Security test system

Abstract

To efficiently and effectively execute automatic crawling by determining whether the contents of respective Web pages in a Web site are substantially consistent with each other or not, and by identifying and grouping the Web page that is substantially consistent.SOLUTION: Pages in a subjected Web site 3 are obtained by crawling, a URL relating to a link in the obtained page is obtained, a determination on whether it is consistent with the other page is made based on a consistency determination rule 15, the URL is registered in a crawling subjected page list 14 when a determination is made that it is not consistent, each URL is set in a prompt when the number of newly registered URL reaches a predetermined number, is input to an LLM 4 for grouping, and a rule for identifying the URL involved in the same group is generated based on the grouping result so as to update the details of the consistency determination rule 15.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to application testing technology, and more particularly to a technology effective when applied to a security testing system for inspecting the presence or absence of vulnerabilities in a Web application.

Background Art

[0002] A Web application is premised on network utilization, and it is very important to inspect and test for the presence or absence of vulnerabilities from a security perspective. Various tools and services for inspecting the presence or absence of vulnerabilities in a Web application are available, and research and development are being carried out every day.

[0003] Web application security testing methods are roughly classified into SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing). In contrast to SAST, which statically analyzes source code and the like, in DAST, for a running application, a pseudo attack (inspection) request is sent from the perspective of an attacker, and it is determined whether there are vulnerabilities based on changes in the behavior of the application. Therefore, in the security testing mechanism by DAST, it is necessary to identify the pages to be attacked (inspected) in a Web application. For this purpose, the target Web application (website) is automatically or manually traversed to analyze the configuration such as links and collect page information.

[0004] As a technology related to the automatic crawling of such websites, for example, in Japanese Patent No. 7320211 (Patent Document 1), in the vulnerability inspection of a website, when automatically crawling the website, AI (Artificial Intelligence) is used to determine inspection-required functions that require vulnerability inspection, and the relevance between a plurality of executable operations executable on a web page and the inspection-required functions is determined, and the operations specified as having a high relevance are preferentially executed.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] According to the above prior art, when automatically crawling a website, among a plurality of operations executable on each web page, since it is possible to execute and crawl from the operations with high priority, for example, even in a case where an upper limit is set depending on the number of web pages to be automatically crawled, the number of hierarchies, the elapsed time, etc., it is said that it is possible to suppress omission of inspection of important functions.

[0007] Here, for example, in a website having a large number of pages corresponding to a huge number of products like an EC (Electronic Commerce) site, there are often thousands of pages generated by the same code (program) or template even for different products. In this case, it is not necessary to crawl all of these pages, and it is sufficient to crawl one page. However, according to the above prior art, if an operation having a high relevance to the inspection-required function is included in the page generated by the code, all of the large number of pages generated by the code will become targets for crawling, resulting in an enormous crawling scale, and there may also be a case where it is impossible to finish crawling when there is a limit set for crawling.

[0008] Therefore, an object of the present invention is to provide a security test system that efficiently and effectively performs automatic crawling by determining whether the contents of each web page within a website are substantially the same, identifying web pages that are substantially the same, and grouping them.

[0009] The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Means for Solving the Problems

[0010] Briefly explaining the outline of representative ones among the inventions disclosed in the present application, it is as follows.

[0011] A security test system, which is a representative embodiment of the present invention, is a security test system for inspecting the presence or absence of security vulnerabilities in a web application. It crawls and acquires pages within the web application to be inspected, acquires one or more first URLs related to links within the acquired pages, and determines whether the pages related to each of the first URLs are the same as other pages within the web application according to a preset identical determination rule. When it is determined that they are not the same, the first URL is registered in a list of pages to be crawled. A newly registered second URL in the list of pages to be crawled is set as a prompt and input into an LLM (Large Language Model) for grouping, and based on the result of the grouping, a rule for identifying URLs included in the same group is generated to update the content of the identical determination rule.

Effects of the Invention

[0012] Briefly explaining the effects obtained by representative ones among the inventions disclosed in the present application, it is as follows.

[0013] That is, according to a typical embodiment of the present invention, in the mechanism for inspecting the vulnerability of a website, it is possible to efficiently and effectively perform automatic traversal by determining whether the content of each web page in the website is substantially the same, identifying the web pages that are substantially the same, and grouping them.

Brief Description of the Drawings

[0014]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Embodiments for Carrying Out the Invention

[0015] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In all the drawings for explaining the embodiments, the same parts are generally denoted by the same reference numerals, and repeated explanations thereof are omitted. On the other hand, for the parts described with reference numerals in a certain drawing, they will not be shown again in the explanations of other drawings, but may be referred to with the same reference numerals.

[0016] <Overview> As described above, in the security test of a website by DAST, information on each web page to be inspected is collected and specified by traversing the target website. Depending on the website, for example, there may be many pages that are different pages but have substantially the same content. When automatically traversing such a website, if these pages are each traversed, the traversal time will be significantly extended. If there are restrictions on the number of pages, elapsed time, etc. for the automatic traversal, other pages may not be traversable.

[0017] However, in vulnerability testing, it is not required to cover all the pages within the target website, but rather to cover the code (program), etc. that generated each page. For example, if there are thousands of product pages sold on an e-commerce site and each of these pages is generated by the same code or template, traversing them all together once is sufficient for inspection, but it would take an enormous amount of time to try to traverse all thousands of them. However, since it is not possible to know which code each web page was generated from during the automatic traversal, ultimately, each page has to be traversed one by one.

[0018] Therefore, in the security test system according to an embodiment of the present invention, it is determined whether pages are substantially the same (pages generated from the same code, etc.) based on information such as the URL (Uniform Resource Locator) of each page and the content of the page, and substantially the same pages can be grouped to set priorities. As a result, the pages to be traversed are substantially reduced, and efficient and effective automatic traversal is realized.

[0019] On the other hand, for the pages to be inspected acquired and collected by the above automatic traversal, the user can be presented in a form such as a list of URLs or a screen transition diagram so that the user can confirm whether the traversal is sufficient including its comprehensiveness. However, as a user, it is not easy to understand what page the URL path leads to just by looking at it, and depending on the website, the number of target pages may reach several hundred, and it is difficult to confirm whether the automatic traversal is sufficient no matter in what form it is presented.

[0020] Therefore, in the security test system according to this embodiment, by labeling each Web page to be inspected acquired by automatic traversal with an appropriate name, the discriminability by the user is improved, and efficient and effective automatic traversal is realized.

[0021] <System Configuration> FIG. 1 is a diagram schematically showing a configuration example of a security test system according to an embodiment of the present invention. The security test system 1 is composed of, for example, a server device or a virtual server constructed on a cloud computing service, and a user terminal 2 such as a PC (Personal Computer) used by the user accesses it via a network such as the Internet, VPN (Virtual Private Network), or LAN (Local Area Network) not shown, using a Web browser or a dedicated application not shown.

[0022] The security test system 1 realizes various functions related to the implementation of security tests by executing, for example, an OS (Operating System), a DBMS (DataBase Management System), middleware such as a web server program, and software operating thereon, which are expanded onto the memory from a recording device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive) by a CPU (Central Processing Unit) not shown in the figure. This security test system 1 has, for example, each unit such as an inspection management unit 11, a circuit processing unit 12, and an inspection execution unit 13 implemented by software. It also has each data store such as a page list 14 to be circulated, an identical determination rule 15, a page list 16, and an inspection result 17 implemented by a database, a file table, etc.

[0023] The inspection management unit 11 has, for example, functions of a management function related to vulnerability inspection and a user interface, such as receiving input of information related to the target web site 3 to be inspected from the user via the user terminal 2, receiving input of various settings and instructions related to the implementation of the inspection, and creating a report based on the inspection result 17, which is the result of the implementation of the inspection, and presenting it to the user via the user terminal 2.

[0024] The circuit processing unit 12 automatically circulates, for example, the target web site 3 specified by the user, determines whether the detected web pages are substantially identical pages (contents) based on the identical determination rule 15, groups them according to the determination result, sets the priority of the circulation, and then registers them in the page list 14 to be circulated. It also has a function of labeling the grouped web page group with an appropriate name and outputting it as the page list 16. In addition, when performing grouping and labeling processes, an external or internal LLM (Large language Models) 4 such as ChatGPT (registered trademark) is used. Details of the processing content of the circuit processing unit 12 will be described later.

[0025] The test execution unit 13 has a function of, for example, testing each Web page registered in the page list 16 for vulnerability using the DAST method. That is, for each target Web page, when sending a request to the target website 3, it sends a pseudo attack request by, for example, inputting an invalid value into a form. Then, it analyzes whether the response from the target website 3 is an unusual response to determine whether there is a vulnerability, and records the determination result in the test result 17.

[0026] <Processing flow> 2 is a flow chart outlining an example of the flow of the automatic patrol process by the patrol processing unit 12 in one embodiment of the present invention. When the automatic patrol process is started, the patrol processing unit 12 first obtains the start page of the target Web site 3 designated by the user and registers it in the patrol target page list 14 (S01). Then, it is determined whether or not the end condition of the automatic patrol is met (S02). For example, if the patrol target page list 14 is empty, or the number of patrolled pages reaches a preset upper limit, or the elapsed time from the start of patrol reaches a preset timeout time, it is determined that the end condition is met (Yes in step S02), and the automatic patrol process is ended.

[0027] If the termination condition is not met (No in step S02), information on the page to be traversed is obtained from the traversal target page list 14 (S03), the page in question on the target website 3 is accessed, and the page is analyzed to extract information on the linked URL (S04).

[0028] FIG. 3 is a diagram showing an outline of an example of extracting a linked URL in an embodiment of the present invention. Here, it shows that the HTML (Hyper Text Markup Language) data of the target page in the target website 3 is acquired and analyzed by a known method to obtain a list of linked URLs as shown in the figure below. Note that the target page may contain a plurality of links as in the example in the figure, and among these links, there may be a group of URLs that, although having different URLs, are substantially the same (each page of the link destination is generated by the same code, etc.).

[0029] Returning to FIG. 2, after obtaining a list of linked URLs as shown in the example of FIG. 3 from the target page (step S04), it is determined whether each of these URLs has substantially the same content as other URLs, and new URLs that are not the same are extracted (S05). Then, for the new URLs, the priority of traversal is set high, and for the URLs determined to be the same, the priority of traversal is lowered (S06), and the new URLs are registered in the traversal target page list 14 (S07). Thereby, in subsequent automatic traversal, instead of checking all the URLs registered in the traversal target page list 14, it is possible to control so as to preferentially traverse the new URLs.

[0030] FIG. 4 is a diagram showing an overview of an example of extracting a new URL in an embodiment of the present invention. Here, for the list of URLs of the linked destinations obtained by analyzing the target page shown in the upper diagram, by the rule-based determination applying the same determination rule 15, it shows that the list of new URLs that are not the same shown in the lower diagram is extracted. Note that, as will be described later, in the same determination rule 15, a list representing by regular expression a URL that is regarded as substantially the same as those that match this is registered. A placeholder such as "${id}" may be used at the end of the URL in the first line of the same determination rule 15 in the figure so that variable character strings and numbers can be handled. Thereby, for example, it can be determined that all of the URLs in the 3rd to 5th lines in the URL list in the upper diagram are substantially the same as they all match the URL in the first line of the same determination rule 15 in the figure.

[0031] Returning to FIG. 2, after registering the new URL in the list of pages to be crawled 14 (step S07), it is determined whether or not a predetermined number or more of the URLs newly registered in the list of pages to be crawled 14 have been accumulated (S08). Here, for example, the number of URLs newly registered in the list of pages to be crawled 14 after the same determination rule 15 has been most recently generated / updated by the processing from step S09 and subsequent steps is targeted. If this number is less than, for example, 20 (No in step S08), it is assumed that no new page (URL) has been accumulated, and the process returns to step S02 and the subsequent processing is repeated. Note that in the repeated processing, as the URLs to be determined whether they are substantially the same content in step S05, URLs that have been determined to be new URLs that are not the same content so far and have not been grouped may be included.

[0032] On the one hand, when the number of newly registered URLs reaches, for example, 20 or more, it is assumed that a certain amount of new pages has accumulated (Yes in step S08), and in subsequent processes, the same determination rule 15 is updated based on the content of the accumulated pages. First, for each page in the page list 14 to be traversed, pages (URLs) that are presumably substantially the same are temporarily grouped using the LLM4 (S09). Furthermore, a group is selected from the temporarily grouped list, and for each pair of URLs in the group, the content of the pages is compared and verified using the LLM4 to determine whether the content is substantially the same (S10). Based on the determination result, the grouping is adjusted and finalized. In FIGS. 2 and FIG. 8 described later, the steps where the processing by the AI using the LLM4 is performed are shown shaded for ease of understanding.

[0033] The processing in this step S10, that is, the processing of comparing the content of the page to determine identity, has a high processing cost, and it may be difficult to compare and verify all combinations of URLs due to time constraints. Therefore, in this embodiment, in step S09 beforehand, URLs that seem to be the same from the appearance of the URLs are temporarily grouped to narrow down the combinations of objects to compare the content of the pages. Note that, in order to achieve further speed improvement, instead of performing the content comparison process in step S10, the temporarily grouped list obtained in step S09 may be directly adopted for subsequent processing.

[0034] FIG. 5 is a diagram showing an overview of an example of provisional grouping of pages (step S09 in FIG. 2) in one embodiment of the present invention. Here, for example, among the URLs registered in the page list 14 to be crawled that have not yet been crawled, a certain number (e.g., 20) of URLs are extracted in order from those with a high crawling priority and set in the template of the prompt input to the LLM4, thereby obtaining a prompt for causing the LLM4 to group the URLs as shown in the upper figure. By inputting this into the LLM4, an output of provisional grouping can be obtained in the form of an array of arrays (nested) as shown in the lower figure. In this embodiment, as described above, a list of URLs is set in the prompt, but in order to improve the accuracy of grouping, for example, other information such as a part of the request and response for the target URL may be additionally set.

[0035] FIG. 6 is a diagram showing an overview of an example of determination of identity by comparison of content (step S10 in FIG. 2) in one embodiment of the present invention. Here, a group (each element in the upper array) is selected from the provisional grouping list as shown in the lower figure of FIG. 5 above, and further a pair of URLs (each element in the lower array) included therein (i.e., a pair of URLs determined to be the same page by provisional grouping) is selected, and the HTML content of each URL in the pair is set in the template of the prompt, thereby obtaining a prompt for causing the LLM4 to determine the identity of the content as shown in the upper figure of FIG. 6. By inputting this into the LLM4, an output of the determination result ("true", identical) as shown in the lower figure can be obtained.

[0036] Regarding the HTML to be set in the prompt for each page to be compared, the entire HTML may be set as it is, or it may be set by extracting or omitting a part while considering the upper limit of the number of tokens in the prompt that LLM4 can interpret. For example, it can be set by filtering only important elements that are likely to show the characteristics of the content (for example, omitting the text of the HTML and using only the tag structure), and can be appropriately processed and set so that effective comparison is possible. When the response body is not HTML (such as JSON (JavaScript Object Notation) or text), these may be set in the prompt, or the response header or request may be set in addition to the response body.

[0037] Returning to FIG. 2, after determining substantially identical content (step S10) and finalizing the grouping, the same determination rule 15 is generated or updated based on the content (S11).

[0038] FIG. 7 is a diagram showing an overview of an example of generating the same determination rule 15 in one embodiment of the present invention. The upper diagram is an example of a temporary grouping list obtained by the process of step S09 in FIG. 2. And the middle diagram on the left shows the URLs determined to be substantially the same by content comparison within each group in the temporary grouping list, and the lower diagram on the left shows the rule (regular expression) for identifying these URLs (that is, determining them to be the same). This rule is added to the same determination rule 15. As described above, it may be expressed using placeholders such as "${id}" corresponding to variable strings and numbers.

[0039] On the other hand, the middle diagram on the right shows the URLs determined to be different by content comparison within each group in the temporary grouping list, and the lower diagram on the right shows the rule (regular expression) for determining these URLs to be different (identifying them as separate URLs). This rule is also added to the same determination rule 15 in the same manner.

[0040] Returning to FIG. 2, after generating and updating the same determination rule 15 (step S11), using this same determination rule 15, it is determined whether the pages newly accumulated in the page list 14 to be crawled are content that is the same based on the rule (S12). Since the content of the processing here is the same as the processing shown in the example of FIG. 4 above (step S05 in FIG. 2), a repeated explanation is omitted. For the URLs determined to be newly the same in step S12, the crawling priority is lowered and the page list 14 to be crawled is updated (S13). Then, returning to step S02, the subsequent processing is repeated until the end condition of the automatic crawling is reached.

[0041] FIG. 8 is a flowchart showing an overview of an example of the process flow of URL labeling in an embodiment of the present invention. Here, after the automatic crawling process shown in FIG. 2 above is completed, for each group of URLs in the page list 14 to be crawled that are determined to be substantially the same and grouped, using the LLM4, a name that facilitates identification by the user is attached for labeling (S21).

[0042] FIG. 9 is a diagram showing an overview of an example of URL group labeling in an embodiment of the present invention. Here, by setting a list of URLs (which may also be the same determination rule 15 represented by a regular expression) that are determined to be substantially the same and grouped into the template of the prompt input to the LLM4, a prompt for causing the LLM4 to perform labeling as shown in the upper figure is obtained. By inputting this into the LLM4, an output in the form where natural language labels (such as "top page" or "fashion category" in the example in the figure) are set for each URL as shown in the lower figure can be obtained. In this embodiment, as described above, a list of URLs is set in the prompt, but in order to improve the accuracy of labeling, for example, other information such as the page title of the target URL and a part of the request and response for the target URL may be additionally input.

[0043] 8, the group of URLs that are determined to be substantially identical are labeled using LLM4 (step S21), and then a list of pages to be visited (visited results) is output as page list 16 with labels added (S22), and the process ends. Page list 16 is presented to the user, for example, by inspection management unit 11 via user terminal 2, and the user can easily understand what type of page each page (URL) is.

[0044] <Data Structure> 10 is a diagram outlining an example of the data configuration of the crawl target page list 14 in one embodiment of the present invention. The crawl target page list 14 is a table that holds a list of pages (URLs) that are the subject of (or have been crawled) automatic crawling, and has items such as the crawl target page ID, crawl request ID, URL, method, request, response, capture, page crawl status, and page crawl priority.

[0045] The item "Crawl target page ID" holds ID information that uniquely identifies the page to be crawled. Also, the item "Crawl request ID" holds ID information that uniquely identifies a crawl request for the target website 3 that contains the target page. By making it possible to individually identify each crawl request, for example, information on the overall status of each crawl (waiting to be crawled, crawling, crawling completed, etc.) can be managed separately in a management table (not shown) or the like.

[0046] The URL item holds information about the URL of the target page. Also, each of the method, request, response, and capture items holds information about the method (GET, POST, PUT, etc.) of the target page, the request for the target page and the response thereto, and the information obtained by capturing the target page. Further, the page crawling status item holds information about the status of the crawl for the target page (waiting for crawl, in crawl, crawl completed, etc.). Also, the page crawling priority item holds information about the priority of the crawl for the target page. By prioritizing the crawling of pages with a high priority, it is possible to crawl efficiently and effectively even when there are limitations such as the number of pages or time for automatic crawling.

[0047] FIG. 11 is a diagram showing an overview of an example of the data configuration of the same determination rule 15 in an embodiment of the present invention. The same determination rule 15 is a table that holds a list of rules consisting of regular expressions, etc., for determining URLs that are considered substantially the same, and has items such as a rule ID, a crawl request ID, a determination rule, and a content crawl priority.

[0048] The rule ID item holds information about an ID that uniquely identifies each determination rule. Also, the crawl request ID item holds information about an ID that uniquely identifies the request for the crawl to which the target determination rule is applied (applied). Also, the determination rule item holds a rule consisting of a regular expression, etc., that identifies URLs that are substantially the same content. A URL that matches this regular expression is determined to be the same content. Further, the content crawl priority item holds information about the priority of the crawl of the content on the page determined to be the same by the target rule. For example, the priority of content that should be inspected preferentially, such as the payment function on an EC site, is set high.

[0049] FIG. 12 is a diagram showing an overview of an example of the data configuration of the page list 16 in one embodiment of the present invention. The page list 16 is a table that holds a list in which pages with substantially the same content obtained as a result of automatic crawling are grouped, and has items such as, for example, a page ID, a URL, and a label.

[0050] The item of the page ID holds information of an ID that uniquely identifies the target page. Also, the item of the URL holds information of the URL of the target page. Further, the item of the label holds information of a natural language label such as a name given to the target page. By referring to this label, the user can easily grasp what kind of page or content the target URL relates to, and the discriminability of the page list can be improved.

[0051] As described above, according to the security test system 1 which is one embodiment of the present invention, based on information such as the URL of each page of the target website 3 and the content of the page, it is determined whether pages are substantially the same (pages generated from the same code, template, etc.), and substantially the same pages are grouped. Thereby, the pages to be automatically crawled can be substantially reduced, and efficient and effective automatic crawling can be realized. Further, by labeling each Web page to be inspected obtained by automatic crawling with an appropriate name, the discriminability by the user can be improved, and efficient and effective automatic crawling can be realized.

[0052] Although the invention made by the present inventor has been specifically described based on the embodiments, it goes without saying that the present invention is not limited to the above embodiments, and various modifications can be made without departing from the gist thereof.

[0053] For example, in the above embodiment, when grouping substantially identical pages, a rule-based determination is made by applying the same determination rule 15 (step S05 in FIG. 2). Regarding this identity determination rule 15, it is configured to be updated based on the results of the preliminary grouping by the LLM4 and the determination of the identity of the content (steps S09 and S10 in FIG. 2) (step S11). However, a configuration may be adopted in which substantially identical pages are grouped based on the results of the preliminary grouping by the LLM4 and the determination of the identity of the content without using the rule-based determination.

[0054] In addition, the above embodiment has been described in detail for the purpose of clearly explaining the present invention, and is not necessarily limited to the one having all the configurations described. Also, it is possible to add, delete, or replace a part of the configuration of the above embodiment with other configurations.

[0055] In addition, each of the above configurations, functions, processing units, processing means, etc. may be realized in hardware by designing a part or all of them, for example, by an integrated circuit. Also, each of the above configurations, functions, etc. may be realized in software by a processor interpreting and executing a program for realizing each function. Information such as a program, table, file, etc. for realizing each function can be placed in a recording device such as a memory, hard disk, SSD, or a recording medium such as an IC card, SD card, DVD.

[0056] In addition, in each of the above figures, control lines and information lines show those considered necessary for explanation, and do not necessarily show all the control lines and information lines in actual implementation. In practice, it may be considered that almost all configurations are interconnected.

Industrial Applicability

[0057] The present invention can be used in a security test system for inspecting the presence or absence of vulnerabilities in a web application.

Explanation of Signs

[0058] 1... Security testing system, 2... User terminal, 3... Target website, 4... LLM, 11... Inspection management department, 12... Patrol processing department, 13... Inspection implementation department, 14... List of pages to be patrolled, 15... Identity determination rule, 16... Page list, 17... Inspection result

Claims

1. A security test system for inspecting the presence or absence of security vulnerabilities in a Web application, circulates through the pages within the Web application to be inspected and acquires one or more first URLs related to the links within the acquired pages, and determines whether the pages related to each of the first URLs are the same as other pages within the Web application according to a preset identical determination rule. If it is determined that they are not the same, the first URL is registered in a list of pages to be circulated, sets the second URL newly registered in the list of pages to be circulated as a prompt, inputs it into an LLM (Large Language Model) for grouping, and based on the result of the grouping, generates a rule for identifying the URLs included in the same group to update the content of the identical determination rule. A security test system.

2. In the security test system according to Claim 1, determines whether the pages related to the URLs registered in the list of pages to be circulated are the same as other pages within the Web application according to the updated identical determination rule. A security test system.

3. In the security test system according to Claim 1, for each third URL registered in the list of pages to be circulated, a circulation priority set based on the determination result of whether the page related to the third URL is the same as other pages within the Web application is also registered. A security test system.

4. In the security test system according to Claim 1, for pairs of fourth URLs included in the same group in the result of the grouping by the LLM, all or part of the HTML of each of the pairs of fourth URLs is set as a prompt and input into the LLM to determine whether the content of the pairs of fourth URLs is the same, and based on the determination result, the result of the grouping is updated. A security test system.

5. In the security test system according to Claim 1, A security testing system that sets information related to each URL group determined to be identical by the same determination rule for each URL in the page list to be circulated, inputs it into the LLM, and causes the LLM to set a label in natural language that can identify the URL group.

6. A security testing system for inspecting the presence or absence of security vulnerabilities in a web application, which circulates pages within the web application to be inspected, obtains one or more URLs related to links in the obtained pages, sets the URLs in a prompt, inputs the prompt into an LLM (Large Language Model), and causes the LLM to determine whether the page related to the URL is identical to other pages within the web application.

Images