Risk prevention and control platform security detection method for vulnerability assessment

Abstract

The application relates to the technical field of vulnerability assessment, and particularly discloses a security detection method of a risk prevention and control platform for vulnerability assessment, which comprises the following steps: S1: bypassing mirror original network data packets, three types of features are extracted from the mirror original network data packets as temporary fingerprints; S2: calculating the similarity of the temporary fingerprints and historical template fingerprints; S3: comparing the similarity to distinguish new and old requests, and calculating the real-time upper limit of the allowed rate of the current network request; S4: DPI detecting threats, if there are threats, the black list is used to return to zero and block, and if there are no threats, the credit is increased or decreased according to whether the speed is exceeded and the percentage. According to the scheme, multi-dimensional bottom layer fingerprints are extracted and associated with the same attack source, accurate judgment is realized through the similarity and the credit score, threats are immediately blacklisted to return to zero, and if the continuous credit score decreases, the connection is blocked, and the defense capability for hidden attacks such as encryption confusion, low-frequency penetration and zero-day vulnerabilities is significantly improved.

Description

Technical Field

[0001] This invention relates to the field of vulnerability assessment technology, and more specifically to a security testing method for a risk control platform used for vulnerability assessment. Background Technology

[0002] In current cybersecurity defense systems, risk control platforms typically rely on static rule bases, known vulnerability signatures, or blacklist mechanisms to perform security checks on network requests. While these methods can identify some known threats, their lag becomes increasingly apparent when facing increasingly complex attack methods such as zero-day exploits, encrypted traffic obfuscation, and low-frequency, slow penetration. Furthermore, most platforms employ a uniform traffic control strategy for all requests, lacking the ability to fine-grained adjust based on the credibility of the request's origin. This can lead to normal business operations being restricted due to misjudgments, or malicious traffic continuing to lurk because it hasn't triggered explicit rules.

[0003] As attackers constantly change their attack vectors and communication modes, relying solely on application-layer payload analysis is no longer sufficient to capture highly covert threat behaviors. The hardware differences, system environments, and protocol stack implementation details of different terminal devices often carry unique behavioral imprints. However, existing detection engines are severely inadequate in mining and utilizing these low-level characteristics, making it impossible to effectively correlate requests initiated by the same attack source at different times or through different entry points. Furthermore, once security policies are set, they remain fixed and cannot dynamically evolve based on real-time interaction results, reducing the timeliness of threat response and increasing the complexity and false positive rate of subsequent vulnerability assessments.

[0004] Therefore, constructing a security detection mechanism that integrates multi-dimensional intrinsic attributes, dynamically updates risk assessment criteria during the request interaction process, and adaptively adjusts transmission control strength accordingly can effectively identify threat events, maximize the service quality of legitimate requests, and enhance the platform's generalized defense capabilities against unknown risks. Summary of the Invention

[0005] The purpose of this invention is to provide a security testing method for a risk prevention and control platform used for vulnerability assessment, thereby solving the above-mentioned technical problems.

[0006] The objective of this invention can be achieved through the following technical solutions: The security testing method for risk control platforms used for vulnerability assessment includes the following steps: S1: When a client initiates a network request that reaches the platform gateway, the platform gateway forwards the network request to the backend server and simultaneously performs bypass mirroring of the original network data packets; The platform gateway extracts hardware features, system environment features, and application surface features from the original network packets of the image as temporary fingerprints. The hardware features include clock offset and TCP initial window size, the system environment features include operating system type, kernel version, and network stack response order, and the application surface features include the JA4 fingerprint in the TLS handshake packet. S2: Calculate the similarity S between the temporary fingerprint and the historical template fingerprint, where the historical template fingerprint refers to the temporary fingerprint stored in the platform database; S3: If the similarity S≤S sta This is recorded as a new network request, and an initial reputation score F0 is set for the new network request. If the similarity S > S sta Let S be a known network request. Let the known network request directly inherit its cached reputation score F, where S... sta This represents the preset similarity threshold; the real-time allowed rate limit V for this network request is calculated based on the reputation score. max and with a real-time allowed rate limit V max Transmit raw network data packets; S4: During the transmission process, perform deep packet inspection on the original network data packets of the image. If any of the following behaviors are found: remote host control, ransomware communication, or SQL injection, it is recorded as a threat event. If a threat event is detected, the temporary fingerprint corresponding to the threat event will be added to the blacklist, the corresponding reputation score will be reduced to zero, and the network request will be blocked. If there is no threat event but the current transmission rate exceeds V max If the corresponding credit score is reduced by λ, where λ represents the preset reduction percentage, 0 < λ < 0.5; If there are no threatening events and the current transmission rate does not exceed V max If so, the corresponding reputation score will be increased by λ.

[0007] As a further aspect of the present invention: in step S3, the real-time allowed rate limit V for this network request is calculated based on the reputation score. max include: Get current credit score F cur If the current credit score is F cur If the initial reputation score is greater than or equal to F0, then the real-time allowed rate limit V is set. max Equal to the platform gateway's maximum transmission rate; If the current credit score is F cur If the score is less than the initial reputation score F0, the real-time allowed rate limit will be set. Where Vs represents the maximum transmission rate of the platform gateway.

[0008] As a further aspect of the present invention: In step S4, after the current network request ends, if it is a new network request, it is stored in the platform database as a historical template fingerprint; if it is a known network request, the historical template fingerprint is overwritten and updated.

[0009] As a further aspect of the present invention: In step S1, the time node when the network request arrives at the platform gateway is obtained. If the network request arrives within a preset non-working time interval, the following processing is performed: If a threat event is detected, the temporary fingerprint corresponding to the threat event will be added to the blacklist, the corresponding reputation score will be reduced to zero, and the network request will be blocked. If there is no threat event but the current transmission rate exceeds V max If so, the corresponding reputation score will be reduced by 2λ, where λ represents the preset reduction percentage, 0 < λ < 0.5; If there are no threatening events and the current transmission rate does not exceed V max If so, the corresponding credit score will be reduced to the initial credit score F0.

[0010] As a further aspect of the present invention: in step S2, calculating the similarity S between the temporary fingerprint and the historical template fingerprint includes: Calculate the similarity between temporary fingerprints and historical template fingerprints. , where N A N represents the number of temporary fingerprints and historical template fingerprints that have exactly the same clock offset and TCP initial window size in the firmware features. B N C Similarly.

[0011] As a further aspect of the present invention: in step S4, a credit score upper limit is preset. If the credit score increases to a value greater than the credit score upper limit, the credit score value is set to equal the credit score upper limit, and the increase is stopped.

[0012] As a further aspect of the present invention: In step S3, if the reputation score corresponding to M consecutive network requests of the same client is lower than FO and is on a continuous downward trend, it is recorded as a threat event, and subsequent network requests of the client are blocked, where M represents the preset number of requests.

[0013] As a further aspect of this invention: if the reputation score corresponding to the client's IP address is less than F0, but the network request initiated by the client this time is a new network request, then the real-time allowed rate limit V is set to... max =Vs.

[0014] The beneficial effects of this invention are as follows: (1) This solution breaks through the limitation of traditional security detection relying solely on application layer load analysis. It constructs a multi-dimensional temporary fingerprint by extracting hardware features, system environment features, and application surface features from network data packets. Low-level features such as clock offset and TCP window size are determined by the details of device hardware and protocol stack implementation, making them difficult for attackers to forge or tamper with in batches. This allows requests initiated by the same attack source at different times or through different entry points to be effectively associated. The solution calculates the similarity between the temporary fingerprint and the historical template fingerprint and combines it with a reputation score mechanism to achieve accurate judgment of the credibility of the request source. When a threat event is detected, the corresponding fingerprint is immediately added to the blacklist and the reputation score is reduced to zero. When the reputation score of the same client is lower than the initial value multiple times and shows a downward trend, it is also recorded as a threat event and subsequent requests are blocked. This dynamic association mechanism based on multi-dimensional low-level attributes enables the platform to effectively capture covert attack behaviors such as encrypted traffic obfuscation and low-frequency slow penetration, significantly improving the generalized defense capability against unknown risks such as zero-day vulnerability exploitation.

[0015] (2) An adaptive flow control mechanism based on reputation score for dynamically adjusting transmission rate was established, overcoming the shortcomings of traditional platforms that adopt a uniform strategy for all requests. An initial reputation score is set for each network request and dynamically adjusted according to real-time interaction results. This design ensures that legitimate requests with good reputation receive sufficient transmission resources, while the transmission bandwidth of suspicious requests is adaptively compressed, effectively curbing the destructive power of malicious traffic and maximizing the service quality of normal business. In addition, the solution implements differentiated reputation adjustment strategies for high-risk periods such as non-working hours and prevents unlimited growth by setting a reputation score cap, enabling the security policy to evolve dynamically with the request interaction process and avoiding the response lag problem caused by policy solidification. Attached Figure Description

[0016] The invention will now be further described with reference to the accompanying drawings.

[0017] Figure 1 This is a schematic diagram of the security detection method of the risk prevention and control platform for vulnerability assessment according to the present invention; Figure 2 This is a flowchart illustrating the security testing method of the risk prevention and control platform for vulnerability assessment according to the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 As shown, the present invention is a security detection method for a risk prevention and control platform used for vulnerability assessment, comprising the following steps: S1: When a client initiates a network request that reaches the platform gateway, the platform gateway forwards the network request to the backend server and simultaneously performs bypass mirroring of the original network data packets; The platform gateway extracts hardware features, system environment features, and application surface features from the original network packets of the image as temporary fingerprints. The hardware features include clock offset and TCP initial window size, the system environment features include operating system type, kernel version, and network stack response order, and the application surface features include the JA4 fingerprint in the TLS handshake packet. S2: Calculate the similarity S between the temporary fingerprint and the historical template fingerprint, where the historical template fingerprint refers to the temporary fingerprint stored in the platform database; S3: If the similarity S≤S sta This is recorded as a new network request, and an initial reputation score F0 is set for the new network request. If the similarity S > S sta Let S be a known network request. Let the known network request directly inherit its cached reputation score F, where S... sta This represents the preset similarity threshold; the real-time allowed rate limit V for this network request is calculated based on the reputation score. max and with a real-time allowed rate limit V max Transmit raw network data packets; S4: During the transmission process, perform deep packet inspection on the original network data packets of the image. If any of the following behaviors are found: remote host control, ransomware communication, or SQL injection, it is recorded as a threat event. If a threat event is detected, the temporary fingerprint corresponding to the threat event will be added to the blacklist, the corresponding reputation score will be reduced to zero, and the network request will be blocked. If there is no threat event but the current transmission rate exceeds V max If the corresponding credit score is reduced by λ, where λ represents the preset reduction percentage, 0 < λ < 0.5; If there are no threatening events and the current transmission rate does not exceed V max If so, the corresponding reputation score will be increased by λ.

[0020] It should be noted that when a client initiates a network request and arrives at the platform gateway, the gateway first forwards the original network data packet to the backend server according to the existing routing policy to ensure business continuity. Simultaneously, the gateway replicates a complete original data packet using bypass mirroring technology and sends it to a separate fingerprint extraction and security analysis module without interfering with the main data flow. This module performs deep analysis on the mirrored data packet, extracting a temporary fingerprint from three dimensions: The first dimension is hardware characteristics, specifically including the network card clock offset and the initial TCP window size. These two parameters are determined by the device's physical components and protocol stack implementation, exhibiting high stability and difficulty in forgery. The second dimension is system environment characteristics, covering the operating system type, kernel version number, and the network protocol stack's response order to specific probe packets. This information reflects the underlying implementation details of the terminal system. The third dimension is application surface characteristics, primarily extracting the JA4 fingerprint during the TLS handshake process. This fingerprint integrates negotiation parameters such as cipher suites, extension types, and protocol versions, effectively characterizing the client application's encrypted communication behavior. These three types of characteristics together constitute a multi-dimensional temporary fingerprint vector, serving as the initial basis for subsequent identity association and reputation determination.

[0021] After extracting the temporary fingerprint, the platform calculates its similarity with historical template fingerprints stored in the database. These historical template fingerprints are temporary fingerprints that first appeared and were archived in previous network requests. The similarity calculation uses a weighted linear combination method. This weighted design ensures a reasonable proportion of each dimension of the fingerprint, preventing any single feature from excessively influencing the judgment result.

[0022] Compare the calculated similarity S with the preset threshold S sth Compare them. If S≤S sth If the current request is considered a new network request, meaning the platform has never seen this source or device combination before, an initial reputation score F0 is assigned to it, and this temporary fingerprint is stored in the database as a new template for subsequent comparison. If S > S sth If the current request is identified as a known network request, it can directly inherit the corresponding cached reputation score F from the database without re-initialization. For known requests, the platform also updates the most recent access time but does not immediately modify the fingerprint template to maintain the stability of historical templates.

[0023] Whether it's a new request or a known request, the platform calculates the real-time allowed rate cap V for this transmission based on the currently valid reputation score. max The specific rules are as follows: First, obtain the current reputation score F. cur If F cur If the score is greater than or equal to the initial reputation score FO, it indicates that the request source has a good historical behavior, allowing it to send data at the gateway's maximum transmission rate Vs to fully guarantee the throughput performance of normal business operations; if F curIf <FO, then the suppression strategy is activated, making This involves using a logarithmic function to non-linearly suppress the data rate, ensuring that the lower the reputation score, the more drastically the available bandwidth decreases, thus effectively curbing data transmission from suspicious sources. Throughout the transmission process, the gateway strictly limits the actual rate to no more than V. max This ensures that traffic control and reputation status are linked in real time.

[0024] During transmission, the platform continuously performs deep packet inspection on the original network data packets of the image, analyzing payload content and protocol behavior. The detection rules cover three main categories of threat events: remote host control, ransomware communication, and SQL injection. If any of these behaviors are detected, the temporary fingerprint corresponding to the request is immediately added to the global blacklist, its reputation score is forcibly reduced to zero, and the request is blocked. Any subsequent requests from the same fingerprint will be directly rejected.

[0025] If no threat event is detected, further examine the actual transmission rate and V. max The relationship. If the actual transmission rate exceeds V... max This could be due to network congestion or timing errors, indicating that the request is exceeding resource limits. While it may not currently pose a security threat, it still raises suspicion of abuse, and in this case, the reputation score will be reduced by a fixed percentage. Conversely, if the actual speed consistently does not exceed V... max If the behavior is deemed compliant, the credit score will be increased by the same percentage. To prevent the credit score from expanding indefinitely, the platform presets a credit score cap. When the increased value exceeds the cap, only the cap value is taken, and further increases cease. After a request is completed, if it is a new network request, its temporary fingerprint is stored in the database as a new historical template; if it is a known network request, the latest temporary fingerprint is used to overwrite and update the original template, allowing historical templates to evolve with minor changes in the device.

[0026] For specific time scenarios, differentiated processing logic for non-working hours has been added. The platform obtains the arrival time of network requests. If it determines that the request falls within a preset non-working time range, it adjusts the reputation change policy. If a threat event exists, the processing method remains unchanged; if no threat event exists but the transmission rate exceeds the limit, the reputation score is reduced by 2λ, i.e., doubled, to strengthen high-risk management during non-working hours; if no threat event exists and the rate does not exceed the limit, the reputation score is directly reduced to the initial reputation score F0, rather than increased. This is because normal requests during non-working hours should also be handled with caution to avoid over-trust leading to the underestimation of potential risks.

[0027] In addition, the platform introduces a continuous behavior analysis mechanism. When the reputation score corresponding to M consecutive network requests from the same client is all below F0 and shows a decreasing trend, even if a single request does not trigger an explicit threat rule, it will be regarded as a threat event as a whole, directly blocking all subsequent requests from that client and adding the corresponding fingerprint to the blacklist. At the same time, considering the correlation between IP address and fingerprint, if the reputation score corresponding to a client IP address is already below FO, but its current request is judged as a new network request due to a different fingerprint, in order to ensure that normal device switching scenarios are not mistakenly affected, the platform allows the new request to be transmitted at the maximum rate Vs, but retains the ability to subsequently detect and link reputation.

[0028] In summary, this method achieves accurate identification of request sources through multi-dimensional, unforgeable underlying fingerprints. Combined with dynamic reputation scoring and non-linear rate control, it enables security policies to evolve in real time with the interaction results of each request. This allows the method to rapidly reduce the transmission capacity in the early stages of an attack while providing sufficient bandwidth guarantees for legitimate requests, thereby significantly improving the vulnerability assessment platform's generalized defense capabilities and service quality against unknown threats.

[0029] In another preferred embodiment of the present invention, the real-time allowed rate limit V for this network request is calculated based on the reputation score. max include: Get current credit score F cur If the current credit score is F cur If the initial reputation score is greater than or equal to F0, then the real-time allowed rate limit V is set. max Equal to the platform gateway's maximum transmission rate; If the current credit score is F cur If the score is less than the initial reputation score F0, the real-time allowed rate limit will be set. Where Vs represents the maximum transmission rate of the platform gateway.

[0030] In another preferred embodiment of the present invention, after the current network request ends, if it is a new network request, it is stored in the platform database as a historical template fingerprint; if it is a known network request, the historical template fingerprint is overwritten and updated.

[0031] Understandably, updating historical template fingerprints involves the following steps: First, the hardware and system environment characteristics in the historical template are retained, regardless of whether these fields change in the current temporary fingerprint. This is because these underlying attributes are determined by the physical device and core system, possessing long-term stability and unforgeability; any short-term fluctuations should not interfere with their baseline values. Second, for application surface features, the platform breaks them down into several independently measurable sub-dimensions, such as the TLS protocol version, cipher suite list, extended field enumeration order, and segment identifiers of the JA4 fingerprint, forming a feature subset. During the update, a random uniform sampling algorithm is used to select exactly 30% of the sub-dimensions from this subset. The latest value of the corresponding sub-dimension for the current temporary fingerprint is written into the historical template, replacing the original content. The remaining 70% of the sub-dimensions retain their old values ​​from the historical template without any changes. This proportional design balances the stability of adaptive evolution, allowing the template to follow regular changes in client application layer configuration while effectively suppressing the excessive impact of a single abnormal request on the overall fingerprint, preventing deviations in similarity calculations for subsequent requests due to occasional errors. After completing the above partial replacement, the platform re-persists the updated complete template fingerprint to the database as the benchmark for subsequent request similarity comparisons. The entire update process does not involve any hardware or system layer modifications, ensuring that the underlying trusted anchor of the fingerprint remains robust, while allowing for gradual and smooth iteration of application layer representations.

[0032] In another preferred embodiment of the present invention, the time node when the network request arrives at the platform gateway is obtained. If the network request arrives within a preset non-working time interval, the following processing is performed: If a threat event is detected, the temporary fingerprint corresponding to the threat event will be added to the blacklist, the corresponding reputation score will be reduced to zero, and the network request will be blocked. If there is no threat event but the current transmission rate exceeds V max If so, the corresponding reputation score will be reduced by 2λ, where λ represents the preset reduction percentage, 0 < λ < 0.5; If there are no threatening events and the current transmission rate does not exceed V max If so, the corresponding credit score will be reduced to the initial credit score F0.

[0033] In another preferred embodiment of the present invention, calculating the similarity S between the temporary fingerprint and the historical template fingerprint includes: Calculate the similarity between temporary fingerprints and historical template fingerprints. , where N A N represents the number of temporary fingerprints and historical template fingerprints that have exactly the same clock offset and TCP initial window size in the firmware features. B N C Similarly.

[0034] In another preferred embodiment of the present invention, a credit score upper limit is preset. If the credit score increases to exceed the upper limit, the credit score is set to equal the upper limit and the increase stops.

[0035] In another preferred embodiment of the present invention, when the reputation score corresponding to M consecutive network requests of the same client is lower than FO and is on a continuous downward trend, it is recorded as a threat event, and subsequent network requests of the client are blocked, where M represents the preset number of requests.

[0036] In another preferred embodiment of the present invention, if the reputation score corresponding to the client IP address is less than F0, but the network request initiated by the client this time is a new network request, the real-time allowed rate limit V is set to... max =Vs.

[0037] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the present invention should still fall within the scope of the present invention.

Claims

1. A security testing method for a risk control platform used for vulnerability assessment, characterized in that, Includes the following steps: S1: When a client initiates a network request that reaches the platform gateway, the platform gateway forwards the network request to the backend server and simultaneously performs bypass mirroring of the original network data packets; The platform gateway extracts hardware features, system environment features, and application surface features from the original network packets of the image as temporary fingerprints. The hardware features include clock offset and TCP initial window size, the system environment features include operating system type, kernel version, and network stack response order, and the application surface features include the JA4 fingerprint in the TLS handshake packet. S2: Calculate the similarity S between the temporary fingerprint and the historical template fingerprint, where the historical template fingerprint refers to the temporary fingerprint already stored in the platform database; S3: If the similarity S≤S sta This is recorded as a new network request, and an initial reputation score F0 is set for the new network request. If the similarity S > S sta Let S be a known network request. Let the known network request directly inherit its cached reputation score F, where S... sta This represents a preset similarity threshold; the real-time allowed rate limit V for this network request is calculated based on the reputation score. max and with a real-time allowed rate limit V max Transmit raw network data packets; S4: During the transmission process, perform deep packet inspection on the original network data packets of the image. If any of the following behaviors are found: remote host control, ransomware communication, or SQL injection, it is recorded as a threat event. If a threat event is detected, the temporary fingerprint corresponding to the threat event will be added to the blacklist, the corresponding reputation score will be reduced to zero, and the network request will be blocked. If there is no threat event but the current transmission rate exceeds V max If the corresponding credit score is reduced by λ, where λ represents the preset reduction percentage, 0 < λ < 0.5; If there are no threatening events and the current transmission rate does not exceed V max If so, the corresponding reputation score will be increased by λ.

2. The security testing method for a risk control platform used for vulnerability assessment according to claim 1, characterized in that, In step S3, the real-time allowed rate limit V for this network request is calculated based on the reputation score. max include: Get current credit score F cur If the current credit score is F cur If the initial reputation score is greater than or equal to F0, then the real-time allowed rate limit V is set to... max Equal to the platform gateway's maximum transmission rate; If the current credit score is F cur If the score is less than the initial reputation score F0, the real-time allowed rate will increase. Where Vs represents the maximum transmission rate of the platform gateway.

3. The security testing method for a risk control platform used for vulnerability assessment according to claim 1, characterized in that, In step S4, after the current network request ends, if it is a new network request, it is stored in the platform database as a historical template fingerprint; if it is a known network request, the historical template fingerprint is overwritten and updated.

4. The security testing method for a risk control platform used for vulnerability assessment according to claim 1, characterized in that, In step S1, the time point at which the network request arrives at the platform gateway is obtained. If the network request arrives within a preset non-working time interval, the following processing is performed: If a threat event is detected, the temporary fingerprint corresponding to the threat event will be added to the blacklist, the corresponding reputation score will be reduced to zero, and the network request will be blocked. If there is no threat event but the current transmission rate exceeds V max If so, the corresponding reputation score will be reduced by 2λ, where λ represents the preset reduction percentage, 0 < λ < 0.5; If there are no threatening events and the current transmission rate does not exceed V max If so, the corresponding credit score will be reduced to the initial credit score F0.

5. The security testing method for a risk control platform used for vulnerability assessment according to claim 1, characterized in that, In step S2, calculating the similarity S between the temporary fingerprint and the historical template fingerprint includes: Calculate the similarity between temporary fingerprints and historical template fingerprints. , where N A N represents the number of temporary fingerprints and historical template fingerprints that have exactly the same clock offset and TCP initial window size in the firmware features. B N C Similarly.

6. The security testing method for a risk control platform for vulnerability assessment according to claim 1, characterized in that, In step S4, a credit score upper limit is preset. If the credit score increases to exceed the upper limit, the credit score value is set to equal the upper limit, and the increase stops.

7. The security testing method for a risk control platform used for vulnerability assessment according to claim 1, characterized in that, In step S3, if the reputation score corresponding to M consecutive network requests from the same client is lower than FO and is on a continuous downward trend, it is recorded as a threat event, and subsequent network requests from that client are blocked. M represents the preset number of requests.

8. The security testing method for a risk control platform used for vulnerability assessment according to claim 1, characterized in that, If the reputation score corresponding to the client's IP address is less than F0, but the network request initiated by the client this time is a new network request, then set the real-time allowed rate cap V. max =Vs.

Images