Calling path restoration method and device

Abstract

The embodiment of the invention provides a call path restoration method and device, which can be applied to the technical field of computers, in the method, a server receives burying point information of a plurality of front-end events triggered in a front-end application and sent by terminal equipment in sequence, and then, for each front-end event, if the front-end event is a key event, a call path is restored. If yes, generating a tracking identifier of the front-end event based on the burying point information of the front-end event; triggering background key interface calling, and recording a background log associated with the background key interface calling; and combining the tracking identifier and the background log into a background event node corresponding to the front-end event. Therefore, based on the burying point information of the plurality of front-end events and the background event node corresponding to the key event in the plurality of front-end events, the whole front-end and rear-end interaction path can be restored, the integrity of calling path restoration can be improved, the attack detection accuracy can be correspondingly improved, the attack behavior occurrence position can be accurately positioned and solved, and the attack detection efficiency can be improved. The system performance is optimized, and the system stability is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a call path restoration method and device. Background Art

[0002] In the field of computer security technology, for front-end applications with transaction functions, relevant personnel usually attack various aspects of the business based on security loopholes and logical loopholes (such as tampering with the amount, stealing, etc.), causing losses to users and enterprises.

[0003] The above-mentioned attack methods, especially those based on logical vulnerabilities, usually have no obvious attack characteristics. Therefore, under the relevant technology, business operations personnel combine background logs to sort out useful information, and then restore the call path based on the sorted useful information, and conduct security threat investigation.

[0004] However, when combing data, emphasis is placed on the analysis of background logs, and the combed data is often isolated. This isolated data lacks specific analysis of user behavior, making it difficult to fully restore the overall call path, which in turn affects the accuracy of attack detection. Summary of the invention

[0005] The embodiments of the present application provide a call path restoration method and device for comprehensively restoring the entire call path and improving the accuracy of attack detection.

[0006] On the one hand, an embodiment of the present application provides a call path restoration method, which is applied to a server, and the method includes:

[0007] Receive the tracking information of multiple front-end events triggered in the front-end application and sent sequentially by the terminal device;

[0008] For each front-end event, the following operations are performed respectively: if the front-end event is a key event, a tracking identifier of the front-end event is generated based on the tracking point information of the front-end event; and, a back-end key interface call is triggered, and a back-end log associated with the back-end key interface call is recorded; the tracking identifier and the back-end log are merged into a back-end event node corresponding to the front-end event;

[0009] Based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events, the target call path is restored.

[0010] On the one hand, an embodiment of the present application provides a call path restoration device, which is applied to a server, and the device includes:

[0011] The receiving module is used to receive the tracking information of multiple front-end events triggered in the front-end application and sent sequentially by the terminal device.

[0012] The processing module is used to perform the following operations for each front-end event: if the front-end event is a key event, a tracking identifier of the front-end event is generated based on the tracking point information of the front-end event; and triggering a background key interface call and recording a background log associated with the background key interface call; merging the tracking identifier and the background log into a background event node corresponding to the front-end event.

[0013] Optionally, the processing module is further configured to:

[0014] After merging the tracking identifier and the background log into the background event node corresponding to the front-end event, the front-end event delay is determined based on the timestamp in the embedding information of the front-end event and the time when the back-end key interface call is triggered;

[0015] If the front-end event delay is greater than the preset server delay threshold, an alarm event is generated.

[0016] Optionally, the processing module is specifically used for:

[0017] When receiving the service request packet sent by the terminal device, triggering the backend key interface call;

[0018] If there is a front-end event and a tracking identifier associated with the service request packet, generating a service response packet corresponding to the service request packet;

[0019] The request time of the service request packet, the service request packet and the service response packet are recorded as background logs associated with the background key interface call.

[0020] Optionally, the processing module is further configured to:

[0021] If there is no front-end event and tracking identifier associated with the service request packet, an alarm event is generated.

[0022] Optionally, the processing module is specifically used for:

[0023] If there is a front-end event and a tracking identifier associated with the service request packet, the front-end event delay is determined based on the timestamp in the tracking point information of the front-end event and the time when the back-end key interface call is triggered;

[0024] If the front-end event delay is less than or equal to the preset server delay threshold, a service response packet corresponding to the service request packet is generated.

[0025] Optionally, the processing module is further configured to:

[0026] If there is a front-end event and a tracking identifier associated with the service request packet, the front-end event delay is determined based on the timestamp in the tracking point information of the front-end event and the time when the back-end key interface call is triggered;

[0027] If the front-end event delay is greater than the preset server delay threshold, an alarm event is generated.

[0028] Optionally, the processing module is further configured to:

[0029] After the tracking identifier and the background log are merged into a background event node corresponding to the front-end event, the tracking identifier is marked as invalid.

[0030] The restoration module is used to restore the target call path based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events.

[0031] Optionally, the restoration module is specifically used for:

[0032] Based on the tracking point information of the multiple front-end events, a front-end call path is constructed, wherein the tracking point information of each front-end event is a front-end event node in the front-end call path;

[0033] For each key event in the multiple front-end events, based on the front-end event node corresponding to the key event in the front-end call path, the background event node corresponding to the key event is associated and added to obtain the target call path.

[0034] Optionally, the restore module is also used to:

[0035] After restoring the target call path based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events, the logical vulnerabilities in the front-end application are detected based on the target call path.

[0036] In one aspect, an embodiment of the present application provides a computer device, including:

[0037] A memory for storing program instructions;

[0038] The processor is used to call the program instructions stored in the memory and execute the steps of the above-mentioned calling path restoration method according to the obtained program.

[0039] On the one hand, an embodiment of the present application provides a computer-readable storage medium, including computer-readable instructions. When a computer reads and executes the computer-readable instructions, the computer executes the steps of the above-mentioned calling path restoration method.

[0040] On the one hand, an embodiment of the present application provides a computer program product, including a computer program stored on a computer-readable storage medium, wherein the computer program includes program instructions, and when the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned calling path restoration method.

[0041] In an embodiment of the present application, by associating the front-end event with the tracking identifier and the business request packet and determining the delay of the front-end event, the difference between the delay in the previous period and the preset server delay threshold is judged, the attack behavior against the security vulnerability is quickly located and an alarm event is generated; in addition, the present application is not limited to the security issues caused by security vulnerabilities, by obtaining the front-end call path, and associating and adding the background event nodes corresponding to the key events on the basis of the front-end event nodes corresponding to the key events, the front-end and back-end interaction paths are clarified, the target call path restoration is achieved, and the attack characteristics are combined to detect logical vulnerabilities in the front-end application, maintain the user's data security, which is beneficial to protect the system from various potential attacks and improve the robustness of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0043] Figure 1 A system architecture diagram provided for an embodiment of the present invention;

[0044] Figure 2 A flowchart of a calling path restoration method provided by an embodiment of the present invention;

[0045] Figure 3 A schematic diagram of a target calling path provided by an embodiment of the present invention;

[0046] Figure 4 A flowchart of a calling path restoration method provided by an embodiment of the present invention;

[0047] Figure 5 A schematic diagram of the structure of a call path restoration device provided by an embodiment of the present invention;

[0048] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and beneficial effects of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] For ease of understanding, the terms involved in the embodiments of the present invention are explained below.

[0051] The following is a brief introduction to the system architecture diagram used in the technical solution of the embodiment of the present application. It should be noted that the system architecture diagram introduced below is only used to illustrate the embodiment of the present application and is not a limitation.

[0052] refer to Figure 1 , which is a system architecture diagram applicable to the embodiment of the present application, and the system architecture at least includes a terminal device 101 and a server 102. The terminal device 101 is pre-installed with a front-end application with a transaction function, and the terminal device 101 can be a smart phone, a smart watch, a tablet computer, a laptop computer, etc., but is not limited thereto.

[0053] The server 102 is a background server of the front-end application, and can record the logs generated by the front-end application to a local file system or a remote log server for collecting, storing and managing the background logs.

[0054] Server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms, but is not limited to these.

[0055] The method in the embodiment of the present application can be interactively executed by the terminal device 101 and the server 102. In the embodiment of the present application, the terminal device 101 and the server 102 can be directly or indirectly connected through one or more networks. The network can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network, or a wireless fidelity (Wireless-Fidelity, WIFI) network, and of course other possible networks, which are not limited in the embodiment of the present application.

[0056] The following is based on Figure 1 The system architecture shown in the figure, the embodiment of the present application provides a flowchart of calling the path restoration method, such as Figure 2 As shown, the process of the method is executed by the server and includes the following steps:

[0057] Step 201, receiving the tracking point information of multiple front-end events triggered in the front-end application and sent sequentially by the terminal device.

[0058] Specifically, front-end events refer to various interactive actions that occur on the user interface of the front-end application, such as clicking a button, entering text, moving the mouse, and other operations. A corresponding front-end tracking point can be set for each front-end event.

[0059] The tracking information of front-end events includes: timestamp, device attributes, user attributes, event attributes, channel attributes and end flag. Device attributes include terminal device ID, terminal device model, IP address, network status, etc.; user attributes include user ID, user type, etc.; event attributes include action type, such as browsing, input, click, etc.; channel attributes include channel parameters, such as third-party APP, mini-programs, etc.; the end flag is used to mark whether the front-end tracking is the end tracking.

[0060] Specifically, the tracking point information of the front-end event is encrypted with the public key and then transmitted to the server.

[0061] Step 202: for each front-end event, execute the following steps 2021 to 2023 respectively:

[0062] Step 2021: If the front-end event is a key event, a tracking identifier of the front-end event is generated based on the tracking point information of the front-end event.

[0063] Specifically, multiple front-end events include key events and non-key events, where key events refer to events that can trigger back-end key interface calls, and non-key events refer to events that cannot trigger back-end key interface calls. The tracking identifier of the front-end event is a unique identifier that can track and associate the front-end event. Through the tracking identifier, the call path of the front-end event can be constructed.

[0064] For example, in a front-end application with shopping functions, the front-end event of a user browsing a product page is not a key event; while the front-end event of a user clicking to pay is a key event that can trigger the call of a back-end key interface.

[0065] Step 2022, triggering the background key interface call and recording the background log associated with the background key interface call.

[0066] Specifically, the backend key interface refers to the application programming interface (API) in the server that responds to important business requests from the frontend application. It provides the core functions and services of the frontend application and is frequently called during the use of the frontend application. The stability of the backend key interface affects the overall stability and reliability of the system. For example, when a payment click event is triggered in a frontend application with a shopping function, the server's payment-related API will be called to implement the payment function.

[0067] In some embodiments, after triggering the backend key interface call and recording the backend log associated with the backend key interface call, the frontend event delay is determined based on the timestamp in the tracking point information of the frontend event and the time when the backend key interface call is triggered. If the frontend event delay is greater than the preset server delay threshold, an alarm event is generated.

[0068] Specifically, if the front-end event delay is greater than the preset server delay threshold, it means that there may be an attacker who intercepts the service request packet and tampers with the data before resending the packet (i.e., the risk of replay attack), which causes a time delay in triggering the backend key interface call (i.e., the front-end event delay increases), so an alarm event needs to be generated. If the front-end event delay is less than or equal to the preset server delay threshold, it can be considered safe and no alarm event needs to be generated.

[0069] For example, in a front-end application with a payment function, a user clicks on payment, and the terminal device sends the front-end event tracking information to the server. The server generates a tracking identifier for the front-end event based on the tracking information and sends a service request package. The attacker intercepts the service request package and tampers with the payment amount in the service request package and resends it to the server. After the server receives the service request package (i.e., triggers a backend key interface call) and records the backend log with the backend key interface call, it determines the front-end event delay based on the timestamp in the front-end event tracking information and the time when the backend key interface call is triggered. Since the service request package is intercepted and the payment amount is tampered with midway, the front-end event delay will be greater than the preset server delay threshold, so an alarm event is generated.

[0070] In the embodiment of the present application, judging whether the front-end event delay has timed out can make the system more efficient in troubleshooting attack behaviors, ensure user data security, and improve system stability.

[0071] In some embodiments, when the server receives a service request packet sent by a terminal device, a background key interface call is triggered; if there is a front-end event and a tracking identifier associated with the service request packet, a service response packet corresponding to the service request packet is generated; the request time of the service request packet, the service request packet and the service response packet are recorded as background logs associated with the background key interface call.

[0072] When the server receives a service request packet sent by a terminal device, it triggers a backend key interface call; if there is no front-end event and tracking identifier associated with the service request packet, an alarm event is generated.

[0073] Specifically, if the server receives a service request packet sent by the terminal device and triggers a background key interface call, there is no front-end event and tracking identifier associated with the service request packet, which means that the background key interface call does not match the front-end event, and there may be a risk of direct packet sending or replay attack.

[0074] Both direct packet sending and replay attack risks are attack behaviors targeting security vulnerabilities. In a normal system, users must interact with the front-end to send valid business request packets, and direct packet sending is an attempt to bypass the interaction step and directly send business request packets; replay attack risk refers to the attacker intercepting and resending previously intercepted business request packets to deceive the background to obtain illegal access rights. This attack method can bypass user authentication, send malicious requests or steal sensitive information, posing a threat to system security. Therefore, when direct packet sending or replay attack risks are detected, it is determined that the current background key interface call is abnormal, so an alarm event is generated.

[0075] In an embodiment of the present application, if the service request packet received by the server does not have an associated front-end event and tracking identifier, an alarm event is generated, which can monitor attack behaviors against security vulnerabilities in real time, reduce potential damage, protect user information, and reduce data leakage or tampering; compared with the strategy of issuing an alarm when a certain number of failures is exceeded in the prior art, the attack behavior can be located and the alarm can be issued more quickly; and measures can be taken before the attack spreads to protect other parts of the system, prevent system interruptions, and maintain the continuity of the entire business process.

[0076] In some embodiments, when the server receives a service request packet sent by a terminal device, a backend key interface call is triggered; if there is a frontend event and a tracking identifier associated with the service request packet, the server determines the frontend event delay based on the timestamp in the embedding information of the frontend event and the time when the backend key interface call is triggered; if the frontend event delay is less than or equal to the preset server delay threshold, a service response packet corresponding to the service request packet is generated. If the frontend event delay is greater than the preset server delay threshold, an alarm event is generated.

[0077] Specifically, if the front-end event delay is greater than the preset server delay threshold, it means that there may be an attacker who intercepts the service request packet and tampers with the data before resending the packet (i.e., the risk of replay attack), which will cause a time delay in triggering the backend key interface call (i.e., the front-end event delay increases), and then the front-end event delay is greater than the preset server delay threshold. In this case, an alarm event can be generated without responding to the service request packet. If the front-end event delay is less than or equal to the preset server delay threshold, it can be considered safe, and the service request packet is directly generated.

[0078] For example, when a user makes a payment in the front-end application, the attacker intercepts the current service request packet, modifies the payment amount, and then resends the service request packet to the server. The server determines the front-end event delay based on the timestamp in the corresponding front-end event's embedding information and the time when the service request packet is received (i.e., the time when the back-end key interface is triggered). At this point, if the front-end event delay is greater than the preset server delay threshold, it is considered that the current back-end key interface call is abnormal and an alarm event is generated.

[0079] In the embodiment of the present application, judging whether the front-end event delay has timed out can make the system more efficient in troubleshooting attack behaviors, ensure user data security, and improve system stability.

[0080] Step 2023: merge the tracking identifier and the background log into a background event node corresponding to the front-end event.

[0081] In some embodiments, after the tracking identifier and the background log are merged into the background event node corresponding to the front-end event, the tracking identifier is marked as invalid. In addition, the tracking identifier can also be directly recorded in the background log, and the background log can be used as the background event node corresponding to the front-end event. This application does not make specific limitations on this.

[0082] In an embodiment of the present application, when the tracking identifier and the background log are merged into a background event node corresponding to the front-end event, they are marked as invalid, thereby avoiding confusion in the background log data caused by multiple uses of the tracking identifier, and ensuring the uniqueness of the tracking information, thereby improving the accuracy of attack behavior monitoring.

[0083] Step 203, based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events, restore the target call path.

[0084] In an embodiment of the present application, the server receives the tracking point information of multiple front-end events triggered in the front-end application and sent in sequence by the terminal device, and then for each front-end event, if the front-end event is a key event, a tracking identifier of the front-end event is generated based on the tracking point information of the front-end event; and, a back-end key interface call is triggered, and a back-end log associated with the back-end key interface call is recorded; the tracking identifier and the back-end log are merged into a back-end event node corresponding to the front-end event. In this way, based on the tracking point information of multiple front-end events and the back-end event nodes corresponding to the key events in multiple front-end events, the entire front-end and back-end interaction path (i.e., the target call path) can be restored, the integrity of the call path restoration can be improved, and the accuracy of attack detection can be correspondingly improved. When an attack occurs, it helps to accurately locate and resolve the location where the attack occurs, improve user experience, optimize system performance, and improve system stability.

[0085] In some embodiments, the server constructs a front-end call path based on the tracking information of multiple front-end events, where the tracking information of each front-end event is a front-end event node in the front-end call path; for each key event in the multiple front-end events, on the basis of the front-end event node corresponding to the key event in the front-end call path, the background event node corresponding to the key event is associated and added to obtain the target call path.

[0086] Specifically, the tool deployed on the server that can build the front-end call path can be the Urchin Tracking Manager (UTM), which is used to collect data about user access behavior and the user's behavior path on the Web or APP side; it can also be the Super Position Model (SPM), which is an identifier for locating the location of content and can collect user behavior log data at specific locations on the Web and APP sides (i.e., front-end applications) on the interface.

[0087] Through UTM or SPM, based on the tracking information of multiple front-end events, build the front-end call path, and on the basis of the front-end call path, associate and add the background event nodes corresponding to the key events to obtain the target call path.

[0088] refer to Figure 3 In the payment scenario, a tracking point is set for each front-end event of the front-end application. The front-end events triggered in sequence in the front-end application are: "Mobile phone / account input" event, "Click to obtain verification code" event, "Verification code / password input" event, "Login click event", "Face verification event", "Product page browsing" event, "Payment click" event, "Payment password / face verification" event, and "Transaction success page" event.

[0089] When each front-end event is triggered, the front-end application sends the encrypted tracking information of the front-end event to the server, among which the "mobile phone / account input" event corresponds to tracking information 1, the "click to obtain verification code" event corresponds to tracking information 2, the "verification code / password input" event corresponds to tracking information 3, the "login click event" corresponds to tracking information 4, the "face verification event" corresponds to tracking information 5, the "product page browsing" event corresponds to tracking information 6, the "payment click" event corresponds to tracking information 7, the "payment password / face verification" event corresponds to tracking information 8, and the "transaction success page" event corresponds to tracking information 9.

[0090] The tracking information of each front-end event includes: timestamp, device attributes, user attributes, event attributes, channel attributes and end identifier.

[0091] When the front-end event is a key event, after the server receives the business request package of the key event, it triggers the key API (i.e., the back-end key interface call), and then generates a tracking identifier of the key event based on the embedding information of the key event, and records the back-end log associated with the key API. The back-end log includes the tracking identifier, the business request package, and the business response package, and the tracking identifier and the back-end log are merged into the back-end event node corresponding to the front-end event. For example, among the multiple front-end events described above, "click to obtain the verification code" is a key event. After the server receives the business request package of the key event (i.e., request package 1), based on the embedding information 2 of the "click to obtain the verification code" event, it generates the tracking identifier 1 corresponding to the "click to obtain the verification code" event, and triggers the corresponding key API in the server to obtain the verification code, and then generates a business response package (i.e., response package 1) based on the verification code. The tracking identifier 1, request package 1, and response package 1 are recorded as the back-end log of the key API, and the obtained back-end log is used as the back-end event node corresponding to the "click to obtain the verification code" event.

[0092] It should be noted that among the multiple front-end events described above, "login click event", "face verification event", "payment click", and "payment password / face verification" are also key events. For these key events, the back-end event nodes can also be obtained in the manner described above, which will not be repeated here. Of course, the information of different front-end events is different, and the tracking identifiers corresponding to different key events are also different.

[0093] Finally, the tracking information of each front-end event is used as a front-end event node, and then the obtained multiple front-end event nodes are connected in sequence according to the timestamps in their respective tracking information to obtain the front-end call path. For the front-end event node corresponding to each key event in the front-end call path, the front-end event node is connected with the associated background event node to obtain the target call path.

[0094] In some embodiments, the server restores the target call path based on the tracking information of multiple front-end events and the background time nodes corresponding to the key events in the multiple front-end events, and then detects logical vulnerabilities in the front-end application based on the target call path.

[0095] In the embodiment of the present application, combining front-end events and back-end events to form a front-end and back-end interaction path helps to more comprehensively analyze user behavior, effectively defend against complex attacks, and improve the stability and reliability of the system.

[0096] In order to better explain the embodiment of the present application, the following describes a method for restoring a call path provided by the embodiment of the present application in combination with an attack detection scenario. The process of the method is as follows: Figure 1 The server execution shown includes the following steps: Figure 4 As shown:

[0097] Step 401, the server receives the tracking information of multiple front-end events triggered in the front-end application and sent sequentially by the terminal device.

[0098] Step 402: for each front-end event, execute the following steps 4021 to 4027 respectively.

[0099] Specifically, each time the tracking point information of a front-end event is received, steps 4021 to 4027 are executed for the front-end event. Alternatively, after receiving the tracking point information of multiple front-end events, steps 4021 to 4027 are executed for each front-end event. This application does not make any specific limitation on this.

[0100] Step 4021: If the front-end event is a key event, a tracking identifier of the front-end event is generated based on the tracking point information of the front-end event.

[0101] Step 4022, when receiving the service request packet sent by the terminal device, triggering the background key interface call.

[0102] Step 4023, determine whether there is a front-end event and a tracking identifier associated with the business request packet. If so, execute step 4024; otherwise, execute step 4027.

[0103] Step 4024, recording the request time of the service request packet, the service request packet and the service response packet as background logs associated with the background key interface call.

[0104] Step 4025, based on the timestamp in the tracking information of the front-end event and the time of triggering the back-end key interface call, determine the front-end event delay.

[0105] Step 4026, determine whether the front-end event delay is less than or equal to the preset server delay threshold, if so, end; otherwise, execute step 4027.

[0106] Step 4027, the server generates an alarm event.

[0107] For example, if an attacker tries to log in multiple times, the first time the login button is clicked, a front-end event is triggered and tracking information is generated. The tracking information is encrypted with a public key and uploaded to the server, and a tracking identifier for the front-end event is generated. When the front-end event is triggered, a service request packet is sent to the server, and the attacker intercepts the service request packet and cracks the account password.

[0108] For the first explosion event (i.e. the first time the account and password are entered), the server matches the front-end event and tracking identifier associated with the business request package, and determines the front-end event delay based on the timestamp in the embedding information of the front-end event and the time when the (business request package) triggers the back-end key interface call. If the delay of the front-end event exceeds the preset server delay threshold, it is considered that the current back-end key interface call is abnormal and an alarm event is generated.

[0109] When the attacker performs a second blasting event (i.e., enters the account and password for the second time), there is no front-end event and tracking identifier associated with the service request packet in the server, so it is considered a direct packet sending behavior and an alarm event is generated. Once more than 3 alarm events are generated, the current account or IP address will be banned.

[0110] In the embodiment of the present application, attack behavior monitoring is performed in combination with the tracking point information of front-end events. This can locate attack behavior and issue an alarm more quickly, thereby reducing user losses, compared with the strategy of issuing an alarm only after a certain number of failures in conventional monitoring solutions.

[0111] Step 403: construct a front-end call path based on the tracking information of multiple front-end events, wherein the tracking information of each front-end event is a front-end event node in the front-end call path.

[0112] Step 404, for each key event in the plurality of front-end events, based on the front-end event node corresponding to the key event in the front-end call path, the background event node corresponding to the key event is associated and added to obtain the target call path.

[0113] Step 405: Detect logic vulnerabilities in the front-end application based on the target call path.

[0114] In the embodiment of the present application, the front-end event is associated with the tracking identifier and the service request packet to determine the delay of the front-end event, and the difference between the delay in the previous period and the preset server delay threshold is judged to quickly locate the attack behavior against the security vulnerability and form an alarm event. In addition, the present application obtains the front-end call path, and associates and adds the background event node corresponding to the key event on the basis of the front-end event node corresponding to the key event, clarifies the front-end and back-end interaction path, realizes the target call path restoration, combines the attack characteristics, detects the logical vulnerabilities in the front-end application, maintains the user's data security, and is conducive to protecting the system from various potential attacks and improving the robustness of the system.

[0115] Based on the same technical concept, the embodiment of the present application provides a schematic diagram of the structure of calling path restoration, such as Figure 5 As shown, the data balancing device 500 includes:

[0116] The receiving module 501 is used to receive the embedding information of multiple front-end events triggered in the front-end application and sent sequentially by the terminal device.

[0117] Processing module 502 is used to perform the following operations for each front-end event: if the front-end event is a key event, generate a tracking identifier of the front-end event based on the tracking point information of the front-end event; and trigger a background key interface call and record a background log associated with the background key interface call; merge the tracking identifier and the background log into a background event node corresponding to the front-end event.

[0118] Optionally, the processing module 502 is further configured to:

[0119] After merging the tracking identifier and the background log into the background event node corresponding to the front-end event, the front-end event delay is determined based on the timestamp in the embedding information of the front-end event and the time when the back-end key interface call is triggered;

[0120] If the front-end event delay is greater than the preset server delay threshold, an alarm event is generated.

[0121] Optionally, the processing module 502 is specifically configured to:

[0122] When receiving the service request packet sent by the terminal device, triggering the backend key interface call;

[0123] If there is a front-end event and a tracking identifier associated with the service request packet, generating a service response packet corresponding to the service request packet;

[0124] The request time of the service request packet, the service request packet and the service response packet are recorded as background logs associated with the background key interface call.

[0125] Optionally, the processing module 502 is further configured to:

[0126] If there is no front-end event and tracking identifier associated with the service request packet, an alarm event is generated.

[0127] Optionally, the processing module 502 is specifically configured to:

[0128] If there is a front-end event and a tracking identifier associated with the service request packet, the front-end event delay is determined based on the timestamp in the tracking point information of the front-end event and the time when the back-end key interface call is triggered;

[0129] If the front-end event delay is less than or equal to the preset server delay threshold, a service response packet corresponding to the service request packet is generated.

[0130] Optionally, the processing module 502 is further configured to:

[0131] If there is a front-end event and a tracking identifier associated with the service request packet, the front-end event delay is determined based on the timestamp in the tracking point information of the front-end event and the time when the back-end key interface call is triggered;

[0132] If the front-end event delay is greater than the preset server delay threshold, an alarm event is generated.

[0133] Optionally, the processing module 502 is further configured to:

[0134] After the tracking identifier and the background log are merged into a background event node corresponding to the front-end event, the tracking identifier is marked as invalid.

[0135] The restoration module 503 is used to restore the target call path based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events.

[0136] Optionally, the restoration module 503 is specifically used for:

[0137] Based on the tracking point information of the multiple front-end events, a front-end call path is constructed, wherein the tracking point information of each front-end event is a front-end event node in the front-end call path;

[0138] For each key event in the multiple front-end events, based on the front-end event node corresponding to the key event in the front-end call path, the background event node corresponding to the key event is associated and added to obtain the target call path.

[0139] Optionally, the restoration module 503 is further configured to:

[0140] After restoring the target call path based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events, the logical vulnerabilities in the front-end application are detected based on the target call path.

[0141] In the embodiment of the present application, attack behavior monitoring is performed in combination with the buried point information of the front-end event. Compared with the strategy of issuing an alarm only after a certain number of failures in the conventional monitoring scheme, the attack behavior can be located faster and the alarm can be issued, thereby reducing user losses. By associating the front-end event with the tracking identifier and the business request packet and determining the delay of the front-end event, the difference between the delay in the previous period and the preset server delay threshold is judged, and the attack behavior against the security vulnerability is quickly located and an alarm event is formed. In addition, the present application is not limited to the security issues caused by security vulnerabilities. By obtaining the front-end call path and associating and adding the background event nodes corresponding to the key events on the basis of the front-end event nodes corresponding to the key events, the front-end and back-end interaction paths are clarified, and the target call path restoration is realized. Combined with the attack characteristics, the logical vulnerabilities in the front-end application are detected, and the user's data security is maintained, which is conducive to protecting the system from various potential attacks and improving the robustness of the system.

[0142] Based on the same technical concept, the embodiment of the present application provides a computer device, which can be Figure 1 The server shown, such as Figure 6 As shown, it includes at least one processor 601 and a memory 602 connected to the at least one processor. The specific link medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 For example, the processor 601 and the memory 602 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0143] In the embodiment of the present application, the memory 602 stores instructions executed by at least one processor 601, and the at least one processor 601 can perform the steps of the above-mentioned calling path restoration method by executing the instructions stored in the memory 602.

[0144] Among them, the processor 601 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and realize call path restoration by running or executing instructions stored in the memory 602 and calling data stored in the memory 602. Optionally, the processor 601 may include one or more processing modules, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0145] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0146] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0147] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the steps of calling the path restoration method mentioned above.

[0148] Based on the same inventive concept, an embodiment of the present application provides a computer program product, including a computer program stored on a computer-readable storage medium, wherein the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned calling path restoration method.

[0149] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0150] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0151] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0152] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0153] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A call path restoration method, applied to a server, characterized in that: include: Receive the tracking information of multiple front-end events triggered in the front-end application and sent sequentially by the terminal device; For each front-end event, the following operations are performed respectively: if the front-end event is a key event, a tracking identifier of the front-end event is generated based on the embedding information of the front-end event; And, triggering a background key interface call, and recording a background log associated with the background key interface call; merging the tracking identifier and the background log into a background event node corresponding to the front-end event; Based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events, the target call path is restored.

2. The method according to claim 1, characterized in that After triggering the background key interface call and recording the background log associated with the background key interface call, the method further includes: Determine the front-end event delay based on the timestamp in the tracking information of the front-end event and the time when the back-end key interface call is triggered; If the front-end event delay is greater than the preset server delay threshold, an alarm event is generated.

3. The method according to claim 1, characterized in that The triggering of the background key interface call and recording of the background log associated with the background key interface call include: When receiving the service request packet sent by the terminal device, triggering the backend key interface call; If there is a front-end event and a tracking identifier associated with the service request packet, generating a service response packet corresponding to the service request packet; The request time of the service request packet, the service request packet and the service response packet are recorded as background logs associated with the background key interface call.

4. The method according to claim 3, characterized in that Also includes: If there is no front-end event and tracking identifier associated with the service request packet, an alarm event is generated.

5. The method according to claim 3, characterized in that If there is a front-end event and a tracking identifier associated with the service request packet, a service response packet corresponding to the service request packet is generated, including: If there is a front-end event and a tracking identifier associated with the service request packet, the front-end event delay is determined based on the timestamp in the tracking point information of the front-end event and the time when the back-end key interface call is triggered; If the front-end event delay is less than or equal to the preset server delay threshold, a service response packet corresponding to the service request packet is generated.

6. The method according to claim 3, characterized in that Also includes: If there is a front-end event and a tracking identifier associated with the service request packet, the front-end event delay is determined based on the timestamp in the tracking point information of the front-end event and the time when the back-end key interface call is triggered; If the front-end event delay is greater than the preset server delay threshold, an alarm event is generated.

7. The method according to claim 1, characterized in that After merging the tracking identifier and the background log into a background event node corresponding to the front-end event, the method further includes: The tracking identifier is marked as invalid.

8. The method according to any one of claims 1 to 7, characterized in that: The restoring the target call path based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events includes: Based on the tracking point information of the multiple front-end events, a front-end call path is constructed, wherein the tracking point information of each front-end event is a front-end event node in the front-end call path; For each key event in the multiple front-end events, based on the front-end event node corresponding to the key event in the front-end call path, the background event node corresponding to the key event is associated and added to obtain the target call path.

9. The method according to claim 8, characterized in that After restoring the target call path based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events, the method further includes: Based on the target call path, logical vulnerabilities in the front-end application are detected.

10. A device for restoring a call path, applied to a server, characterized in that: include: A receiving module, used to receive the tracking information of multiple front-end events triggered in the front-end application and sent sequentially by the terminal device; The processing module is used to perform the following operations for each front-end event: if the front-end event is a key event, generate a tracking identifier of the front-end event based on the tracking point information of the front-end event; And, triggering a background key interface call, and recording a background log associated with the background key interface call; merging the tracking identifier and the background log into a background event node corresponding to the front-end event; The restoration module is used to restore the target call path based on the tracking point information of the multiple front-end events and the background event nodes corresponding to the key events in the multiple front-end events.

11. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of any one of the methods of claims 1 to 9 are implemented.

12. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device. When the program is run on the computer device, the computer device executes the steps of any method described in claims 1 to 9.

13. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer device, the computer device is caused to execute the steps of the method according to any one of claims 1 to 9.

Images