Unauthorized vulnerability detection method, device, storage medium and computer equipment

Abstract

The present application proposes a method, device, storage medium and computer equipment for detecting unauthorized vulnerabilities, the method comprising receiving a request message; determining first account information corresponding to the request message; determining second account information of a session corresponding to the request message; and performing unauthorized vulnerability detection on the request message based on the first account information combined with the second account information. The present application can effectively improve the comprehensiveness of unauthorized vulnerability detection, improve the accuracy of unauthorized vulnerability detection, and thus improve the detection effect of unauthorized vulnerabilities.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a method, device, storage medium and computer equipment for detecting an unauthorized vulnerability. Background Art

[0002] Among various security vulnerabilities, logic vulnerabilities are more difficult to find and more likely to occur than traditional security vulnerabilities such as SQL structured query language (Structured Query Language) injection, so this type of vulnerability has become one of the main causes of security risks such as data leakage. Among various logic vulnerabilities, unauthorized vulnerabilities are more common. Developers often cannot ensure that all interfaces have perfect permission verification logic, resulting in more or less unauthorized vulnerabilities in certain interfaces in the application. Once they exist in key interfaces, such as interfaces for obtaining sensitive information and performing sensitive operations, they will cause serious security problems.

[0003] In the related technologies, logical vulnerabilities are usually detected based on features, but the feature-based detection method is difficult to apply to the detection of unauthorized access vulnerabilities, because the attack requests of unauthorized access vulnerabilities do not have fixed request features. Alternatively, unauthorized access vulnerabilities are detected by identifying the form in the request response page and the non-modifiable parameters in the corresponding hidden field. The detection coverage of this type of method is limited and the detection accuracy is poor. Summary of the invention

[0004] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the purpose of this application is to propose a detection method, device, storage medium and computer equipment for unauthorized vulnerability, which can effectively improve the comprehensiveness of unauthorized vulnerability detection, improve the accuracy of unauthorized vulnerability detection, and thus improve the detection effect of unauthorized vulnerability.

[0006] To achieve the above-mentioned purpose, the method for detecting an unauthorized access vulnerability proposed in the first aspect of the embodiment of the present application includes: receiving a request message; determining first account information corresponding to the request message; determining second account information of a session corresponding to the request message; and performing an unauthorized access vulnerability detection on the request message based on the first account information in combination with the second account information.

[0007] The method for detecting an unauthorized vulnerability proposed in the first aspect of the embodiment of the present application, by receiving a request message, determining the first account information corresponding to the request message, and determining the second account information of the session corresponding to the request message, and performing unauthorized vulnerability detection on the request message based on the first account information combined with the second account information, can effectively improve the comprehensiveness of unauthorized vulnerability detection, improve the accuracy of unauthorized vulnerability detection, and thus improve the detection effect of unauthorized vulnerability.

[0008] To achieve the above-mentioned purpose, the second aspect of the present application proposes a detection device for an unauthorized vulnerability, including: a receiving module for receiving a request message; a first determination module for determining the first account information corresponding to the request message; a second determination module for determining the second account information of the session corresponding to the request message; and a detection module for performing an unauthorized vulnerability detection on the request message based on the first account information in combination with the second account information.

[0009] The unauthorized vulnerability detection device proposed in the second aspect of the embodiment of the present application can effectively improve the comprehensiveness of the unauthorized vulnerability detection, improve the accuracy of the unauthorized vulnerability detection, and thus improve the detection effect of the unauthorized vulnerability by receiving a request message, determining the first account information corresponding to the request message, and determining the second account information of the session corresponding to the request message, and performing unauthorized vulnerability detection on the request message based on the first account information and the second account information.

[0010] The non-temporary computer-readable storage medium proposed in the third aspect embodiment of the present application, when the instructions in the storage medium are executed by the processor of the computer device, enables the computer device to execute a method for detecting an unauthorized vulnerability, and the method includes: the method for detecting an unauthorized vulnerability proposed in the first aspect embodiment of the present application.

[0011] The non-temporary computer-readable storage medium proposed in the third aspect embodiment of the present application can effectively improve the comprehensiveness of unauthorized vulnerability detection, improve the accuracy of unauthorized vulnerability detection, and thus improve the detection effect of unauthorized vulnerability by receiving a request message, determining the first account information corresponding to the request message, and determining the second account information of the session corresponding to the request message, and performing unauthorized vulnerability detection on the request message based on the first account information and the second account information.

[0012] The computer device proposed in the fourth aspect of the present application includes: a shell, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the shell, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the computer device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method for detecting unauthorized vulnerabilities proposed in the first aspect of the present application.

[0013] The computer device proposed in the fourth aspect of the present application can effectively improve the comprehensiveness of unauthorized vulnerability detection and the accuracy of unauthorized vulnerability detection by receiving a request message, determining the first account information corresponding to the request message, and determining the second account information of the session corresponding to the request message, and performing unauthorized vulnerability detection on the request message based on the first account information and the second account information, thereby improving the detection effect of unauthorized vulnerability.

[0014] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0016] Figure 1 It is a flowchart of a method for detecting an unauthorized vulnerability proposed in an embodiment of the present application;

[0017] Figure 2 The implementation process of configuring the corresponding relationship table in the embodiment of the present application;

[0018] Figure 3 It is a flowchart of a method for detecting an unauthorized vulnerability proposed in another embodiment of the present application;

[0019] Figure 4 It is a structural diagram of a detection device for an unauthorized vulnerability proposed in an embodiment of the present application;

[0020] Figure 5 It is a structural schematic diagram of a detection device for an unauthorized vulnerability proposed in another embodiment of the present application;

[0021] Figure 6 It is a schematic diagram of the structure of a computer device proposed in one embodiment of the present application. DETAILED DESCRIPTION

[0022] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be construed as limiting the present application. On the contrary, the embodiments of the present application include all changes, modifications and equivalents that fall within the spirit and connotation of the appended claims.

[0023] Figure 1 It is a flowchart of a method for detecting an unauthorized vulnerability proposed in an embodiment of the present application.

[0024] This embodiment is described by taking the detection method of the unauthorized vulnerability as an example in which the detection device of the unauthorized vulnerability is configured.

[0025] In this embodiment, the method for detecting an unauthorized vulnerability may be configured in a detection device for an unauthorized vulnerability. The detection device for an unauthorized vulnerability may be set in a server, or may also be set in a computer device, and this embodiment of the present application does not limit this.

[0026] This embodiment takes the method for detecting an unauthorized vulnerability being configured in a computer device as an example.

[0027] It should be noted that the execution entity of the embodiment of the present application may be, for example, a central processing unit (CPU) in a server or computer device in terms of hardware, or may be, for example, a related background service in a server or computer device in terms of software, without limitation.

[0028] See also Figure 1 , the method comprising:

[0029] S101: Receive a request message.

[0030] The request message may be, for example, a request message supporting HTTP (Hyper Text Transfer Protocol), or may also be a request message supporting any other communication protocol, without limitation.

[0031] Typically in data communication application scenarios, a computer device may respond to a user access instruction and generate a corresponding request message according to the user access instruction, thereby sending the request message to a background server to obtain a corresponding service.

[0032] An example of the format of a request message may be:

[0033] (Each request message will generate a unique request ID, such as xxxxxx)

[0034] POST / pages / viewpage.action HTTP / 1.1

[0035] Host:xx.xx.com

[0036] Connection:keep-alive

[0037] Pragma:no-cache

[0038] Cache-Control: no-cache

[0039] Upgrade-Insecure-Requests:1

[0040] User-Agent:Mozilla / 5.0(Macintosh;Intel Mac OS

[0041] Sec-Fetch-Site:none

[0042] Accept-Encoding:gzip,deflate,br

[0043] Accept-Language:zh-CN,zh; q=0.9,zh-TW; q=0.8

[0044] Cookie:JSESSIONID=36F106BD456DFB53C04F7EFE271111E3.

[0045] S102: Determine first account information corresponding to the request message.

[0046] It is understandable that when obtaining the corresponding service of the backend server based on the request message, the request message usually carries some account-related information of the user. The account-related information can be called the first account information. The first account information can be used to identify the account of the user using the computer device, or the user identity (ID number, mobile phone number, etc.), without any restriction.

[0047] During the specific execution process, the request message can be parsed to obtain authentication information (authentication information is, for example, cookie (a computer file that sends information to a central server by a network or Internet user), token, etc.), so as to obtain the first account information corresponding to the request message based on the authentication information.

[0048] The first account information includes, for example, user UID (short for User Identification), user mobile phone number, user nickname, user ID number, etc.

[0049] Of course, in the actual execution process, the first account information collected can be flexibly defined according to the application situation. For example, the data that the application may use for resource positioning can be collected. For example, for an application, if the acquisition and operation of sensitive data is mainly determined by UID to determine the authority, then the focus is on collecting the user UID as the first account information, and there is no restriction on this.

[0050] S103: Determine second account information of the session corresponding to the request message.

[0051] In some embodiments, the request message also includes: a request identifier, determining the second account information of the session corresponding to the request message, including: determining a sample request identifier that matches the request identifier from a preconfigured correspondence table; the correspondence table has learned the correspondence between the sample request identifier, the sample session account corresponding to the sample request identifier, and the sample account information; and taking the sample session account corresponding to the sample request identifier and the sample account information corresponding to the sample session account together as the second account information.

[0052] That is to say, a correspondence table is pre-configured in the embodiment of the present application, and the correspondence table has learned the correspondence between the sample request identifier, the sample session account corresponding to the sample request identifier, and the sample account information. Therefore, when determining the second account information corresponding to the session corresponding to the request message, the corresponding sample session account can be directly read from the correspondence table according to the request identifier, and the sample account information corresponding to the sample session account can be used as the second account information. This can quickly determine the second account information corresponding to the session corresponding to the request message, thereby ensuring the detection efficiency of unauthorized vulnerabilities and promptly avoiding resource leakage caused by request messages with unauthorized vulnerabilities accessing applications.

[0053] For example, the corresponding relationship table can refer to the following Table 1, where the field values ​​in Table 1 are based on the format of the above request message as an example:

[0054] Table 1

[0055]

[0056] That is to say, for the above Table 1, after parsing the request identifier in the request message, the session account (session account), session account detailed information, etc. can be directly read from Table 1 as the second account information.

[0057] Of course, any other possible method may be used to determine the second account information of the session corresponding to the request message, and there is no limitation to this.

[0058] The process of pre-configuring the correspondence table can be exemplified as follows (the example can be referred to in Table 1 and the format example of the request message, and can be referred to in Figure 2 , Figure 2The implementation process of configuring the corresponding relationship table in the embodiment of the present application): the corresponding relationship between the sample authentication identifier (cookie, token, etc.) corresponding to the sample request message and the user account information is collected. When the sample authentication identifier of the sample request message is collected, the application login interface can be detected to extract the login account and the cookie or token after the login is completed, or the user center can be connected to obtain the corresponding relationship between the cookie or token after the login and the user, or RASP (Runtime Application Self-Protection, real-time application self-protection) technology, obtains the correspondence between all requests and sessions in real time within the application, or it can be the login record table of the docking application, obtains the correspondence between the application login account and the request cookie or token, etc., or it can be any other possible method, without limitation, so as to collect the correspondence between the sample request identifier and the session, and then collects the sample user account associated with the sample request message, and the correspondence between the account information associated with the sample user account. The account information associated with the sample user account, for example, the user account is xxx@xx.com, and the detailed information that needs to be collected may include: user UID, user mobile phone number, user nickname, user ID number, etc., and then, use the above collected data to configure the correspondence table.

[0059] S104: Perform unauthorized vulnerability detection on the request message according to the first account information and the second account information.

[0060] After collecting the first account information corresponding to the request message and determining the second account information of the session corresponding to the request message, the request message can be directly detected for unauthorized vulnerabilities based on the first account information and the second account information. Therefore, there is no need to perform unauthorized vulnerability detection based on feature detection rules. Instead, unauthorized vulnerability detection is performed directly based on some account information associated with the request message, thereby avoiding the shortcomings of detection using feature detection rules. In addition, since unauthorized vulnerabilities are unauthorized access and calls to some interfaces, the request message is detected based on the dimension of account information to determine whether there are unauthorized vulnerabilities, which makes the detection of unauthorized vulnerabilities more targeted, thereby improving the accuracy of unauthorized vulnerability detection.

[0061] In some embodiments, when the request message is checked for an unauthorized access vulnerability based on the first account information in combination with the second account information, it can be that when the matching status between the first account information and the second account information is a mismatch, it is determined that the request message has an unauthorized access vulnerability, and if the matching status between the first account information and the second account information is a match, it is determined that the request message does not have an unauthorized access vulnerability.

[0062] Of course, any other possible method may be used to perform unauthorized vulnerability detection on the request message according to the first account information in combination with the second account information, such as a modeling method, an engineering method, etc., and there is no limitation on this.

[0063] The embodiment of the present application also provides a specific implementation method for performing unauthorized vulnerability detection on a request message based on the first account information combined with the second account information. For details, please refer to the following embodiment.

[0064] In this embodiment, by receiving a request message, determining the first account information corresponding to the request message, determining the second account information of the session corresponding to the request message, and performing unauthorized vulnerability detection on the request message based on the first account information and the second account information, the comprehensiveness of unauthorized vulnerability detection can be effectively improved, the accuracy of unauthorized vulnerability detection can be improved, and thus the detection effect of unauthorized vulnerability can be improved.

[0065] Figure 3 It is a flowchart of a method for detecting an unauthorized vulnerability proposed in another embodiment of the present application.

[0066] See also Figure 3 , the method comprising:

[0067] S301: Receive a request message.

[0068] The request message is used to invoke the target interface of the application.

[0069] S302: Determine first account information corresponding to the request message.

[0070] S303: Determine second account information of the session corresponding to the request message.

[0071] S301 - S303 may refer to the above embodiment.

[0072] S304: Determine whether the target interface information is in a preconfigured interface parameter table, where the interface parameter table has learned the correspondence between the sample interface information and the sample account information that can be ignored and that corresponds to the sample interface information.

[0073] The interface parameter table may be pre-configured, and the fields in the interface parameter table indicate that if the information of the target interface matches the information of the sample interface, some categories of account information may be ignored during the detection of the unauthorized vulnerability.

[0074] The interface parameter table may be shown in Table 2 below:

[0075] Table 2

[0076] App ID Request Type interface Ignore parameters Other fields aaaaaaa POST / userinfo uid …

[0077] The information of the target interface may include, for example: the application ID to which it belongs, the target interface, and the request type of the request message. Correspondingly, the interface parameter table lists the sample application ID, sample request type, name of the sample interface, and the corresponding ignorable sample account information. The above Table 2 uses the ignorable sample account information as the UID as an example. Of course, the ignorable sample account information can be configured as any account information, and there is no restriction on this.

[0078] That is to say, in the embodiment of the present application, the information of the target interface is first parsed and determined whether the information of the target interface is in the preconfigured interface parameter table. If it is in the preconfigured interface parameter table, it is then determined whether there is corresponding target account information that can be ignored, thereby assisting in the detection of subsequent unauthorized vulnerability detection based on the unauthorized target account information, thereby effectively ensuring the hit rate and accuracy of the detection, and improving the detection effect of the unauthorized vulnerability.

[0079] S305: If the target interface information is not in the preconfigured interface parameter table, or if the target interface information is in the preconfigured interface parameter table and the first account information does not match the ignorable target account information corresponding to the target interface information, perform an unauthorized vulnerability detection on the request message according to the matching status between the first account information and the second account information.

[0080] Optionally, if the matching status between the first account information and the second account information is not a match, it is determined that the request message has an unauthorized access vulnerability; if the matching status between the first account information and the second account information is a match, it is determined that the request message does not have an unauthorized access vulnerability.

[0081] S306: If the information of the target interface is in the pre-configured interface parameter table, and the first account information matches the target account information, it is directly determined that there is no unauthorized vulnerability in the request message.

[0082] In some embodiments, it is determined whether the request message submits a field included in the second account information of the session (which may be referred to as the target account information). If not, the detection of the unauthorized access vulnerability of the request message is terminated; if included, the detection is continued. In other words, if not included, it can be directly determined that there is no possibility of unauthorized access and call to the request message. At this time, the logic for unauthorized access vulnerability detection may not be triggered, which can effectively save the consumption of hardware and software resources required for detection, making the detection of unauthorized access vulnerabilities more reasonable and improving the rationality of the detection logic configuration.

[0083] For example, in the above sample request, uid=12345 is passed in POSTDATA, which includes the field uid in the user account. Then, further unauthorized access vulnerability detection can be performed, and the matching field is uid.

[0084] For example, when the unauthorized vulnerability detection is triggered, the pre-configured interface parameter table can be compared, and if the information of the target interface of the request message is in the pre-configured interface parameter table, and the first account information matches the target account information, it is directly determined that there is no unauthorized vulnerability in the request message. Otherwise, an alarm prompt is issued.

[0085] For example:

[0086] If the request message is:

[0087] POST / userinfo HTTP / 1.1

[0088] Host:xx.xx.com

[0089] Connection:keep-alive

[0090] Pragma:no-cache

[0091] Cache-Control: no-cache

[0092] Upgrade-Insecure-Requests:1

[0093] User-Agent:Mozilla / 5.0(Macintosh;Intel Mac OS

[0094] Sec-Fetch-Site:none

[0095] Accept-Encoding:gzip,deflate,br

[0096] Accept-Language:zh-CN,zh; q=0.9,zh-TW; q=0.8

[0097] Cookie:JSESSIONID=36F106BD456DFB53C04F7EFE271111E3

[0098] First account information uid=12345

[0099] The user corresponding to the cookie is xx@xxx.com, and the second account information is {'uid':'11111','username':'xx','phone':'177777777777'}. Although the uid submitted in the request message is inconsistent with the corresponding UID in the session, the pre-configured interface parameter table believes that the detection of the UID field can be ignored, so the detection result is directly ended without an alarm.

[0100] If the request message is:

[0101] POST / pages / viewpage.action HTTP / 1.1

[0102] Host:xx.xx.com

[0103] Connection:keep-alive

[0104] Pragma:no-cache

[0105] Cache-Control: no-cache

[0106] Upgrade-Insecure-Requests:1

[0107] User-Agent:Mozilla / 5.0(Macintosh;Intel Mac OS

[0108] Sec-Fetch-Site:none

[0109] Accept-Encoding:gzip,deflate,br

[0110] Accept-Language:zh-CN,zh; q=0.9,zh-TW; q=0.8

[0111] Cookie:JSESSIONID=36F106BD456DFB53C04F7EFE271111E3

[0112] First account information uid=12345&pageId=037664704

[0113] Since there is no / pages / viewpage.action interface in the pre-configured interface parameter table, and the submitted uid=12345, while the uid corresponding to the session is 11111, the detection results are inconsistent, so an unauthorized attack alarm is directly generated.

[0114] In an embodiment of the present application, a method flow diagram for pre-configuring an interface parameter table is also provided, which can be used to obtain a large number of sample request messages before receiving a request message, wherein the sample request message includes sample authentication information; parse the sample authentication information to obtain sample account information corresponding to the sample request message; identify ignorable sample account information from the sample account information based on historical access information of the sample request message; parse the information of the sample interface corresponding to the sample request message, and establish an interface parameter table based on the sample interface information and the ignorable sample account information corresponding to the sample interface information.

[0115] That is to say, the embodiment of the present application collects massive sample request messages, and identifies the sample account information that can be ignored from the sample account information based on the historical access information of the sample request messages, and then establishes an interface parameter table using big data training, thereby effectively helping to improve the accuracy of detection, and has good detection capabilities and a wide detection range for unauthorized attacks.

[0116] For example, obtain the data of the correspondence table between request messages and account information in the past n days (the default configuration is 30 days, and any time length can be selected), and filter to obtain the data containing the corresponding account information in all request message submissions. For the filtered data, automatically identify the data whose account information in the request message submission data is inconsistent with the account details of the session, and mark it.

[0117] For example, if the phone number submitted in the request message is 17788888888, but the phone information corresponding to the account actually associated with the session is 177777777777, it is marked as inconsistent with the phone field submitted in the request message. Then, the algorithm model is used to learn the identified and marked data to identify which fields of which interfaces can submit data that is inconsistent with the account information bound to the session. The learning logic is: for the same interface, for a long time, among the account information submitted by request messages from a large number of different accounts, most request messages are marked with a certain field that can submit data that is inconsistent with the data in the session. In this case, it can be considered that the interface can submit such data. The learning algorithm can be a classification or clustering algorithm. The model learning result is that in the submitted data of a certain interface of a certain application, the data of a certain account information may not correspond to the account information in the session, so as to configure the interface parameter table.

[0118] After the interface parameter table is preconfigured, if the information of the target interface is not in the preconfigured interface parameter table, or if the information of the target interface is in the preconfigured interface parameter table, and when the first account information and the target interface information corresponding to the ignorable target account information do not match, if it is detected that the first account information and the target account information match differently, and the first account information and the second account information do not match, a prompt message can also be generated. If the user's selection for the prompt message is: ignore the mismatch between the first account information and the second account information in this application scenario, it means that the first account information may not match the second account information in this application scenario. At this time, the first account information can be added to the interface parameter table, so as to improve the interface parameter table during dynamic detection.

[0119] For example, the alarm content is, application: a, interface: / pages / viewpage.action, alarm parameter: uid, alarm content: actual UID is 11111 and the request submitted is 12345..., the user can choose to click to ignore this alarm, and during the ignoring process, you can choose to ignore the application, ignore the application interface, and ignore the parameter of the application interface. For example, if you choose to ignore the UID parameter of the / pages / viewpage.action interface of application a, then no alarm will be issued for any subsequent submission of any value for the interface UID. For false alarms generated in special scenarios, rapid optimization and elimination can be achieved by adopting user-side calibration, thereby effectively reducing the false alarm rate and improving the detection accuracy by continuously improving the interface parameter table.

[0120] In this embodiment, the target interface information is obtained by parsing, and it is determined whether the target interface information is in the preconfigured interface parameter table. If it is in the preconfigured interface parameter table, it is further determined whether there is corresponding ignorable target account information, so as to assist the subsequent detection of unauthorized vulnerabilities based on the ignorable target account information, thereby effectively ensuring the hit rate and accuracy of detection, and improving the detection effect of unauthorized vulnerabilities. By collecting massive sample request messages, and identifying ignorable sample account information from sample account information based on the historical access information of sample request messages, an interface parameter table is established by big data training, which effectively helps to improve the accuracy of detection, and has good detection capabilities and a wide detection range for unauthorized attacks. Rapid optimization and elimination can be achieved by adopting user-side calibration, so that the false alarm rate can be effectively reduced, and the detection accuracy can be improved by continuously improving the interface parameter table.

[0121] Figure 4 It is a structural diagram of a detection device for an unauthorized vulnerability proposed in an embodiment of the present application.

[0122] See also Figure 4, the detection device 400 for the unauthorized vulnerability includes:

[0123] Receiving module 401, used for receiving a request message;

[0124] A first determining module 402, configured to determine first account information corresponding to the request message;

[0125] A second determination module 403, configured to determine second account information corresponding to the session corresponding to the request message;

[0126] The detection module 404 is used to perform unauthorized vulnerability detection on the request message according to the first account information and the second account information.

[0127] Optionally, in some embodiments, see Figure 5 The request message is used to call the target interface of the application and also includes:

[0128] A judgment module 405 is used to judge whether the information of the target interface is in a pre-configured interface parameter table after receiving the request message, and the interface parameter table has learned the correspondence between the information of the sample interface and the sample account information that can be ignored corresponding to the information of the sample interface;

[0129] The detection module 404 is specifically used for:

[0130] According to the result of the determination, the request message is checked for unauthorized access vulnerabilities in combination with the first account information and the second account information.

[0131] Optionally, in some embodiments, the detection module 404 is further configured to:

[0132] If the target interface information is not in the preconfigured interface parameter table, or if the target interface information is in the preconfigured interface parameter table and the first account information does not match the ignorable target account information corresponding to the target interface information, perform an unauthorized vulnerability detection on the request message according to the matching status between the first account information and the second account information;

[0133] If the information of the target interface is in the pre-configured interface parameter table, and the first account information matches the target account information, it is directly determined that there is no unauthorized vulnerability in the request message.

[0134] Optionally, in some embodiments, the detection module 404 is further configured to:

[0135] If the matching status between the first account information and the second account information is not matched, it is determined that the request message has an unauthorized vulnerability;

[0136] If the matching status between the first account information and the second account information is a match, it is determined that there is no unauthorized vulnerability in the request message.

[0137] Optionally, in some embodiments, the request message further includes: a request identifier, and a second determination module 403 is specifically configured to:

[0138] Determine a sample request identifier that matches the request identifier from a preconfigured correspondence table; the correspondence table has learned the correspondence between the sample request identifier, the sample session account corresponding to the sample request identifier, and the sample account information;

[0139] The sample session account corresponding to the sample request identifier and the sample account information corresponding to the sample session account are collectively used as the second account information.

[0140] Optionally, in some embodiments, see Figure 5 , also includes:

[0141] Establish module 406, which is used to obtain massive sample request messages before receiving request messages, the sample request messages include sample authentication information, and parse the sample authentication information to obtain sample account information corresponding to the sample request messages, identify ignorable sample account information from the sample account information based on historical access information of the sample request messages, and parse the information of the sample interface corresponding to the sample request messages, and establish an interface parameter table based on the sample interface information and the ignorable sample account information corresponding to the sample interface information.

[0142] Optionally, in some embodiments, see Figure 5 , also includes:

[0143] Display module 407, used to display a prompt message indicating that the matching status between the first account information and the second account information is not matched, and to display the first account information and the information of the target interface;

[0144] The updating module 408 is used to respond to the user's selection instruction and supplement the interface parameter table according to the target information corresponding to the selection instruction, wherein the target information is any one of the first account information and the target interface information.

[0145] It should be noted that the above Figure 1-Figure 3 The explanation of the embodiment of the method for detecting an unauthorized vulnerability in the embodiment is also applicable to the detection device 400 for an unauthorized vulnerability in this embodiment, and the implementation principle is similar, which will not be described again here.

[0146] In this embodiment, by receiving a request message, determining the first account information corresponding to the request message, determining the second account information of the session corresponding to the request message, and performing unauthorized vulnerability detection on the request message based on the first account information and the second account information, the comprehensiveness of unauthorized vulnerability detection can be effectively improved, the accuracy of unauthorized vulnerability detection can be improved, and thus the detection effect of unauthorized vulnerability can be improved.

[0147] Figure 6 It is a schematic diagram of the structure of a computer device proposed in one embodiment of the present application.

[0148] See also Figure 6 The computer device 600 of this embodiment includes a housing 601, a processor 602, a memory 603, a circuit board 604 and a power supply circuit 605, wherein the circuit board 604 is arranged inside the space enclosed by the housing 601, and the processor 602 and the memory 603 are arranged on the circuit board 604; the power supply circuit 605 is used to supply power to various circuits or devices of the computer device 600; the memory 603 is used to store executable program codes; the processor 602 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 603, so as to execute:

[0149] Receive request message;

[0150] Determining first account information corresponding to the request message;

[0151] Determine second account information for a session corresponding to the request message;

[0152] The request message is detected for unauthorized access vulnerabilities based on the first account information in combination with the second account information.

[0153] It should be noted that the above Figure 1-Figure 3 The explanation of the embodiment of the method for detecting an unauthorized vulnerability in the embodiment is also applicable to the computer device 600 of this embodiment, and the implementation principle is similar, which will not be repeated here.

[0154] In this embodiment, by receiving a request message, determining the first account information corresponding to the request message, determining the second account information of the session corresponding to the request message, and performing unauthorized vulnerability detection on the request message based on the first account information and the second account information, the comprehensiveness of unauthorized vulnerability detection can be effectively improved, the accuracy of unauthorized vulnerability detection can be improved, and thus the detection effect of unauthorized vulnerability can be improved.

[0155] In order to implement the above-mentioned embodiment, the embodiment of the present application proposes a non-temporary computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the method for detecting the unauthorized vulnerability of the above-mentioned method embodiment is implemented.

[0156] It should be noted that, in the description of this application, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of this application, unless otherwise specified, the meaning of "plurality" is two or more.

[0157] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0158] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0159] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0160] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0161] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0162] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0163] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for detecting an unauthorized vulnerability, characterized in that: The method comprises: receiving a request message, wherein the request message is used to call a target interface of an application program; After receiving the request message, determining whether the target interface information is in a preconfigured interface parameter table, wherein the interface parameter table has learned the correspondence between the sample interface information and the sample account information that can be ignored corresponding to the sample interface information; Determining first account information corresponding to the request message; Determining second account information of a session corresponding to the request message; According to the result of the determination, the request message is subjected to an unauthorized vulnerability detection in combination with the first account information and the second account information; According to the result of the determination, the request message is subjected to an unauthorized vulnerability detection in combination with the first account information and the second account information, including: If the target interface information is not in the preconfigured interface parameter table, or if the target interface information is in the preconfigured interface parameter table and the first account information does not match the ignorable target account information corresponding to the target interface information, perform an unauthorized vulnerability detection on the request message according to a matching status between the first account information and the second account information; If the information of the target interface is in the preconfigured interface parameter table, and the first account information matches the target account information, it is directly determined that there is no unauthorized vulnerability in the request message.

2. The method for detecting an unauthorized vulnerability as claimed in claim 1, wherein: The performing unauthorized vulnerability detection on the request message according to the matching situation of the first account information and the second account information includes: If the matching status between the first account information and the second account information is not a match, it is determined that the request message has an unauthorized vulnerability; If the matching status between the first account information and the second account information is a match, it is determined that there is no unauthorized vulnerability in the request message.

3. The method for detecting an unauthorized vulnerability according to claim 1, wherein: The request message further includes: a request identifier, and the determining the second account information of the session corresponding to the request message includes: Determine a sample request identifier that matches the request identifier from a preconfigured correspondence table; the correspondence table has learned the correspondence between the sample request identifier, the sample session account corresponding to the sample request identifier, and the sample account information; The sample session account corresponding to the sample request identifier and the sample account information corresponding to the sample session account are used together as the second account information.

4. The method for detecting an unauthorized vulnerability according to claim 1, wherein: Before receiving the request message, the method further includes: Obtaining a large number of sample request messages, wherein the sample request messages include sample authentication information; Parsing the sample authentication information to obtain sample account information corresponding to the sample request message; identifying, according to the historical access information of the sample request message, sample account information that can be ignored from the sample account information; The sample interface information corresponding to the sample request message is parsed, and the interface parameter table is established according to the sample interface information and the ignorable sample account information corresponding to the sample interface information.

5. The method for detecting an unauthorized vulnerability as claimed in claim 4, characterized in that: If the matching status between the first account information and the second account information is not matched, after determining that the request message has an unauthorized vulnerability, the method further includes: Displaying a prompt message indicating that the matching status between the first account information and the second account information is not matched, and displaying information of the first account information and the target interface; In response to a selection instruction from a user, the interface parameter table is supplemented according to target information corresponding to the selection instruction, wherein the target information is any one of the first account information and information of the target interface.

6. A detection device for unauthorized vulnerability, characterized in that: The device comprises: A receiving module, used for receiving a request message, wherein the request message is used to call a target interface of an application program; A judgment module, used for judging whether the information of the target interface is in a pre-configured interface parameter table after receiving the request message, wherein the interface parameter table has learned the correspondence between the information of the sample interface and the sample account information that can be ignored corresponding to the information of the sample interface; A first determining module, configured to determine first account information corresponding to the request message; A second determining module, configured to determine second account information of a session corresponding to the request message; A detection module, configured to perform an unauthorized vulnerability detection on the request message based on the judgment result and the first account information and the second account information; The detection module is further used for: If the target interface information is not in the preconfigured interface parameter table, or if the target interface information is in the preconfigured interface parameter table and the first account information does not match the ignorable target account information corresponding to the target interface information, perform an unauthorized vulnerability detection on the request message according to a matching status between the first account information and the second account information; If the information of the target interface is in the preconfigured interface parameter table, and the first account information matches the target account information, it is directly determined that there is no unauthorized vulnerability in the request message.

7. The device for detecting an unauthorized vulnerability according to claim 6, wherein: The detection module is further used for: If the matching status between the first account information and the second account information is not a match, it is determined that the request message has an unauthorized vulnerability; If the matching status between the first account information and the second account information is a match, it is determined that there is no unauthorized vulnerability in the request message.

8. The device for detecting an unauthorized vulnerability according to claim 6, wherein: The request message further includes: a request identifier, and the second determining module is specifically configured to: Determine a sample request identifier that matches the request identifier from a preconfigured correspondence table; the correspondence table has learned the correspondence between the sample request identifier, the sample session account corresponding to the sample request identifier, and the sample account information; The sample session account corresponding to the sample request identifier and the sample account information corresponding to the sample session account are used together as the second account information.

9. The device for detecting an unauthorized vulnerability according to claim 6, wherein: Also includes: Establish a module, used for obtaining a large number of sample request messages before receiving the request message, the sample request message including sample authentication information, and parsing the sample authentication information to obtain sample account information corresponding to the sample request message, identifying ignorable sample account information from the sample account information according to historical access information of the sample request message, and parsing the information of the sample interface corresponding to the sample request message, and establishing the interface parameter table according to the sample interface information and the ignorable sample account information corresponding to the sample interface information.

10. The device for detecting an unauthorized vulnerability according to claim 7, wherein: Also includes: A display module, configured to display a prompt message indicating that the matching status between the first account information and the second account information is not matched, and to display information of the first account information and the target interface; An update module is used to respond to a selection instruction of a user and supplement the interface parameter table according to target information corresponding to the selection instruction, wherein the target information is any one of the first account information and the information of the target interface.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for detecting an unauthorized vulnerability as described in any one of claims 1 to 5 is implemented.

12. A computer device, comprising a housing, a processor, a memory, a circuit board and a power supply circuit, wherein: The circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the computer device; the memory is used to store executable program codes; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method for detecting an unauthorized vulnerability as described in any one of claims 1 to 5.

Images