A vulnerability scanning method and system for authentication bypass detection

Abstract

The application provides a vulnerability scanning method and system for authentication bypass detection, which comprises the following steps: performing semantic preservation disturbance on a legal authentication request, generating a variation request vector and a corresponding response vector; mapping a difference vector between the response vector and a baseline vector to obtain a new logic state; based on the new logic state, iteratively creating a directed edge in a state transition graph to dynamically construct an authentication logic state machine; in the state machine, identifying an abnormal path by using graph theory path search to determine an authentication bypass vulnerability; the application changes the semantic intention under the premise of maintaining the legality of the request syntax, can deeply detect the branches of the business logic without triggering the regular defense; by mapping the difference vector, the implicit state information is quantitatively identified, and an authentication logic state machine reflecting the authentication behavior of the target system is iteratively constructed to identify the abnormal path, and the vulnerability determination is improved from matching the known attack mode to the path analysis at the logic model level.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a vulnerability scanning method and system for authentication bypass detection. Background Technology

[0002] In the field of network security technology, especially in the area of ​​automated security assessment for network applications, authentication mechanisms, as the cornerstone of system access control, have always been a crucial issue in terms of security testing. As network application architectures become increasingly complex and business logic layer interactions become more flexible, traditional authentication vulnerability scanning techniques are gradually revealing their limitations, driving the development of next-generation detection technologies. The technical field most relevant to this invention focuses on how to overcome the bottlenecks of existing scanning technologies through intelligent and dynamic methods to achieve accurate detection of authentication bypass vulnerabilities, particularly improving the detection capabilities for unknown logic vulnerabilities and zero-day vulnerabilities.

[0003] Existing authentication bypass vulnerability (i.e., 0-day vulnerability) scanning techniques primarily employ a "known attack simulation" paradigm, relying on a predefined test case library for detection. These techniques verify the existence of recorded vulnerabilities in the target system by simulating publicly known attacker patterns, such as brute-forcing attempts using common weak password dictionaries, injecting known SQL injection or cross-site scripting payloads, etc. Within this paradigm, key technologies revolve around static rule matching and known vulnerability pattern reproduction. Static rule matching uses preset characteristic strings, status codes, or response body keywords (such as "login failed," "incorrect password," etc.) to determine the authentication result, comparing the response with preset "success" or "failure" templates. Known vulnerability pattern reproduction techniques, based on attack vectors recorded in vulnerability databases (such as CVEs), construct standardized request packets and send them to the target endpoint, determining the existence of a vulnerability based on whether expected anomalies (such as privilege escalation or sensitive information leakage) are triggered.

[0004] However, the core limitation of such technologies stems from their strong reliance on prior knowledge. Because they can only detect publicly disclosed or documented vulnerability patterns, they are completely ineffective against novel logical vulnerabilities or zero-day vulnerabilities that are not yet documented. For example, when a target system has a logical problem caused by a flaw in its business process design—such as "skipping a certain verification step and directly entering the authorization state"—existing technologies cannot identify it because there are no corresponding predefined use cases. Furthermore, existing technologies often focus on the surface-level inputs (such as parameter values ​​and request headers) and responses (such as status codes and page content) of authentication requests, ignoring the state transition logic, exception handling mechanisms, and dynamic changes in the session context within the authentication process—and these dynamic characteristics are typical carriers of logical vulnerabilities. For example, some systems, upon receiving a legitimate request with specific redundant parameters, may incorrectly bypass the backend verification module and directly enter the session creation process; such anomalies in state transition cannot be captured by static rule matching.

[0005] In summary, existing authentication bypass vulnerability scanning technologies have significant shortcomings in detecting unknown logical vulnerabilities, handling complex state transitions, and accurately identifying unexpected paths. There is an urgent need for a new method that can break free from reliance on prior knowledge and accurately identify authentication bypass vulnerabilities. Summary of the Invention

[0006] To overcome the shortcomings of the prior art, this invention proposes a vulnerability scanning method for authentication bypass detection, comprising: Basic state awareness is performed on the target authentication endpoint to obtain multi-dimensional state features in order to construct a baseline vector; A semantically preserving perturbation is performed on the legitimate authentication request to generate a mutated request vector, and the response vector of the target authentication endpoint under the mutated request vector is obtained; The difference vector between the response vector and the baseline vector is input into a nonlinear state classifier for mapping to obtain the new logical state of the target authentication endpoint; Based on the new logical state, directed edges are iteratively created in the state transition graph to dynamically construct the authentication logic state machine; In the authentication logic state machine, a graph theory path search algorithm is used to identify abnormal paths in order to determine authentication bypass vulnerabilities.

[0007] Preferably, the step of semantically preserving perturbation of legitimate authentication requests to generate mutated request vectors includes: The legitimate authentication request is vectorized to obtain a legitimate request vector; the legitimate request vector includes the request method, request header, request body and request context; While maintaining syntactic validity, the request body is subjected to semantic preservation perturbation to generate a mutated request vector; the semantic preservation perturbation includes adding, deleting or modifying specific fields.

[0008] Preferably, the step of mapping the difference vector between the response vector and the baseline vector into a nonlinear state classifier to obtain a new logical state of the target authentication endpoint includes: A support vector machine-based classifier is used as a nonlinear state classifier; The nonlinear state classifier is used to map the difference vector between the response vector and the baseline vector to a preset set of basic logical states to obtain a new logical state of the target authentication endpoint. The basic logical state set includes: idle state, verification state, authentication successful state, authentication rejected state, and authentication abnormal state.

[0009] Preferably, the step of iteratively creating directed edges in the state transition graph based on the new logical state to dynamically construct the authentication logic state machine includes: Using the new logical state as the target state, a directed edge is created in the state transition graph pointing from the current state to the target state; the directed edge carries the identifier of the mutation request vector; The current target state is used as the current state of the next iteration. Based on the new mutation request vector, the new target state is repeatedly obtained, and directed edges are created iteratively until the iteration termination condition is met, so as to dynamically construct the authentication logic state machine. Preferably, the iteration termination condition includes: no new target state is generated in the state transition graph after multiple consecutive iterations; or the state transition graph already contains the complete path from the non-authentication success state to the authentication success state.

[0010] Preferably, in the authentication logic state machine, a graph theory path search algorithm is used to identify abnormal paths to determine authentication bypass vulnerabilities, including: In the authentication logic state machine, starting from the idle state and ending from the successful authentication state, a graph theory path search algorithm is used to search for paths to obtain all reachable paths to the destination. Among all reachable paths to the destination, a path that reaches the authentication success state through at least one intermediate state is identified as an abnormal path; the intermediate states include authentication rejection state and authentication abnormal state. The confidence score is calculated for the abnormal path. When the confidence score exceeds a preset threshold, it is determined that the target authentication endpoint has an authentication bypass vulnerability.

[0011] Preferably, the step of calculating the confidence score for the abnormal path includes: The normalized difference between the total response delay of the abnormal path and the baseline average response delay is calculated to obtain the path delay deviation. Calculate the Shannon entropy of the intermediate states in the abnormal path to obtain the state sequence entropy; Calculate the difference between the resource consumption during the execution of the abnormal path and the basic resource consumption to obtain the change in resource consumption; By using preset weighting coefficients, the path delay deviation, the state sequence entropy, and the resource consumption change are weighted and fused to calculate the confidence score of the abnormal path.

[0012] Preferably, the step of performing basic state awareness on the target authentication endpoint to obtain multi-dimensional state features to construct a baseline vector includes: Without triggering valid authentication logic, multiple basic requests are sent to the target authentication endpoint to perform basic state awareness and obtain basic output responses; the basic requests include empty requests and invalid credential requests. Extract the multidimensional state features of the basic output response, and construct a baseline vector based on the multidimensional state features; the multidimensional state features include temporal features, content features, and resource features.

[0013] Preferably, the timing feature is the basic average response latency of the target authentication endpoint; the content features include the distribution of HTTP status codes, the response body length range, and the frequency of occurrence of error semantic tags; and the resource feature is the database interaction increment generated by the target authentication endpoint when processing requests.

[0014] Based on the same inventive concept, the present invention also provides a vulnerability scanning system for authentication bypass detection, comprising: The baseline construction module is used to perform basic state awareness on the target authentication endpoint, obtain multi-dimensional state features, and construct a baseline vector. The mutation response module is used to perform semantically preserved perturbation on legitimate authentication requests, generate a mutated request vector, and obtain the response vector of the target authentication endpoint under the mutated request vector. The mapping module is used to input the difference vector between the response vector and the baseline vector into a nonlinear state classifier for mapping, so as to obtain a new logical state of the target authentication endpoint. The state mechanism component module is used to iteratively create directed edges in the state transition graph based on the new logical state in order to dynamically construct the authentication logic state machine; The vulnerability determination module is used to identify abnormal paths in the authentication logic state machine using a graph theory path search algorithm, so as to determine authentication bypass vulnerabilities.

[0015] Preferably, the mutation response module is specifically used for: The legitimate authentication request is vectorized to obtain a legitimate request vector; the legitimate request vector includes the request method, request header, request body and request context; While maintaining syntactic validity, the request body is subjected to semantic preservation perturbation to generate a mutated request vector; the semantic preservation perturbation includes adding, deleting or modifying specific fields.

[0016] Preferably, the mapping module is specifically used for: A support vector machine-based classifier is used as a nonlinear state classifier; The nonlinear state classifier is used to map the difference vector between the response vector and the baseline vector to a preset set of basic logical states to obtain a new logical state of the target authentication endpoint. The basic logical state set includes: idle state, verification state, authentication successful state, authentication rejected state, and authentication abnormal state.

[0017] Preferably, the state mechanism module is specifically used for: Using the new logical state as the target state, a directed edge is created in the state transition graph pointing from the current state to the target state; the directed edge carries the identifier of the mutation request vector; The current target state is used as the current state of the next iteration. Based on the new mutation request vector, the new target state is repeatedly obtained, and directed edges are created iteratively until the iteration termination condition is met, so as to dynamically construct the authentication logic state machine. Preferably, the iteration termination condition includes: no new target state is generated in the state transition graph after multiple consecutive iterations; or the state transition graph already contains the complete path from the non-authentication success state to the authentication success state.

[0018] Preferably, the vulnerability determination module includes: The path search unit is used in the authentication logic state machine to perform path search using a graph theory path search algorithm, starting from the idle state and ending at the successful authentication state, to obtain all reachable paths to the destination. An anomaly identification unit is used to identify, among all reachable paths, a path that reaches the authentication success state through at least one intermediate state as an anomaly path; the intermediate states include authentication rejection state and authentication anomaly state; The calculation unit is used to calculate the confidence level of the abnormal path and obtain a confidence score; The determination unit is used to determine that the target authentication endpoint has an authentication bypass vulnerability when the confidence score exceeds a preset threshold.

[0019] Preferably, the computing unit is specifically used for: The normalized difference between the total response delay of the abnormal path and the baseline average response delay is calculated to obtain the path delay deviation. Calculate the Shannon entropy of the intermediate states in the abnormal path to obtain the state sequence entropy; Calculate the difference between the resource consumption during the execution of the abnormal path and the basic resource consumption to obtain the change in resource consumption; By using preset weighting coefficients, the path delay deviation, the state sequence entropy, and the resource consumption change are weighted and fused to calculate the confidence score of the abnormal path.

[0020] Preferably, the baseline construction module is specifically used for: Without triggering valid authentication logic, multiple basic requests are sent to the target authentication endpoint to perform basic state awareness and obtain basic output responses; the basic requests include empty requests and invalid credential requests. Extract the multidimensional state features of the basic output response, and construct a baseline vector based on the multidimensional state features; the multidimensional state features include temporal features, content features, and resource features.

[0021] Preferably, the timing feature is the basic average response latency of the target authentication endpoint; the content features include the distribution of HTTP status codes, the response body length range, and the frequency of occurrence of error semantic tags; and the resource feature is the database interaction increment generated by the target authentication endpoint when processing requests.

[0022] Based on the same inventive concept, the present invention also provides a computer device, comprising: one or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, a vulnerability scanning method for authentication bypass detection as described above is implemented.

[0023] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed, it implements a vulnerability scanning method for authentication bypass detection as described above.

[0024] Compared with the closest existing technology, the present invention has the following beneficial effects: This invention provides a vulnerability scanning method and system for authentication bypass detection. The method includes: performing basic state perception on a target authentication endpoint to obtain multi-dimensional state features to construct a baseline vector; performing semantically preserving perturbation on legitimate authentication requests to generate a mutated request vector, and obtaining the response vector of the target authentication endpoint under the mutated request vector; mapping the difference vector between the response vector and the baseline vector to a nonlinear state classifier to obtain a new logical state of the target authentication endpoint; iteratively creating directed edges in a state transition graph based on the new logical state to dynamically construct an authentication logic state machine; and employing a graph theory path search algorithm in the authentication logic state machine to identify abnormal paths to determine authentication bypass. Vulnerability; This invention generates mutated requests through semantic preservation perturbation, changing the semantic intent while maintaining the legality of the request syntax. This allows for deep probing of business logic branches without triggering conventional defenses, overcoming the problem of traditional random mutated requests being easily intercepted. By mapping the difference vector between the response vector and the baseline vector into a nonlinear state classifier, implicit state information is transformed into explicit logical states, achieving quantitative identification of state transitions. Based on iterative creation of directed edges, an authentication logic state machine reflecting the authentication behavior of the target system is dynamically constructed, and abnormal paths are identified in the authentication logic state machine. This elevates vulnerability determination from matching known attack patterns to path analysis at the logical model level, achieving accurate detection of unknown logical vulnerabilities. Attached Figure Description

[0025] Figure 1 A schematic diagram of a vulnerability scanning method for authentication bypass detection provided by the present invention; Figure 2 A schematic diagram of a vulnerability scanning system for authentication bypass detection provided by the present invention; Figure 3 This is a schematic diagram of an electronic device structure provided by the present invention. Detailed Implementation

[0026] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0027] Example 1: This invention provides a vulnerability scanning method for authentication bypass detection, such as... Figure 1 As shown, it includes: S1. Perform basic state awareness on the target authentication endpoint to obtain multi-dimensional state features in order to construct a baseline vector; S2. Perform semantically preserving perturbation on the legitimate authentication request to generate a mutated request vector, and obtain the response vector of the target authentication endpoint under the mutated request vector; S3. The difference vector between the response vector and the baseline vector is input into a nonlinear state classifier for mapping to obtain the new logical state of the target authentication endpoint. S4. Based on the new logical state, iteratively create directed edges in the state transition graph to dynamically construct the authentication logic state machine; S5. In the authentication logic state machine, a graph theory path search algorithm is used to identify abnormal paths in order to determine authentication bypass vulnerabilities.

[0028] Considering the significant shortcomings of existing authentication bypass vulnerability scanning technologies in detecting unknown logical vulnerabilities, handling complex state transitions, and accurately identifying unexpected paths, this invention generates mutated requests through semantically preserving perturbations. While maintaining the legality of the request syntax, it alters the semantic intent, enabling deep probing of business logic branches without triggering conventional defenses, overcoming the problem of traditional random mutated requests being easily intercepted. By mapping the difference vector between the response vector and the baseline vector into a nonlinear state classifier, implicit state information is transformed into explicit logical states, achieving quantitative identification of state transitions. Based on iterative creation of directed edges, an authentication logic state machine reflecting the authentication behavior of the target system is dynamically constructed, and abnormal paths are identified within this machine. This elevates vulnerability determination from matching known attack patterns to path analysis at the logical model level, achieving accurate detection of unknown logical vulnerabilities.

[0029] More specifically, at the state awareness level, most existing technologies focus on the surface input and response of authentication requests, using "silent observation" or "low-intensity probing," remaining at a single dimension, or only calculating the average response time, or only analyzing the distribution of status codes. They lack collaborative analysis of multi-dimensional features, ignoring the dynamic changes in state transitions, exception handling, and session context within the authentication process. This results in the constructed baseline failing to accurately reflect the comprehensive behavioral characteristics of the system under different scenarios such as normal, abnormal, and rejection. These dynamic features are precisely the high-incidence areas of logical vulnerabilities, thus making subsequent state determinations unreliable.

[0030] In order to deeply analyze these inherent and dynamic behavioral characteristics, this invention designs a multi-dimensional basic state perception and vector extraction step in S1 above, systematically collects and quantifies the temporal, content and resource characteristics that constitute the system's "silent" or "rejected" state, thereby establishing a scientific and comprehensive baseline.

[0031] Basic state awareness refers to the process of sending a probe request to the target authentication endpoint and collecting its response characteristics without carrying the correct credentials or triggering the authentication success logic. Its purpose is to establish an objective and comprehensive behavioral baseline for subsequent dynamic analysis, rather than to conduct attack probes, so as to avoid subsequent deep probes being misjudged as regular attacks and intercepted, thereby accurately discovering hidden authentication bypass vulnerabilities.

[0032] A target authentication endpoint refers to the network interface in a business system that is responsible for receiving user credentials and executing authentication logic. For example, in the web application security assessment industry, a target authentication endpoint includes the login verification interface of an API gateway (such as https: / / target.com / api / login).

[0033] In this embodiment, when constructing the baseline vector in S1, it may include: Without triggering valid authentication logic, multiple basic requests are sent to the target authentication endpoint to perform basic state awareness and obtain basic output responses; the basic requests include empty requests and invalid credential requests. Extract the multidimensional state features of the basic output response, and construct a baseline vector based on the multidimensional state features; the multidimensional state features include temporal features, content features, and resource features.

[0034] In one alternative embodiment, before the formal probing, 100 empty GET requests (empty requests) and 100 random string POST requests (invalid credential requests) are made to the target authentication endpoint.

[0035] In this embodiment, the timing feature is the basic average response latency of the target authentication endpoint; the content feature includes the HTTP status code distribution, response body length range, and frequency of occurrence of error semantic tags; and the resource feature is the database interaction increment generated by the target authentication endpoint when processing requests.

[0036] Timing characteristics under 100 empty GET requests and 100 random string POST requests. The determination process includes: Calculate the average response latency to obtain the average response latency for an empty request. Average response time for invalid requests .

[0037] Content Features The determination process includes: Statistical analysis of HTTP status code distribution yields... ;in, , and The distribution values ​​of status codes 200, 404, and 500 are shown; analysis of the response body length range reveals that it is mainly concentrated in the [200, 250] byte range; the frequency of occurrence of error semantic tags such as "error" and "loginfailed" in the response body is identified using an NLP model. . Resource characteristics The determination process includes: Estimate the database query log increment caused by each invalid request using side-channel methods (such as analyzing specific patterns of database interaction in network traffic). .

[0038] Integrating the above features, an initial state vector is constructed. This vector, serving as a baseline vector, includes temporal features (average response latency), content features (status code distribution, response body length range, and frequency of error semantic tags), and resource features (incremental database query logs triggered by invalid requests), representing the standard behavioral profile of the target system in the "not effectively triggered" state.

[0039] At the request construction level, existing technologies often use random mutation or brute-force enumeration to generate test requests. Such requests often destroy the semantic structure of legitimate requests (such as tampering with JSON syntax or destroying parameter key-value pairs), making them easy to be intercepted by the input validation module of the target system. Not only can they not reach the deep business logic, but they may also trigger the protection mechanism due to a large number of invalid requests, resulting in low scanning efficiency or being blocked by the target system.

[0040] Building upon this, in step S2 above, the present invention generates a mutation request as a probe request using a semantically preserving mutation strategy and performs vectorization processing. This strategy can purposefully perturb specific fields while maintaining the basic semantic structure of a legitimate request, thereby inducing the system to execute its deeper, unexpected business logic branches, rather than simply triggering input validation failure.

[0041] In this embodiment, S2 may include: The legitimate authentication request is vectorized to obtain a legitimate request vector; the legitimate request vector includes the request method, request header, request body and request context; While maintaining syntactic validity, the request body is subjected to semantic preservation perturbation to generate a mutated request vector; the semantic preservation perturbation includes adding, deleting or modifying specific fields.

[0042] A legitimate authentication request refers to an authentication message that conforms to the target system interface specification and carries the correct credential structure.

[0043] To generate probe requests that can penetrate protection and to standardize response characteristics, both requests and responses are vectorized. The specific process of request vectorization includes: Define each request as In this context, M represents the request method (such as GET, POST, PUT, etc.), H represents the request header (such as Cookie, User-Agent, Authorization, etc.), B represents the request body (such as form data, JSON parameters, etc.), and C represents the request context information (such as session ID, timestamp, associated historical request sequence, etc.).

[0044] When performing semantically preserving perturbations on the request body, for example, a legitimate authentication request. After perturbation, a mutation request vector is generated. = \{\text{POST}, H, \{\text{"user":"test", "pass":"test123", "is_internal":"true"}\}, C\}, This request has perfectly correct JSON syntax, but its intent is to probe for the existence of a backdoor parameter for internal calls.

[0045] The response vector refers to the standardized, multi-dimensional feature data returned by the target system after receiving a mutation request. For example, the response vector to the mutation request mentioned above. Among them: request response delay HTTP status codes are obtained by calculating the difference between the request sending time and the response receiving time. Extract directly from the response header (e.g., 200, 401, 403, etc.); response body length Error labels are obtained by counting the number of bytes in the response body. The system uses regular expressions to match error keywords (such as "invalid", "fail", "error") in the response body. A successful match is marked as 1, otherwise as 0. (Resource consumption estimate) By comparing the incremental database query logs caused by invalid requests get.

[0046] Subsequently, the core paradigm of existing technologies is "known attack simulation," which heavily relies on predefined test case libraries. This directly results in its ability to detect only publicly disclosed or documented vulnerability patterns, rendering it completely ineffective against unknown, novel authentication bypass vulnerabilities (including zero-day vulnerabilities) based on logical flaws. This invention aims to abandon this passive and lagging detection model and discover unknown vulnerabilities through a proactive and adaptive analysis method.

[0047] To address this, this invention introduces a mechanism for dynamically constructing and evolving an Authentication Logic State Machine (ALSM) in S3 and S4. This mechanism does not rely on any prior vulnerability templates. Instead, it continuously sends carefully crafted probe requests to the target system and analyzes its responses to reverse-engineer a dynamically changing state transition model that truly reflects the essence of the target system's internal authentication process. In this way, this invention can discover authentication bypass paths not included in any known vulnerability databases, resulting from unexpected state transitions.

[0048] Specifically, in S3 above, a nonlinear state classifier is used to determine the authentication logic state corresponding to the current request. A nonlinear state classifier is a classification model built based on machine learning algorithms that can handle nonlinearly separable data. In this embodiment, a support vector machine (SVM)-based classifier is specifically used. By combining the SVM-based nonlinear state classifier, this invention can map complex responses to a core state set (i.e., a basic logic state set) representing the essence of the authentication process in S3, thereby capturing subtle state anomalies that cannot be identified solely by status codes or keyword matching.

[0049] In this embodiment, S3 includes: A support vector machine-based classifier is used as a nonlinear state classifier; The nonlinear state classifier is used to map the difference vector between the response vector and the baseline vector to a preset set of basic logical states to obtain the new logical state of the target authentication endpoint. The basic logical state set includes: idle state, verification state, authentication successful state, authentication rejected state, and authentication abnormal state.

[0050] Specifically, define a set of states that are independent of specific pages and describe the essence of the authentication process, forming a basic logical state set. These states will serve as labels for subsequent request and response classifications, forming the basis for building ALSM nodes. An idle state indicates that the user has not initiated any authentication request; The status check indicates that the authentication request has been submitted and the system is performing authentication. A successful authentication status indicates that the user has been verified and has obtained access privileges; An authentication rejection status indicates that user authentication has failed. This is an authentication error status, indicating that an error occurred during the authentication process or the authentication was blocked by the system.

[0051] The specific mapping process includes: the initial state vector constructed based on the S1 stage. (i.e., the baseline vector of normal system authentication behavior), calculate the current response vector. The difference vector between the initial state vector and the initial state vector This vector reflects the degree of deviation in the system state caused by the current request. This difference vector is then input into a pre-trained SVM classifier to determine the authentication status corresponding to the current request.

[0052] In one alternative embodiment, the Support Vector Machine-based classifier (SVM classifier) ​​includes an input layer, a kernel function computation layer, and a decision output layer. The input layer receives a 5-dimensional difference vector; the kernel function computation layer uses a Gaussian radial basis function (RBF kernel) to nonlinearly map the low-dimensional inseparable input to a high-dimensional space; the decision output layer outputs state class labels based on the optimal hyperplane.

[0053] The training steps for an SVM classifier include: 1) Sample collection: Collect a large amount of authentication response data from web applications, extract five-dimensional features and calculate the difference with the baseline, and manually label the true state. 2) Parameter initialization: Set the initial values ​​for the penalty parameter C and the kernel function parameter γ; 3) Model training: The SVM model is trained using the labeled training set, and the maximum margin hyperplane is found by solving a convex quadratic programming problem; 4) Cross-validation: The penalty parameter C and the kernel function parameter γ are tuned using a grid search method to obtain the optimal parameter combination, complete the model solidification, and obtain a pre-trained SVM classifier.

[0054] A state transition graph is a graph data structure composed of state nodes and directed edges, used to dynamically record detected state transitions. A directed edge is a line connecting one state node to another in the state transition graph. It carries the identifier of the mutation request vector, used to record the request that triggers the transition. The Authentication Logic State Machine (ALSM) is a directed graph model that expands iteratively and can realistically reflect the complex authentication process of the target system.

[0055] In this embodiment, S4 may include: Using the new logical state as the target state, a directed edge is created in the state transition graph pointing from the current state to the target state; the directed edge carries the identifier of the mutation request vector; The current target state is used as the current state of the next iteration. Based on the new mutation request vector, the new target state is repeatedly obtained, and directed edges are created iteratively until the iteration termination condition is met, so as to dynamically construct the authentication logic state machine. In this embodiment, the iteration termination condition includes: no new target state is generated in the state transition graph after multiple consecutive iterations; or the state transition graph already contains the complete path from the non-authentication success state to the authentication success state.

[0056] To clearly illustrate the dynamic evolution process of creating directed edges in this iterative step, let's take a set of iterations as an example: Iteration 1 (Exploring the legitimate path): The system engine generates a legitimate login request, i.e., a legitimate authentication request. After sending, a response was received. Calculate the difference vector. The input is then fed into an SVM classifier, which determines the category of the response based on the boundaries it has learned. Authentication successful. The first directed edge has been created in ALSM. . This iteration sends a valid authentication request that has not been disturbed, and the non-linear state classifier outputs the corresponding new logical state. At this point, it remains in the default idle state. Using this new logical state as the current state and this new logical state as the target state, create a basic directed edge in the state transition graph that points from the current state to the target state. This completes the construction of the basic legal path and generates the initial state transition diagram.

[0057] After establishing the basic legal path, subsequent iterations still use the default idle state as the initial current state and enter the deep exploration phase based on the mutation request vector. By continuously generating mutation request vectors, new target states are explored, and directed edges are continuously created iteratively in the state transition graph.

[0058] Iteration 2 (Semantic Preservation Mutation): To detect the existence of hidden logic, the engine performs semantic preservation mutation, generating a seemingly valid mutation request vector that contains additional parameters. = \{\text{POST}, H, \{\text{"user":"test", "pass":"test123", "is_internal":"true"}\}, C\}. This request has perfectly correct JSON syntax, but its intent is to probe for a backdoor parameter intended for internal calls. An abnormal state was detected: Send Then, the system returns an exception response vector: The classifier analyzes the difference vector at this point. It was found that although its status code was 401 (usually representing unauthorized), the response body length and latency were similar to the typical average response latency. The error is inconsistent and the resource consumption is extremely low. Based on the comprehensive judgment, it belongs to a special "internal interface rejection" state, and the engine instantiates it into a new state. Create a second directed edge in ALSM. . Iteration 3 (Critical Path Discovery): The engine anticipates that certain systems may experience state contamination after receiving a specific sequence of requests. Therefore, it designs a second mutated request vector. Its body is {"user":"test"} (containing only the username). Send this request to the user in the specified location. The system unexpectedly returned the state context (by reusing or simulating the cookie from the previous request). The response is completely consistent with a successful login, and the classifier determines its status as [missing information]. Creating key edges in ALSM Thus, a complete, unexpected, and abnormal path has been established. Dynamically constructed: .

[0059] Through the closed-loop "probe-classify-edge construction" process described above, this invention can adaptively evolve a simple initial state graph into a complex ALSM model, truly restoring the interaction flow of the business logic layer.

[0060] Finally, in the status determination stage, existing technologies typically rely on simple threshold judgments (such as considering a response time exceeding a certain value as abnormal) or keyword matching (such as considering authentication success if the response body contains "success"), only providing a binary conclusion of "vulnerability exists" or "vulnerability does not exist." This lacks the ability to finely identify unexpected states and fails to reveal the complete path of vulnerability triggering and the process of unexpected state transitions, making it difficult for developers to pinpoint the root cause and fix the problem. For example, when the system throws an exception due to parameter parsing errors but unexpectedly grants session permissions, existing technologies may misjudge authentication failure because the response body contains the keyword "error," or misjudge success because the status code is 200, leading to an extremely high false positive or false negative rate.

[0061] To address the above issues, this invention proposes a bypass vulnerability assessment method based on abnormal path analysis. First, based on the aforementioned iterative process, the concept of an "ideal authentication state machine" is defined, meaning that a legitimate authentication request should directly lead to an authentication success state. Then, S5 actively searches the ALSM dynamically constructed in S4 for all suspicious paths that start from an idle state, pass through unsuccessful intermediate states, and ultimately reach authentication success. A quantitative indicator, an authentication bypass confidence score, is introduced. This score comprehensively considers the deviation of path time consumption, the complexity of the intermediate state sequence (measured by Shannon entropy), and the change in backend resource consumption, forming a multi-factor fusion and scientific vulnerability assessment model. Only when the confidence score exceeds a preset threshold is the vulnerability ultimately identified, thereby significantly improving the accuracy and reliability of vulnerability reports.

[0062] In this embodiment, S5 includes: S501. In the authentication logic state machine, starting from the idle state and ending from the successful authentication state, a graph theory path search algorithm is used to search for paths to obtain all reachable paths to the endpoint. S502. Among all paths reachable from the destination, the path that reaches the authentication success state through at least one intermediate state is identified as an abnormal path; the intermediate state includes authentication rejection state and authentication abnormal state. S503. Calculate the confidence level of the abnormal path to obtain a confidence score; S504. When the confidence score exceeds a preset threshold, it is determined that the target authentication endpoint has an authentication bypass vulnerability.

[0063] Graph-based path search algorithms are mathematical algorithms for finding sequences of nodes that satisfy specific constraints in a graph data structure. In this embodiment, the depth-first search (DFS) algorithm is used.

[0064] In this embodiment, S503 specifically includes: The normalized difference between the total response delay of the abnormal path and the baseline average response delay is calculated to obtain the path delay deviation. Calculate the Shannon entropy of the intermediate states in the abnormal path to obtain the state sequence entropy; Calculate the difference between the resource consumption during the execution of the abnormal path and the basic resource consumption to obtain the change in resource consumption; By using preset weighting coefficients, the path delay deviation, the state sequence entropy, and the resource consumption change are weighted and fused to calculate the confidence score of the abnormal path.

[0065] For example, for unexpected abnormal paths Calculate the confidence score: Path delay deviation ; State sequence entropy It is obtained by calculating the Shannon entropy of the intermediate state sequence. This example is relatively simple and the entropy value is low. Changes in resource consumption

[0066] Set delay weights Then the confidence score The preset threshold θ=3.0. Since 5.108>3.0, it is judged as a high-risk vulnerability.

[0067] By introducing Shannon entropy to quantify the degree of chaos in state jumps and combining it with normalized deviations in time and resource dimensions, this invention transforms vulnerability determination from a qualitative "yes or no" question into a quantitative scientific assessment of "how certain" the vulnerability is. This multi-factor weighting mechanism can effectively filter out seemingly plausible low-risk anomalies (such as occasional network fluctuations causing increased latency), greatly reducing the false positive rate.

[0068] In summary, the core technical principle of this invention lies in completely abandoning the existing passive paradigm of "known attack simulation" and shifting to an active and adaptive paradigm of "system behavior modeling and analysis." Its fundamental idea is to abstract the authentication process of the target system into a Dynamic Authentication Logic State Machine (ALSM). By injecting carefully designed probe requests into the system and observing and recording the state transitions under different inputs, the implicit authentication logic can be reverse engineered. Once this state machine model is constructed, this invention can use graph theory path search to find abnormal paths that violate the "ideal authentication logic"—that is, paths that start from an "idle" state, bypass the normal "credential verification" and "authentication success" states, and instead reach the "authentication success" state through a series of unexpected intermediate states (such as "authentication rejection" and "system anomaly"). These abnormal paths are direct evidence of authentication bypass vulnerabilities. To improve the accuracy of the judgment, this invention introduces a multi-dimensional feature fusion initial state perception mechanism and a machine learning-based state classifier, and quantifies the confidence score of the discovered abnormal paths, thereby achieving accurate and low false alarm detection of unknown logical vulnerabilities.

[0069] The beneficial effects ultimately achieved by this invention include: 1. This invention shifts the focus of detection from "matching known attack patterns" to "discovering unexpected state transitions in the system" by dynamically constructing an Authentication Logic State Machine (ALSM). As long as the target system possesses a business logic that can reach a successful authentication state via an unexpected path, no matter how hidden or unprecedented the logic is, it can be detected by searching the state space. This is a paradigm that combines "white-box" logic probing with "black-box" behavioral observation, and its detection scope is no longer limited to existing human knowledge. 2. The root cause of false positives / false negatives in existing technologies lies in their rudimentary judgment logic. For example, a response returning a 200 status code due to incorrect permission configuration but containing an error page might be mistakenly judged as successful; a response returning a 404 due to WAF interception might be missed. This invention does not rely on a single feature but integrates five dimensions of features, including time sequence, content, and resources, and uses an SVM-based nonlinear state classifier for judgment. This classifier learns the decision boundaries of a large number of samples and can identify complex patterns that are difficult for humans to describe. For example, it can distinguish between "successful authentication (fast response, rich content, high resource consumption)" and "system crash (slow response, empty content, abnormal resource consumption)," both belonging to the 200 status code category, thus avoiding misjudging system crash as successful authentication. Combined with a quantitative confidence scoring mechanism, this constitutes a dual mechanism to ensure high accuracy in judgment. This significantly reduces the false positive and false negative rates, upgrading vulnerability judgment results from rough qualitative conclusions to high-precision quantitative assessments, and significantly improving detection quality. 3. Existing technologies suffer from insufficient scanning depth and poor adaptability due to neglecting dynamic state transitions within the authentication process and the ease with which probe requests can be intercepted. This invention utilizes semantically preserving mutation. Because semantically preserving mutation generates a much higher proportion of effective probe requests than random mutation, it triggers more meaningful state transitions per unit time, effectively addressing complex and non-standardized modern authentication processes, resulting in better scanning efficiency and penetration. The entire process is highly automated, eliminating the need for security personnel to manually write complex, application-specific test scripts, significantly reducing operational complexity and reliance on specialized skills. Furthermore, through dynamic state machine evolution, this invention can perform scanning like drawing a map... Figure 1 In this way, we gradually explore and understand complex authentication processes. Whether it's a simple one-step login or a complex OAuth 2.0 authorization code process, its inherent state transitions (such as from "obtaining an authorization code" to "exchanging for a token" and then to "accessing resources") are accurately modeled in ALSM. This deep understanding enables the present invention to construct probe requests that conform to specific process contexts, thereby penetrating multiple layers of protection and achieving deep scanning.

[0070] 4. Existing technologies often provide binary conclusions, failing to offer effective remediation guidance for developers. This invention provides abundant vulnerability reproduction information and root cause analysis clues, greatly improving the efficiency of security incident response and remediation, transforming passive alerts into proactive empowerment. Developers can directly use the request sequence in the report to replay it in the test environment, quickly locating which specific parameter and in which state triggered the erroneous logical branch. For example, the report might state: "The problem occurred from..." Status to The state transition was caused by the `bypass_flag=true` parameter in the second-step request, which incorrectly reset the authentication failure counter in the session. This information, precise down to the code logic level, allows for targeted troubleshooting, significantly shortening the Mean Time To Repair (MTTR) and reducing the risk of business disruption due to security incidents. In summary, this invention, through its unique technical solution, produces beneficial technical effects compared to existing technologies in four aspects: detection range (discovering unknown vulnerabilities), detection quality (reducing false positive rate), detection capability (adaptive and in-depth), and practical value (providing remediation clues). It provides a more intelligent, accurate, and efficient proactive detection tool for network security defense systems.

[0071] The following example illustrates the security of a fintech company's core API gateway, with its login authentication endpoint at https: / / api.financecorp.com / v1 / auth / token. The company claims to employ an industry-leading "adaptive multi-factor authentication" mechanism, capable of resisting various automated attacks. Before project deployment, this invention was used to conduct a deep and comprehensive security assessment of its authentication module to identify any potential, unforeseen authentication bypass risks.

[0072] The specific implementation steps are as follows: Phase 1: Multi-dimensional initial state perception and vector extraction (establishing scientific baseline vectors) Silent observation and low-intensity detection: The scanning engine first sends 100 empty POST requests (without body) and 100 random string POST requests (body is {"data":"random_string_xyz"}) to https: / / api.financecorp.com / v1 / auth / token, strictly controlling the request rate to no more than 1 request per second. Data acquisition and calculation: Temporal characteristics According to engine statistics, the average response latency for an empty request is... Average response latency of invalid random requests . Content Features Statistical analysis of HTTP status codes yielded the following status code distribution values. This indicates that the vast majority of invalid requests were blocked by format validation. Response body length The frequency of occurrence of the "Invalid request format" error semantic tag in the response body is highly concentrated in the [180, 220] byte range. The NLP model identifies the frequency of occurrence of this error in the response body. . Resource characteristics By analyzing network traffic through a side-channel plugin, it was estimated that each invalid request only triggered approximately [number missing] cases. This is a database connection query (used for recording audit logs). Constructing the initial state vector: Based on the above data, construct a baseline vector representing the "rejection" or "silence" state of the target system: This baseline will serve as the benchmark for all subsequent state determinations. Phase Two: Dynamic Construction and Evolution of the Authentication Logic State Machine (ALSM) (Core Modeling) Core state definition: The engine loads a preset set of basic logic states. . Iterative probing and state mapping: Iteration 1 (Exploring the legitimate path): The system engine generates a legitimate login request, i.e., a legitimate authentication request. After sending, a response was received. Calculate the difference vector. The input is then fed into an SVM classifier, which determines the category of the response based on the boundaries it has learned. Authentication successful. The first directed edge has been created in ALSM. . This iteration sends a valid authentication request that has not been disturbed, and the non-linear state classifier outputs the corresponding new logical state. At this point, it remains in the default idle state. Using this new logical state as the current state and this new logical state as the target state, create a basic directed edge in the state transition graph that points from the current state to the target state. This completes the construction of the basic legal path and generates the initial state transition diagram.

[0073] After establishing the basic legal path, subsequent iterations still use the default idle state as the initial current state and enter the deep exploration phase based on the mutation request vector. By continuously generating mutation request vectors, new target states are explored, and directed edges are continuously created iteratively in the state transition graph.

[0074] Iteration 2 (Semantic Preservation Mutation): To detect the existence of hidden logic, the engine performs semantic preservation mutation, generating a seemingly valid mutation request vector that contains additional parameters. = \{\text{POST}, H, \{\text{"user":"test", "pass":"test123", "is_internal":"true"}\}, C\}. This request has perfectly correct JSON syntax, but its intent is to probe for a backdoor parameter intended for internal calls. An abnormal state was detected: Send Then, the system returns an exception response vector: The classifier analyzes the difference vector at this point. It was found that although its status code was 401 (usually representing unauthorized), the response body length and latency were similar to the typical average response latency. The error is inconsistent and the resource consumption is extremely low. Based on the comprehensive judgment, it belongs to a special "internal interface rejection" state, and the engine instantiates it into a new state. Create a second directed edge in ALSM. . Iteration 3 (Critical Path Discovery): The engine anticipates that certain systems may experience state contamination after receiving a specific sequence of requests. Therefore, it designs a second mutated request vector. Its body is {"user":"test"} (containing only the username). Send this request to the user in the specified location. The system unexpectedly returned the state context (by reusing or simulating the cookie from the previous request). The response is completely consistent with a successful login, and the classifier determines its status as [missing information]. Creating key edges in ALSM Thus, a complete, unexpected, and abnormal path has been established. Dynamically constructed: . Phase 3: Bypass vulnerability identification based on path anomaly analysis (vulnerability confirmation) Suspicious path identification: The engine's vulnerability assessment module automatically searches for the above-mentioned paths in ALSM. The path starts from... We set off, passing through non- intermediate state Finally arrived This perfectly matches the definition of a vulnerability path. Confidence score calculation: Calculate path delay deviation The total time taken for the path is approximately the sum of the two requests. . . Calculate the entropy of the state sequence The intermediate state sequence is The probability is 1, Shannon entropy . Calculate the change in resource consumption The resource consumption after the path is executed is 20. . Calculate confidence score Set weights ; but .

[0075] Vulnerability Assessment and Reporting: At this point, the preset threshold θ = 5.0. Since 13.457 > 5.0, the engine has identified an extremely high-risk authentication bypass vulnerability. The final report not only explicitly states the existence of the vulnerability but also provides a complete list of the request sequence that triggered it, in the form of a reproduction guide. and The detailed information (Headers and Cookies), as well as the corresponding state transitions at each step, clearly reveals the unprecedented logical flaw that "by carrying the is_internal parameter to disguise an internal request as being rejected, and then sending a request containing only the username, one can bypass password verification." Through the practice of this embodiment, a zero-day authentication bypass vulnerability deeply hidden in the business logic layer was discovered. The entire process requires no prior vulnerability intelligence and relies entirely on the system's own dynamic behavior modeling and analysis. Compared to traditional scanners that can only verify known weaknesses, this invention provides the ability to discover unknown threats and high-precision detection, fully demonstrating its value and practicality in protecting critical business systems from advanced logic attacks.

[0076] Example 2: Based on the same inventive concept, this invention also provides a vulnerability scanning system for authentication bypass detection, such as... Figure 2 As shown, it includes: The baseline construction module is used to perform basic state awareness on the target authentication endpoint, obtain multi-dimensional state features, and construct a baseline vector. The mutation response module is used to perform semantically preserved perturbation on legitimate authentication requests, generate a mutated request vector, and obtain the response vector of the target authentication endpoint under the mutated request vector. The mapping module is used to input the difference vector between the response vector and the baseline vector into a nonlinear state classifier for mapping, so as to obtain a new logical state of the target authentication endpoint. The state mechanism component module is used to iteratively create directed edges in the state transition graph based on the new logical state in order to dynamically construct the authentication logic state machine; The vulnerability determination module is used to identify abnormal paths in the authentication logic state machine using a graph theory path search algorithm, so as to determine authentication bypass vulnerabilities.

[0077] In this embodiment, the mutation response module is specifically used for: The legitimate authentication request is vectorized to obtain a legitimate request vector; the legitimate request vector includes the request method, request header, request body and request context; While maintaining syntactic validity, the request body is subjected to semantic preservation perturbation to generate a mutated request vector; the semantic preservation perturbation includes adding, deleting or modifying specific fields.

[0078] In this embodiment, the mapping module is specifically used for: A support vector machine-based classifier is used as a nonlinear state classifier; The nonlinear state classifier is used to map the difference vector between the response vector and the baseline vector to a preset set of basic logical states to obtain the new logical state of the target authentication endpoint. The basic logical state set includes: idle state, verification state, authentication successful state, authentication rejected state, and authentication abnormal state.

[0079] In this embodiment, the state mechanism module is specifically used for: Using the new logical state as the target state, a directed edge is created in the state transition graph pointing from the current state to the target state; the directed edge carries the identifier of the mutation request vector; The current target state is used as the current state of the next iteration. Based on the new mutation request vector, the new target state is repeatedly obtained, and directed edges are created iteratively until the iteration termination condition is met, so as to dynamically construct the authentication logic state machine. In this embodiment, the iteration termination condition includes: no new target state is generated in the state transition graph after multiple consecutive iterations; or the state transition graph already contains the complete path from the non-authentication success state to the authentication success state.

[0080] In this embodiment, the vulnerability determination module includes: The path search unit is used in the authentication logic state machine to perform path search using a graph theory path search algorithm, starting from the idle state and ending at the successful authentication state, to obtain all reachable paths to the destination. An anomaly identification unit is used to identify, among all reachable paths, a path that reaches the authentication success state through at least one intermediate state as an anomaly path; the intermediate states include authentication rejection state and authentication anomaly state; The calculation unit is used to calculate the confidence level of the abnormal path and obtain a confidence score; The determination unit is used to determine that the target authentication endpoint has an authentication bypass vulnerability when the confidence score exceeds a preset threshold.

[0081] In this embodiment, the computing unit is specifically used for: The normalized difference between the total response delay of the abnormal path and the baseline average response delay is calculated to obtain the path delay deviation. Calculate the Shannon entropy of the intermediate states in the abnormal path to obtain the state sequence entropy; Calculate the difference between the resource consumption during the execution of the abnormal path and the basic resource consumption to obtain the change in resource consumption; By using preset weighting coefficients, the path delay deviation, the state sequence entropy, and the resource consumption change are weighted and fused to calculate the confidence score of the abnormal path.

[0082] In this embodiment, the baseline construction module is specifically used for: Without triggering valid authentication logic, multiple basic requests are sent to the target authentication endpoint to perform basic state awareness and obtain basic output responses; the basic requests include empty requests and invalid credential requests. Extract the multidimensional state features of the basic output response, and construct a baseline vector based on the multidimensional state features; the multidimensional state features include temporal features, content features, and resource features.

[0083] In this embodiment, the timing feature is the basic average response latency of the target authentication endpoint; the content feature includes the HTTP status code distribution, response body length range, and frequency of occurrence of error semantic tags; and the resource feature is the database interaction increment generated by the target authentication endpoint when processing requests.

[0084] Example 3 like Figure 3 As shown, the present invention also provides an electronic device, which may be a computer device, a microcontroller device, a smart mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, processor, and transceiver component are connected via a bus; the memory can be used to store executable programs, and an exemplary executable program may include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be accessed and / or modified when instructions are executed.

[0085] The processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, and it is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in the storage medium to implement the corresponding method flow or corresponding function, so as to implement the steps of a vulnerability scanning method for authentication bypass detection in the above embodiments.

[0086] Example 4 Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). This readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the storage medium here can include both built-in storage media within the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. Loading and executing one or more instructions stored in the storage medium by the processor can implement the steps of a vulnerability scanning method for authentication bypass detection in the above embodiments.

[0087] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0088] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0089] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0090] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims of the present invention.

Claims

1. A vulnerability scanning method for authentication bypass detection, characterized in that, include: Basic state awareness is performed on the target authentication endpoint to obtain multi-dimensional state features in order to construct a baseline vector; A semantically preserving perturbation is performed on the legitimate authentication request to generate a mutated request vector, and the response vector of the target authentication endpoint under the mutated request vector is obtained; The difference vector between the response vector and the baseline vector is input into a nonlinear state classifier for mapping to obtain the new logical state of the target authentication endpoint; Based on the new logical state, directed edges are iteratively created in the state transition graph to dynamically construct the authentication logic state machine; In the authentication logic state machine, a graph theory path search algorithm is used to identify abnormal paths in order to determine authentication bypass vulnerabilities.

2. The method as described in claim 1, characterized in that, The step of semantically preserving perturbation of legitimate authentication requests to generate mutated request vectors includes: The legitimate authentication request is vectorized to obtain a legitimate request vector; the legitimate request vector includes the request method, request header, request body and request context; While maintaining syntactic validity, the request body is subjected to semantic preservation perturbation to generate a mutated request vector; the semantic preservation perturbation includes adding, deleting or modifying specific fields.

3. The method as described in claim 1, characterized in that, The step of mapping the difference vector between the response vector and the baseline vector into a nonlinear state classifier to obtain a new logical state of the target authentication endpoint includes: A support vector machine-based classifier is used as a nonlinear state classifier; The nonlinear state classifier is used to map the difference vector between the response vector and the baseline vector to a preset set of basic logical states to obtain a new logical state of the target authentication endpoint. The basic logical state set includes: idle state, verification state, authentication successful state, authentication rejected state, and authentication abnormal state.

4. The method as described in claim 3, characterized in that, The step of iteratively creating directed edges in the state transition graph based on the new logical state to dynamically construct the authentication logic state machine includes: Using the new logical state as the target state, a directed edge is created in the state transition graph pointing from the current state to the target state; the directed edge carries the identifier of the mutation request vector; The current target state is used as the current state for the next iteration. Based on the new mutation request vector, the new target state is repeatedly obtained, and directed edges are created iteratively until the iteration termination condition is met, so as to dynamically construct the authentication logic state machine.

5. The method as described in claim 4, characterized in that, The iteration termination conditions include: no new target state is generated in the state transition graph after multiple consecutive iterations; or the state transition graph already contains the complete path from the non-authentication success state to the authentication success state.

6. The method according to any one of claims 3-5, characterized in that, In the authentication logic state machine, a graph theory path search algorithm is used to identify abnormal paths in order to determine authentication bypass vulnerabilities, including: In the authentication logic state machine, starting from the idle state and ending from the successful authentication state, a graph theory path search algorithm is used to search for paths to obtain all reachable paths to the destination. Among all paths reachable from the destination, a path that reaches the authentication success state through at least one intermediate state is identified as an abnormal path; the intermediate states include authentication rejection state and authentication abnormal state. The confidence score is calculated for the abnormal path. When the confidence score exceeds a preset threshold, it is determined that the target authentication endpoint has an authentication bypass vulnerability.

7. The method as described in claim 6, characterized in that, The process of calculating the confidence score for the abnormal path includes: The normalized difference between the total response delay of the abnormal path and the baseline average response delay is calculated to obtain the path delay deviation. Calculate the Shannon entropy of the intermediate states in the abnormal path to obtain the state sequence entropy; Calculate the difference between the resource consumption during the execution of the abnormal path and the basic resource consumption to obtain the change in resource consumption; By using preset weighting coefficients, the path delay deviation, the state sequence entropy, and the resource consumption change are weighted and fused to calculate the confidence score of the abnormal path.

8. The method according to any one of claims 1-5, characterized in that, The basic state awareness of the target authentication endpoint, to obtain multi-dimensional state features, to construct a baseline vector, includes: Without triggering valid authentication logic, multiple basic requests are sent to the target authentication endpoint to perform basic state awareness and obtain basic output responses; the basic requests include empty requests and invalid credential requests. Extract the multidimensional state features of the basic output response, and construct a baseline vector based on the multidimensional state features; the multidimensional state features include temporal features, content features, and resource features.

9. The method as described in claim 8, characterized in that, The timing feature is the basic average response latency of the target authentication endpoint; the content features include the distribution of HTTP status codes, the range of response body lengths, and the frequency of occurrence of error semantic tags; the resource feature is the incremental database interaction generated by the target authentication endpoint when processing requests.

10. A vulnerability scanning system for authentication bypass detection, characterized in that, include: The baseline construction module is used to perform basic state awareness on the target authentication endpoint, obtain multi-dimensional state features, and construct a baseline vector. The mutation response module is used to perform semantically preserved perturbation on legitimate authentication requests, generate a mutated request vector, and obtain the response vector of the target authentication endpoint under the mutated request vector. The mapping module is used to input the difference vector between the response vector and the baseline vector into a nonlinear state classifier for mapping, so as to obtain a new logical state of the target authentication endpoint. The state mechanism component module is used to iteratively create directed edges in the state transition graph based on the new logical state in order to dynamically construct the authentication logic state machine; The vulnerability determination module is used to identify abnormal paths in the authentication logic state machine using a graph theory path search algorithm, so as to determine authentication bypass vulnerabilities.

Images