Test method and device of Web application protection system and electronic equipment

Abstract

The invention relates to the technical field of network security, in particular to a test method and device for a Web application protection system and electronic equipment. The method comprises the following steps: when a test instruction of the Web application protection system is detected, determining a target queue and a target flow control parameter for controlling flow change, reading data in the queue according to the dynamically changed target flow control parameter, and performing playback test, and analyzing the protection performance of the Web application protection system according to the playback test result. The problem that the test effect of the WAF protection capability in different scenes is poor due to the fact that the flow cannot be adjusted in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a testing method, device and electronic equipment for a Web application protection system. Background Art

[0002] Web application protection systems, such as cloud protection products, are widely used to protect web applications and websites from threats or attacks. They effectively defend against cross-site forgery, cross-site scripting (XSS attacks), SQL injection, DDoS attacks, and many other types of attacks by monitoring traffic between users, applications, and other Internet sources. However, the traffic faced by WAF products is changing, and changes in traffic often cause potential problems for WAF products, such as memory leaks, increased false positives and false negatives, etc.

[0003] Recording and playback software has the following problems: 1. It can only record real-time traffic data and cannot copy historical traffic; 2. Once the traffic parameters are set, the traffic is constant and cannot be adjusted, so it is impossible to complete the test in a complex and dynamic traffic environment; 3. It cannot distinguish between normal requests and attack requests. Therefore, it is urgent to provide a performance testing software with traffic control that can detect defects in application firewall WAF products in advance. Summary of the invention

[0004] In view of this, one of the technical problems solved by the embodiments of the present application is to provide a testing method, device and electronic equipment for a Web application protection system to solve the testing of the protection capabilities of WAF products in different scenarios under complex and changeable traffic environments, and to improve the protection performance testing effect of WAF products.

[0005] In a first aspect of an embodiment of the present application, a method for testing a Web application protection system is disclosed, the method comprising:

[0006] When a test instruction of the Web application protection system is detected, a target queue and a target flow control parameter for controlling flow changes are determined;

[0007] Read data from the target queue according to the target flow control parameters, and perform playback testing in the test environment of the Web application protection system based on the test flow that changes according to the target flow control parameters;

[0008] Analyze the protection performance of the Web application protection system based on the playback test results.

[0009] In a second aspect of an embodiment of the present application, a testing device for a Web application protection system is disclosed, the device comprising:

[0010] A flow control parameter determination module, used to determine a target queue and a target flow control parameter for controlling flow changes when a test instruction of the Web application protection system is detected;

[0011] The dynamic traffic playback test module is used to read data from the target queue according to the target traffic control parameters, and perform playback testing in the test environment of the Web application protection system based on the read test traffic that changes according to the target traffic control parameters;

[0012] The playback test performance analysis module is used to analyze the protection performance of the Web application protection system based on the playback test results.

[0013] In a third aspect of an embodiment of the present application, an electronic device is disclosed. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above method are implemented.

[0014] In a fourth aspect of the embodiments of the present application, a computer-readable storage medium is disclosed, which stores a computer program. When the computer program is executed by a processor, the steps of the above method are implemented.

[0015] The present application has the following advantages: the embodiment of the present application determines the target queue and the target flow control parameters for controlling the flow change when detecting the test instruction of the Web application protection system, so as to read the data of the target queue of the cached flow according to the target flow control parameters, and perform a playback test in the test environment of the Web application protection system according to the read test flow that changes according to the target flow control parameters, so as to analyze the protection performance of the Web application protection system according to the playback test results. This method of adding the target flow control parameters in the flow playback test to achieve the random change of the playback flow not only saves the control steps of the playback program, but also achieves the purpose of adjusting the flow playback frequency by sharing the target queue, and also adjusts the queue length by adjusting the flow control parameters to achieve the purpose of reading and writing switching control of the flow, reduces the difficulty of expanding the distributed flow playback scenario, improves the role of testing the protection capability of the WAF in the scenario where the flow changes from time to time, solves the problem of poor test effect of the protection capability of the WAF in different scenarios due to the inability to adjust the flow in the prior art, and provides a high protection performance and high protection capability WAF with the performance and protection capability facing the complex and changeable flow environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a method for testing a Web application protection system provided by an embodiment of the present application;

[0017] Figure 2A schematic diagram of the test system framework structure of a Web application protection system provided in one embodiment of the present application;

[0018] Figure 3 A schematic diagram of the structure of a testing device for a Web application protection system provided in one embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0020] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0021] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0022] According to an embodiment of the present application, a method for testing a Web application protection system is provided, such as Figure 1 As shown, the method includes step S101, step S102 and step S103.

[0023] Step S101: When a test instruction of the Web application protection system is detected, a target queue and a target flow control parameter for controlling flow changes are determined.

[0024] In specific applications, a test instruction may be generated when a selected operation of a user test control is detected.

[0025] In the embodiment of the present application, the target flow control parameter is used to adjust the characteristics of the change in the flow size per unit time during the process of entering and leaving the team, such as the change of flow over time is normally distributed, or the flow changes over time and shows an increasing trend, or the flow changes over time and shows a downward trend, etc. When applied, two important parameters, mean and variance, can be used to describe the normal distribution. Among them, the mean is the center point of the normal distribution curve. The larger the mean, the more the curve deviates to the right, and the smaller the mean, the more the curve deviates to the left; the smaller the variance, the more concentrated the data is near the mean, the steeper the curve, and the larger the variance, the more dispersed the data is, and the flatter the curve. The present application realizes the trend of controlling the flow to change from time to time by controlling the size of the configured mean and variance, and solves the problem that the Web application protection system in the prior art cannot be tested under complex flow change conditions. When applied, the mean and standard layer can also be used to control the normal distribution curve of the flow.

[0026] Specifically, the target flow control parameters may be configured according to a preset algorithm, such as setting the flow control parameters through a random array, or may be determined according to a custom configuration of a tester.

[0027] Step S102: reading data from the target queue according to the target flow control parameter, and performing a playback test in the test environment of the Web application protection system according to the read test flow that changes according to the target flow control parameter.

[0028] In an embodiment of the present application, the target queue is used to write traffic for playback testing. Among them, the target queue is a variable-length queue of dynamic caching. When applied, when the number of target queues is greater than 1, the queues used in different scenarios may be different. Specifically, the number of target queues can be set as needed, generally set to 1-5. When applied, the number of queues constructed for different test scenarios is different. For example, in a stress test scenario, only one queue can be constructed; in an attack identification and protection performance test scenario, two queues can be constructed to write normal requests and attack requests respectively; or for a test scenario for a specific domain name, a queue can be constructed, that is, normal requests and attack requests are written in the queue.

[0029] Specifically, the test traffic may be a normal request, an attack request, or normal requests and attack requests played back in a predetermined ratio.

[0030] Step S103: Analyze the protection performance of the Web application protection system based on the playback test results.

[0031] Specifically, the performance test result may be determined based on the returned response code included in the playback test result.

[0032] The embodiment of the present application, upon detecting a test instruction of the Web application protection system, determines a target queue and a target flow control parameter for controlling flow changes, reads data from the target queue of the cached flow according to the target flow control parameter, and performs a playback test in the test environment of the Web application protection system according to the read test flow that changes according to the target flow control parameter, thereby analyzing the protection performance of the Web application protection system according to the playback test result. This method of adding a target flow control parameter in the flow playback test to achieve random changes in the playback flow not only saves the need for control steps of the playback program, and achieves the purpose of adjusting the flow playback frequency by sharing the target queue, but also adjusts the queue length by adjusting the flow control parameter, and achieves the purpose of switching the read and write flow, thereby reducing the difficulty of expanding distributed flow playback scenarios, and improving the role of testing the protection capability of the WAF in scenarios where the flow changes from time to time, and solves the problem of poor test results of the protection capability of the WAF in different scenarios due to the inability to adjust the flow in the prior art, and provides a high-protection-performance high-WAF with performance and protection capability for facing complex and changeable flow environments.

[0033] In some embodiments, before determining the target queue and the target flow control parameter for controlling flow change in step S101, the method further includes:

[0034] Step S1011 (not shown in the figure): determining a target flow control parameter for a target test scenario from among a plurality of preset flow control parameters;

[0035] Step S1012 (not shown in the figure): determining the proportion of attack requests included in the traffic used for testing of the Web application protection system in the target test scenario;

[0036] Step S1013 (not shown in the figure): based on the proportion of attack requests included in the traffic used for testing by the Web application protection system in the target test scenario, logs are pulled from a preset sample log library to obtain target logs;

[0037] Step S1014 (not shown in the figure): rewrite the target log and write it in a distributed manner into a queue for the target test scenario to obtain a target queue.

[0038] The embodiment of the present application presets a plurality of flow control parameters, thereby facilitating the user to quickly select a flow change mode for testing the WAF, and saving the user time in setting the flow control parameters in real time.

[0039] In the embodiment of the present application, the target test scenario is used to characterize the test purpose of the Web application protection system, including stress testing, attack identification testing, etc. Among them, stress testing is the process of evaluating the performance and stability of the Web application protection system under high load; attack identification is the process of evaluating whether the Web application protection system can correctly identify normal requests and attack requests and analyze its security.

[0040] In the embodiment of the present application, the proportion is used to characterize the proportion of attacks included in the traffic in different test scenarios. Specifically, the proportion of attacks can be within a preset proportion value range, such as a preset proportion value range of 0-1. When the proportion is 0, it means that all the traffic used for playback is normal requests. This traffic can be used to perform stress testing on the WAF.

[0041] In the embodiment of the present application, by setting up a sample log library, there is no need to consider the occurrence of test failures due to log collection interruptions, which solves the problem of playback failures caused by collection interruptions in the prior art due to the use of the method of collecting logs while performing playback tests. When applied, the logs pulled from the sample log library can be cached in the memory, and the operation of writing to the queue is completed after the memory is rewritten.

[0042] Specifically, the sample log library can be stored in a log server or in a log server cluster. More specifically, the data of the log server or log server cluster (i.e., normal requests and attack requests of all nodes in all time periods) are stored in a key-value format to solve the problem of quickly filtering logs that meet the needs according to user needs. When applied, a log acquisition request (including key-value items required by users) can be sent to the log server or log server cluster to obtain qualified logs. When applied, the sample log library can be obtained by using pre-installed log collection software (such as flume software) to upload the log files to the log server after the log files are collected, and then the log server uses the preset database Elasticsearch (ES for short) to store them.

[0043] In some embodiments, step S1013 further includes:

[0044] If the proportion of attack requests included in the traffic used for testing in the target test scenario is a first preset proportion value, the target log is the first traffic including normal requests, and the first traffic is distributedly stored in a queue for the target test scenario according to the target traffic control parameter to obtain the target queue;

[0045] If the proportion of attack requests included in the traffic used for testing in the target test scenario is a second preset proportion value, the target log is the second traffic including abnormal requests, and the first traffic is distributedly stored in the queue for the target test scenario according to the target traffic control parameter to obtain the target queue;

[0046] If the traffic used for testing in the target test scenario includes attack requests whose proportion reaches a first preset proportion value and is less than a second preset proportion value, the target log includes a third traffic of normal requests and abnormal requests, and the third traffic is distributedly stored in a queue for the target test scenario according to the target traffic control parameters to obtain a target queue.

[0047] When applied, the first preset proportion value is generally set to 0, and the second preset proportion value is generally set to 1. Among them, when the first proportion value is zero, the corresponding target test scenario may be a stress test, and when the second proportion value is 1, the corresponding target test scenario may be attack identification. In these two situations, the number of queues constructed for the target test scenario can be 1, or two or more queues can be set as needed. In the embodiment of the present application, the queues constructed in these two situations are both 1, and the target flow control parameter is the flow control parameter for the queue. According to the flow control parameter, the write operation is performed in the queue to complete the task of enqueuing the flow, and the read operation is also performed according to the flow control parameter during the playback test to complete the task of dequeuing the flow. Specifically, when the proportion is in the range of 0-1, the target test scenario may be a test for a certain domain name, or it may be an attack identification test for identifying attacks in the flow including normal requests and attack requests. At this time, the corresponding request needs to be pulled according to the proportion. In this case, one queue can be constructed, or two queues can be constructed. For example, if the test is for a certain domain name, you can build a queue to store both normal requests and attack requests in the queue; if the attack identification test is to identify attacks in traffic including normal requests and attack requests, you can build two queues to store normal requests and attack requests respectively.

[0048] The embodiment of the present application quantifies the test scenario by setting the first preset proportion value and the second preset proportion value, thereby determining the construction of a corresponding number of queues according to the scenario, and solving the problem of affecting the processing speed of log entry / exit due to too many or too few queues being constructed.

[0049] In the above target log, the target flow control parameter includes a first flow control parameter for a correct request and a second flow control parameter for an attack request. The third flow is distributedly stored in a queue for a target test scenario according to the target flow control parameter to obtain a target queue. The method further includes:

[0050] Distributively storing normal requests in the third flow in a queue for normal requests according to the first flow control parameter to obtain a first queue;

[0051] The attack requests in the third flow are distributedly stored in the queue for abnormal requests according to the second flow control parameter to obtain a second queue.

[0052] In the embodiment of the present application, by setting the first flow control parameter and the second flow control parameter, the effect of independent control of normal requests and attack requests is achieved, and the two parameters can be dynamically adjusted as needed.

[0053] In the above embodiment including the first queue and the second queue, step S102 further includes:

[0054] According to the first flow control parameter of the first queue, the second flow control parameter of the second queue and the proportion, data of the first queue and the second queue are read, and a playback test is performed in the test environment of the Web application protection system based on the test flow that changes according to the target flow control parameters.

[0055] When applied, the proportion of normal requests and attack requests can be dynamically adjusted. This adjustment method helps to improve the performance and protection capabilities of the test WAF in the complex and changeable traffic environment it faces.

[0056] In some embodiments, step S1014 further includes:

[0057] Determine the key fields of the test website for testing the web application protection system, including domain name, response code, user agent UA and uniform resource locator URL;

[0058] The corresponding key field of the target log modified according to the key field.

[0059] The embodiment of the present application completes the test of the Web application protection system in a test website environment by modifying key fields, thereby preventing traffic from being sent to a real website and increasing the load on the real website.

[0060] In some embodiments, step S1014 further includes:

[0061] Determining a predetermined number of logs to be written in the rewritten target log;

[0062] If the number of write failures for any log to be written reaches a preset number threshold, the log to be written is discarded, and the write operation is performed on the next log to be written in the queue for the target test scenario.

[0063] Specifically, the rewritten predetermined number of logs to be written are generally cached in the memory in a paged manner. When applied, they are generally cached in the memory as a page with N (such as 10) logs. When writing to the queue, if a message that any log fails to be written to the queue is detected, the write-to-queue operation will continue to be performed on any log, and after the write-to-queue operation of any log fails 3 times, the any log will be discarded and the write-to-queue operation will continue to be performed on the next log; after all 10 logs are written, the next page of logs will be updated to the content and the write-to-queue operation will continue.

[0064] Specifically, multi-threaded distributed data can be used to perform write processing. When applied, a preset distributed algorithm can be used to allocate threads based on the amount of data that needs to be written at the current time. This achieves the effect of starting multiple threads for parallel batch processing in the write process, thereby achieving the purpose of improving resource utilization.

[0065] In some embodiments, step S103 further includes:

[0066] Step S1031 (not shown in the figure): determine the response code returned by the Web application protection system in the playback test result;

[0067] Step S1032 (not shown in the figure): match the response code returned by the Web application protection system with a preset reference response code, and determine the fault existing in the Web application protection system based on the matching result.

[0068] Specifically, when the test traffic is an attack request and the response code returned by the Web application protection system is inconsistent with the customized response code, it can be determined that the Web application protection system has failed to identify; when the test request traffic is a normal request and the response code returned by the Web application protection system is inconsistent with the benchmark response code, it can be determined that the Web application protection system has failed to identify; when the response code returned by the Web application protection system is a preset error response code, it can be determined that the Web application protection system has failed.

[0069] Specifically, the Web application protection system returns different response codes for different traffic flows. For example, if the playback test is an attack request, the Web application protection system will respond with a 493 response code customized by the WAF after identifying it. If the returned response code is not 493, the request is considered to have failed, and the failed request is saved in a file for subsequent analysis. For another example, if the Web application protection system returns an error response code such as 500 or 502 for the WAF device under test, it is considered that the request has caused a failure in the WAF device under test, and the request is considered to have failed. The failed request is saved in a file for subsequent analysis.

[0070] Combine the following Figure 2 The provided system describes the present application in detail. Figure 2 The provided system includes a log storage module, a log pulling module, a log rewriting module, a cache queue, a replay request module and a WAF detection device. After receiving the logs uploaded by multiple log collection modules (which can be deployed on a server to collect logs with the flume software installed, and the log storage module is used to collect the flume software), the log storage module can be uniformly stored in the El ast icsearch database. The log storage module can store the logs uploaded by the log collection module together, or can classify and store them according to the log type. After the classified storage, it can also perform secondary classification storage according to the domain name. For example, normal requests and attack requests can be classified and stored in different locations. After that, the log pulling module can select some samples from the El ast icsearch database for playback according to different test purposes. After the log rewriting module caches the selected part of the samples to the content, replaces the domain name, response code, URL and UA of the selected part of the samples with the corresponding information of the test website, and then performs write operation processing in the cache queue. The write operation can be configured by the preset flow control module to configure the flow control module and the attack ratio module of the cache queue for parameter configuration. Assuming that the test scenario is to identify the protection of traffic including normal requests and attack requests, two queues are constructed here, and each queue is configured with corresponding traffic control parameters. One queue writes normal requests, and the other queue writes attack requests. In this way, after sending the test instruction using the replay request module, the data of the two queues are read according to the traffic control parameters of the two queues and the proportion of attack requests in the traffic configured by the corresponding attack ratio module. In this way, the read traffic changes dynamically according to the traffic control parameters, and the traffic input to the WAF detection device changes dynamically, which can meet the purpose of the high and low traffic changes required by the test, so that the WAF detection device can perform performance and protection capability tests in a complex and changeable traffic environment. The WAF detection device replays the test website according to the input traffic, and can judge whether the response is abnormal according to the replay test results. If it is, it records the abnormal information and uses the abnormal information as a failed test case to analyze and improve the protection performance of the WAF detection device, providing data basis for subsequent improvement of its character.

[0071] An embodiment of the present application provides a testing device for a Web application protection system, such as Figure 3 As shown, the device 30 includes: a flow control parameter determination module 301, a dynamic flow playback test module 302 and a playback test performance analysis module 303.

[0072] A flow control parameter determination module, used to determine a target queue and a target flow control parameter for controlling flow changes when a test instruction of the Web application protection system is detected;

[0073] The dynamic traffic playback test module is used to read data from the target queue of the cached traffic according to the target traffic control parameters, and to perform playback testing in the test environment of the Web application protection system based on the read test traffic that changes according to the target traffic control parameters;

[0074] The playback test performance analysis module is used to analyze the protection performance of the Web application protection system based on the playback test results.

[0075] The embodiment of the present application determines a target queue and a target flow control parameter for controlling flow changes upon detecting a test instruction of a Web application protection system, so as to read data from the target queue of cached flow according to the target flow control parameter, and perform a playback test in the test environment of the Web application protection system according to the read test flow that changes according to the target flow control parameter, thereby analyzing the protection performance of the Web application protection system according to the playback test result. This method of adding a target flow control parameter in a flow playback test to achieve a random change in the playback flow not only saves the need for a control step of the playback program, and achieves the purpose of adjusting the flow playback frequency by sharing a target queue, but also achieves the purpose of adjusting the queue length by adjusting the flow control parameter, and achieves the purpose of switching the read and write flow, thereby reducing the difficulty of expanding distributed flow playback scenarios, and improving the role of testing the protection capability of WAF in scenarios where the flow changes from time to time, thereby solving the problem of poor testing effect of the protection capability of WAF in different scenarios due to the inability to adjust the flow in the prior art, and providing a WAF with high performance and protection capability for facing complex and changeable flow environments.

[0076] Furthermore, before determining the target queue and the target flow control parameter for controlling the flow change, the flow control parameter determination module further includes:

[0077] A flow parameter determination submodule, used to determine a target flow control parameter for a target test scenario among a plurality of preset flow control parameters;

[0078] The attack proportion determination submodule is used to determine the proportion of attack requests included in the traffic used for testing of the Web application protection system in the target test scenario;

[0079] The log pulling submodule is used to pull logs from a preset sample log library based on the attack request ratio included in the traffic used for testing by the Web application protection system in the target test scenario to obtain the target log;

[0080] The log rewriting queue submodule is used to rewrite the target log and write it to the queue for the target test scenario in a distributed manner to obtain the target queue.

[0081] Furthermore, the log rewrite queue submodule includes:

[0082] A first pulling unit is used for, if the proportion of attack requests included in the traffic used for testing in the target test scenario is a first preset proportion value, then the target log is the first traffic including normal requests, and the first traffic is distributedly stored in a queue for the target test scenario according to the target traffic control parameter to obtain the target queue;

[0083] A second pulling unit is used for, if the proportion of attack requests included in the traffic used for testing in the target test scenario is a second preset proportion value, then the target log is the second traffic including abnormal requests, and the first traffic is distributedly stored in the queue for the target test scenario according to the target traffic control parameter to obtain the target queue;

[0084] The third pulling unit is used to, if the traffic used for testing in the target test scenario includes attack requests that account for a first preset proportion value and are less than a second preset proportion value, then the target log includes a third traffic of normal requests and abnormal requests, and according to the target traffic control parameters, the third traffic is distributedly stored in a queue for the target test scenario to obtain a target queue.

[0085] Further, the target flow control parameter includes a first flow control parameter for a correct request and a second flow control parameter for an attack request, and the third pulling unit further includes:

[0086] a first queue determination subunit, configured to distribute and store normal requests in the third flow in a queue for normal requests according to the first flow control parameter, to obtain a first queue;

[0087] The second queue determination subunit is used to distribute and store the attack requests in the third flow in the queue for abnormal requests according to the second flow control parameter to obtain a second queue.

[0088] Furthermore, the dynamic traffic playback test module includes:

[0089] Two queue reading and playback submodules are used for the second flow control parameters and proportion of the second queue, to read data from the first queue and the second queue, and to perform playback testing in the test environment of the Web application protection system based on the read test flow that changes according to the target flow control parameters.

[0090] Furthermore, the log rewrite queue submodule includes:

[0091] A rewrite field determination unit is used to determine key fields of a test website for testing the Web application protection system, wherein the key fields include a domain name, a response code, a user agent UA, and a uniform resource locator URL;

[0092] The log key field rewriting unit is used to modify the corresponding key field of the target log according to the key field website information.

[0093] Furthermore, the log rewrite queue submodule includes:

[0094] A to-be-written log determination unit, used to determine a predetermined number of to-be-written logs in the rewritten target log;

[0095] The log writing processing unit is used to discard any log to be written if the number of write failures of any log to be written reaches a preset number threshold, and perform write operation processing on the next log to be written in the queue for the target test scenario.

[0096] Furthermore, the playback test performance analysis module includes:

[0097] The test return response code determination module is used to determine the response code returned by the Web application protection system in the playback test results;

[0098] The test return response code matching module is used to match the response code returned by the Web application protection system with the preset benchmark response code, and analyze the protection performance of the Web application protection system based on the matching results.

[0099] Another embodiment of the present application provides a terminal, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned search engine-based data processing method when executing the computer program.

[0100] Specifically, the processor may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0101] Specifically, the processor is connected to the memory via a bus, and the bus may include a path for transmitting information. The bus may be a PCI bus or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0102] The memory can be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, CD-ROM or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0103] Optionally, the memory is used to store the code of the computer program for executing the solution of the present application, and the execution is controlled by the processor. The processor is used to execute the application program code stored in the memory to implement Figure 3 The illustrated embodiments provide for the operation of the apparatus.

[0104] Another embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions for executing the above-mentioned Figure 1 or Figure 2 The method shown.

[0105] The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0106] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0107] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions without violating the spirit of the present application. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A testing method for a Web application protection system, characterized in that: The method comprises: When a test instruction of the Web application protection system is detected, a target queue and a target flow control parameter for controlling flow changes are determined; Reading data from the target queue according to the target flow control parameter, and performing a playback test in the test environment of the Web application protection system according to the read test flow that changes according to the target flow control parameter; The protection performance of the Web application protection system is analyzed based on the playback test results.

2. The method according to claim 1, characterized in that Before determining the target queue and the target flow control parameter for controlling flow change, the method further includes: Determining the target flow control parameter for the target test scenario among the preset multiple flow control parameters; Determine the proportion of attack requests included in the traffic used for testing of the Web application protection system in a target test scenario; Based on the proportion of attack requests included in the traffic used for testing of the Web application protection system in the target test scenario, logs are pulled from a preset sample log library to obtain target logs; The target log is rewritten and distributedly written into a queue for the target test scenario to obtain the target queue.

3. The method according to claim 2, characterized in that The step of rewriting the target log and distributively writing it into a queue for the target test scenario to obtain the target queue includes: If the proportion of attack requests included in the traffic used for testing in the target test scenario is a first preset proportion value, the target log is a first traffic including normal requests, and the first traffic is distributedly stored in a queue for the target test scenario according to the target traffic control parameter to obtain the target queue; If the proportion of attack requests included in the traffic used for testing in the target test scenario is a second preset proportion value, the target log is the second traffic including abnormal requests, and the first traffic is distributedly stored in a queue for the target test scenario according to the target traffic control parameter to obtain the target queue; If the proportion of attack requests included in the traffic used for testing in the target test scenario is greater than the first preset proportion value and less than the second preset proportion value, then the target log is a third traffic including normal requests and abnormal requests, and the third traffic is distributedly stored in the queue for the target test scenario according to the target traffic control parameters to obtain the target queue.

4. The method according to claim 3, characterized in that The target flow control parameters include a first flow control parameter for a correct request and a second flow control parameter for an attack request, and the third flow is distributedly stored in a queue for the target test scenario according to the target flow control parameters to obtain the target queue, including: Distributively storing the normal requests in the third flow in a queue for normal requests according to the first flow control parameter to obtain a first queue; The attack requests in the third flow are distributedly stored in a queue for abnormal requests according to the second flow control parameter to obtain a second queue.

5. The method according to claim 4, characterized in that The step of reading data from a target queue of cached traffic according to the target traffic control parameter, and performing a playback test in a test environment of the Web application protection system according to the read test traffic that changes according to the target traffic control parameter, includes: According to the first flow control parameter of the first queue, the second flow control parameter of the second queue, and the proportion, data is read from the first queue and the second queue, and a playback test is performed in the test environment of the Web application protection system based on the read test flow that changes according to the target flow control parameter.

6. The method according to claim 2, characterized in that The step of rewriting the target log and distributively writing it into a queue for the target test scenario to obtain the target queue includes: Determine key fields of a test website for testing the Web application protection system, wherein the key fields include a domain name, a response code, a user agent UA, and a uniform resource locator URL; The corresponding key fields of the target log are modified according to the key field website information.

7. The method according to claim 2, characterized in that: The step of rewriting the target log and distributively writing it into a queue for the target test scenario to obtain the target queue further includes: Determining a predetermined number of logs to be written in the rewritten target log; If the number of write failures for any log to be written reaches a preset number threshold, the log to be written is discarded, and a write operation is performed on the next log to be written in the queue for the target test scenario.

8. The method according to claim 1, characterized in that The analysis of the protection performance of the Web application protection system according to the playback test results includes: Determine the response code returned by the Web application protection system in the playback test result; The response code returned by the Web application protection system is matched with a preset reference response code, and the protection performance of the Web application protection system is analyzed based on the matching result.

9. A testing device for a Web application protection system, characterized in that: include: A flow control parameter determination module, used to determine a target queue and a target flow control parameter for controlling flow changes when a test instruction of the Web application protection system is detected; A dynamic traffic playback test module, used to read data from the target queue according to the target traffic control parameter, and perform playback testing in the test environment of the Web application protection system according to the read test traffic that changes according to the target traffic control parameter; The playback test performance analysis module is used to analyze the protection performance of the Web application protection system based on the playback test results.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions, and the processor is used to execute the computer-readable instructions, wherein the computer-readable instructions execute the method according to any one of claims 1 to 8 when executed.

Images