results are found or multiple candidate organizations are returned, a fuzzy matching process is initiated. A list of candidate organizations related to the target organization name can be obtained from the returned results (e.g., the top N results from a keyword search), and a string similarity algorithm (e.g., cosine similarity) is used to calculate the similarity value between the target organization name and each candidate organization name. A similarity threshold (e.g., 85%) is pre-set, and a list of candidate organizations with similarity values ​​higher than this threshold is retained. If the candidate organization with the highest similarity is unique, it is directly confirmed as the standard name of the target organization; if multiple highly similar candidate organizations exist, a list of candidate organizations can be returned for manual verification by the user.

[0064] In step S222, based on the list of main domains, query all subdomains associated with each main domain to generate a list of subdomains.

[0065] In the embodiments of this application, for each acquired primary domain name, a built-in subdomain collection engine (which can integrate the logic of various open-source tools) can be activated to recursively enumerate and build a detailed list of subdomains. Subdomains can be obtained by calling public interfaces and datasets without direct interaction with the target entity.

[0066] For example, the following types of data sources can be integrated to implement subdomain queries.

[0067] (1) Certificate Transparency Log. Implementation Principle: Utilizing the issuance records of SSL certificates (Secure Sockets Layer Certificate) or TLS certificates (Transport Layer Security Certificate), the certificate contains various identity information of the website. For example, the CN field (Common Name) is the main field used to identify the domain name to which the certificate belongs, and the SANs field (Subject Alternative Names) is used to list all these additional domain names.

[0068] Data Extraction: In practice, the system first obtains the target entity's main domain name list by calling the entity's filing information query API. Then, using these main domain names as search criteria, the system performs fuzzy matching or exact query in the certificate transparency log database to filter out all certificate records containing the main domain name. Finally, the system parses the retrieved certificate records and extracts all domain names listed in the CN and SANs fields to generate a complete list of subdomain assets for the target entity.

[0069] (2) Conventional DNS (Domain Name System) Datasets and Threat Intelligence. Implementation Principle: Querying historical DNS resolution records and the threat intelligence database of security vendors. Historical DNS resolution records document the mapping history between domain names and IP addresses (Internet Protocol). By analyzing these records, one can trace which IP addresses a domain name has previously resolved to; one can also reverse-query an IP address to find out which newly appearing domain names have subsequently used it as a resolution target. Thus, related domain information can be discovered. The threat intelligence database contains confirmed malicious domain names, IP addresses, and other threat indicators. By querying this information, related domain names can also be discovered and obtained.

[0070] (3) Search engines and online archives. Implementation principle: By utilizing the indexing capabilities of search engines on a massive number of public pages of Internet sites and using the advanced syntax of search engines, various subdomains under the target domain can be filtered and extracted from the returned titles and hyperlinks.

[0071] (4) Domestic data sources (optimized for the domestic environment). Implementation principle: It can integrate data sources with good coverage of domestic assets, such as cyberspace mapping systems. These platforms usually have higher coverage of domestic assets and can supplement the blind spots of conventional international tools in Chinese context, special domain name suffixes and domestic specific services, so as to ensure the completeness of subdomain collection in the domestic environment.

[0072] In step S223, the main domain name list and the subdomain name list are merged and deduplicated to generate the domain name list of the target unit.

[0073] In the embodiments of this application, the main domain name list and the subdomain name list can be merged and deduplicated to automatically filter out duplicate domain names and generate a complete and unique list of valid domain names.

[0074] In step S224, based on the domain name list, obtain the target unit's network asset list.

[0075] In the embodiments of this application, all collected domain names can be automatically submitted to the asset mapping platform API to query associated IP addresses, open ports, Web (World Wide Web) service titles, and other information, forming an initial list of Internet exposure surface assets, i.e., a network asset list. The network asset list may include: domain names, corresponding IP addresses, ports, web service titles, and corresponding web addresses.

[0076] In the embodiments of this application, by automatically generating a list of network assets, the operation that originally required manually switching between multiple platforms is integrated into an automated workflow, realizing one-click discovery from the target unit name to the list of surviving web assets.

[0077] Figure 4 The flowchart illustrating reverse engineering an external script file using a large model, according to an embodiment of this application, is shown schematically. Figure 4 As shown, this embodiment is one embodiment of step S240, which includes steps S241 to S244.

[0078] In step S241, the large model is used to perform reverse analysis on the external script file to reconstruct the original code of the external script file.

[0079] In the embodiments of this application, a large model can be used to perform reverse engineering on external script files. Specifically, the external script file and the Prompt instruction used to guide the large model in reverse engineering can be input into the large model. The large model first performs lexical analysis and syntax parsing on the content of the external script file according to the Prompt instruction to detect and locate obfuscation features; then, it automatically applies the corresponding reverse rules to restore the logic of the obfuscated variable names, function names, and control flow; finally, it outputs the original code corresponding to the external script file.

[0080] For example, the Prompt instruction could be set to: "The following script employs a combination of encryption and obfuscation protection: [script]. Please use the knowledge of trained obfuscated samples to perform reverse engineering on this script."

[0081] It should be noted that the large model used for reverse analysis has been trained on a large number of obfuscated samples and has the ability to identify and process various obfuscation and encryption techniques, thereby ensuring the accurate restoration of complex script files.

[0082] In step S242, based on preset network request feature rules, a large model is used to identify target code segments in the original code that contain network request operations. The network request feature rules are used to characterize the syntax structure of the code that initiates the network request operation.

[0083] In the embodiments of this application, network request feature rules are used to characterize the code syntax structure that initiates a network request operation. For example, in a JS file, if a network request operation is involved, its code is typically implemented through a specific API or syntax pattern.

[0084] For example, the syntax pattern may include: (1) the name of the specific function or method to be called, such as XMLHttpRequest.open(), fetch(), axios; (2) key parameters, such as HTTP method (GET / POST) and URL (Uniform Resource Locator) template (such as / api / user / {id}); (3) the accompanying data setting and sending process, such as the use of setRequestHeader or .send() method.

[0085] In the embodiments of this application, by setting these syntactic features as identifiable keyword rules, a large model can accurately locate and identify all target code segments in a JS file that involve network request behavior. For example, the large model can use a retrieval tool to quickly search for keywords set in the network request feature rules within the JS code, precisely locating the code position that initiates the network request.

[0086] In step S243, the target code fragment is parsed to obtain the interface call information in the network request operation.

[0087] In the embodiments of this application, by parsing and extracting parameters from the target code fragment, interface call information of the target calling interface corresponding to the network request operation can be generated. The interface call information may include the request address and request parameters.

[0088] For example, a large model can be used to perform deep analysis on the located target code snippets, identifying data such as the interface identifier, interface access address, request method, request headers, query parameters, and request body parameters of the called interfaces in the network request operation. This data is then integrated by interface dimension to generate structured interface call information. The generated structured interface call information can be written to a file and stored in JSON, XML, or other structured data formats suitable for machine parsing.

[0089] For example, the large model can be used to organize the interface call information in the identified network request operations according to the fields and hierarchical structure defined by the OpenAPI (Open Application Programming Interface) specification, and integrate them by interface to generate interface description information that conforms to the OpenAPI standard, such as generating a standard open interface description file as openapi.json.

[0090] In step S244, in response to the detection that an encryption operation existed before the network request operation was triggered, the corresponding encryption logic information is identified.

[0091] In the embodiments of this application, the large model can be specifically trained to recognize various encryption libraries (such as CryptoJS) and signature patterns. If the large model detects that an encryption operation exists before a network request is sent, such as "encrypt(data)" or "sign(params)", the large model will extract the encrypted code fragment and deeply analyze the logic of the encryption function used in the encrypted code fragment to determine the data encryption method, encryption key, and encryption / decryption processing logic used, thereby generating the corresponding encryption logic information.

[0092] In the embodiments of this application, a large model is used to replace the most time-consuming and complex manual reverse engineering in the traditional solution. As a result, the system can automatically process compressed, obfuscated, and even front-end code containing complex cryptographic signatures, and generate machine-readable API specifications and directly callable request code. By automating this task, which originally required senior security experts to complete for days or even weeks, engineers with less experience can also undertake complex web application evaluation tasks.

[0093] Figure 5 A flowchart illustrating a vulnerability scan according to an embodiment of this application is shown. Figure 5 As shown, this embodiment is one embodiment of step S250, which includes steps S251 to S253.

[0094] In step S251, the encryption logic information is converted into an encryption software class conforming to a preset programming language specification. This encryption software class is used to centrally manage and encapsulate the encryption logic.

[0095] In the embodiments of this application, the large model can automatically convert the encryption logic information into equivalent code in other programming languages ​​and encapsulate it into an independent encryption software class. This software class is used to centrally manage and encapsulate all operations related to the encryption logic. Regardless of how many different encryption strategies are involved (such as using different signature algorithms for different interfaces), the complex encryption logic can be uniformly encapsulated into an independent software class.

[0096] For example, based on the encryption logic information, the large model can automatically translate the logic of the corresponding original encrypted code snippets in external script files from JavaScript into functionally equivalent Python code, organize the corresponding methods in the code according to the interface dimension, and finally encapsulate and output a class named "MyRequests" stored in the MyRequests.py file. The "MyRequests" class internalizes this encryption logic. It can inherit from the mainstream Python requests library and override core methods such as get and post, automatically performing encryption / signing operations internally. In this way, subsequent scanning tools only need to import this class "import MyRequests as requests" to transparently call these protected APIs without needing to worry about complex encryption details. At the same time, the encryption software class can be reused.

[0097] In step S252, a preset vulnerability scanning tool is obtained, and corresponding scanning configuration information is generated based on the interface call information.

[0098] In the embodiments of this application, the planned vulnerability scanning tools can be pre-integrated, and scanning configuration information corresponding to each vulnerability scanning tool can be generated based on structured interface call information. Here, the scanning configuration is not a single file, but refers to the startup parameters, payload template, or configuration file generated for a specific scanning tool. It includes the target URL, HTTP headers (including token / signature), request body data, and the tool-specific detection switches. Since different tools have different input formats, the module will perform targeted conversion according to the API structure.

[0099] Optionally, vulnerability scanning tools can be categorized, integrated, and managed according to scanning type, such as weak password detection, malicious code detection, and script security analysis, to meet diverse vulnerability detection needs. By scheduling, configuring, and fusing the results of multiple scanning tools, a comprehensive vulnerability scanning and detection mechanism with complementary detection dimensions can be formed, thereby improving the completeness and accuracy of vulnerability discovery.

[0100] In step S253, based on the scanning configuration information and encryption software class, a vulnerability scanning tool is used to scan the target unit's network assets for vulnerabilities.

[0101] In the embodiments of this application, based on scanning configuration information and encryption software classes, vulnerability scanning tools can be used to perform comprehensive detection of network assets.

[0102] According to the embodiments of this application, by encapsulating the encrypted logic information into an independent software class and combining it with interface call information, and using a vulnerability scanning tool to perform vulnerability scanning, the vulnerability scanning stage and the interface analysis stage can be seamlessly connected, realizing full-process automation from interface analysis to vulnerability scanning. This solves the pain point that traditional vulnerability scanning tools are unable to cover encrypted business logic, and can effectively and automatically detect vulnerabilities in complex APIs that were previously considered "scanning blind spots," significantly improving the depth and breadth of vulnerability discovery.

[0103] Figure 6 Another flowchart illustrating a vulnerability scan according to an embodiment of this application is shown schematically. Figure 6 As shown, this embodiment is one embodiment of step S253, including steps S2531 to S2535.

[0104] In step S2531, the network request operation initiated by the vulnerability scanning tool is intercepted, and the corresponding target call interface is obtained.

[0105] In the embodiments of this application, network requests initiated by vulnerability scanning tools can be intercepted via a proxy. The original data packets sent by the tool can be intercepted at the traffic entry point and parsed to obtain the target API that the tool is attempting to call. The proxy method can include dynamic proxies, which dynamically create API proxy objects at runtime using reflection, transparently forwarding the request traffic of the vulnerability scanning tool to the proxy layer.

[0106] In step S2532, it is determined whether the target calling interface belongs to the preset monitoring interface range.

[0107] In the embodiments of this application, after obtaining the target interface address that the vulnerability scanning tool attempts to call, it can be further determined whether the target call interface belongs to a preset monitoring interface range. The preset monitoring interface range is synchronized and consistent with the range of all interfaces involved in encryption processing within the encryption software class.

[0108] For example, it can be determined whether the target calling interface is a preset monitoring interface based on the address of the target interface, such as determining whether the URL contains the characteristic path " / sys / ".

[0109] In step S2533, in response to the target call interface belonging to the preset monitoring interface range, the encrypted code fragment corresponding to the target call interface is located and extracted from the encryption software class.

[0110] For example, after obtaining the target API that the vulnerability scanning tool attempts to call, the first step is to check if the encryption software class `MyRequests.py` exists in the task directory. If the encryption software class does not exist, the intercepted network request operation is allowed; if the encryption software class exists, it is dynamically loaded using Python's importlib library, and the `MyRequests` class within it is instantiated. The `MyRequests` class inherits from `requests.Session` and overrides the `request` method. Next, the target API is checked to see if the corresponding encryption logic definition exists in the encryption software class. If it does not exist, the intercepted network request operation is allowed; if it does exist, the encryption code snippet corresponding to the target API is located and extracted from the encryption software class.

[0111] In step S2534, the request data of the target API call is encrypted based on the extracted encrypted code fragment.

[0112] In the embodiments of this application, based on the extracted encrypted code fragments, the request data for calling the target interface can be encrypted. After encryption, ciphertext data conforming to the interface specification is generated and encapsulated back into the original request structure, thereby achieving a complete reproduction of the original encryption logic of the external script file.

[0113] In step S2535, based on the encrypted request data, the intercepted network request operation is recovered and a network asset vulnerability scan is performed.

[0114] In the embodiments of this application, after the encrypted request data is encapsulated back into the original request structure, the intercepted network request operation is restored, that is, the reconstructed request is sent to the target calling interface, and then subsequent network asset vulnerability scanning is performed.

[0115] For example, suppose the encryption logic of the encrypted code snippet targeting interface A in the encryption software class is discovered to be: first concatenating the SALT salt value, then calculating the MD5 hash value. When the target calling interface is interface A, the following steps can be performed: First, extract the request data of the interface, such as request parameters and request body parameters, and merge this data; second, concatenate the merged data with the preset SALT salt value to form a string to be signed; then calculate the MD5 hash value of this string to generate the signature value required for interface authentication; third, automatically add the generated signature and the current timestamp to the HTTP request header; fourth, send the reconstructed request to interface A and perform a vulnerability scan.

[0116] According to embodiments of this application, by intercepting network request operations and calling the encapsulated encryption software class, the vulnerability scanning tool does not need to be aware of complex encryption details, and the traffic it sends can automatically carry the correct signature / encryption data, ensuring that it can pass the security verification of the server.

[0117] In embodiments of this application, the method may further include: in response to detecting that the target unit has historical vulnerability scan results, determining whether the target unit has added network asset information, wherein the added network asset information includes added domain name, added external script file or added call interface; in response to detecting that the target unit has added network asset information, obtaining the interface call information and encryption logic information corresponding to the added network asset information; and performing vulnerability scanning on the added network asset information based on the interface call information and encryption logic information.

[0118] In the embodiments of this application, the domain name list, external script files, and structured interface call information of each identified target unit can be stored in an ordered manner according to the time sequence of their identification. When a target unit is detected to have historical vulnerability scan results, it indicates that the target unit has already undergone vulnerability scanning. Based on this, an incremental vulnerability detection mechanism can be introduced. By comparing the domain name list obtained this time with the historical domain name list, newly added domain names can be identified; by comparing the external script files obtained this time with historical external script files, newly added external script files can be identified; by comparing the structured interface call information obtained this time with historical structured interface call information, newly added call interfaces can be identified. These newly added network asset information are analyzed to obtain their corresponding interface call information and encryption logic information; based on these interface call information and encryption logic information, vulnerability scanning can be performed only on the newly added network asset information.

[0119] According to the embodiments of this application, by introducing an incremental vulnerability detection mechanism, vulnerability scanning can be performed only on newly added information, effectively avoiding repetitive work and improving detection efficiency.

[0120] In embodiments of this application, the method may further include: obtaining vulnerability scanning results; inputting the vulnerability scanning results into a large model, the large model being used to analyze the vulnerability scanning results and generate vulnerability descriptions and remediation suggestions in conjunction with vulnerability principles; and encapsulating the vulnerability descriptions and remediation suggestions into a vulnerability report based on a preset output template format and outputting it.

[0121] For example, various raw vulnerability scan results from vulnerability scanning tools can be collected. When users conduct independent testing, they can be allowed to supplement corresponding penetration testing notes. These raw and mixed vulnerability scan results can be submitted to a large model. The large model automatically classifies, organizes, and rates the vulnerability information based on built-in templates, and generates descriptions and remediation suggestions based on vulnerability principles. Finally, it outputs a well-formatted, detailed, and easy-to-read vulnerability report, such as a Word or Markdown format vulnerability report.

[0122] According to embodiments of this application, by fully automating the tedious work of report writing, the format and quality of reports are standardized, greatly liberating the productivity of safety engineers.

[0123] Figure 7 Another flowchart of an AI network asset vulnerability scanning method according to an embodiment of this application is illustrated.

[0124] like Figure 7 As shown, after obtaining the name of the target organization to be scanned for vulnerabilities, network assets of the target organization can be collected to generate a network asset list. Subsequently, based on the network asset list, interface reverse analysis can be performed. Specifically, external script files involved in all web pages in the network asset list can be obtained, and interface reverse analysis of external script files can be performed using a large model. Structured interface call information can be automatically generated, which can be uniformly described in the form of open interface description files according to the interface dimension. When the large model detects that the request data of the called interface has encryption operation before being sent, its encryption logic can be extracted simultaneously and encapsulated to generate an encryption software class file. On this basis, based on the generated open interface description file and encryption software class file, network asset vulnerability scanning can be performed and the original vulnerability scanning results can be output. Finally, the large model can be used to classify, organize and risk-rating the original vulnerability scanning results, and generate descriptions and remediation suggestions in combination with vulnerability principles, ultimately forming a standardized vulnerability report.

[0125] Based on the above-described AI network asset vulnerability scanning method, embodiments of this application also provide an AI network asset vulnerability scanning device. The following will combine... Figure 8 The device is described in detail.

[0126] Figure 8 A schematic block diagram of an AI network asset vulnerability scanning apparatus according to an embodiment of this application is shown.

[0127] like Figure 8 As shown, the AI ​​network asset vulnerability scanning device 800 of this embodiment includes a request acquisition module 810, an asset collection module 820, an external script file acquisition module 830, a reverse analysis module 840, and a vulnerability scanning module 850.

[0128] The request acquisition module 810 is used to acquire vulnerability scanning requests, which at least include the name of the target organization. In one embodiment, the request acquisition module 810 can be used to execute step S210 described above, which will not be repeated here.

[0129] The asset collection module 820 is used to obtain a list of network assets corresponding to the target entity based on the target entity's name. The list of network assets records information about network assets visible to the public internet. In one embodiment, the asset collection module 820 can be used to execute step S220 described above, which will not be repeated here.

[0130] The external script file acquisition module 830 is used to acquire external script files referenced in corresponding web pages based on network asset information. In one embodiment, the external script file acquisition module 830 can be used to execute step S230 described above, which will not be repeated here.

[0131] The reverse analysis module 840 is used to perform reverse analysis on external script files using a large model, identifying interface call information and corresponding encryption logic information in the external script files. The interface call information includes the request address and request parameters of the called interface, and the encryption logic information includes the data encryption method, encryption key, and encryption / decryption processing logic. In one embodiment, the reverse analysis module 840 can be used to execute step S240 described above, which will not be repeated here.

[0132] The vulnerability scanning module 850 is used to perform network asset vulnerability scanning on the target unit based on interface call information and encryption logic information. In one embodiment, the vulnerability scanning module 850 can be used to execute step S250 described above, which will not be repeated here.

[0133] According to an embodiment of this application, the asset collection module 820 is further configured to: obtain all main domains registered by the target entity based on the target entity name; generate a list of main domains; query all subdomains associated with each main domain based on the list of main domains; generate a list of subdomains; merge and deduplicate the list of main domains and the list of subdomains to generate a list of domains of the target entity; and obtain a list of network assets of the target entity based on the list of domains.

[0134] According to an embodiment of this application, the reverse analysis module 840 is further configured to perform reverse analysis on the external script file using a large model to reconstruct the original code of the external script file; based on preset network request feature rules, use the large model to identify target code segments in the original code that initiate network request operations, wherein the network request feature rules are used to characterize the code syntax structure of the code that initiates the network request operation; perform syntax parsing on the target code segments to obtain interface call information in the network request operation; and in response to detecting that there is an encryption operation before the network request operation is triggered, identify the corresponding encryption logic information.

[0135] According to an embodiment of this application, the vulnerability scanning module 850 is further configured to convert the encrypted logic information into an encrypted software class conforming to a preset programming language specification, wherein the encrypted software class is used to centrally manage and encapsulate the encrypted logic; obtain a preset vulnerability scanning tool and generate corresponding scanning configuration information based on the interface call information; and use the vulnerability scanning tool to perform network asset vulnerability scanning on the target unit based on the scanning configuration information and the encrypted software class.

[0136] According to an embodiment of this application, the vulnerability scanning module 850 may further include a request interception module.

[0137] The request interception module is used to intercept network request operations initiated by vulnerability scanning tools and obtain the corresponding target call interface; determine whether the target call interface belongs to the preset monitoring interface range; in response that the target call interface belongs to the preset monitoring interface range, locate and extract the encrypted code fragment corresponding to the target call interface from the encryption software class; based on the extracted encrypted code fragment, encrypt the request data of the target call interface; based on the encrypted request data, restore the intercepted network request operation and perform network asset vulnerability scanning.

[0138] According to embodiments of this application, the AI ​​network asset vulnerability scanning device 800 may further include a vulnerability report generation module and an incremental vulnerability scanning module.

[0139] The vulnerability report generation module is used to obtain vulnerability scan results; input the vulnerability scan results into the large model, which analyzes the vulnerability scan results and generates vulnerability descriptions and remediation suggestions based on vulnerability principles; based on the preset output template format, the vulnerability descriptions and remediation suggestions are packaged into a vulnerability report and output.

[0140] The incremental vulnerability scanning module is used to determine whether the target unit has added network asset information in response to the detection of historical vulnerability scan results. The added network asset information includes new domain names, new external script files, or new API calls. In response to the detection of new network asset information in the target unit, the module obtains the corresponding API call information and encryption logic information. Based on the API call information and encryption logic information, the module performs vulnerability scanning on the new network asset information.

[0141] Compared with related technologies, the embodiments of this application have the following significant advantages and positive effects:

[0142] According to embodiments of this application, firstly, by chaining the entire security assessment process from asset discovery to report output into an automated pipeline, a "one-click" operation is achieved. Compared to traditional manual methods, assessment efficiency is increased by orders of magnitude, making large-scale, high-frequency security assessments possible. Secondly, by using AI to automate the reverse analysis of front-end APIs, a task that previously required days or even weeks for senior security experts can be completed automatically in minutes, enabling less experienced engineers to handle complex web application assessment tasks. Thirdly, by automatically generating OpenAPI specifications for interfaces and performing code-level translation and encapsulation of custom encryption / signature logic, the pain point of traditional vulnerability scanning tools' inability to cover the core business logic of modern web applications is addressed. This enables effective automated vulnerability detection of complex interfaces previously considered "blind spots," significantly improving the depth and breadth of vulnerability discovery. Simultaneously, the automatically generated OpenAPI documentation and vulnerability reports ensure that each assessment output adheres to a unified, high-quality standard. This not only facilitates team collaboration and results archiving but also enhances the professionalism of reports delivered to end users. Finally, by freeing security engineers from a lot of repetitive and tedious manual labor (such as information gathering, code analysis, and report writing), allowing them to focus on more creative work, such as vulnerability verification, logical vulnerability discovery, and remediation research, the value of human capital is maximized.

[0143] According to embodiments of this application, any multiple modules among the request acquisition module 810, asset collection module 820, external script file acquisition module 830, reverse analysis module 840, and vulnerability scanning module 850 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the request acquisition module 810, asset collection module 820, external script file acquisition module 830, reverse analysis module 840, and vulnerability scanning module 850 can be at least partially implemented as hardware circuitry, such as field-programmable gate arrays, programmable logic arrays, systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits, or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the request acquisition module 810, asset collection module 820, external script file acquisition module 830, reverse analysis module 840, and vulnerability scanning module 850 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0144] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an AI network asset vulnerability scanning method according to an embodiment of this application.

[0145] like Figure 9 As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory 902 or a program loaded from a storage portion 908 into a random access memory 903. The processor 901 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for executing different steps of the method flow according to an embodiment of this application.

[0146] Random access memory 903 stores various programs and data required for the operation of electronic device 900. Processor 901, read-only memory 902, and random access memory 903 are interconnected via bus 904. Processor 901 executes various steps of the method flow according to embodiments of this application by executing programs stored in read-only memory 902 and / or random access memory 903. It should be noted that the programs may also be stored in one or more memories other than read-only memory 902 and random access memory 903. Processor 901 may also execute various steps of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0147] According to embodiments of this application, the electronic device 900 may further include an input / output interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card, such as a local area network card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0148] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0149] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include the read-only memory 902 described above, and / or random access memory 903, and / or one or more memories other than read-only memory 902 and random access memory 903.

[0150] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0151] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0152] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable medium 911. When the computer program is executed by processor 901, it performs the functions defined in the system of embodiments of this application. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0153] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0154] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0155] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. An AI-based method for scanning network asset vulnerabilities, characterized in that, The method includes: Obtain a vulnerability scanning request, wherein the vulnerability scanning request includes at least the name of the target organization; Based on the target entity name, obtain the network asset list corresponding to the target entity, wherein the network asset list is used to record the network asset information of the target entity that is visible on the public network; Based on the network asset information, obtain the external script files referenced in the corresponding webpage; The external script file is reverse-engineered using a large model to identify the interface call information and corresponding encryption logic information in the external script file. The interface call information includes the request address and request parameters of the called interface, and the encryption logic information includes the data encryption method, encryption key and encryption / decryption processing logic. Based on the interface call information and the encryption logic information, a network asset vulnerability scan is performed on the target unit.

2. The method according to claim 1, characterized in that, The step of using a large model to perform reverse analysis on the external script file to identify the interface call information and corresponding encryption logic information in the external script file includes: The external script file was reverse-engineered using a large model to reconstruct its original code. Based on preset network request feature rules, a large model is used to identify target code segments in the original code that initiate network request operations. The network request feature rules are used to characterize the code syntax structure that initiates network request operations. The target code fragment is parsed to obtain the interface call information in the network request operation; In response to the detection that an encryption operation occurred before the network request operation was triggered, the corresponding encryption logic information is identified.

3. The method according to claim 1, characterized in that, The network asset vulnerability scan of the target unit based on the interface call information and the encryption logic information includes: The encryption logic information is converted into an encryption software class that conforms to a preset programming language specification, wherein the encryption software class is used to centrally manage and encapsulate the encryption logic; Obtain a preset vulnerability scanning tool and generate corresponding scanning configuration information based on the interface call information; Based on the scanning configuration information and the encryption software class, the vulnerability scanning tool is used to scan the target unit for network asset vulnerabilities.

4. The method according to claim 3, characterized in that, The step of performing network asset vulnerability scanning on the target entity using the vulnerability scanning tool based on the scanning configuration information and the encryption software class includes: Intercept the network request operation initiated by the vulnerability scanning tool and obtain the corresponding target call interface; Determine whether the target API call falls within the preset monitoring API range; In response to the target call interface falling within a preset monitoring interface range, the encrypted code fragment corresponding to the target call interface is located and extracted from the encrypted software class; Based on the extracted encrypted code fragment, the request data of the target API call is encrypted; Based on the encrypted request data, the intercepted network request operation is recovered and a network asset vulnerability scan is performed.

5. The method according to claim 1, characterized in that, The step of obtaining the network asset list corresponding to the target unit based on the target unit name includes: Based on the target entity name, obtain all the main domain names registered by the target entity and generate a list of main domain names; Based on the list of main domains, query all subdomains associated with each main domain to generate a list of subdomains; The main domain name list and the subdomain name list are merged and deduplicated to generate the domain name list of the target unit; Based on the domain name list, obtain the target entity's network asset list.

6. The method according to claim 1, characterized in that, The method further includes: Obtain vulnerability scan results; The vulnerability scan results are input into a large model, which analyzes the vulnerability scan results and generates vulnerability descriptions and remediation suggestions based on vulnerability principles. Based on a preset output template format, the vulnerability description and the remediation suggestions are encapsulated into a vulnerability report and output.

7. The method according to claim 1, characterized in that, The method further includes: In response to the detection of historical vulnerability scan results for the target unit, it is determined whether the target unit has any new network asset information, wherein the new network asset information includes new domain names, new external script files, or new calling interfaces; In response to the detection of new network asset information in the target unit, obtain the interface call information and encryption logic information corresponding to the new network asset information; Based on the interface call information and the encryption logic information, a vulnerability scan is performed on the newly added network asset information.

8. An AI-powered network asset vulnerability scanning device, characterized in that, The device includes: The request acquisition module is used to acquire vulnerability scanning requests, wherein the vulnerability scanning requests include at least the name of the target organization; The asset collection module is used to obtain a list of network assets corresponding to the target unit based on the target unit name, wherein the list of network assets is used to record network asset information of the target unit that is visible on the public network. The external script file acquisition module is used to acquire the external script files referenced in the corresponding web pages based on the network asset information. The reverse engineering module is used to perform reverse engineering analysis on the external script file using a large model, identifying the interface call information and corresponding encryption logic information in the external script file. The interface call information includes the request address and request parameters of the called interface, and the encryption logic information includes the data encryption method, encryption key, and encryption / decryption processing logic. The vulnerability scanning module is used to perform network asset vulnerability scanning on the target unit based on the interface call information and the encryption logic information.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images