Method, device and storage medium for analyzing security vulnerabilities of web application

Abstract

The application relates to a security vulnerability analysis method, device and equipment of a Web application and a storage medium. The method comprises the following steps: acquiring multi-modal features of a target Web application; inputting the multi-modal features, a preset vulnerability knowledge graph and feedback data into a large language model; performing joint analysis and reasoning on the multi-modal features by using the large language model in combination with the preset vulnerability knowledge graph and the feedback data to obtain a reasoning result; generating dynamic loads based on the feedback data, the reasoning result and a preset attack mode library to obtain variant loads; performing automatic penetration testing on the variant loads to obtain a penetration testing result; performing vulnerability verification and analysis on the penetration testing result to obtain a vulnerability verification result; constructing an attack chain based on the vulnerability verification result to obtain attack chain link information; and performing risk assessment based on the attack chain link information to obtain a risk assessment result. The application can improve the vulnerability detection accuracy and perform more comprehensive and deeper security risk assessment on the Web application.

Description

Technical Field

[0001] This application relates to the fields of network security and intelligent penetration testing technology, and in particular to a method, apparatus, device and storage medium for analyzing security vulnerabilities in web applications. Background Technology

[0002] With the increasing complexity of web application architectures and the diversification of network attack methods, automated penetration testing and vulnerability discovery technologies have become a critical line of defense for ensuring information system security. In existing security technology systems, the generation and verification of attack payloads are core components of assessing system vulnerabilities.

[0003] Currently, mainstream web security detection and penetration testing solutions primarily rely on static rule matching and black-box fuzzing. The technical principle of static rule matching lies in building a large vulnerability signature database and attack payload set. It establishes a mapping relationship between "URL pattern - vulnerability type" through pattern matching algorithms (such as regular expressions and keyword matching), thereby identifying known vulnerabilities. Black-box fuzzing mainly utilizes automated scanning tools based on black-box testing. It collects web application URLs and parameters using web crawling technology, performs fuzzing using predefined fixed attack payloads, and determines the existence of vulnerabilities by analyzing HTTP response content.

[0004] However, in static rule-based high-level matching, the rule base relies on manual maintenance, and its update speed often lags behind the emergence of new vulnerabilities, resulting in low detection coverage. Furthermore, static rules only focus on mechanical string matching and cannot understand the deep business logic and data flow of web applications. For attack chains requiring multi-step interactions, logical vulnerabilities, and complex vulnerabilities dependent on specific application behaviors, static rule scanners cannot perform effective deep detection, leading to a high false negative rate. Traditional black-box testing typically uses predefined, fixed attack payload templates. These payloads lack variation and have obvious characteristics, making them easily identified and blocked by Web Application Firewalls (WAFs) and other protective devices. At the same time, fixed payloads are difficult to adapt to different technology stacks and business scenarios, leading to a large number of false positives or failure to reach deep vulnerabilities during testing.

[0005] It is evident that existing web security detection and penetration testing solutions generally suffer from high rates of false negatives and false positives, making it difficult to meet the actual needs of high-precision web security detection and penetration testing. Summary of the Invention

[0006] This application provides a method, apparatus, device, and storage medium for analyzing security vulnerabilities in web applications, aiming to solve the problem of high false negative and false positive rates in traditional web security detection and penetration testing schemes.

[0007] In a first aspect, embodiments of this application provide a method for analyzing security vulnerabilities in web applications, the method comprising: Obtain the multimodal features of the target web application; The multimodal features, the preset vulnerability knowledge graph, and the feedback data are input into the trained large language model; By combining the large language model with the preset vulnerability knowledge graph and the feedback data, the multimodal features are jointly analyzed and reasoned to obtain the reasoning results; Based on the feedback data, the inference results, and the preset attack pattern library, dynamic payloads are generated to obtain mutated payloads; The variable load is subjected to automated penetration testing to obtain the penetration test results; The penetration test results are then subjected to vulnerability verification and analysis to obtain vulnerability verification results. Based on the vulnerability verification results, an attack chain is constructed to obtain attack link information; A risk assessment is performed based on the attack chain information to obtain the risk assessment results.

[0008] A further technical solution is that the multimodal features include structural features, semantic features, and behavioral features, and the acquisition of the multimodal features of the target Web application includes: Obtain the access point of the target web application; The target web application is traversed and probed using an intelligent crawler and information collection module to obtain the target crawling results. The crawling results are extracted using a multidimensional heterogeneous feature extraction module to obtain structural features, semantic features, and behavioral features.

[0009] A further technical solution is that the intelligent crawler and information collection module is used to traverse and probe the target web application to obtain the target crawling results, including: By combining traditional crawler engines with headless browser engines, static content is crawled and dynamic page rendering is performed on the target web application. API interfaces are discovered through traffic interception or code analysis to obtain preliminary crawling results. The initial crawling results are processed using a strategy that combines breadth-first traversal and depth-first traversal. During the traversal, intelligent path prediction is performed to discover hidden paths, and the identified form fields are automatically filled and login sessions are maintained to obtain the target crawling results.

[0010] A further technical solution is that, before performing automated penetration testing on the variant load to obtain the penetration test results, the method further includes: The feedback data, the inference results, and the preset attack pattern library are input into the intelligent payload generation module; The intelligent payload generation module is used to construct a dictionary by combining the feedback data, the inference results, and the preset attack pattern library to obtain a dynamic dictionary; The step of performing automated penetration testing on the variant load to obtain penetration test results includes: The variant load and the dynamic dictionary are subjected to automated penetration testing to obtain the penetration test results.

[0011] A further technical solution is that the attack chain is constructed based on the vulnerability verification result to obtain attack chain information, including: Based on the vulnerability verification results, state space modeling is performed to obtain a state transition model; Based on the state transition model, an attack graph is constructed; In the attack graph, a preset search algorithm is used to find the optimal attack path from the initial state to the target risk state, and the optimal attack path is the attack link information.

[0012] A further technical solution is that, based on the vulnerability verification results, state space modeling is performed to obtain a state transition model, including: Identify the application state of the target web application, wherein the application state includes user state, session state, business state, system state, and data state; Based on the application state, state transition modeling is performed to obtain the state transition model.

[0013] A further technical solution is that, based on the state transition model, constructing the attack graph includes: Based on the state transition model, multiple nodes and the corresponding attributes of each node are defined; wherein, the multiple nodes include state nodes, attack nodes, condition nodes, target nodes and resource nodes; The connection relationships between the multiple nodes are determined to obtain the attack graph.

[0014] Secondly, embodiments of this application also provide a security vulnerability analysis apparatus for web applications, which includes a unit for performing the above-described method.

[0015] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0016] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.

[0017] This application provides a method, apparatus, device, and storage medium for analyzing security vulnerabilities in web applications. The method includes: acquiring multimodal features of a target web application; inputting the multimodal features, a preset vulnerability knowledge graph, and feedback data into a trained large language model; using the large language model in conjunction with the preset vulnerability knowledge graph and the feedback data to perform joint analysis and reasoning on the multimodal features, obtaining a reasoning result; generating a mutated payload based on the feedback data, the reasoning result, and a preset attack pattern library; performing automated penetration testing on the mutated payload, obtaining a penetration test result; performing vulnerability verification and analysis on the penetration test result, obtaining a vulnerability verification result; constructing an attack chain based on the vulnerability verification result, obtaining attack chain information; and performing a risk assessment based on the attack chain information, obtaining a risk assessment result.

[0018] This application embodiment utilizes a large language model combined with a pre-defined vulnerability knowledge graph and feedback data to perform joint analysis and reasoning on the multimodal features. Specifically, the introduction of the vulnerability knowledge graph compensates for the shortcomings of the general large language model in specific security domains, enhancing the factual basis and interpretability of the model's reasoning. Combined with feedback data, the large language model can adjust its analysis strategy based on the real-time status of the target application. This multi-dimensional joint reasoning mechanism allows the detection process to move beyond simple static rule matching, enabling more accurate identification of potential vulnerabilities and thus improving vulnerability detection accuracy. Secondly, by dynamically generating variant payloads based on the feedback data, the reasoning results, and a pre-defined attack pattern library, this dynamic generation mechanism endows penetration testing with strong environmental adaptability, generating variant payloads that better fit the target context, thereby effectively bypassing firewalls and other security devices and improving the success rate of vulnerability discovery. Furthermore, by constructing multi-step attack chains, complex business logic vulnerabilities can be discovered, enabling a more comprehensive and in-depth security risk assessment of web applications. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0022] Figure 1 A flowchart illustrating the first embodiment of a security vulnerability analysis method for web applications provided in this application; Figure 2 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0025] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0026] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0027] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0028] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0029] With the increasing complexity of web application architectures and the diversification of network attack methods, automated penetration testing and vulnerability discovery technologies have become a critical line of defense for ensuring information system security. In the existing security technology system, the generation and verification of attack payloads are the core steps in assessing system vulnerability. Currently, mainstream web security detection and penetration testing solutions mainly include static rule matching and black-box fuzzing testing, as described below: 1. Static rule-based vulnerability scanning techniques and their limitations The technical principle of static rule-based vulnerability scanners lies in building a large vulnerability signature database and attack payload set, and establishing a mapping relationship between "URL pattern - vulnerability type" through pattern matching algorithms (such as regular expressions and keyword matching) to identify known vulnerabilities.

[0030] However, this static defense approach driven by signature databases has an inherent flaw: Lagging rule base updates and low detection coverage: Static rules rely heavily on manual maintenance, and in the face of a constant stream of zero-day vulnerabilities and variant attacks, rule base updates often lag significantly. Furthermore, static rules struggle to adapt to dynamically changing web application architectures, resulting in detection accuracy typically remaining at a low level of only 40%-55%, making it difficult to address unknown security threats.

[0031] Lack of contextual understanding and intelligent reasoning capabilities: These technologies only focus on string-level matching and cannot understand the deep business logic and data flow of web applications. Static rule scanners are often helpless for attack chains that require multi-step interactions, logical vulnerabilities, and complex vulnerabilities that depend on specific application behaviors, and cannot perform effective deep detection.

[0032] 2. Automated scanning techniques based on black-box testing and their limitations Black-box testing-based automated scanning tools primarily use web crawling technology to collect the URLs and parameters of web applications, perform fuzz testing using predefined fixed attack payloads, and determine the existence of vulnerabilities by analyzing HTTP response content.

[0033] While this approach achieves some degree of test automation, it still has serious shortcomings in actual combat scenarios: Limited testing depth and high false positive rate: Traditional web crawling techniques struggle to delve into hidden attack surfaces, and due to the use of fixed attack payloads, their characteristics are easily identified and blocked by WAF (Web Application Firewall) and other protective devices. Lacking intelligent payload generation and mutation capabilities, their ability to bypass protection is very limited, and they are prone to generating a large number of false positives.

[0034] Unable to handle complex business logic testing: Black-box scanning tools typically treat web applications as "black boxes," unable to understand their internal business processes and state transitions. Therefore, for advanced vulnerabilities involving privilege escalation, business process defects, and other situations requiring an understanding of contextual states, these tools cannot execute complex, multi-step attack scenarios, resulting in significant blind spots in their detection capabilities.

[0035] To address the aforementioned issues, this application provides a method for analyzing security vulnerabilities in web applications, which can improve the accuracy of vulnerability detection and enable a more comprehensive and in-depth security risk assessment of web applications.

[0036] See Figure 1 , Figure 1 This application provides a flowchart illustrating a first embodiment of a security vulnerability analysis method for web applications. The method includes the following steps: Step 110: Obtain the multimodal features of the target web application.

[0037] Step 120: Input the multimodal features, the preset vulnerability knowledge graph, and the feedback data into the trained large language model.

[0038] Step 130: Using the large language model combined with the preset vulnerability knowledge graph and the feedback data, perform joint analysis and reasoning on the multimodal features to obtain the reasoning result.

[0039] Step 140: Based on the feedback data, the inference results, and the preset attack mode library, generate dynamic payloads to obtain mutated payloads.

[0040] Step 150: Perform an automated penetration test on the variable load to obtain the penetration test results.

[0041] Step 160: Perform vulnerability verification and analysis on the penetration test results to obtain vulnerability verification results.

[0042] Step 170: Construct the attack chain based on the vulnerability verification results to obtain attack chain information.

[0043] Step 180: Perform a risk assessment based on the attack chain information to obtain the risk assessment results.

[0044] This embodiment combines a large language model with a pre-defined vulnerability knowledge graph and feedback data to perform joint analysis and reasoning on the multimodal features. Specifically, the introduction of the vulnerability knowledge graph compensates for the shortcomings of the general large language model in specific security domains, enhancing the factual basis and interpretability of the model's reasoning. Combined with feedback data, the large language model can adjust its analysis strategy according to the real-time status of the target application. This multi-dimensional joint reasoning mechanism allows the detection process to move beyond simple static rule matching, enabling more accurate identification of potential vulnerabilities and thus improving vulnerability detection accuracy. Secondly, by dynamically generating variant payloads based on the feedback data, the reasoning results, and a pre-defined attack pattern library, this dynamic generation mechanism gives penetration testing strong environmental adaptability, generating variant payloads that better fit the target context, effectively bypassing firewalls and other security devices, and improving the success rate of vulnerability discovery. Furthermore, by constructing multi-step attack chains, complex business logic vulnerabilities can be discovered, enabling a more comprehensive and in-depth security risk assessment of web applications.

[0045] In some embodiments, before performing automated penetration testing on the mutated payload to obtain penetration test results, the method further includes: inputting the feedback data, the inference results, and a preset attack pattern library into an intelligent payload generation module; using the intelligent payload generation module to combine the feedback data, the inference results, and the preset attack pattern library to construct a dictionary, thereby obtaining a dynamic dictionary; and performing automated penetration testing on the mutated payload and the dynamic dictionary to obtain penetration test results.

[0046] In some embodiments, the multimodal features include structural features, semantic features, and behavioral features. Specifically, see the second embodiment. The second embodiment, based on the first embodiment, provides a detailed explanation of how to obtain the multimodal features of a target web application. Specifically, obtaining the multimodal features of the target web application in the second embodiment includes: Step 111: Obtain the access point of the target web application.

[0047] Step 112: Use the intelligent crawler and information collection module to traverse and probe the target web application to obtain the target crawling results.

[0048] Step 113: Use the multidimensional heterogeneous feature extraction module to extract features from the crawling results to obtain structural features, semantic features and behavioral features.

[0049] Referring to the third embodiment, which, based on the second embodiment, specifically explains how to use an intelligent crawler and information collection module to traverse and probe the target web application to obtain the target crawling results, the third embodiment includes: Step 1121: Combining traditional crawler engines with headless browser engines, perform static content crawling and dynamic page rendering interaction on the target web application, and discover API interfaces through traffic interception or code analysis to obtain preliminary crawling results.

[0050] Step 1122: Process the preliminary crawling results using a strategy that combines breadth-first traversal and depth-first traversal; during the traversal, perform intelligent path prediction to discover hidden paths, and perform automatic fill-in tests and login session maintenance on the identified form fields to obtain the target crawling results.

[0051] In conjunction with steps 1121-1122, the intelligent crawler and deep information collection algorithm used in this application will be described in detail.

[0052] The intelligent crawler and deep information collection algorithm includes a target initialization phase and an intelligent crawler execution phase.

[0053] Specifically, during the target initialization phase, domain name resolution and service discovery are performed first. The specific process for domain name resolution and service discovery can be as follows: A comprehensive DNS resolution, including A records, CNAME records, and MX records, is performed on the target domain. This is combined with various methods such as dictionary attacks, DNS brute-force attacks, and certificate transparency log analysis to deeply enumerate and discover all subdomains associated with the target. Based on this, port scanning of the target is conducted using technologies such as SYN scanning and TCP connection scanning to discover open ports. Then, banner crawling and fingerprinting technologies are used to accurately determine the service types and version information running on the open ports. In addition, it simultaneously checks whether the target is using CDN services and attempts to penetrate protection to obtain the target server's real IP address, thereby completing a comprehensive mapping of the target's basic network assets.

[0054] After completing the basic network asset mapping, the next stage is deep technology stack fingerprinting, aiming to comprehensively analyze the target's technical architecture from the application layer. This process first extracts and analyzes key fields such as Server and X-Powered-By in the HTTP response to directly obtain the technical identifiers of the web server and backend operating environment. Simultaneously, by actively constructing requests to trigger exception status codes such as 404 and 500, the characteristics of the error pages returned by the server are deeply analyzed to help infer the specific type of web server software and development framework. Based on this, further feature extraction is performed on static resource files such as CSS and JS referenced on the page. Their path structure, naming conventions, and code characteristics are used to accurately infer the frontend framework and third-party component libraries used by the target. The Cookie field in the HTTP response is also parsed simultaneously, and its naming rules, encryption algorithms, and session management mechanisms are used to infer the backend development language and mainstream framework information. In addition, by monitoring and analyzing the target's response time patterns under different requests, the hardware performance characteristics of the server and whether a load balancing strategy is configured are inferred, thereby constructing a complete profile of the target's technology stack.

[0055] During the intelligent crawler execution phase, the system primarily employs a multi-engine parallel crawling strategy and a depth-first traversal strategy. Specifically, the multi-engine parallel crawling strategy comprehensively covers different content formats of the target application. On one hand, it utilizes a traditional crawler engine based on the Scrapy framework for efficient static content scraping and supports distributed deployment to increase crawling scale. On the other hand, it combines Selenium and Chrome Headless to build a headless browser engine for in-depth parsing of page content dynamically rendered by JavaScript. During the crawling process, the system proactively discovers potential API interfaces through traffic interception and JavaScript code analysis techniques, and simultaneously simulates mobile device access to uncover mobile-specific functions and interfaces. Furthermore, the entire crawling process is equipped with an intelligent load balancing mechanism, which can reasonably allocate crawling tasks and request frequencies, ensuring data collection integrity while effectively avoiding excessive access pressure on the target server.

[0056] Furthermore, regarding the depth-first traversal strategy, firstly, a breadth-first traversal strategy is used to discover more pages and functionalities first, quickly building a complete site map. Then, a depth-first traversal strategy is combined to delve deeper into specific functional modules to uncover hidden vulnerabilities. During the traversal, the system intelligently predicts paths based on discovered URL patterns, proactively inferring and probing potential hidden paths. Simultaneously, for interactive elements on pages, it intelligently identifies form field types and automatically fills in appropriate test data. In addition, the system has robust login state maintenance capabilities, automatically handling complex login authentication processes and maintaining valid session states, thereby ensuring that the crawler can deeply access restricted areas requiring authentication, achieving comprehensive deep crawling.

[0057] In some embodiments, this application employs an intelligent payload generation algorithm based on a large language model, which utilizes the generation capabilities of the large language model to intelligently generate personalized attack payloads based on the characteristics of the target application.

[0058] The intelligent payload generation algorithm based on a large language model includes a target feature analysis stage, a payload template generation stage, and a dynamic payload generation stage.

[0059] In the target feature analysis phase, the system will conduct an in-depth analysis of the target from two core dimensions: technology stack composition and security protection mechanisms. Regarding technology stack feature extraction, the system can accurately identify the web development frameworks (such as Spring, Django, Laravel, etc.) and underlying programming languages ​​used by the target. By analyzing clues such as error messages, response characteristics, and file extensions, it can further determine the database type and version, the middleware architecture (web server and application server, etc.), and the specific version information of the third-party libraries, plugins, and components it depends on. Simultaneously, in terms of protection mechanism identification, the system constructs specific feature payload tests to identify the type of WAF (Web Application Firewall) deployed by the target and its rule characteristics, and deeply analyzes the target's user input filtering and validation logic and output content encoding and escaping mechanisms. Furthermore, the system will focus on detecting the CSRF token generation and verification rules, as well as the session ID generation algorithm and security configuration, thereby comprehensively constructing a security defense profile of the target application and providing a basis for decision-making in subsequent targeted testing.

[0060] In the payload template generation phase, the system first systematically classifies and organizes attack vectors, covering five core categories: injection attacks (such as SQL, NoSQL, command injection, etc.), cross-site attacks (such as XSS, CSRF, clickjacking), file operations (such as file upload, path traversal), logical flaws (such as privilege escalation, condition races), and information leakage (such as sensitive information, debugging information leakage), to build a complete attack testing framework. Based on this, the system designs and trains a customized large language model specifically for payload generation using the GPT-3.5 architecture. During training, 500,000 real attack payloads and their corresponding target feature data are collected to construct a high-quality dataset. Feature engineering techniques are used to transform the target features into vector representations that the model can understand. Simultaneously, a strategy combining teacher-mandated and adversarial training is employed for model optimization. Dedicated evaluation metrics are designed around dimensions such as payload effectiveness, bypass capability, and diversity, ensuring that the model can generate high-quality, highly adaptable attack payload templates.

[0061] In the dynamic payload generation phase, the system first performs refined context construction, converting target features into natural language descriptions to clarify the vulnerability type and attack target to be tested. Simultaneously, constraints such as payload length, character set, and encoding method are set. Successful payloads targeting similar targets are retrieved for reference, and practical experience from security experts is incorporated. Based on this, the system enters the payload sequence generation stage, generating an initial payload candidate set based on the constructed context and template. Nucleus Sampling technology is introduced to regulate the diversity of generated payloads. Subsequently, the generated payloads undergo rigorous syntactic correctness and executability verification to ensure their semantics are highly consistent with the attack target. While ensuring attack effectiveness, the payload length is specifically optimized to output high-quality, highly adaptable dynamic attack payloads.

[0062] In some embodiments, this application employs a multi-step attack chain construction algorithm to automatically construct complex multi-step attack chains and discover complex vulnerabilities that require multiple steps to exploit. The multi-step attack chain construction algorithm mainly includes a state space modeling stage and an attack graph construction stage. See the fourth embodiment for details, which specifically explains how to construct the attack chain based on the vulnerability verification results to obtain attack link information. The process of constructing the attack chain based on the vulnerability verification results to obtain attack link information includes: Step 171: Based on the vulnerability verification results, perform state space modeling to obtain the state transition model.

[0063] The step of performing state space modeling based on the vulnerability verification results to obtain a state transition model includes: Step 1711: Identify the application state of the target web application, wherein the application state includes user state, session state, business state, system state, and data state.

[0064] Step 1712: Based on the application state, perform state transition modeling to obtain the state transition model.

[0065] For steps 1711-1712, in the state space modeling phase, the system first performs multi-dimensional application state identification, comprehensively analyzing user states from different dimensions such as anonymous users, logged-in users, and administrators. It tracks the lifecycle changes of sessions from creation, maintenance to destruction, accurately identifies key business states such as orders, payments, and audits, and simultaneously monitors system-level states such as system operation, configuration, and errors, as well as state evolution such as data creation, modification, and deletion. Based on this, the system delves into state transition modeling, not only identifying the specific conditions and events triggering state transitions and deeply analyzing the actions and operations performed during the transition process, but also extracting strict preconditions and constraints. Simultaneously, it calculates the probability distribution of state transitions using historical data and focuses on identifying abnormal state transition paths that may harbor security risks, thereby constructing a complete and security-aware dynamic state space model.

[0066] Step 172: Construct the attack graph based on the state transition model.

[0067] The construction of the attack graph based on the state transition model includes: Step 1721: Based on the state transition model, define multiple nodes and the attributes corresponding to each node; wherein, the multiple nodes include state nodes, attack nodes, condition nodes, target nodes and resource nodes.

[0068] Step 1722: Determine the connection relationships between the multiple nodes to obtain the attack graph.

[0069] Step 173: In the attack graph, a preset search algorithm is used to find the optimal attack path from the initial state to the target risk state. The optimal attack path is the attack link information.

[0070] For steps 172-173, in the attack graph construction phase, the system first builds the foundation of the graph structure by finely defining nodes and their attributes. This includes state nodes containing state descriptions and risk scores, attack nodes containing attack types and success probabilities, condition nodes containing verification methods and difficulty levels, target nodes containing target value and detection risk, and resource nodes containing resource types and acquisition difficulty. Based on this, the system employs diverse path search and optimization algorithms to address different scenario requirements: it uses A-heuristic search based on target distance and attack cost to find the optimal path; it uses depth-first search to traverse all possible paths for comprehensive analysis; it uses breadth-first search to quickly discover the shortest attack path; it combines genetic algorithms to optimize path selection under complex constraints; and it introduces Monte Carlo tree search to effectively handle path planning problems in uncertain and dynamic environments, thereby constructing an efficient and practically valuable attack path graph.

[0071] In some embodiments, this application employs an intelligent WAF bypass algorithm. This algorithm aims to automatically identify WAF defense rules and generate effective bypass payloads. Its implementation process mainly includes two core stages: WAF fingerprint identification and dynamic payload mutation. First, in the WAF fingerprint identification stage, the system performs preliminary profiling through multi-dimensional response feature analysis (covering HTTP response headers, error pages, status code patterns, response time differences, and content identifiers). Then, combining various detection tests such as basic payload, boundary values, encoding methods, and combined attacks, it accurately infers the specific filtering logic and rules of the WAF. Based on this, the algorithm enters the dynamic payload mutation stage, focusing on semantic preservation strategies. Through techniques such as synonym replacement, syntactic equivalence conversion, logical transformation, implicit data type conversion, and execution path adjustment, the payload structure is reconstructed while ensuring the attack intent remains unchanged, thereby effectively circumventing WAF detection.

[0072] In some embodiments, this application also employs a business logic vulnerability detection algorithm. This algorithm aims to automatically discover business logic defects in web applications. Its core process includes two stages: business process modeling and abnormal scenario generation. First, in the business process modeling stage, the system identifies key business states such as orders, users, and payments, constructs a rigorous state machine model, deeply analyzes legitimate transition paths and conditions, and simultaneously investigates abnormal states, handles concurrent execution logic, and verifies cross-system state consistency, thereby establishing a normal business baseline. Based on this, the algorithm enters the abnormal scenario generation stage, specifically constructing illegal operations to detect potential vulnerabilities. Specific methods include attempting state jumps that skip intermediate steps, executing reverse operations of reverse processes, repeatedly submitting idempotency tests of single operations, creating concurrent conflicts that lead to resource contention, and using time differences for timing attacks, thereby comprehensively verifying the robustness and security of the business logic.

[0073] Based on the web application security vulnerability analysis method provided in the above embodiments, this application also provides a web application security vulnerability analysis system. This system adopts a layered microservice architecture and a high-performance computing architecture. In terms of the distributed microservice architecture, the system employs a refined service decomposition strategy, decoupling core functions such as target discovery, intelligent crawling, AI inference (encapsulating large language models and payload generation), test execution, and report generation into independent services. It achieves efficient inter-service communication through gRPC, combines message queues for asynchronous processing and task scheduling, and incorporates service discovery and dynamic load balancing mechanisms to ensure system elasticity. Regarding the high-performance computing architecture, hardware resources are configured with a GPU cluster equipped with NVIDIA RTX 4090s to accelerate AI model inference, paired with a high-performance CPU cluster to handle high-concurrency crawling and testing tasks, with each node configured with at least 64GB of memory. The storage system uses MinIO distributed storage to manage test data, utilizes Redis to cache hot data and session information, and combines PostgreSQL and Neo4j to achieve efficient persistent storage of structured data and graph data, respectively.

[0074] In some embodiments, the layered microservice architecture design provided in this application mainly includes a target discovery and identification layer, a deep information collection layer, a multimodal feature extraction layer, and an AI reasoning and decision-making layer.

[0075] Specifically, the target discovery and identification layer is primarily responsible for intelligent target discovery, supporting multiple input methods such as domain names, IP ranges, and URL lists. It simultaneously performs basic service fingerprinting, including web server type and version identification, as well as technical stack analysis of programming languages, frameworks, and databases. Building upon this, the deep information collection layer uses a deep learning-based intelligent crawler system to accurately capture JavaScript rendering and dynamic content. It then extracts information such as URL structure, parameters, form fields, and API interfaces from multiple dimensions, and deeply analyzes core business logic such as user interaction flows and state transitions. The multimodal feature extraction layer further deconstructs the collected data, extracting structured features such as HTML structure and HTTP header information, while utilizing pre-trained language models to mine deep semantic features of page content and error messages. It also analyzes behavioral features such as user interaction behavior and application response patterns. Finally, the AI ​​inference and decision-making layer, relying on a large language model engine based on the Transformer architecture, integrates the multimodal features extracted from the first three layers to intelligently generate highly targeted attack payloads and test cases. It dynamically optimizes test strategies and priorities based on target characteristics, achieving an efficient and accurate automated security testing loop.

[0076] The internal structure of the large language model engine includes multimodal input processing, feature fusion, and intelligent payload generation. Specifically, this process begins with a deep analysis of the target application, acquiring key features through three dimensions: technical identification, historical attack data extraction, and business logic analysis. After preprocessing (such as frame feature extraction, attack pattern encoding, and state transition modeling), these raw information yield frame features, sequence features, and logical relationship features. Frame features can be processed using a multi-head attention mechanism. These features are then input into the multimodal fusion layer for feature fusion processing, resulting in a multimodal fusion vector. Subsequently, the multimodal fusion vector, attack syntax templates, and bypass strategy injection information are combined and fed into the core Transformer generator. Finally, based on comprehensive contextual understanding, this generator outputs a payload sequence that meets specific requirements, thereby achieving intelligent attack payload or test case generation.

[0077] In some embodiments, system performance can also be optimized, primarily focusing on two dimensions: concurrent processing and AI models. Regarding concurrent processing, an asynchronous architecture is constructed by introducing coroutines and asynchronous I / O, coupled with task queues, worker pools, and dynamic load balancing mechanisms to improve throughput. Simultaneously, result caching, Bloom filter deduplication, and intelligent preloading strategies reduce redundant computation, ultimately achieving significant results: a 500% increase in concurrency, a 70% reduction in response time, and a 60% increase in resource utilization. In terms of AI model optimization, compression techniques such as knowledge distillation, quantization, and pruning are employed to simplify the size of large language models. TensorRT is used to accelerate GPU inference, implement batch processing and pipelined parallelism, and support dynamic model loading and unloading, thereby significantly improving model inference speed and deployment flexibility while maintaining accuracy.

[0078] Therefore, this system achieves a significant leap in both detection capability and testing efficiency by integrating large language models and multimodal data technologies. In terms of detection capability, the system can intelligently generate personalized attack payloads based on target application characteristics and automatically construct complex multi-step attack chains, effectively uncovering deep business logic vulnerabilities that are difficult for traditional tools to access. Combined with intelligent verification and continuous learning optimization mechanisms, the vulnerability detection accuracy is improved to over 92% (46.9% higher than traditional solutions), while significantly reducing the false positive rate to 8.7%. Regarding testing efficiency, the system achieves up to 98% automated detection, supports concurrent processing of 100 targets, and drastically reduces the average time for a single penetration test from 8 hours to less than 30 minutes, improving efficiency by over 94%. This significantly reduces manual intervention while greatly enhancing the system's large-scale practical processing capabilities.

[0079] Corresponding to the above-described web application security vulnerability analysis method, this application also provides a web application security vulnerability analysis device. This web application security vulnerability analysis device includes a unit for executing the above-described web application security vulnerability analysis method, and can be configured in a desktop computer, tablet computer, laptop computer, or other terminal.

[0080] like Figure 2 As shown in the figure, this application provides a computer device including a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114. Memory 113 is used to store computer programs; In one embodiment of this application, when the processor 111 executes the program stored in the memory 113, it implements the web application security vulnerability analysis method provided in any of the foregoing method embodiments, including: Obtain the multimodal features of the target web application; The multimodal features, the preset vulnerability knowledge graph, and the feedback data are input into the trained large language model; By combining the large language model with the preset vulnerability knowledge graph and the feedback data, the multimodal features are jointly analyzed and reasoned to obtain the reasoning results; Based on the feedback data, the inference results, and the preset attack pattern library, dynamic payloads are generated to obtain mutated payloads; The variable load is subjected to automated penetration testing to obtain the penetration test results; The penetration test results are then subjected to vulnerability verification and analysis to obtain vulnerability verification results. Based on the vulnerability verification results, an attack chain is constructed to obtain attack link information; A risk assessment is performed based on the attack chain information to obtain the risk assessment results.

[0081] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0082] Therefore, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, wherein when executed by a processor, the computer program implements the steps of the security vulnerability analysis method for Web applications provided in any of the foregoing method embodiments, including: Obtain the multimodal features of the target web application; The multimodal features, the preset vulnerability knowledge graph, and the feedback data are input into the trained large language model; By combining the large language model with the preset vulnerability knowledge graph and the feedback data, the multimodal features are jointly analyzed and reasoned to obtain the reasoning results; Based on the feedback data, the inference results, and the preset attack pattern library, dynamic payloads are generated to obtain mutated payloads; The variable load is subjected to automated penetration testing to obtain the penetration test results; The penetration test results are then subjected to vulnerability verification and analysis to obtain vulnerability verification results. Based on the vulnerability verification results, an attack chain is constructed to obtain attack link information; A risk assessment is performed based on the attack chain information to obtain the risk assessment results.

[0083] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0084] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0085] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0086] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0087] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0088] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0089] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Since these modifications and variations fall within the scope of the claims and their equivalents, this application also intends to include these modifications and variations.

[0090] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for analyzing security vulnerabilities in web applications, characterized in that, The method includes: Obtain the multimodal features of the target web application; The multimodal features, the preset vulnerability knowledge graph, and the feedback data are input into the trained large language model; By combining the large language model with the preset vulnerability knowledge graph and the feedback data, the multimodal features are jointly analyzed and reasoned to obtain the reasoning results; Based on the feedback data, the inference results, and the preset attack pattern library, dynamic payloads are generated to obtain mutated payloads; The variable load is subjected to automated penetration testing to obtain the penetration test results; The penetration test results are then subjected to vulnerability verification and analysis to obtain vulnerability verification results. Based on the vulnerability verification results, an attack chain is constructed to obtain attack link information; A risk assessment is performed based on the attack chain information to obtain the risk assessment results.

2. The method according to claim 1, characterized in that, The multimodal features include structural features, semantic features, and behavioral features. The acquisition of the multimodal features of the target web application includes: Obtain the access point of the target web application; The target web application is traversed and probed using an intelligent crawler and information collection module to obtain the target crawling results. The crawling results are extracted using a multidimensional heterogeneous feature extraction module to obtain structural features, semantic features, and behavioral features.

3. The method according to claim 2, characterized in that, The process of using an intelligent crawler and information collection module to traverse and probe the target web application to obtain the target crawling results includes: By combining traditional crawler engines with headless browser engines, static content is crawled and dynamic page rendering is performed on the target web application. API interfaces are discovered through traffic interception or code analysis to obtain preliminary crawling results. The initial crawling results are processed using a strategy that combines breadth-first traversal and depth-first traversal. During the traversal, intelligent path prediction is performed to discover hidden paths, and the identified form fields are automatically filled and login sessions are maintained to obtain the target crawling results.

4. The method according to claim 1, characterized in that, Before performing automated penetration testing on the variant load to obtain the penetration test results, the method further includes: The feedback data, the inference results, and the preset attack pattern library are input into the intelligent payload generation module; The intelligent payload generation module is used to construct a dictionary by combining the feedback data, the inference results, and the preset attack pattern library to obtain a dynamic dictionary; The step of performing automated penetration testing on the variant load to obtain penetration test results includes: The variant load and the dynamic dictionary are subjected to automated penetration testing to obtain the penetration test results.

5. The method according to claim 1, characterized in that, The attack chain construction based on the vulnerability verification results, to obtain attack chain information, includes: Based on the vulnerability verification results, state space modeling is performed to obtain a state transition model; Based on the state transition model, an attack graph is constructed; In the attack graph, a preset search algorithm is used to find the optimal attack path from the initial state to the target risk state, and the optimal attack path is the attack link information.

6. The method according to claim 5, characterized in that, The process of performing state space modeling based on the vulnerability verification results to obtain a state transition model includes: Identify the application state of the target web application, wherein the application state includes user state, session state, business state, system state, and data state; Based on the application state, state transition modeling is performed to obtain the state transition model.

7. The method according to claim 5, characterized in that, The construction of the attack graph based on the state transition model includes: Based on the state transition model, multiple nodes and the corresponding attributes of each node are defined; wherein, the multiple nodes include state nodes, attack nodes, condition nodes, target nodes and resource nodes; The connection relationships between the multiple nodes are determined to obtain the attack graph.

8. A security vulnerability analysis device for web applications, characterized in that, Includes a unit for performing the method as described in any one of claims 1-7.

9. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the method as described in any one of claims 1-7.

Images