Safety detection method, device, electronic device and computer-readable storage medium

Abstract

The embodiment of the present invention discloses a security detection method, device, electronic equipment, and computer-readable storage medium. The method includes: obtaining request data, evaluating the request data according to preset evaluation rules, and obtaining the request data evaluation Score; calculate the cumulative evaluation score of the requested data on the preset feature dimension within the first preset time period of a certain computing node; when the cumulative evaluation score is higher than the preset threshold corresponding to a certain feature dimension, execute the The preset security operation corresponding to the feature dimension. This technical solution can effectively detect and automatically intercept malicious requests even when they do not completely match attack requests, which enhances WAF's ability to identify and intercept malicious requests, improves the automation of WAF, and reduces labor costs. put in.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of network security, and in particular to a security detection method, device, electronic equipment, and computer-readable storage medium. Background technique [0002] With the development of Internet technology, web applications are becoming more and more abundant, but at the same time, web servers have gradually become the main attack targets due to their powerful computing power, processing performance and high value, such as SQL injection, web page tampering, web page Troubleshooting, etc. Security incidents occur frequently. A website application-level intrusion prevention system (Web Application Firewall, WAF) that works at the application layer and can solve web application security problems that traditional firewalls are unable to do anything about comes into being. [0003] Before attacking a certain system, most attackers need to conduct vulnerability testing to supplement e...

AI Technical Summary

Problems solved by technology

Such requests will have many adverse effects on the web system and subsequent data analysis, such as: 1. Vulnerabilities may be discovered by attackers and exploited; 2. A large number of invalid requests occupy the normal processing resources of the business system; 3. Contaminate business data , bringing unpredictable consequences; 4. The business system generates a large number of error alarms, resulting in the flooding of error alarms that originally needed attention; 5. Pollution of request log data, affecting modeling and analysis of business based on log data

The existing WAF configuration rules based on payload matching can intercept some malicious requests, but because the attack requests carry too many malicious payload PAYLOAD variants, it is impossible to intercept them all. Therefore, there is an urgent need for an attack that does not require an exact match to be effective against malicious requests. interception scheme

Images