CN115146272A - Vulnerability testing method and vulnerability testing device for browser - Google Patents

Abstract

The disclosure provides a vulnerability testing method and device for a browser. The vulnerability testing method comprises the following steps: selecting sample grammar data from a vulnerability grammar library, and preprocessing the sample grammar data to obtain a to-be-trained data set; training a data set to be trained by using a deep learning network model to obtain an initial sample set to be tested, wherein the initial sample set to be tested comprises a plurality of initial first samples to be tested; performing model prediction and assembly processing on at least one part of a plurality of first samples to be tested in the initial sample set to be tested to form a second sample to be tested; inputting the second sample to be detected into the browser so that the browser can analyze the second sample to be detected, and monitoring the running state of the browser; and determining the second sample to be detected as an abnormal sample under the condition that the operation of the browser is detected to have a fault, generating abnormal log data, and storing the abnormal sample and the abnormal log data. The vulnerability detection efficiency of the browser can be improved.

Description

Vulnerability testing method and vulnerability testing device for browsers

technical field

The present disclosure relates to the field of information security, and in particular, to a vulnerability testing method and a vulnerability testing device for browsers.

Background technique

With the development of network technology, more and more people understand the world through the Internet. And the most common tool that people use to get into the online world is the browser, so the security of the browser is very important. In a traditional browser vulnerability detection process, an html (hyper text markup language, hypertext markup language) file with a syntax template is usually constructed first. The random strategy generates sample sets by adding, deleting, modifying and other operations according to the grammar template. Such a large number of random operations make the generated samples have the following shortcomings in the process of browser vulnerability detection:

Test code redundancy: based on random seeds and grammar rule templates; random tests are likely to generate more duplicate codes and reduce detection efficiency.

For example, the traditional test code uses a large javascript syntax library. For example, the syntax library has the following 6 lines of code:

Var1=var1.add(1+2);

Var2 = var2.sub(obj.err.a-77623);

Var3=new array(1,2,3,4,5,6,7);

var var_rand1=var_dataview1[4];

let var_rand2 = var_string1;

var var_rand3 = var_arraybuf4[-1079235270];

Then randomly select test code from this grammar library. For example, randomly select the following:

Var1=var1.add(1+2);

Var1=var1.add(1+2);

Var1=var1.add(1+2);

However, the above-mentioned three lines of code are repeated, thus resulting in redundant test code and reducing detection efficiency. In addition, in the above-mentioned grammar library, the probability of correct grammar is relatively high. Using the correct grammar to test the browser, the browser will not crash, and it is not easy to find loopholes, which also reduces the detection efficiency.

SUMMARY OF THE INVENTION

A technical problem solved by the present disclosure is to provide a vulnerability testing method for browsers to improve detection efficiency.

According to one aspect of the present disclosure, there is provided a vulnerability testing method for browsers, including: selecting sample syntax data from a vulnerability syntax library, preprocessing the sample syntax data to obtain a data set to be trained; utilizing depth The learning network model trains the data set to be trained to obtain an initial sample set to be tested, and the initial sample set to be tested includes a plurality of initial samples to be tested; Perform model prediction and assembly processing on at least a part of the first sample to be tested to form a second sample to be tested; input the second sample to be tested into a browser so that the browser can parse the second sample to be tested, and Monitoring the running state of the browser; and determining that the second sample to be tested is an abnormal sample in the case of detecting that the browser is running faulty, generating abnormal log data, and saving the abnormal sample and the abnormality log data.

In some embodiments, the step of preprocessing the sample grammar data includes: parsing the sample grammar data and retaining the fixed label format of the sample grammar data; converting the functions and variables in the sample grammar data into The word is a unit to form the first data set, and the functions and variables in the first data set are deduplicated; the equal signs, parentheses and punctuation marks in the sample grammar data are formed into the second data set according to characters, and carry out de-duplication processing to the equal sign, brackets and punctuation marks in the second data set; and combine the first data set after de-duplication processing and the second data set after de-duplication processing, and combine the merged The data set is vectorized to generate a data set to be trained.

In some embodiments, the step of deduplicating the variables in the first data set includes: obtaining multiple variables with the same name from the first data set; if the multiple variables include the same type If the multiple variables include variables of different types, rename the variables of different types to distinguish the variables of different types.

In some embodiments, the step of using a deep learning network model to train the set of data to be trained includes: importing the set of data to be trained into a gated loop unit of the deep learning network model; and in a neural network loss function When the value of is less than a predetermined value, the data set to be trained is trained to obtain an initial sample set to be tested.

In some embodiments, the predetermined value ranges from 0.05 to 0.1.

In some embodiments, the step of performing model prediction and assembly processing on at least a part of the plurality of first samples to be tested in the initial sample set to be tested includes: taking a certain variable of the first samples to be tested as The starting character is used as the prediction starting point to predict the starting sentence; with the starting sentence as the starting point, several lines of statements are selected in turn from the initial sample set to be tested, and an attempt rule module and/or a capture rule module are added to each line of the statement; and The several lines of sentences are a unit, and the label is assembled to the unit to form the second sample to be tested.

According to another aspect of the present disclosure, a vulnerability testing apparatus for a browser is provided, comprising: a preprocessing unit, configured to select sample syntax data from a vulnerability syntax library, and preprocess the sample syntax data to obtain a set of data to be trained; a training unit, used for training the set of data to be trained by using a deep learning network model to obtain an initial set of samples to be tested, the initial set of samples to be tested includes a plurality of initial first samples to be tested; A prediction assembling unit for performing model prediction and assembling processing on at least a part of the plurality of first samples to be tested in the initial sample set to be tested to form a second sample to be tested; a monitoring unit for assembling the first samples to be tested The second sample to be tested is input into the browser, so that the browser can parse the second sample to be tested and monitor the running state of the browser; and a determination unit, configured to detect that the browser is running faulty The next step is to determine that the second sample to be tested is an abnormal sample, generate abnormal log data, and save the abnormal sample and the abnormal log data.

In some embodiments, the preprocessing unit is configured to parse the sample grammar data, retain the fixed label format of the sample grammar data, and form the functions and variables in the sample grammar data into a first word in units of words. data set, and perform deduplication processing on the functions and variables in the first data set, form a second data set according to characters in the equal sign, brackets and punctuation marks in the sample grammar data, and perform the second data set on the second data set. The equal signs, parentheses, and punctuation marks in the data set are deduplicated, and the deduplicated first data set and the deduplicated second data set are merged, and the merged data set is vectorized. to generate a set of data to be trained.

In some embodiments, the preprocessing unit is configured to obtain a plurality of variables with the same name from the first data set. If the plurality of variables include variables of the same type, perform deduplication processing on the variables of the same type, and if the plurality of variables include variables of different types, rename the variables of the different types respectively to Distinguish the different types of variables.

In some embodiments, the training unit is configured to import the data set to be trained into a gated loop unit of the deep learning network model, and in the case that the value of the neural network loss function is smaller than a predetermined value The data set is trained to obtain the initial set of samples to be tested.

In some embodiments, the predetermined value ranges from 0.05 to 0.1.

In some embodiments, the prediction assembling unit is configured to use a certain variable of the first sample to be tested as a starting character as a prediction starting point to predict a starting sentence, and using the starting sentence as a starting point, from the initial Several lines of statements are sequentially selected from the sample set to be tested, and an attempt rule module and/or a capture rule module is added to each line of statements, and the several lines of statements are used as a unit to assemble labels for the unit to form a second sample to be tested.

According to another aspect of the present disclosure, there is provided a vulnerability testing apparatus for a browser, comprising: a memory; and a processor coupled to the memory, the processor configured to The instruction executes the method as previously described.

According to another aspect of the present disclosure, there is provided a computer-readable storage medium having computer program instructions stored thereon, the computer program instructions implementing the aforementioned method when executed by a processor.

In the above vulnerability testing method, sample grammar data is selected from the vulnerability grammar database, and the sample grammar data is preprocessed to obtain a set of data to be trained; a deep learning network model is used to train the set of training data to obtain an initial set of samples to be tested, The initial sample set to be tested includes a plurality of initial samples to be tested; model prediction and assembly processing are performed on at least a part of the plurality of first samples to be tested in the initial sample set to be tested to form a second sample to be tested; The second sample to be tested is input into the browser so that the browser can parse the second sample to be tested and monitor the running state of the browser; and when it is detected that the browser is running faulty, the second sample to be tested is determined to be an abnormal sample, and generates Exception log data, and save exception samples and exception log data. This method implements vulnerability testing of browsers. Since the method obtains samples from the vulnerability grammar library and trains the samples to obtain new samples that may have vulnerabilities, using such samples for browser vulnerability testing can improve the browser's vulnerability detection efficiency.

Other features of the present disclosure and advantages thereof will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings.

Description of drawings

The accompanying drawings, which form a part of the specification, illustrate embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure.

The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, wherein:

FIG. 1 is a flowchart illustrating a vulnerability testing method for a browser according to some embodiments of the present disclosure;

FIG. 2 is a flowchart illustrating a vulnerability testing method for a browser according to other embodiments of the present disclosure;

3 is a schematic structural diagram illustrating a vulnerability testing apparatus for a browser according to some embodiments of the present disclosure;

FIG. 4 is a schematic structural diagram illustrating a vulnerability testing apparatus for a browser according to other embodiments of the present disclosure;

FIG. 5 is a schematic structural diagram illustrating a vulnerability testing apparatus for a browser according to other embodiments of the present disclosure.

Detailed ways

Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of the components and steps, the numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.

Meanwhile, it should be understood that, for the convenience of description, the dimensions of various parts shown in the accompanying drawings are not drawn in an actual proportional relationship.

The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the disclosure, its application or uses in any way.

Techniques, methods, and apparatus known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, such techniques, methods, and apparatus should be considered part of the specification.

In all examples shown and discussed herein, any specific value should be construed as illustrative only and not as limiting. Accordingly, other examples of exemplary embodiments may have different values.

It should be noted that like numerals and letters refer to like items in the following figures, so once an item is defined in one figure, it does not require further discussion in subsequent figures.

FIG. 1 is a flowchart illustrating a vulnerability testing method for a browser according to some embodiments of the present disclosure. As shown in FIG. 1 , the method includes steps S102 to S110.

In step S102, sample grammar data is selected from the vulnerability grammar database, and the sample grammar data is preprocessed to obtain a data set to be trained.

In some embodiments, the step of preprocessing the sample grammar data includes: parsing the sample grammar data, and retaining the fixed label format of the sample grammar data; forming a first data set with functions and variables in the sample grammar data in units of words , and perform deduplication processing on the functions and variables in the first data set; the equal signs, parentheses and punctuation marks in the sample grammar data are formed into a second data set according to characters, and the equal signs, parentheses in the second data set Perform deduplication processing with punctuation marks; and combine the deduplicated first data set and the deduplicated second data set, and perform vectorization processing on the combined data set to generate a to-be-trained data set. In this embodiment, through deduplication processing, the accuracy rate in the subsequent training process can be improved.

In some embodiments, the fixed tag format may include: <html> tags and/or <script>. Optionally, the fixed tag format may further include: <title> tag and/or <head> tag.

In some embodiments, the functions described above may include: function names, function methods, and function parameters.

In some embodiments, the step of deduplicating the variables in the first data set includes: obtaining multiple variables with the same name from the first data set; if the multiple variables include variables of the same type, Perform de-duplication processing on variables of the same type; and if the plurality of variables include variables of different types, rename the variables of different types to distinguish the variables of different types.

That is, for the above-mentioned multiple variables with the same name, if some variables are of the same type, remove the duplication and keep one of these variables of the same type. Variables are renamed respectively, for example, modified to variable_1, variable_2, and so on, so that different types of variables can be distinguished. In this way, the deduplication operation is realized, and data loss due to deduplication of variables of different types is also prevented.

In step S104, a deep learning network model is used to train the data set to be trained to obtain an initial sample set to be tested. The initial sample set to be tested includes an initial plurality of first samples to be tested. The first sample to be tested is the initial sample to be tested.

In some embodiments, this step S104 includes: importing the data set to be trained into the gated loop unit of the deep learning network model; and training the data set to be trained to obtain the initial value when the value of the neural network loss function is less than a predetermined value sample set to be tested. For example, the predetermined value may range from 0.05 to 0.1. For example, the predetermined value may be 0.1. Of course, those skilled in the art can understand that the predetermined value is only exemplary, and the embodiments of the present disclosure may also adopt predetermined values in other numerical ranges, and therefore, the present disclosure is not limited thereto. In this embodiment, the initial sample set to be tested generated through the training process has a high test use value.

Here, the deep learning network model may use a recurrent neural network (Recurrent Neural Network, RNN for short) model known to those skilled in the art. The RNN algorithm has been applied to fields such as text prediction, and the vulnerability fuzzing (fuzz) used here for browsers has obvious advantages. In the above steps, the batch-processed character stream data set is imported into the gated loop unit. After training, the neural network loss function value less than 0.1 is used as the training target for training, which can generate an initial value with high test use value. sample set to be tested.

In step S106, model prediction and assembly processing are performed on at least a part of the plurality of first samples to be tested in the initial sample set to be tested to form a second sample to be tested. Here, the second sample to be tested is a complete sample to be tested for vulnerability fuzzing of browsers.

In some embodiments, this step S106 includes: predicting a starting sentence with a variable of the first sample to be tested as a starting character as a prediction starting point; using the starting sentence as a starting point, sequentially selecting several lines from the initial sample set to be tested statement, add a try rule module (i.e. try{} module) and/or catch rule module (i.e. catch() module) to each line of statements; and take the several lines of statements as a unit, assemble tags (such as <html> for the unit) tag, <head> tag, <script> tag or <body> tag, etc.) to form the second sample to be tested. Here, adding a try{}catch() rule to the sample to be tested can prevent the sample from being discarded after a row fails to parse, so that the sample to be tested after training can be fully and efficiently used.

For example, in the following lines:

Line1.try{var_arraybuf1.length=1;}catch(e){}

Line2.try{var_dataview2.length=8;}catch(e){}

Line3.try{var_arraybuf2.__proto__=2.3023e-320;}catch(e){}

Line4.try{var_int2=var_int3.supportedLocalesOf(var_date1[55073]);}catch(e){}

If try{}catch() is not added, for example, Line2 is an incorrect syntax, then the browser stops parsing when it reaches the second line, and the sample is discarded, and Line3 and Line4 are no longer parsed. After adding try{}catch(), if Line2 is an incorrect syntax, the browser will give up Line2 and continue to try to parse Line3 and Line4. The sample will continue to be parsed until all grammars are complete. Therefore, adding the try{}catch() rule to the sample to be tested can avoid the problem that the sample is discarded after the parsing of a line fails.

In step S108, the second sample to be tested is input into the browser so that the browser can parse the second sample to be tested and monitor the running state of the browser.

For example, a python script can be used to monitor and keep the browser running and automatically feed the sample to be tested to the browser. Here, the python script can be a known script on the github platform, which can maintain the running state of the browser.

In step S110, in the case of detecting that the browser is running faulty, it is determined that the second sample to be tested is an abnormal sample, abnormal log data is generated, and the abnormal sample and the abnormal log data are saved.

For example, using the msec.py script in the CERT/CC (Computer Emergency Response Team/CoordinationCenter) Basic Fuzzing Framework (Basic Fuzzing Framework, referred to as BFF) framework can record the phenomenon of browser crashes and The state of each register of the CPU (central processing unit, central processing unit) at the time of the crash (these phenomena and states can be used as abnormal log data). And save this state and the POC (Proof of Concept) code that caused the browser crash to the crashed folder. In order to facilitate viewing, the naming rules can be: 1.html, 1.log; 2.html, 2.log and so on; html saves the JavaScript code (which can be used as an abnormal sample), and the log file saves the browser caused by this time. The register state of the crashed cpu (can be used as exception log data).

In some embodiments, the above test result may also be returned to the client.

So far, vulnerability testing methods for browsers according to some embodiments of the present disclosure are provided. The vulnerability testing method includes: selecting sample grammar data from a vulnerability grammar database, preprocessing the sample grammar data to obtain a data set to be trained; using a deep learning network model to train the data set to be trained to obtain an initial sample set to be tested, so The initial sample set to be tested includes a plurality of initial samples to be tested; model prediction and assembly processing are performed on at least a part of the plurality of first samples to be tested in the initial sample set to be tested to form a second sample to be tested; The second sample to be tested is input into the browser so that the browser can parse the second sample to be tested, and monitor the running state of the browser; and determine that the second sample to be tested is abnormal in the case of detecting that the browser runs faulty (eg crash) Samples, generate abnormal log data, and save abnormal samples and abnormal log data. This method implements vulnerability testing of browsers. Since the method obtains samples from the vulnerability grammar library and trains the samples to obtain new samples that may have vulnerabilities, using such samples for browser vulnerability testing can improve the browser's vulnerability detection efficiency.

In some embodiments, if a browser crash is detected, it is recorded, and the cause of the browser crash can be preliminarily analyzed. For example, since the abnormal sample and the abnormal log data are saved, you can use the browser to reopen the html file in the crashed folder for detailed analysis, analyze the cause of the browser crash, and analyze whether the crash vulnerability causes heap overflow, Whether it causes problems such as code executable.

The inventors of the present disclosure found that the prior art still has the problems of insufficient sample depth, poor aggregation of grammatical environments, and poor aggregation of grammatical rules. Here, the sample depth depends on the number of grammars in the grammar library. If the grammar number of the grammar library is relatively small, the test depth is insufficient. Poor syntactic environment aggregation: In the generated samples, the syntactic environment context relationship depends on the grammar rule template, which cannot form an effective syntactic relationship combination. Poor grammatical rules aggregation: Based on random seeds and grammatical rule templates, the variables, attributes, functional relationships, parameters, etc. generated by fuzzing with high probability cannot form correct corresponding relationships, causing browser parsing to stop and reducing detection efficiency.

However, in the above method of the embodiment of the present disclosure, using the RNN algorithm to predict can improve the accuracy of javascript grammar rules, and using a large number of samples of known vulnerabilities for training, the loss function value of the reference training condition is small (for example, the loss function of the neural network The value of the function is less than 0.1), so the training samples have a low probability of test code redundancy, insufficient sample depth, poor syntactic environment aggregation and poor syntactic rule aggregation. Therefore, the above method can solve the above problems of the prior art as much as possible . Furthermore, the training is performed based on the vulnerability library samples, and the vulnerability fuzzing can be performed by using the sample model with the vulnerability to train the predicted sample model, which can increase the probability of discovering browser vulnerabilities.

FIG. 2 is a flowchart illustrating a vulnerability testing method for a browser according to other embodiments of the present disclosure.

First, perform sample preprocessing.

For example, as shown in Figure 2, the POC sample data of the public vulnerability library is selected as the training template. For example, 4000 poc sample data is a set. When parsing the sample, keep the html sample fixed tag format, such as <html>, <title>, <head>, and <script> tags.

As shown in FIG. 2 , the variables, function names, function methods, and function parameters of js (that is, JavaScript) syntax can be composed of words as units to form a first data set, and deduplication processing is performed. The equal sign, parentheses, and punctuation marks are formed into a second data set according to characters, and deduplication is performed.

Then, as shown in FIG. 2 , the first data set and the second data set are merged into the data set and vectorized to obtain a data set to be trained, which may also be called a character sequence.

In some embodiments, one-hot encoding can be used for vectorization. E.g:

The first dataset: array1[]={var_1,var_2,var_3,var_4},

Second dataset: array2[]={'=','(',')'},

Combined to get: array[]={var_1,var_2,var_3,var_4,'=','(',')'},

vectorized array = one-hot(array).

Here, using one-hot encoding can improve the accuracy in the subsequent prediction process.

Next, as shown in Figure 2, a known recurrent neural network algorithm RNN is used for model training to obtain an initial sample set to be tested. For example, the batched character stream data set is imported into the GRU (gated recurrent unit, gated recurrent unit) gate. After training, the training completes the target when the value of the neural network loss function is less than 0.1. The target samples (ie, the initial sample set to be tested) generated in this way have high test use value.

Next, as shown in FIG. 2 , model prediction and assembly processing are performed on at least a part of the plurality of first samples to be tested in the initial sample set to be tested to form a second sample to be tested.

For example, a certain variable "var1=" (of course, other variables) of the first sample to be tested is used as the starting character to predict the starting sentence; Select several lines (for example, 1000 lines) of statements in turn, and add a try{}catch() module to each line of statements to ensure that each line of statements can be executed by the browser; and use the several lines of statements as a unit to assemble the unit <html> tag to form a complete second sample to be tested. Of course, you can also assemble <head> tags, <script> tags or <body> tags.

Next, as shown in Figure 2, use python script monitoring to keep the browser running, and automatically feed the second sample to be tested to the browser. If it is normal, the browser will be released. If a browser crash is detected, the cause of the browser crash will be recorded and the abnormal sample will be saved.

So far, vulnerability testing methods for browsers according to other embodiments of the present disclosure are provided. In this method, a large number of vulnerability poc sample data of known browsers are collected and put into the data set as the training source, the training source is imported into the deep learning machine, and the grammatical function is generated after training with the recurrent neural network algorithm and the GRU gating unit The complex initial sample set to be tested, and the try{}catch() rule is added to the initial sample to be tested to avoid the fate of the sample being discarded after a line parsing failure, so that the trained sample to be tested is fully and efficiently used, Use tags such as <html> to assemble web page models, write a python background detection module, feed the samples to be tested to the browser, retain abnormal log data and abnormal sample files after detection, generate a preliminary analysis report, and return it to the client result. The method can solve the problems of redundant test code, insufficient sample depth, poor syntactic environment aggregation, and poor syntactic rule aggregation in the prior art as much as possible during the browser vulnerability detection process, thereby improving the browser vulnerability fuzzing technology. Moreover, the above method solves the problems of blindness, insufficient detection depth and low code coverage that rely solely on random fuzzing tests in the prior art.

FIG. 3 is a schematic structural diagram illustrating a vulnerability testing apparatus for a browser according to some embodiments of the present disclosure. As shown in FIG. 3 , the vulnerability testing apparatus includes a preprocessing unit 302 , a training unit 304 , a prediction assembling unit 306 , a monitoring unit 308 and a determining unit 310 .

The preprocessing unit 302 is configured to select sample syntax data from the vulnerability syntax database, and preprocess the sample syntax data to obtain a data set to be trained.

In some embodiments, the preprocessing unit 302 may be configured to parse the sample grammar data, retain the fixed label format of the sample grammar data, form a first data set with functions and variables in the sample grammar data in units of words, and analyze the first data set for the first data set. The functions and variables in a data set are deduplicated, the equal signs, parentheses and punctuation marks in the sample grammar data are formed into a second data set according to characters, and the equal signs, parentheses and punctuation marks in the second data set are processed. Deduplication processing, and combining the deduplicated first data set and the deduplicated second data set, and performing vectorization processing on the combined data set to generate a to-be-trained data set.

In some embodiments, the preprocessing unit 302 may be configured to obtain multiple variables with the same name from the first data set. If the plurality of variables include variables of the same type, perform deduplication processing on the variables of the same type, and if the plurality of variables include variables of different types, rename the variables of the different types respectively to distinguish the variables of the different types .

The training unit 304 is configured to perform training on the data set to be trained by using the deep learning network model to obtain an initial sample set to be tested, where the initial sample set to be tested includes a plurality of initial samples to be tested.

In some embodiments, the training unit 304 may be configured to import the data set to be trained into the gated loop unit of the deep learning network model, and train the data set to be trained to obtain the initial value when the value of the neural network loss function is less than a predetermined value. sample set to be tested. For example, the predetermined numerical value ranges from 0.05 to 0.1.

The prediction assembling unit 306 is configured to perform model prediction and assembly processing on at least a part of the multiple first samples to be tested in the initial sample set to be tested to form a second sample to be tested.

In some embodiments, the prediction assembling unit 306 may be configured to use a certain variable of the first sample to be tested as a starting character as a starting point of prediction to predict a starting sentence, and use the starting sentence as a starting point to sequentially select from the initial sample set to be tested Several lines of statements, each line of statements is added with an attempt rule module and/or a capture rule module, and the several lines of statements are used as a unit, and a label is assembled for the unit to form a second sample to be tested.

The monitoring unit 308 is configured to input the second sample to be tested into the browser, so that the browser can parse the second sample to be tested, and monitor the running state of the browser.

The determining unit 310 is configured to determine that the second sample to be tested is an abnormal sample in the case of detecting a browser running failure, generate abnormal log data, and save the abnormal sample and the abnormal log data.

So far, a vulnerability testing apparatus for a browser according to some embodiments of the present disclosure is provided. The vulnerability testing device realizes the vulnerability testing of browsers. Since the vulnerability testing device obtains samples from the vulnerability grammar library and trains the samples to obtain new samples that may have vulnerabilities, using such samples for browser vulnerability testing can improve browser vulnerability detection efficiency.

FIG. 4 is a schematic structural diagram illustrating a vulnerability testing apparatus for a browser according to other embodiments of the present disclosure. The vulnerability testing apparatus includes a memory 410 and a processor 420 . in:

The memory 410 may be a magnetic disk, flash memory, or any other non-volatile storage medium. The memory is used to store the instructions in the embodiment corresponding to FIG. 1 and/or FIG. 2 .

The processor 420 is coupled to the memory 410 and may be implemented as one or more integrated circuits, such as a microprocessor or microcontroller. The processor 420 is used to execute the instructions stored in the memory, and obtain new samples that may have vulnerabilities by obtaining samples from the vulnerability grammar library and training the samples. Using such samples for browser vulnerability testing can improve browsing performance. The vulnerability detection efficiency of the device.

In some embodiments, as shown in FIG. 5 , the vulnerability testing apparatus 500 includes a memory 510 and a processor 520 . Processor 520 is coupled to memory 510 through BUS 530 . The vulnerability testing device 500 can also be connected to the external storage device 550 through the storage interface 540 to call external data, and can also be connected to the network or another computer system (not shown) through the network interface 560, which will not be described in detail here. .

In this embodiment, the data instructions are stored in the memory, the above instructions are processed by the processor, and new samples with possible vulnerabilities are obtained by obtaining samples from the vulnerability grammar library and training the samples, and such samples are used in the browser. It can improve the efficiency of browser vulnerability detection.

In some embodiments, the present disclosure also provides a computer-readable storage medium on which computer program instructions are stored, and when the instructions are executed by a processor, implement the method in the embodiment corresponding to FIG. 1 and/or FIG. 2 . step. As will be appreciated by one skilled in the art, embodiments of the present disclosure may be provided as a method, apparatus, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein .

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

So far, the present disclosure has been described in detail. Some details that are well known in the art are not described in order to avoid obscuring the concept of the present disclosure. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

While some specific embodiments of the present disclosure have been described in detail by way of examples, those skilled in the art will appreciate that the above examples are provided for illustration only, and are not intended to limit the scope of the present disclosure. Those skilled in the art will appreciate that modifications may be made to the above embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims (14)

1. A vulnerability testing method for a browser comprises the following steps:

selecting sample grammar data from a vulnerability grammar library, and preprocessing the sample grammar data to obtain a to-be-trained data set;

training the data set to be trained by using a deep learning network model to obtain an initial sample set to be tested, wherein the initial sample set to be tested comprises a plurality of initial first samples to be tested;

performing model prediction and assembly processing on at least one part of the plurality of first samples to be tested in the initial sample set to be tested to form a second sample to be tested;

inputting the second sample to be tested into a browser so that the browser can analyze the second sample to be tested and monitor the running state of the browser; and

and under the condition that the operation fault of the browser is detected, determining that the second sample to be detected is an abnormal sample, generating abnormal log data, and storing the abnormal sample and the abnormal log data.

2. The vulnerability testing method of claim 1, wherein the step of preprocessing the sample grammar data comprises:

analyzing the sample grammar data and reserving a fixed label format of the sample grammar data;

forming a first data set by taking words as units for functions and variables in the sample grammatical data, and performing duplicate removal processing on the functions and variables in the first data set;

forming a second data set by using the equal signs, the brackets and the punctuation marks in the sample grammar data according to characters, and performing de-duplication processing on the equal signs, the brackets and the punctuation marks in the second data set; and

merging the first data set after the deduplication processing and the second data set after the deduplication processing, and carrying out vectorization processing on the merged data set to generate a data set to be trained.

3. The vulnerability testing method of claim 2, wherein the step of de-duplicating the variables in the first data set comprises:

obtaining a plurality of variables with the same name from the first data set;

if the variables comprise the variables of the same type, performing duplicate removal processing on the variables of the same type; and

and if the variables comprise different types of variables, renaming the different types of variables respectively to distinguish the different types of variables.

4. The vulnerability testing method of claim 1, wherein the step of training the data set to be trained using a deep learning network model comprises:

importing the data set to be trained into a gate control cycle unit of the deep learning network model; and

and training the data set to be trained under the condition that the numerical value of the neural network loss function is smaller than a preset numerical value to obtain an initial sample set to be tested.

5. The vulnerability testing method of claim 4, wherein,

the predetermined value ranges from 0.05 to 0.1.

6. The vulnerability testing method of claim 1, wherein the step of performing model prediction and assembly processing on at least a portion of the first plurality of samples under test in the initial set of samples under test comprises:

predicting an initial statement by taking a certain variable of the first sample to be detected as an initial character as a prediction starting point;

sequentially selecting a plurality of lines of sentences from the initial sample set to be detected by taking the initial sentences as starting points, and adding an attempt rule module and/or a capture rule module to each line of sentences; and

and taking the line sentences as a unit, and assembling a label on the unit to form a second sample to be tested.

7. A vulnerability testing apparatus for a browser, comprising:

the preprocessing unit is used for selecting sample grammar data from a vulnerability grammar library and preprocessing the sample grammar data to obtain a data set to be trained;

the training unit is used for training the data set to be trained by utilizing a deep learning network model to obtain an initial sample set to be tested, and the initial sample set to be tested comprises a plurality of initial first samples to be tested;

the prediction assembling unit is used for performing model prediction and assembling processing on at least one part of the first samples to be tested in the initial sample set to be tested to form a second sample to be tested;

the monitoring unit is used for inputting the second sample to be tested into a browser so that the browser can analyze the second sample to be tested and monitor the running state of the browser; and

and the determining unit is used for determining the second sample to be detected as an abnormal sample under the condition that the operation of the browser is detected to have a fault, generating abnormal log data and storing the abnormal sample and the abnormal log data.

8. The vulnerability testing apparatus of claim 7, wherein,

the preprocessing unit is used for analyzing the sample grammar data, reserving a fixed tag format of the sample grammar data, forming a first data set by taking words as units for functions and variables in the sample grammar data, performing deduplication processing on the functions and variables in the first data set, forming a second data set by using equal signs, parentheses and punctuations in the sample grammar data according to characters, performing deduplication processing on the equal signs, the parentheses and the punctuations in the second data set, merging the first data set after the deduplication processing and the second data set after the deduplication processing, and performing vectorization processing on the merged data set to generate a data set to be trained.

9. The vulnerability testing apparatus of claim 8, wherein,

the preprocessing unit is used for acquiring a plurality of variables with the same name from the first data set. If the variables comprise the same type of variables, performing deduplication processing on the same type of variables, and if the variables comprise different types of variables, renaming the different types of variables respectively to distinguish the different types of variables.

10. The vulnerability testing apparatus of claim 7, wherein,

the training unit is used for importing the data set to be trained into a gate control cycle unit of the deep learning network model, and training the data set to be trained to obtain an initial sample set to be tested under the condition that the numerical value of a neural network loss function is smaller than a preset numerical value.

11. The vulnerability testing apparatus of claim 10, wherein,

the predetermined value ranges from 0.05 to 0.1.

12. The vulnerability testing apparatus of claim 7, wherein,

the prediction assembling unit is used for predicting an initial sentence by taking a certain variable of the first sample to be tested as an initial character as a prediction starting point, sequentially selecting a plurality of lines of sentences from the initial sample set to be tested by taking the initial sentence as the starting point, adding a trial rule module and/or a capture rule module to each line of sentence, and assembling a label to the unit by taking the plurality of lines of sentences as a unit to form a second sample to be tested.

13. A vulnerability testing apparatus for a browser, comprising:

a memory; and

a processor coupled to the memory, the processor configured to perform the method of any of claims 1-6 based on instructions stored in the memory.

14. A computer readable storage medium having stored thereon computer program instructions which, when executed by a processor, implement the method of any one of claims 1 to 6.

Images