Web application firewall testing method, device, electronic device, medium and product

Abstract

This disclosure provides a Web application firewall testing method, apparatus, electronic device, medium, and product, relating to the fields of computer technology, particularly information security technology, and capable of improving the efficiency of Web application firewall testing. A specific implementation scheme involves obtaining attack traffic, where the attack traffic includes at least one attack request from a terminal identified by an online Web application firewall. A test case is then generated based on the attack traffic, and the test case is used to test the Web application firewall under test, obtaining test results.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of information security technology. Background Art

[0002] A Web Application Firewall (WAF) is a user-friendly World Wide Web (Web) security product designed to protect against various web attacks. It effectively filters malicious attack requests and forwards safe requests to the website's server, improving server operational security. Summary of the Invention

[0003] The present disclosure provides a Web application firewall testing method, device, electronic device, medium and product.

[0004] A first aspect of the present disclosure provides a method for testing a web application firewall, including:

[0005] Obtaining attack traffic, where the attack traffic includes at least one attack request from a terminal identified by an online web application firewall;

[0006] generating a test case based on the attack traffic;

[0007] The Web application firewall to be tested is tested using the test case to obtain a test result of the Web application firewall to be tested.

[0008] A second aspect of the present disclosure provides a Web application firewall testing device, including:

[0009] An acquisition module, configured to acquire attack traffic, wherein the attack traffic includes at least one attack request from a terminal identified by an online web application firewall;

[0010] A generation module, configured to generate a test case based on the attack traffic;

[0011] The test module is used to test the Web application firewall to be tested using the test case to obtain the test result.

[0012] According to a third aspect of the present disclosure, an electronic device is provided, including:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any one of the above-mentioned Web application firewall testing methods.

[0016] According to a fourth aspect of the embodiments of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any one of the above-mentioned Web application firewall testing methods.

[0017] According to a fifth aspect of the embodiments of the present disclosure, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the computer program implements the Web application firewall testing method according to any one of the above items.

[0018] The Web application firewall testing method, apparatus, electronic device, medium, and product provided by the embodiments of the present disclosure can generate test cases based on attack traffic from terminals identified by an online Web application firewall, and then test the Web application firewall under test based on the test cases to obtain test results for the Web application firewall under test. Because the embodiments of the present disclosure can automatically test the Web application firewall, testing efficiency is improved.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0021] Figure 1 This is a flow chart of a Web application firewall testing method provided by an embodiment of the present disclosure;

[0022] Figure 2 is a flowchart of another Web application firewall testing method provided by an embodiment of the present disclosure;

[0023] Figure 3 is a flowchart of another Web application firewall testing method provided by an embodiment of the present disclosure;

[0024] Figure 4 This is a flow chart of a method for deploying a Web application firewall to be tested provided by an embodiment of the present disclosure;

[0025] Figure 5 This is an exemplary schematic diagram of a Web application firewall testing process provided by an embodiment of the present disclosure;

[0026] Figure 6 This is a schematic diagram of the structure of a Web application firewall testing device provided by an embodiment of the present disclosure;

[0027] Figure 7 This is a structural diagram of another Web application firewall testing device provided by an embodiment of the present disclosure;

[0028] Figure 8 It is a block diagram of an electronic device used to implement the Web application firewall testing method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0030] With the rapid development of the Internet, applications based on World Wide Web (Web) services are widely used in various important fields such as education, commerce, finance, and communications. The web application systems that host various Web service-based applications are becoming increasingly complex, and security issues and the resulting maintenance and management problems are becoming increasingly prominent. Furthermore, the ease of information dissemination has also led to a reduction in the cost of attacks. According to statistics, 80% of websites have been attacked by Web attacks. A Web Application Firewall (WAF) is a user-friendly Web security protection product that can effectively protect against various Web attacks. Furthermore, a Web Application Firewall allows users to customize access rules, effectively filtering malicious attack requests and forwarding normal and secure requests to the website's server, thereby improving the security of the website.

[0031] Testing a Web application firewall involves testing its engine module and / or rule base. Traditional Web application firewall testing relies on manually constructed test cases or test cases constructed using testing tools. Test cases constructed in either of these ways lack realism and have low construction efficiency. Currently, most testing is performed manually or semi-automatically, resulting in slow iterations and difficulty responding to rapidly changing vulnerabilities with minor changes to the engine module or updates to the regular rule base. Web application firewalls have strict requirements for launch, and current testing methods cannot detect Web application firewall vulnerabilities in a timely manner, resulting in a slow launch of Web application firewalls.

[0032] To improve the testing efficiency of a Web application firewall (WAF), embodiments of the present disclosure provide a WAF testing method. In one implementation, the method can be applied to a WAF server that has a WAF to be tested deployed on it. The WAF to be tested can be a WAF that is under development and has not yet been put into production.

[0033] Alternatively, in another implementation, the method can be applied to a test server, where the test server and the web application firewall server are two different servers. The test server is in communication with the web application firewall server and is used to test the web application firewall to be tested in the web application firewall server.

[0034] like Figure 1 As shown, the Web application firewall testing method provided by the embodiment of the present disclosure includes the following steps:

[0035] S101. Obtain attack traffic.

[0036] The attack traffic includes at least one attack request from a terminal identified by an online web application firewall. The online web application firewall refers to the web application firewall currently in use online.

[0037] In the disclosed embodiment, attack requests hit by the online web application firewall can be copied and stored on a backup server. During step S101, the online traffic replication tool can be used to obtain attack traffic from the backup server. Furthermore, the backup server can store relevant parameters for each attack request. For example, these parameters include the online web application firewall's identification result for each attack request and the time the online web application firewall received the attack request.

[0038] S102. Generate test cases based on attack traffic.

[0039] In the embodiment of the present disclosure, a test case may be generated based on each attack request.

[0040] After test cases are generated, they can be stored on a backup server to achieve persistent storage of test cases, reducing test case maintenance costs. Furthermore, since test cases can be automatically generated without manual operation, the cost of creating test cases is reduced, saving manpower.

[0041] S103: Use the test case to test the Web application firewall to obtain the test result.

[0042] In one implementation, during S101, attack requests identified by the online web application firewall can be obtained in real time. A test case is generated in S102. S103 uses this test case to test the web application firewall under test, obtaining the web application firewall's recognition result of the test case. The accuracy of this recognition result can then be further analyzed. This implementation ensures the real-time nature of the acquired attack traffic, allowing for real-time testing of the web application firewall's performance.

[0043] In another implementation, during S101, attack requests identified by the online web application firewall can be periodically obtained. For example, all attack requests identified by the online web application firewall the previous day can be obtained daily. A test case is then generated for each attack request in S102. During S103, the web application firewall under test is tested using the batch of test cases generated in S102. The web application firewall under test then obtains its recognition results for each test case. The accuracy of each recognition result is then determined, and a test report is generated based on this information. This implementation method can capture a large amount of attack traffic, ensuring the accuracy of the test.

[0044] During the testing process, if a test case fails to execute (for example, the Web application firewall under test cannot recognize the test case), the test case can be stored separately in a storage location (for example, in a designated storage area on a backup server) to facilitate subsequent troubleshooting and analysis. The failed test case will not affect the execution of other test cases.

[0045] In the related art, test cases need to be constructed manually or manually through test tools, resulting in low testing efficiency.

[0046] The Web application firewall testing method provided by the embodiments of the present disclosure can generate test cases based on attack traffic from terminals identified by an online Web application firewall. The Web application firewall under test is then tested based on the test cases to obtain test results for the Web application firewall under test. This demonstrates that the embodiments of the present disclosure can automatically generate test cases without requiring human intervention and can also automatically test the Web application firewall, thereby improving testing efficiency.

[0047] In addition, the test cases in the embodiments of the present disclosure are generated based on attack traffic, that is, based on real traffic, so the embodiments of the present disclosure improve the authenticity of the test cases.

[0048] In one embodiment of the present disclosure, Figure 2 As shown, the above S102 generates a test case based on the attack traffic, including the following steps:

[0049] S1021. For each attack flow, parse the attack flow to obtain a specified field in the attack flow.

[0050] For example, the specified fields in the attack request may include: Hyper Text Transfer Protocol (http) request method, http request header, request Uniform Resource Locator (URL), client Internet Protocol (IP) address, and http request body, etc.

[0051] S1022. Concatenate the specified fields according to a specified format, and use the concatenated result as a test case. The specified format is a format supported and recognized by the web application firewall to be tested. For example, the specified format is: HTTP request method (e.g., POST) + request URL + HTTP request header + client IP address + HTTP request body.

[0052] Optionally, a specific format for concatenating the specified fields may be determined based on the test environment of the web application firewall to be tested. For example, the specific format may be a rav format.

[0053] Using the above method, the disclosed embodiment can automatically generate test cases based on attack traffic, eliminating the need for human intervention and reducing labor costs. Furthermore, the fact that the test cases are generated based on real traffic also increases their authenticity. Therefore, the disclosed embodiment allows for rapid test case iteration, making it applicable to scenarios involving minor engine module modifications or regular rule base updates, broadening the scope of application of the disclosed embodiment.

[0054] In addition, testing has found that for minor changes to the engine module or updates to the conventional rule base in the embodiment of the present disclosure, the iteration cycle of the test cases in the embodiment of the present disclosure is shortened by more than 80% compared with the conventional test case iteration cycle.

[0055] In one embodiment of the present disclosure, after generating the test cases, the test cases generated based on the attack traffic can also be classified according to the business type to which the attack traffic belongs. This facilitates the subsequent use of test cases of different business types to test the Web application firewall to be tested, and obtains the recognition results of the test cases of different business types by the Web application firewall to be tested.

[0056] The embodiment of the present disclosure may add the following parameter items to the test case: path (Path), rule name (RuleName), absolute time (Ctime) and service (Services).

[0057] Among them, Path is used to represent the fields in the attack traffic that hit the filtering rules, where the filtering rules are the rules configured in the rule library of the online Web application firewall. Some regular requests of some services may contain fields that hit the filtering rules, causing these regular requests to be mistaken for attack requests. The embodiment of the present disclosure can manually analyze the attack traffic identified by the online Web application firewall. If a request is manually determined to be a normal request, but is identified as an attack request by the Web application firewall, this normal request can be added to the whitelist according to the Path to avoid misidentification of the normal request.

[0058] RuleName is used to represent the name of the filtering rule in the rule library of the online web application firewall that the attack traffic hits. When determining the test result in S103, the RuleName can be compared with the name of the filtering rule that the web application firewall under test hits for the test case, thereby achieving underreporting statistics for the web application firewall under test.

[0059] Ctime represents the attack time of the attack request corresponding to the test case. For example, the attack time can be the time the attack request was sent or the time the online web application firewall received the attack request. When generating a test report, you can use Ctime to categorize and count test cases by time.

[0060] Services is used to indicate the business type of the attack request corresponding to the test case. When generating a test report, you can use Services to categorize and count test cases by business type.

[0061] In one embodiment of the present disclosure, there are multiple test cases generated in S102, that is, the present disclosure embodiment can periodically obtain a batch of attack requests, and generate a test case according to each attack request, and use the generated batch of test cases to test the Web application firewall to obtain the test results. Figure 3 As shown, the method of determining the test result in S103 can be implemented as the following steps:

[0062] S1031. According to a preset concurrency, batch input test cases into the Web application firewall to be tested, and obtain a first recognition result of each test case by the Web application firewall to be tested.

[0063] When the electronic device is a Web application firewall server, the Web application firewall server inputs the test case into its own Web application firewall to be tested during S1031 .

[0064] When the electronic device is a test server, the test server sends test cases in batches to the Web application firewall server during S1031 .

[0065] Since the web application firewall to be tested is set with a threshold for the number of requests received per second, if the number of requests received per second by the web application firewall to be tested exceeds the threshold, the request will be queued. If the queue time exceeds a certain time, it will be discarded. In order to reduce data loss, the embodiment of the present disclosure can set a preset concurrency less than the threshold, and batch input test cases to the web application firewall to be tested according to the preset concurrency. The preset concurrency can be called the query rate per second (QPS), for example, QPS is 1500.

[0066] S1032: Compare the first recognition result and the second recognition result of each test case to determine the false negative rate of the Web application firewall to be tested.

[0067] The second identification result is the online web application firewall's identification result of the attack traffic corresponding to the test case. When the online web application firewall stores the attack traffic on the backup server, the second identification result of the online web application firewall on the attack traffic can also be stored on the backup server in a corresponding manner with the attack traffic, so that the electronic device can obtain the second identification result from the backup server.

[0068] For example, for each test case, if the first identification result indicates that the test case is a normal request, while the second result indicates that the test case is an attack request, it can be determined that the web application firewall under test missed the test case. Based on whether the web application firewall under test missed each test case, the missed rate is calculated.

[0069] S1033: Compare the first recognition result and the specified recognition result of each test case to obtain the false alarm rate of the Web application firewall to be tested.

[0070] The designated identification result may include a manual identification result of the test case. For example, a third-party web application firewall may be used to identify each test case, obtain an identification result for the test case, and then manually analyze the identification result to obtain the designated identification result for the test case. The third-party web application firewall may be different from the online web application firewall and the web application firewall to be tested.

[0071] For example, for each test case, the first recognition result indicates that the test case is a normal request, while the designated result indicates that the test case is an attack request; or, alternatively, the first recognition result indicates that the test case is an attack request, while the designated result indicates that the test case is a normal request. In either case, it can be determined that the web application firewall under test has issued a false alarm for the test case. Based on whether the web application firewall under test has issued a false alarm for each test case, the false alarm rate is calculated.

[0072] S1034. Generate a test report based on the missed alarm rate and the false alarm rate.

[0073] Optionally, in addition to the missed alarm rate and false alarm rate, the test report may also include the total number of test cases and the number of test cases identified as attack traffic by the web application firewall under test, etc., which are not specifically limited in the present embodiment. The electronic device may obtain the total number of generated test cases when generating the test cases in S102. When obtaining the first identification result in S1031, the number of test cases identified as attack traffic by the web application firewall under test may be obtained.

[0074] Optionally, the disclosed embodiment can also embed the content and format of the reminder email in Hyper Text Markup Language (HTML), then encapsulate it via Simple Mail Transfer Protocol (SMTP), and send the encapsulated reminder email to relevant personnel to prompt them to handle it in a timely manner. For example, the content of the reminder email may include: the total number of attack requests intercepted by the online web application firewall on that day, the hit rate of the web application firewall to be tested for the test case, the missed alarm rate and false alarm rate of the web application firewall to be tested, the historical missed alarm rate of the web application firewall to be tested (for example, the missed alarm rate in the past ten days and the missed alarm rate in the past thirty days), etc.

[0075] By adopting the above method, the embodiment of the present disclosure can automatically analyze the identification of the Web application firewall to be tested, and automatically generate a test report and reminder email, so that relevant personnel can understand the identification ability of the Web application firewall to be tested and further optimize the Web application firewall to be tested.

[0076] As can be seen from the description in S101 above, the attack traffic may be real-time traffic or traffic obtained within a period of time.

[0077] When the attack traffic is real-time traffic, the above method can generate a test report and send a reminder email in a timely manner based on the identification results of the Web application firewall to be tested, so that relevant personnel can handle it in the first time.

[0078] When the attack traffic is traffic obtained within a period of time, the above method can be used to generate a test report and send a reminder email based on the identification results of the Web application firewall to be tested, which facilitates the research and development and problem troubleshooting of the Web application firewall to be tested by relevant personnel.

[0079] In one embodiment of the present disclosure, the present disclosure embodiment can update the Web application firewall to be tested, such as Figure 4 As shown, the update method includes the following steps:

[0080] S401: Monitor whether there is a new version of the Web application firewall to be tested. If a new version of the Web application firewall exists, execute S402.

[0081] In one implementation, an acquisition request may be periodically sent to the version management platform (for example, an acquisition request may be sent every 20 seconds).

[0082] If an acquisition response sent by the version management platform in response to the acquisition request is received within a preset time period, it is determined that a new version of the web application firewall to be tested exists, wherein the acquisition response includes the new version of the web application firewall to be tested.

[0083] If no acquisition response is received from the version management platform for a preset period of time, it is determined that no new version of the web application firewall to be tested exists.

[0084] It can be understood that the acquisition request is used to request a new version of the engine module and rule base of the Web application firewall to be tested. In the embodiment of the present disclosure, since the version management platform can determine that the current electronic device is online each time it receives an acquisition request, the acquisition request also implements a heartbeat keep-alive function, that is, by periodically sending an acquisition request to the version management platform to report to the version management platform that the electronic device is online. Optionally, the above-mentioned acquisition request can carry heartbeat information, and the heartbeat information is used to indicate the online status. Using the above method, the embodiment of the present disclosure can monitor and obtain in a timely manner whether there is a new version of the Web application firewall to be tested, and can also report its own online status to the version management platform so that the version management platform can send the new version to the electronic device in a timely manner.

[0085] Optionally, the acquisition response may include a configuration file, which includes a new version of the engine module and / or the rule base. For example, the preset time length is 20 seconds.

[0086] S402: Install the new version and use the new version as the Web application firewall to be tested.

[0087] In one implementation, when a new version is obtained, the new version can be automatically loaded and deployed without manual operation, and the new version of the Web application firewall to be tested can be tested subsequently.

[0088] Optionally, when deploying the Web Application Firewall to be tested, you can also set the protection status. The protection status indicates the protection mode. For example, a high protection status indicates stricter filtering rules, while a low protection status indicates more permissive filtering rules.

[0089] By adopting the above method, the embodiment of the present disclosure can detect whether there is a new version of the Web application firewall to be tested, and obtain the new version for testing in a timely manner, thereby improving the testing efficiency of the new version.

[0090] See also Figure 5 The following describes the overall process of the Web application firewall testing method provided by the embodiment of the present disclosure in combination with the application scenario:

[0091] The online WAF copies the identified attack traffic and stores the attack traffic and the second identification result of the online WAF on the backup server. The test server obtains the attack traffic from the backup server, parses and concatenates the attack traffic, and adds the path, rule name, Ctime, and services to generate a test case in RAV format. The test case supports the CSV Data Set Config parameter format. CSV Data Set Config is a component that implements data parameterization.

[0092] The test server sends batches of test cases to the Web application firewall under test based on the preset concurrency, and obtains the first recognition result of each test case by the Web application firewall under test. The Web application firewall under test is the latest version issued by the version management platform.

[0093] The test server uploads the first recognition result to the analysis platform, and uses the analysis platform to analyze the false alarm rate of the Web application firewall to be tested.

[0094] The test server compares the first identification result with the second identification result to obtain the false negative rate of the Web application firewall to be tested. The second identification result can be obtained from the backup server.

[0095] The test server generates a test report and sends a reminder email based on the missed alarm rate and false alarm rate.

[0096] After the test is completed, the test environment is restored and the test data generated by the test server during the test is deleted.

[0097] Based on the same inventive concept, corresponding to the above method embodiment, the present disclosure embodiment provides a Web application firewall testing device, such as Figure 6 As shown, it includes: an acquisition module 601, a generation module 602 and a testing module 603;

[0098] An acquisition module 601 is configured to acquire attack traffic, where the attack traffic includes at least one attack request from a terminal identified by an online web application firewall;

[0099] A generating module 602 is configured to generate a test case based on the attack traffic;

[0100] The testing module 603 is used to test the Web application firewall to be tested using the test case to obtain a test result.

[0101] The web application firewall testing device provided by the disclosed embodiments can generate test cases based on attack traffic from a terminal identified by an online web application firewall, and then test the web application firewall under test based on the test cases to obtain test results for the web application firewall under test. Because the disclosed embodiments can automatically test the web application firewall, testing efficiency is improved.

[0102] Optionally, the generating module 602 is specifically configured to:

[0103] For each attack flow, the attack flow is parsed to obtain the specified field in the attack flow;

[0104] The specified fields are spliced ​​according to a specified format, and the splicing result is used as a test case. The specified format is a format supported and recognized by the Web application firewall to be tested.

[0105] Optionally, there are multiple test cases, and the test module 603 is specifically used to:

[0106] Inputting the test cases into the web application firewall to be tested in batches according to a preset concurrency, and obtaining a first recognition result of the web application firewall to be tested for each test case;

[0107] Comparing the first recognition result and the second recognition result of each test case to determine the false negative rate of the web application firewall to be tested, where the second recognition result is the recognition result of the online web application firewall for the attack traffic corresponding to the test case;

[0108] Compare the first recognition result and the specified recognition result of each test case to obtain the false alarm rate of the web application firewall to be tested;

[0109] A test report is generated according to the missed alarm rate and the false alarm rate.

[0110] Optional, such as Figure 7 As shown, the device may further include: a monitoring module 604 and an installation module 605;

[0111] A monitoring module 604 is used to monitor whether there is a new version of the web application firewall to be tested;

[0112] The installation module 605 is used to install a new version of the Web application firewall when a new version exists, and use the new version as the Web application firewall to be tested.

[0113] Optionally, the monitoring module 604 is specifically configured to:

[0114] Periodically send acquisition requests to the version management platform;

[0115] If an acquisition response sent by the version management platform in response to the acquisition request is received within a preset time period, it is determined that a new version of the web application firewall to be tested exists, and the acquisition response includes the new version of the web application firewall to be tested;

[0116] If the acquisition response sent by the version management platform is not received for the preset period of time, it is determined that there is no new version of the web application firewall to be tested.

[0117] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision and disclosure of attack traffic involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0118] It should be noted that the attack traffic in this embodiment is not targeted at a specific user and cannot reflect the personal information of a specific user.

[0119] It should be noted that the attack traffic in this embodiment may come from a public data set.

[0120] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0121] Figure 8A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided as examples only and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0122] like Figure 8 As shown, the electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0123] Multiple components in the electronic device 800 are connected to the I / O interface 805, including an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0124] The computing unit 801 can be various general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as the web application firewall testing method. For example, in some embodiments, the web application firewall testing method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the web application firewall testing method described above can be performed. Alternatively, in other embodiments, the computing unit 801 can be configured to perform the web application firewall testing method by any other suitable means (e.g., via firmware).

[0125] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0126] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0127] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0128] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0129] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0130] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0131] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not a limitation herein.

[0132] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A web application firewall testing method, comprising: Obtaining attack traffic, where the attack traffic includes at least one attack request from a terminal identified by an online web application firewall; For each attack flow, the attack flow is parsed to obtain designated fields in the attack flow, wherein the designated fields include: a hypertext transfer protocol request method, a hypertext transfer protocol request header, a requested uniform resource locator, a client internet protocol address, and a hypertext transfer protocol request body; splicing the specified fields according to a specified format, and using the splicing result as a test case, wherein the specified format is a format supported and recognized by the web application firewall to be tested, and the test case further includes: a path and a rule name, wherein the path is a field in the attack traffic that hits the filtering rule, the filtering rule is used to identify the attack traffic, and the rule name is the name of the filtering rule hit by the attack traffic, and there may be multiple test cases; Inputting the test cases into the web application firewall to be tested in batches according to a preset concurrency rate, obtaining a first recognition result of the web application firewall to be tested for each test case, wherein the preset concurrency rate is less than a threshold of number of requests received per second of the web application firewall to be tested; Comparing the first recognition result and the second recognition result of each test case to determine the false negative rate of the web application firewall to be tested, where the second recognition result is the recognition result of the online web application firewall for the attack traffic corresponding to the test case; Compare the first recognition result and the specified recognition result of each test case to obtain the false alarm rate of the web application firewall to be tested; A test report is generated according to the missed alarm rate and the false alarm rate.

2. The method according to claim 1, further comprising: Monitor whether there is a new version of the web application firewall to be tested; When a new version of the Web application firewall exists, the new version is installed and used as the Web application firewall to be tested.

3. The method according to claim 2, wherein: The monitoring of whether a new version of the web application firewall to be tested exists includes: Periodically send acquisition requests to the version management platform; If an acquisition response sent by the version management platform in response to the acquisition request is received within a preset time period, it is determined that a new version of the web application firewall to be tested exists, and the acquisition response includes the new version of the web application firewall to be tested; If the acquisition response sent by the version management platform is not received for the preset period of time, it is determined that there is no new version of the web application firewall to be tested.

4. A Web application firewall testing device, comprising: An acquisition module, configured to acquire attack traffic, wherein the attack traffic includes at least one attack request from a terminal identified by an online web application firewall; A generation module is configured to parse each attack flow to obtain designated fields in the attack flow, wherein the designated fields include: a Hypertext Transfer Protocol request method, a Hypertext Transfer Protocol request header, a request Uniform Resource Locator, a client Internet Protocol address, and a Hypertext Transfer Protocol request body; splice the designated fields in a designated format, and use the spliced ​​result as a test case, wherein the designated format is a format supported and recognized by the Web application firewall to be tested, and the test case further includes: a path and a rule name, wherein the path is a field in the attack flow that hits a filtering rule, the filtering rule is used to identify the attack flow, and the rule name is the name of the filtering rule hit by the attack flow, and there may be multiple test cases; The testing module is configured to batch-input the test cases into the web application firewall to be tested according to a preset concurrency, obtain a first recognition result of the web application firewall to be tested for each test case, wherein the preset concurrency is less than a threshold of the number of requests received per second of the web application firewall to be tested; compare the first recognition result and a second recognition result of each test case to determine a false alarm rate of the web application firewall to be tested, wherein the second recognition result is a recognition result of the attack traffic corresponding to the test case by the online web application firewall; compare the first recognition result and a specified recognition result of each test case to obtain a false alarm rate of the web application firewall to be tested; and generate a test report based on the false alarm rate and the false alarm rate.

5. The apparatus according to claim 4, further comprising: Monitoring module and installation module; The monitoring module is used to monitor whether there is a new version of the Web application firewall to be tested; The installation module is used to install a new version of the Web application firewall when a new version exists, and use the new version as the Web application firewall to be tested.

6. The device according to claim 5, wherein The monitoring module is specifically used to: Periodically send acquisition requests to the version management platform; If an acquisition response sent by the version management platform in response to the acquisition request is received within a preset time period, it is determined that a new version of the web application firewall to be tested exists, and the acquisition response includes the new version of the web application firewall to be tested; If the acquisition response sent by the version management platform is not received for the preset period of time, it is determined that there is no new version of the web application firewall to be tested.

7. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 3.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-3.

9. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 3.

Images