Zero-load interface safety protection method and device, electronic equipment and storage medium

Abstract

The invention discloses a zero-load interface security protection method and device, electronic equipment and a storage medium, and the method comprises the steps: reading an access log of a business service, and dividing an intranet access log and an extranet access log according to a remote access IP field in the access log and a preset intranet IP address range; determining an accessed intranet domain name and an accessed extranet domain name according to the intranet access log and the extranet access log; searching service item deployment positions of the intranet domain name and the extranet domain name to obtain a service item deployment file, and extracting an interface address of the corresponding domain name according to the service item deployment file; determining an open range to the outside of the interface address, obtaining a public network open interface and an intranet access interface, and assembling to obtain an interface complete link of the public network open interface and the intranet access interface; and performing abnormal access identification according to the interface complete link, and intercepting an abnormal access behavior. The safety protection capability of the interface and the safety of the system are improved, and the method can be applied to the technical field of information.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a zero-load interface security protection method, device, electronic equipment and storage medium. Background Art

[0002] An interface is a set of software functions encapsulated from the server software to meet the external needs of the software. A typical HTTP / HTTPS interface consists of two parts: an interface link and a request method. The interface link is open on the Internet in the format of "http or https: / / domain name / location / interface address", where the " / location / " part can have any number of separated by the symbol / .

[0003] All interfaces open through the public network need to be effectively protected by firewalls and other facilities, otherwise the business may be attacked and the business data may be leaked; accurate full interface information is also of great significance for the testing and monitoring coverage of the interface. In addition, interface information also helps to efficiently handle alarms and fault events in daily operation and maintenance work, and can also be used to analyze resources and interface development and other related work efficiency. However, the total number of interfaces of Internet companies may reach 100,000 or even more. How to continuously and accurately discover, effectively manage, evaluate the security risks of all interfaces and effectively protect them has become an important issue that needs to be solved in actual work.

[0004] Terminology explanation:

[0005] Interface: Also known as API, it refers to an abstract set of software functions that a server application opens to different forms of software such as web pages, mobile clients or other server applications. It is usually a set of pre-defined functions. The purpose is to provide application and developers with the ability to access a set of routines based on certain software or hardware without accessing the source code or understanding the details of the internal working mechanism. In the description of the present invention, the interface specifically refers to the interface opened through the HTTP / HTTPS protocol.

[0006] Interface metadata: refers to the information of the interface itself, the project to which the interface belongs, the project's release (to be deployed) files, and the various resources that need to be called when the interface runs.

[0007] Web Application Firewall (WAF): also known as Web application-level protection / intrusion prevention system, is a product that protects Web applications by executing a series of security policies for HTTP / HTTPS at the application layer. It represents an emerging type of information security technology that is used to solve Web application security issues that traditional devices such as firewalls cannot handle. Summary of the invention

[0008] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0009] To this end, an object of an embodiment of the present invention is to provide a zero-load interface security protection method, which realizes automatic discovery of interface information and automatic identification and interception of abnormal access behavior, thereby improving the security protection capability of the interface and the security of the system.

[0010] Another object of an embodiment of the present invention is to provide a zero-load interface safety protection device.

[0011] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0012] On the one hand, an embodiment of the present invention provides a zero-load interface security protection method, comprising the following steps:

[0013] Read the access log of the business service, and divide the intranet access log and the extranet access log according to the remote access IP field in the access log and the preset intranet IP address range;

[0014] Determine the visited intranet domain name and extranet domain name according to the intranet access log and the extranet access log;

[0015] Find the business project deployment location of the intranet domain name and the extranet domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name according to the business project deployment file;

[0016] Determine the externally open scope of the interface address, obtain the public network open interface and the intranet access interface, and assemble to obtain the complete interface link of the public network open interface and the intranet access interface;

[0017] Abnormal access is identified based on the complete link of the interface, and abnormal access behavior is intercepted.

[0018] Furthermore, in one embodiment of the present invention, the zero-load interface security protection method further includes the following steps:

[0019] When the business project deployment file is updated, the interface address and the business project to which the changed domain name corresponds are searched according to the domain name change information.

[0020] Further, in one embodiment of the present invention, the identifying of abnormal access according to the complete link of the interface and intercepting the abnormal access behavior specifically includes:

[0021] Extract the tail content of the complete interface link to obtain the tail interface link;

[0022] Searching for a target access log from the external network access log according to the tail interface link, wherein the access link of the target access log includes the tail interface link, but other parts are different from the complete interface link;

[0023] Determine the suspiciousness analysis index of the target access log according to the access source IP, and determine the IP region, IP range and IP access frequency of the target access log;

[0024] Input the suspiciousness analysis index, the region to which the IP belongs, the range to which the IP belongs, and the IP access frequency into a pre-trained abnormal access recognition model to determine whether the target access log is an abnormal access log;

[0025] Determine the corresponding abnormal behavior source IP according to the abnormal access log, and determine the risk level of the abnormal behavior source IP;

[0026] The abnormal access behavior is intercepted according to the abnormal behavior source IP and the risk level.

[0027] Further, in one embodiment of the present invention, the searching for the business project deployment location of the intranet domain name and the extranet domain name to obtain the business project deployment file, and extracting the interface address of the corresponding domain name according to the business project deployment file, specifically includes:

[0028] Determine the service IP and port information of the intranet domain name and the extranet domain name;

[0029] Find the business project deployment location of the corresponding domain name according to the service IP and the port information, and obtain the business project deployment file;

[0030] The file type of the business project deployment file is determined, and the business project deployment file is parsed according to the file type to obtain the interface address.

[0031] Further, in one embodiment of the present invention, the determining of the externally open scope of the interface address, obtaining the public network open interface and the intranet access interface, and assembling to obtain the interface complete link of the public network open interface and the intranet access interface specifically includes:

[0032] Searching for a context-path configuration value in the image file according to the starting path of the class file, and obtaining a first interface address by concatenating the context-path configuration value and the interface address;

[0033] Obtaining the location address of the interface address through a Web server, matching the location address with the first interface address, determining the externally accessible scope of the interface address according to the matching result, and obtaining the public network open interface and the intranet access interface;

[0034] Assemble the corresponding interface complete link of the public network open interface according to the corresponding domain name, the location address and the first interface address that matches successfully;

[0035] The interface complete link of the corresponding intranet access interface is assembled according to the corresponding domain name, the location address and the first interface address that fails to match.

[0036] Further, in one embodiment of the present invention, the determination of the suspiciousness analysis index of the target access log according to the access source IP, and the determination of the IP region, IP range and IP access frequency of the target access log specifically include:

[0037] Determine the access source IP of the target access log, and search for the suspiciousness analysis indicator according to the access source IP, wherein the suspiciousness analysis indicator includes the User-Agent, request size, response size, response status code, access time, actual access link, backend / underlying business service and IP actually reached by the access, and the project or domain name actually accessed of the target access log;

[0038] The region to which the IP belongs and the range to which the IP belongs are determined according to the access source IP, and the number of visits of the access source IP within a preset time period is counted to obtain the IP access frequency.

[0039] Further, in one embodiment of the present invention, the determining of the corresponding abnormal behavior source IP according to the abnormal access log and the determining of the risk level of the abnormal behavior source IP specifically include:

[0040] The access source IP of the abnormal access log is used as the source IP of the abnormal behavior;

[0041] Determine the interface link address set and corresponding access parameters found by the abnormal behavior source IP, and determine the business parameters, access frequency, access tool characteristics and abnormal behavior type set successfully obtained by the abnormal behavior source IP according to the status code and response;

[0042] The risk level of the abnormal behavior source IP is determined according to the business parameters, the access frequency, the access tool characteristics and the abnormal behavior type set.

[0043] On the other hand, an embodiment of the present invention provides a zero-load interface safety protection device, including:

[0044] An access log reading module is used to read the access log of the business service and divide the intranet access log and the extranet access log according to the remote access IP field in the access log and the preset intranet IP address range;

[0045] An access domain name determination module, used to determine the visited intranet domain name and extranet domain name according to the intranet access log and the extranet access log;

[0046] An interface address extraction module is used to find the business project deployment location of the intranet domain name and the extranet domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name according to the business project deployment file;

[0047] An interface complete link assembly module, used to determine the external open scope of the interface address, obtain the public network open interface and the intranet access interface, and assemble to obtain the interface complete link of the public network open interface and the intranet access interface;

[0048] The abnormal access behavior interception module is used to identify abnormal access according to the complete link of the interface and intercept the abnormal access behavior.

[0049] On the other hand, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein the program, when executed by the processor, realizes the zero-load interface security protection method as described above.

[0050] On the other hand, an embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the zero-load interface security protection method as described above.

[0051] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0052] The embodiment of the present invention reads the access log of the business service, divides the intranet access log and the extranet access log according to the remote access IP field in the access log and the preset intranet IP address range, determines the intranet domain name and the extranet domain name being accessed according to the intranet access log and the extranet access log, searches for the business project deployment location of the intranet domain name and the extranet domain name, obtains the business project deployment file, extracts the interface address of the corresponding domain name according to the business project deployment file, determines the external open range of the interface address, obtains the public network open interface and the intranet access interface, assembles the interface complete link of the public network open interface and the intranet access interface, identifies abnormal access according to the interface complete link, and intercepts abnormal access behavior. The embodiment of the present invention realizes the automatic discovery of interface information and the automatic identification and interception of abnormal access behavior, improves the security protection capability of the interface and the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0054] Figure 1 A step flow chart of a zero-load interface security protection method provided by an embodiment of the present invention;

[0055] Figure 2 A schematic diagram of an implementation framework of a zero-load interface security protection method provided by an embodiment of the present invention;

[0056] Figure 3 Another step flow chart of the zero-load interface security protection method provided by an embodiment of the present invention;

[0057] Figure 4 A step flow chart of step S103 provided in an embodiment of the present invention;

[0058] Figure 5 A step flow chart of step S104 provided in an embodiment of the present invention;

[0059] Figure 6 A step flow chart of step S105 provided in an embodiment of the present invention;

[0060] Figure 7 A step flow chart of step S1053 provided in an embodiment of the present invention;

[0061] Figure 8 A step flow chart of step S1055 provided in an embodiment of the present invention;

[0062] Fig. 9 A schematic diagram of the structure of a zero-load interface safety protection device provided by an embodiment of the present invention;

[0063] Fig.10 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention;

[0064] Fig.11 A schematic diagram of the structure of a storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0065] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limitations on the present application. It should be noted that, although the functional module division is performed in the system schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order from the module division in the system schematic diagram or the flow chart. For the step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0066] In the description of the present invention, the meaning of "a plurality" is two or more. If there is a description of the first or the second, it is only for the purpose of distinguishing the technical features, and it cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by technicians in the technical field of this application. The terms used in this document are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0067] Related art discloses a technology for automatically discovering and connecting to a REST interface, where a supplier computing device analyzes data received from the REST interface of a Web service in response to an HTTP request that has been sent to an endpoint of the Web service, and then determines its pattern and confidence level based on the analyzed data representation and generates one or more possible rules for the REST interface. This automatically discovers and connects to the REST interface. This solution generates additional accesses to the interface, which not only wastes resources but also results in junk data in the business system. In addition, the efficiency of interface discovery is low, and it is difficult to find all interfaces.

[0068] The related art also discloses a non-aware automatic discovery API security management system and method, which requires first registering interfaces with security management requirements, so it cannot automatically discover unregistered interfaces. The related art also discloses an API automatic discovery method based on eBPF. The resource and performance loss of this solution in completely collecting and parsing API information in the business domain will increase the burden of normal business communications and have a certain negative impact on normal business operations. Its solution for collecting interface information based on actual network traffic cannot obtain data on inactive interfaces.

[0069] Related technologies also disclose an interface difference analysis method, device, storage medium and apparatus, which can extract a jar package from a docker image file, and then use a preset class loader to obtain interface information from the jar file. The shortcomings of this solution include:

[0070] 1) It is required to pre-configure accurate information. The acquisition of this information is not only cumbersome, but also some information is difficult or even impossible to obtain accurately in advance due to technical barriers. In addition, it may be necessary to develop available class loaders for some projects. This solution does not provide a technical method to automatically obtain all preset information.

[0071] 2) The interface information obtained is limited, and it is impossible to find out important information related to practical applications such as interface dependencies and potential security risks;

[0072] 3) There are defects in performance and stability: Extracting the jar package from the image file to the hard disk not only involves disk I / O, but if the jar file is deleted or damaged during the processing, it will also cause the solution to execute abnormally; in addition, there is a situation where the ClassLoader can load the class in the jar but cannot obtain the interface information described in the solution, making the solution essentially unfeasible for many projects.

[0073] Other technical solutions that are expected to obtain interface information include: ① Extracting interface addresses from source code. However, due to domain name configuration and security protection during business deployment, the interface addresses defined in the R&D code cannot constitute a complete interface link deployed in the existing network environment; ② Extracting interface addresses from business access logs. However, since business access logs for a certain period of time do not have logs of inactive or unaccessed interfaces, a large amount of junk data is likely to appear in business access logs when there are abnormal accesses such as attacks and interface scanning, resulting in these solutions being unable to provide an accurate full set of interface information at any time.

[0074] The present invention provides a zero-load interface security protection method, device, electronic device and storage medium to achieve the following objectives:

[0075] 1) Find all domain names accessed by the public network and the intranet based on the remote host IP recorded in the access logs of services such as Apache HTTP Server, Nginx, and k8s Ingress, and then use the obtained domain names to find the deployment configuration and deployment files of the corresponding business system. Then, retrieve and extract the interface information directly from the deployment files based on the memory, and further integrate the deployment information to obtain the complete interface link and distinguish between internal and external interfaces, so as to achieve accurate and automatic discovery of the full amount of interface information without affecting business operations;

[0076] 2) Automatically discover and synchronize changes in interface information of each project by linking interface change events, including activation of new domain names, update events of the project to which the interface belongs, or changes in project deployment file update events;

[0077] 3) Based on the accurate interface address found, by analyzing the actual access link, User-Agent, access frequency and other information of external access behavior in the access log of the business service, it automatically identifies and classifies abnormal behaviors such as scanning and attacking of the business interface and implements appropriate protection to eliminate the impact of abnormal requests or non-real business requests on the business system.

[0078] The zero-load interface security protection method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a set-top box, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the zero-load interface security protection method, etc., but is not limited to the above forms.

[0079] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0080] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0081] First, the implementation framework of the zero-load interface security protection method of the embodiment of the present invention is described. Figure 2The figure shows a schematic diagram of the implementation framework of the zero-load interface security protection method provided by an embodiment of the present invention, which includes a server, an automatic discovery client and an automatic protection client. The automatic protection client needs to be deployed on the web server to be protected. When the automatic discovery client parses the interface information from the deployment file of the business project, it can be deployed on any server as long as it can access the business deployment file. The server is centrally deployed as a cluster service, and the data can be saved in a relational database or a NoSQL database, and the topology data can be saved in a graph database. The automatic discovery client is mainly used to collect and report domain names, load balancing, and HTTP service processes and configuration information. It also supports analyzing the deployment files of business projects and retrieving and extracting interface addresses therefrom and reporting them to the server after processing. The automatic protection client is mainly responsible for parsing the HTTP and HTTPS protocols on the network device side, and identifying and protecting abnormal access behaviors to the interface based on whether the access link is a real interface link and the abnormal interface access behavior judgment model provided by the server. The server mainly provides management of domain names, load balancing, HTTP servers (Nginx, Apache HTTP Server, etc.) and their configurations and changes. It supports the classification and management of projects, interfaces and their changes, and sources of abnormal interface access. It also provides management and auditing functions for abnormal information such as inactive interfaces, domain names that have not been officially enabled, domain names that cannot be found in the configuration, and interface addresses that match abnormalities.

[0082] The embodiment of the present invention can not only automatically find out the accurate information of the actual interface of each business project, but also does not require any access to the business project; no log will be generated on any part of the business project deployment architecture, and the business project will not store unnecessary data in its database; for different types of project release files, the solution is completely based on memory during the execution process, not only has high performance (it has been verified that the performance can be improved by more than 110 times that of conventional decompilation-based solutions, for example, it only takes about 0.3 seconds on a server with 8GB of memory to complete the parsing and output process of all interfaces contained in a business project image), but also does not require a Docker environment, does not need to start an application, has low requirements for resources such as memory and CPU, can run with high performance on a low-configuration server, and will not generate any temporary files on the disk during the entire process, so it also has higher reliability and is convenient for application; the result data is also valuable for access log analysis of business projects.

[0083] like Figure 1 FIG. 1 is a flowchart of a zero-load interface security protection method provided by an embodiment of the present invention, referring to FIG. Figure 1 The embodiment of the present invention provides a zero-load interface security protection method, which specifically includes the following steps:

[0084] S101, read the access log of the business service, and divide the intranet access log and the extranet access log according to the remote access IP field in the access log and the preset intranet IP address range;

[0085] S102, determining the visited intranet domain name and extranet domain name according to the intranet access log and the extranet access log;

[0086] S103, searching for the business project deployment location of the intranet domain name and the extranet domain name, obtaining the business project deployment file, and extracting the interface address of the corresponding domain name according to the business project deployment file;

[0087] S104, determining the externally open scope of the interface address, obtaining the public network open interface and the intranet access interface, and assembling to obtain the complete interface link of the public network open interface and the intranet access interface;

[0088] S105. Identify abnormal access based on the complete interface link and intercept abnormal access behavior.

[0089] like Figure 4 FIG. 1 is a flow chart of step S103 provided in an embodiment of the present invention, referring to FIG. Figure 4 As an optional implementation method, the business project deployment location of the intranet domain name and the extranet domain name is searched, the business project deployment file is obtained, and the interface address of the corresponding domain name is extracted according to the business project deployment file, which specifically includes:

[0090] S1031. Determine the service IP and port information of the intranet domain name and the extranet domain name;

[0091] S1032, searching for the business project deployment location of the corresponding domain name according to the service IP and port information, and obtaining the business project deployment file;

[0092] S1033: Determine the file type of the business project deployment file, parse the business project deployment file according to the file type, and obtain an interface address.

[0093] like Figure 5 FIG. 1 is a flowchart of step S104 provided in an embodiment of the present invention, referring to FIG. Figure 5 As an optional implementation method, the external open range of the interface address is determined, the public network open interface and the intranet access interface are obtained, and the complete interface link of the public network open interface and the intranet access interface is obtained by assembling, which specifically includes:

[0094] S1041. Search the context-path configuration value from the image file according to the starting path of the class file, and obtain the first interface address by concatenating the context-path configuration value and the interface address;

[0095] S1042, obtaining the location address of the interface address through the Web server, matching the location address with the first interface address, determining the externally accessible range of the interface address according to the matching result, and obtaining a public network open interface and an intranet access interface;

[0096] S1043, assembling a corresponding complete interface link of the public network open interface according to the corresponding domain name, location address and the first interface address that matches successfully;

[0097] S1044: Assemble the corresponding complete interface link of the intranet access interface according to the corresponding domain name, location address, and the first interface address that fails to match.

[0098] Specifically, the process of the zero-load interface automatic discovery solution of the embodiment of the present invention is as follows:

[0099] 1) Read and analyze the access logs of business services (usually the access logs of services such as Apache HTTP Server, Nginx, and k8sIngress), find the access logs that are as close to the backend service interface as possible based on the content at the end of the access link, and find the remote access host IP in these log records;

[0100] 2) Determine whether the corresponding log record is initiated by a public IP or an intranet IP based on the remote host IP: If it is a common IP, treat the IPs in the range of 10.0.0.0~10.255.255.255, 172.0.0.0~172.255.255.255, 192.0.0.0~192.255.255.255, 169.0.0.0~169.255.255.255, 127.0.0.1 as intranet IPs, otherwise as public IPs; If it is an IPv6 address, treat the IPs starting with fc00:: / 7, fd00:: / 8 or fe80:: / 10 as intranet IPs, and the rest as public IPs. It is allowed to adjust the IP judgment range here according to the actual situation;

[0101] 3) Summarize all logs of public IP and intranet IP access, extract and summarize the domain names open to the public network from the corresponding access links, and the remaining domain names are domain names for the intranet;

[0102] The following two steps implement the topology discovery from the address pointed to by the domain name to the server where the business project deployment file is located, and finally find the location where the business project deployment file is located, so as to facilitate obtaining all the deployed and online interfaces of the corresponding business from the business deployment file.

[0103] 4) Based on the domain name information, search for all service IPs and possible port information corresponding to each domain name obtained above from public network and intranet DNS services, and record the domain name that cannot be found and the last update time of the configuration;

[0104] 5) Find the deployment address of the backend business system: According to the runtime process and port information on the relevant server, combined with the results obtained in the previous step, find the specific service on the corresponding IP and port until the deployment address of the backend business system is found, mainly including business systems, traditional Web services and k8s services, and calculate the total amount of computing resources used by the business project, such as how many servers or how many Pods, including how many core CPUs and how many GB of memory;

[0105] 6) Find the deployment file of the business system deployed to the domain name: If it is a business system, find the specific deployment path of the business system according to the runtime process information on the server and obtain the business deployment file; If it is a Web service such as Nginx or Apache HTTP Server, first verify the deployment relationship according to whether the access IP of such service comes from the IP of the service in the previous link, and then find and record the possible location and reverse proxy, load balancing configuration. If there are multiple, pass / connect in the order of actual configuration, record the creation time and update time of the relevant configuration files, and then further recursively search for the configuration address or IP and port of its backend service here; If it is a k8s service, find the corresponding image;

[0106] 7) Here, based on the memory, all interface addresses contained in the project are obtained by parsing the file according to the type of business deployment file: first record the creation time and update time of the file, and then process all interface addresses according to the type of business deployment file:

[0107] a. If the deployment file has a jar or war file extension, you can use the fact that these files are compressed files to process them:

[0108] ① Read the compressed file content through the corresponding compression input stream to obtain each compressed item, and then determine whether further analysis and processing is required based on the path, name, and content contained in each compressed item;

[0109] ② Taking advantage of the fact that most current Internet businesses are built based on the MVC model, search for all compressed items in the controller folder or compressed items with the name containing Controller and the extension class based on the MVC model. You can also use reflection retrieval to obtain all classes containing interface address annotations to ensure that only required classes are processed, thereby eliminating the impact of a large number of other files in the compressed file and recording the starting path of the class file. Here, you can also use the enterprise's inherent package path information to locate the target folder;

[0110] ③ For each such compressed item, first read its compressed byte stream from the compressed file, then read the class, method and related annotation information from the class byte stream in sequence based on the JVM specification, and then use this information to construct the bytecode object representing the corresponding class;

[0111] ④ Next, take advantage of the fact that annotations are commonly used to define interfaces in current programming languages ​​and development frameworks, and find out whether the class or method of the object obtained in the previous step has annotations related to defining interface information (for example, using the Spring framework to use the RestController annotation to declare a class containing an interface, and then define the interface in such a class method; you can also use RequestMapping, GetMapping, PostMapping, PutMapping, DeleteMapping, etc. (mainly the first three) annotations to define interface information from both class and method aspects. Similar annotations also exist in languages ​​such as Go, Python, C#, or their mainstream frameworks, and interface information can also be parsed similarly), to find out all classes and methods that define interfaces;

[0112] ⑤ Comprehensively use the link addresses defined in the annotations of the class and method to determine whether it belongs to a formal interface definition: When the class annotation contains interface address information, connect the two parts in the order of the class annotation address and the method annotation address through the symbol / as the address of each interface. Otherwise, directly determine the interface address based on the address information on the method annotation, and use the definition and usage of the annotation to parse its request method. For example, the request methods of the GetMapping, PostMapping, and DeleteMapping annotations are Get, Post, and Delete, respectively. RequestMapping either uses the method attribute defined by the developer through the annotation to define the request method, or uses the default request method. Here, all annotations that do not define address link information and class interface annotations that do not contain method interface annotations should be ignored. When the address of the class annotation does not start with / , add / to the left of the first character. For these situations, alarms can be recorded for technical personnel to improve;

[0113] ⑥ Parse and record the class and specific method name of the interface. If the project does not use annotations to define the interface address, extract the interface address and the corresponding Java class method from the XML configuration file. If it fails, record the domain name and its corresponding project information for subsequent investigation.

[0114] If the release file is a project developed in C#, Python, Go, etc., it can be processed similarly based on reflection and annotation technology. Here you can also get information such as the development language / platform of the business project and the technical framework used;

[0115] b. If the deployment file is another type of compressed file, for example, the docker image of the business system deployed on k8s is a compressed file with the extension tar. Other tar files may be nested in a certain path inside this type of compressed file, so it should be noted that this type of file may have 2 or more layers of compressed files nested. The real business system release file is often a compressed file in another format, which may exist in another compressed file in any of the compressed files, and the size of the image file may exceed 1GB. The industry generally believes that "you need to decompress the .tar file before you can directly access the files in it", which is bound to cause inefficiency or even instability due to disk I / O. Therefore, if you can directly read the interface information from such a file with high performance and stability using only memory, it will be very positive for automatically discovering the interfaces defined by various projects. The solution here does not require specifying or configuring any information for the business image to be processed, and the entire process can be completed in the server memory:

[0116] ① You need to find the business system release files and their paths based on the types (file extensions) of business deployment files released by each development platform and the possible unified release paths of business files. Be careful to exclude typical folders included in the operating system, and then proceed as follows:

[0117] ②Based on the memory, the contents of all types of compressed files are read layer by layer until the target type of file is obtained according to the extension characteristics of the business deployment file, the enterprise-specific package structure information, the business class name where the interface is located, its extension class and its path, and the compressed item containing the interface definition class file and its path are found in a compressed file in the inner layer;

[0118] ③Continuously read the byte data of the compressed items of the inner compressed file in sequence, and construct the data stream object of the corresponding class file until no data can be read;

[0119] ④ According to the order specified by the JVM specification, the information about annotations, classes and their methods contained in the class byte stream is read, parsed and saved in memory for subsequent use, and then the information is used to construct an object representing the corresponding class bytecode. The traditional solution for this part is to use various ClassLoader objects of the JVM, but these class loaders actually make the loaded classes in a state that can be instantiated and run, while extracting the annotation information of the class does not require this. Therefore, using class loaders requires more resources. More importantly, conventional class loaders cannot process the compressed byte stream from the image file here. Other situations include: due to differences in class loaders, the timing of class loading and the influence of the context environment, even if the class object can be obtained through the class loader, the class annotation cannot be obtained. Therefore, class loaders are not applicable in this environment. They are also cumbersome and require more resources.

[0120] ⑤ Use this object to find the annotated class that defines the interface address information as described in the above-mentioned "jar or war file" section. Similarly, annotate the method of such a class and further obtain the interface address. In this process, you can easily parse and record the class and specific method name of the interface.

[0121] c. If the file is deployed through source code or after the source code is obfuscated to a certain extent, the link address is found from the file by using regular expressions based on the characteristics of the link address content and its location above the class and method definition;

[0122] d. If the business project deployment file has been compiled into a binary file, all interface addresses are found through symbol supplementation and symbol analysis. In special cases, relevant source code retrieval and extraction can be performed.

[0123] 8) According to the starting path of the class file, search the project configuration file with the extension of properties, yml or yaml from the compressed file or image based on the memory, and search for the possible context-path configuration from it. If it exists, concatenate the context-path configuration value and each of the above interface addresses in sequence to form a new interface address;

[0124] 9) According to the rules of matching the location configuration of the Web server (such as Nginx) with the actual business interface address and possible location configurations of this type, determine the scope of the interface open to the outside by checking whether the address obtained by the location part matches (whether the beginning of the interface address is the address configured by the location) and the interface address finally obtained in the previous step:

[0125] a. If the interface belongs to a public domain name, the public interface can be matched, and the interface that cannot be accessed from the outside but can only be accessed from the intranet cannot be matched. The address format of this type of interface is usually http: / / business deployment IP: port / project context / interface address defined by the business system;

[0126] b. If the interface belongs only to the intranet domain name, the matching interface can be accessed within the intranet, and the unmatched interface can only be accessed based on the business deployment server.

[0127] Next, the domain name, the address obtained from the location part and the successfully matched interface address are combined into a complete interface address through / , that is, all public open interfaces and their complete links are obtained, and all interfaces and their links that cannot be accessed from the public network and can only be accessed from the intranet are obtained simultaneously;

[0128] 10) Summarize and record the domain name of the business project, the deployment file name of the business project, the development language / platform of the project, the complete links of each interface included in the project, the request method of the interface, the class file where the interface is located and the package it is in, and mark each interface as a public network or intranet interface. Based on this information, relevant staff can confirm and supplement the purpose of the interface in actual work, the department to which it belongs, the person in charge, and other information, which is conducive to the specific review of the deployment environment of different interfaces, the scope of opening to different networks, and other issues.

[0129] like Figure 3 FIG. 1 is another flow chart of the steps of the zero-load interface security protection method provided by an embodiment of the present invention, referring to FIG. Figure 3 As an optional implementation, the zero-load interface security protection method further includes the following steps:

[0130] S201. When a business project deployment file is updated, the interface address and the business project to which the changed domain name corresponds are searched according to the domain name change information.

[0131] Specifically, when the project to which the interface belongs is launched or offline, a batch of interfaces may be launched or offline; when the project release file is updated, the interface's open scope to the public network, request method, interface complete link and other information may change. These interface change information can be automatically obtained by following the steps below:

[0132] 1) Regularly scan and check the location and configuration information of the domain name, load balancing and other services recorded above, and find out the changes of domain names and their projects according to the changes of DNS configuration, domain name online and offline events, and changes in the update time of business project deployment files, and adjust the correspondence between domain names and business projects when necessary;

[0133] 2) Repeat steps 4) to 7) above for all changed domain names and projects, find the changed interfaces and their projects, record the change time, change content, and the service (project) to which the change is applied, including the newly launched interfaces, offline interfaces, and related domain names;

[0134] 3) Based on the results of the previous step, get the latest domain name, project and interface list, including the interfaces of the internal and external networks.

[0135] The above solution can obtain the interface address without obtaining the original development code, which can avoid cross-departmental coordination and code security issues. It can also solve the problem that the actual deployment domain name and path are not defined in the business code, resulting in the inability to obtain the complete interface link from the business deployment file or the corresponding source code, and can automatically obtain accurate all interface links facing the public network and the intranet.

[0136] like Figure 6 FIG. 1 is a flow chart of step S105 provided in an embodiment of the present invention, referring to FIG. Figure 6 As an optional implementation method, abnormal access is identified based on the complete interface link, and abnormal access behavior is intercepted, which specifically includes:

[0137] S1051, extract the tail content of the complete interface link to obtain the tail interface link;

[0138] S1052, searching the target access log from the external network access log according to the tail interface link, the access link of the target access log includes the tail interface link, but the other parts are different from the complete interface link;

[0139] S1053, determining the suspiciousness analysis index of the target access log according to the access source IP, and determining the IP region, IP range, and IP access frequency of the target access log;

[0140] S1054, inputting the suspiciousness analysis index, the region to which the IP belongs, the range to which the IP belongs, and the IP access frequency into a pre-trained abnormal access recognition model to determine whether the target access log is an abnormal access log;

[0141] S1055, determining the corresponding abnormal behavior source IP according to the abnormal access log, and determining the risk level of the abnormal behavior source IP;

[0142] S1056. Intercept abnormal access behavior based on the source IP address and risk level of the abnormal behavior.

[0143] like Figure 7 FIG. 1 is a flow chart of step S1053 provided in an embodiment of the present invention, referring to FIG. Figure 7As an optional implementation, the suspiciousness analysis index of the target access log is determined according to the access source IP, and the IP region, IP range and IP access frequency of the target access log are determined, which specifically includes:

[0144] S10531. Determine the access source IP of the target access log, and search for suspicious analysis indicators based on the access source IP. The suspicious analysis indicators include the User-Agent, request size, response size, response status code, access time, actual access link, backend / underlying business service and IP actually reached by the access, and the project or domain name actually accessed of the target access log;

[0145] S10532. Determine the region and range to which the IP belongs based on the access source IP, and count the number of visits by the access source IP within a preset time period to obtain the IP access frequency.

[0146] like Figure 8 FIG. 1 is a flow chart of step S1055 provided in an embodiment of the present invention, referring to FIG. Figure 8 As an optional implementation, the corresponding abnormal behavior source IP is determined according to the abnormal access log, and the risk level of the abnormal behavior source IP is determined, which specifically includes:

[0147] S10551. Use the access source IP of the abnormal access log as the source IP of the abnormal behavior;

[0148] S10552, determine the interface link address set and corresponding access parameters found by the abnormal behavior source IP, and determine the business parameters, access frequency, access tool characteristics, and abnormal behavior type set successfully obtained by the abnormal behavior source IP according to the status code and response;

[0149] S10553. Determine the risk level of the IP address from which the abnormal behavior originated based on business parameters, access frequency, access tool characteristics, and an abnormal behavior type set.

[0150] The following is a description of the process of identifying and intercepting abnormal access behavior in an embodiment of the present invention.

[0151] Based on the fact that there will be no interface link or request method errors when the enterprise business itself accesses the relevant interfaces (if they occur, they are system bugs and need to be eliminated before the project goes online), the real interface information obtained above is used to analyze the access logs of the corresponding projects, which is conducive to easily identifying and classifying risky access behaviors. The results can be used for interface security protection.

[0152] The main steps are as follows:

[0153] 1) First, filter the logs whose access sources are intranet addresses from the business access logs, then extract the part excluding the domain name from the real interface address, or use the last 2 to 3 parts of the matching / split, set the result as pu, and search for the access logs whose access links contain pu in the business access logs;

[0154] 2) Check the links and logs whose contents before and after pu in the access links of the found logs are different from the corresponding contents in the real interface address corresponding to pu;

[0155] 3) Further group the logs by access source IP address to find out the User-Agent, request size, response size, response status code, access time, actual access link, backend / underlying business service and IP address that the access actually reaches, and the project or domain name that the access actually reaches. Use these data to determine whether the access source can undoubtedly access the business interface, and further use the judgment results here to determine whether the corresponding access source is suspicious. Sort each group of records by access time;

[0156] 4) Calculate the geographical area and IP range of the access based on the access source IP, and calculate the time interval between different access requests from the same IP and the access frequency within a certain period of time based on the access time;

[0157] 5) Based on the detection and protection history of WAF and similar tools or other identified problem data and normal access logs, select the data set consisting of the content in the previous two steps as the training set to train the random forest or support vector machine model. Next, use a batch of historical data sets based on such detection and protection tools as the test set to test the trained model. Then, use grid search to find the optimal model and its parameter combination and evaluate the model performance. Select the best one as the judgment model for illegal access behavior.

[0158] 6) Use the above model to classify the access logs of the interface and further find out the source of the interface link scanning and attack behavior and its IP set;

[0159] 7) For each abnormal behavior source, record the interface link address set that has been found, access parameters, business parameters and corresponding interfaces that each abnormal source has successfully obtained based on the status code and response, the number of accesses within a certain period of time, the access frequency, the characteristics of the access tools used by each, and the abnormal behavior type set;

[0160] 8) Classify all abnormal behavior sources found and verify them in combination with the original access logs of each source, and record the results of each classification according to the number, severity or impact of abnormal behavior, so as to facilitate the subsequent adoption of appropriate protective measures;

[0161] 9) Taking advantage of the fact that network requests first pass through the Linux kernel and then are passed to the corresponding business system, an eBPF program is developed to integrate the above model and support remote updating of the model. The program is used to parse HTTP / HTTPS protocol requests in real time. According to the request header information actually accessed, whether the interface link actually accessed is a real link, and the proportion of real links in all access links, the abnormal access behavior classification determined by the above model is used to analyze, identify, and filter abnormal access behaviors on the network card side of the business service or the appropriate network device side, so that the abnormal request is detected and intercepted and filtered out in advance based on the operating system kernel before reaching the Web server of the corresponding interface or business signature, that is, the abnormal request is terminated directly on the network device, so that it will not affect the business system and occupy unnecessary business server resources, and will not generate unnecessary business access logs. Next, the main data of the filtered requests are recorded in batches according to time periods, including the source of the abnormality, related interfaces, number of visits, request parameters, etc., and the incomplete access log records can also be output in the required format.

[0162] The method steps of the embodiment of the present invention are described above, and it can be recognized that the embodiment of the present invention realizes the automatic discovery of interface information and the automatic identification and interception of abnormal access behavior, thereby improving the security protection capability of the interface and the security of the system. The present invention is further described below in conjunction with a specific embodiment.

[0163] In order to collect and report the interfaces open to the public network for a series of businesses, an Internet company A spent several months mobilizing employees of various products to manually collect and summarize open interface information. Even after two rounds of reporting and improvement, it still encountered problems including incomplete reported data, incomplete interface links, data errors, irregularities, duplications, etc. The solution of the embodiment of the present invention can realize the automatic collection of interface information facing the internal and external networks, and automatically obtain the accurate links and request methods of all interfaces open to the public network without manual intervention. The resulting data also helps to use the interface as the basis and object for in-depth resource management and protection. The main implementation steps are as follows:

[0164] 1) Collect and store access logs of various business projects through Apache HTTP Server, Nginx, k8sIngress and other services through ELK or similar tools;

[0165] 2) Collect the processes and configurations of security services such as DNS, load balancing, reverse proxy, and firewall on each server in the production environment;

[0166] 3) According to the above interface automatic discovery solution, the log is analyzed to find out the domain name actually accessed, and all interfaces deployed in the existing network are found according to the domain name, and the events related to interface updates are responded to to obtain the interface change information, so as to always obtain the accurate information set of the interface and its project and domain name;

[0167] 4) Generate a report file of the public network open interface and related information in xlsx format for relevant personnel to confirm and supplement the necessary data;

[0168] 5) You can further choose to analyze the access log of the business project to which the interface belongs based on the obtained interface address, find out abnormal access behaviors, classify them, and take appropriate protective response measures.

[0169] The method steps of the embodiments of the present invention are described above. It can be recognized that the present invention comprehensively utilizes the access log of the business project and the deployment file of the corresponding project, and utilizes reflection or symbolic analysis technology to automatically obtain the real interface link data set for the actual deployment of the public network and the intranet and the deployment topology of the related projects completely based on the memory, including obtaining the latest interface information by responding to the interface deployment information change event, which solves the problem that the full amount of public network and intranet interfaces and their complete links cannot be accurately obtained at any time due to the incomplete interface address contained in the source code, the difficulty of the log to include inactive interfaces, and the abnormal access contained in the massive logs causing the interface address to be inaccurate; analyzing the interface access log according to the real interface link helps to distinguish normal access from a large amount of log data, identify and classify abnormal access behaviors and respond to them respectively, including directly shielding the impact of abnormal access on the real interface data from the network card or network device; using the discovered accurate interface link data set and access log, evaluate and determine the actual access volume, abnormal access volume, and access quality of the interface, module, microservice, project, and product dimensions, and simultaneously provide specific interfaces and corresponding codes with different access volume and access quality levels and corresponding quantitative data on R&D efficiency and quality, and further provide labels reflecting interface characteristics and interface resource utilization in the project dimension based on interface functional semantics.

[0170] Compared with the prior art, the embodiments of the present invention also have the following advantages:

[0171] 1) High performance and good versatility: The present invention does not require users to specify unique information of the business system and its interface information. The interface address can be obtained directly from the project release file that is formally deployed after packaging based on memory analysis. The interface of any project built using different programming languages, frameworks or development platforms can be universally and efficiently parsed and extracted, filling the industry gap of directly obtaining interface information from project release files without decompressing them.

[0172] 2) Zero load: The tool constructed by the solution of the present invention can be run on any server that can access the business deployment file, and does not need to be deployed to the formal business server. In addition, the discovery and protection process of interface information will not affect the running business services, nor will it cause any increase or change in the data of the business access log;

[0173] 3) The present invention can accurately find out the links of all interfaces actually deployed on the public network and the intranet, the implementation methods corresponding to the interfaces, the last access information of the interfaces, and the inactive interfaces;

[0174] 4) The present invention can find out the hierarchical deployment topology from domain name to business project deployment files;

[0175] 5) The present invention supports treating interface links as important resources, and deepens the management of business projects and their resources into management based on interface information, which helps to quickly and accurately discover inactive or rarely accessed interfaces;

[0176] 6) Using real interface addresses to analyze business access behaviors helps to quickly and more accurately identify the source of interface scanning and attack behaviors, making it easier to classify and protect abnormal access behaviors;

[0177] 7) In addition to intercepting abnormal access based on the network card, the solution of the present invention will not have any impact on business files, user operations on the business system, business data and logs during execution, nor will it cause the specific business system to increase data or files.

[0178] like Fig. 9 FIG. 1 is a schematic diagram of the structure of a zero-load interface safety protection device provided by an embodiment of the present invention, referring to FIG. Fig. 9 , an embodiment of the present invention provides a zero-load interface safety protection device, comprising:

[0179] The access log reading module is used to read the access log of the business service and divide the intranet access log and the extranet access log according to the remote access IP field in the access log and the preset intranet IP address range;

[0180] An access domain name determination module is used to determine the visited intranet domain name and extranet domain name based on the intranet access log and the extranet access log;

[0181] The interface address extraction module is used to find the business project deployment location of the intranet domain name and the extranet domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name according to the business project deployment file;

[0182] The interface complete link assembly module is used to determine the external open scope of the interface address, obtain the public network open interface and the intranet access interface, and assemble to obtain the interface complete link of the public network open interface and the intranet access interface;

[0183] The abnormal access behavior interception module is used to identify abnormal access based on the complete link of the interface and intercept abnormal access behavior.

[0184] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0185] The embodiment of the present invention also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned zero-load interface security protection method. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0186] like Fig.10 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Fig.10 , an embodiment of the present invention provides an electronic device, including:

[0187] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0188] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the zero-load interface security protection method of the embodiment of the present invention;

[0189] Input / output interface 1003, used to implement information input and output;

[0190] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0191] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0192] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0193] like Fig.11 FIG. 1 is a schematic diagram of a storage medium according to an embodiment of the present invention. Fig.11 An embodiment of the present invention further provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs 1101, and the one or more programs 1101 can be executed by one or more processors to implement the above-mentioned zero-load interface security protection method.

[0194] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0195] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0196] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0197] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0198] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0199] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0200] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0201] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0202] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0203] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0204] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A zero-load interface security protection method, characterized in that: The following steps are involved: Read the access log of the business service, and divide the intranet access log and the extranet access log according to the remote access IP field in the access log and the preset intranet IP address range; Determine the visited intranet domain name and extranet domain name according to the intranet access log and the extranet access log; Find the business project deployment location of the intranet domain name and the extranet domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name according to the business project deployment file; Determine the externally open scope of the interface address, obtain the public network open interface and the intranet access interface, and assemble to obtain the complete interface link of the public network open interface and the intranet access interface; Abnormal access is identified based on the complete link of the interface, and abnormal access behavior is intercepted.

2. A zero-load interface safety protection method according to claim 1, characterized in that: The zero-load interface safety protection method further comprises the following steps: When the business project deployment file is updated, the interface address and the business project to which the changed domain name corresponds are searched according to the domain name change information.

3. A zero-load interface safety protection method according to claim 1, characterized in that: The identifying of abnormal access according to the complete link of the interface and intercepting the abnormal access behavior specifically includes: Extract the tail content of the complete interface link to obtain the tail interface link; Searching for a target access log from the external network access log according to the tail interface link, wherein the access link of the target access log includes the tail interface link, but other parts are different from the complete interface link; Determine the suspiciousness analysis index of the target access log according to the access source IP, and determine the IP region, IP range and IP access frequency of the target access log; Input the suspiciousness analysis index, the region to which the IP belongs, the range to which the IP belongs, and the IP access frequency into a pre-trained abnormal access recognition model to determine whether the target access log is an abnormal access log; Determine the corresponding abnormal behavior source IP according to the abnormal access log, and determine the risk level of the abnormal behavior source IP; The abnormal access behavior is intercepted according to the abnormal behavior source IP and the risk level.

4. A zero-load interface safety protection method according to claim 1, characterized in that: The searching for the business project deployment location of the intranet domain name and the extranet domain name to obtain the business project deployment file, and extracting the interface address of the corresponding domain name according to the business project deployment file, specifically includes: Determine the service IP and port information of the intranet domain name and the extranet domain name; Find the business project deployment location of the corresponding domain name according to the service IP and the port information, and obtain the business project deployment file; The file type of the business project deployment file is determined, and the business project deployment file is parsed according to the file type to obtain the interface address.

5. A zero-load interface safety protection method according to claim 1, characterized in that: The determining of the externally open scope of the interface address, obtaining the public network open interface and the intranet access interface, and assembling to obtain the interface complete link of the public network open interface and the intranet access interface specifically includes: Searching for a context-path configuration value in the image file according to the starting path of the class file, and obtaining a first interface address by concatenating the context-path configuration value and the interface address; Obtaining the location address of the interface address through a Web server, matching the location address with the first interface address, determining the externally accessible scope of the interface address according to the matching result, and obtaining the public network open interface and the intranet access interface; Assemble the corresponding interface complete link of the public network open interface according to the corresponding domain name, the location address and the first interface address that matches successfully; The interface complete link of the corresponding intranet access interface is assembled according to the corresponding domain name, the location address and the first interface address that fails to match.

6. A zero-load interface safety protection method according to claim 3, characterized in that: The method of determining the suspiciousness analysis index of the target access log according to the access source IP, and determining the IP region, IP range and IP access frequency of the target access log specifically includes: Determine the access source IP of the target access log, and search for the suspiciousness analysis indicator according to the access source IP, wherein the suspiciousness analysis indicator includes the User-Agent, request size, response size, response status code, access time, actual access link, backend / underlying business service and IP actually reached by the access, and the project or domain name actually accessed of the target access log; The region to which the IP belongs and the range to which the IP belongs are determined according to the access source IP, and the number of visits of the access source IP within a preset time period is counted to obtain the IP access frequency.

7. A zero-load interface safety protection method according to claim 3, characterized in that: Determining the corresponding abnormal behavior source IP according to the abnormal access log, and determining the risk level of the abnormal behavior source IP, specifically includes: The access source IP of the abnormal access log is used as the source IP of the abnormal behavior; Determine the interface link address set and corresponding access parameters found by the abnormal behavior source IP, and determine the business parameters, access frequency, access tool characteristics and abnormal behavior type set successfully obtained by the abnormal behavior source IP according to the status code and response; The risk level of the abnormal behavior source IP is determined according to the business parameters, the access frequency, the access tool characteristics and the abnormal behavior type set.

8. A zero-load interface safety protection device, characterized in that: include: An access log reading module is used to read the access log of the business service and divide the intranet access log and the extranet access log according to the remote access IP field in the access log and the preset intranet IP address range; An access domain name determination module, used to determine the visited intranet domain name and extranet domain name according to the intranet access log and the extranet access log; An interface address extraction module is used to find the business project deployment location of the intranet domain name and the extranet domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name according to the business project deployment file; An interface complete link assembly module, used to determine the external open scope of the interface address, obtain the public network open interface and the intranet access interface, and assemble to obtain the interface complete link of the public network open interface and the intranet access interface; The abnormal access behavior interception module is used to identify abnormal access according to the complete link of the interface and intercept the abnormal access behavior.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the zero-load interface security protection method as described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the zero-load interface security protection method as described in any one of claims 1 to 7.

Images