A method and device for identifying a Web service device

Abstract

An embodiment of the present invention provides a method and apparatus for identifying a Web service device. The method includes constructing a first access request and at least one second access request for accessing a Web service device by a Web client, performing a similarity operation on a first response page of the first access request and a second response page of the second access request for each second access request, and determining a first similarity value. If it is determined that the first similarity value is greater than a similarity threshold, determining a first device type that conforms to a programming language used by the Web service device from the device type of at least one Web service device that matches the second response page. Based on the first device type, the target device type of the Web service device can be accurately determined, thereby effectively improving the recognition accuracy of the device type of the Web service device, thereby effectively reducing the missed alarm rate and the false alarm rate generated during feature matching recognition.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of financial technology (Fintech), and in particular to a method and apparatus for identifying a Web service device. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field. The traditional financial industry is gradually transforming into financial technology. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology. In terms of financial information security, it is usually necessary to remotely identify which type of web server is used by the website to be visited, so as to further perform asset profiling and vulnerability detection on the web server.

[0003] At present, two identification methods are usually used to identify the device type of a Web server. Specifically, the first identification method is to use a Web client to initiate a normal access request to a Web server, and perform feature matching and identification on the device type related information of the Web server in the response page returned by the Web server, so as to determine the device type of the Web server (some Web servers will mark the device type related information of the Web server in the server field in the header of the returned message, and some Web servers will include the device type related information of the Web server in the returned response page). The second identification method is to construct an access request that causes the Web server to report an error in the Web client (for example, construct a non-existent access path in the access request or construct an incorrect parameter in the access request, etc.), and initiate the constructed access request to the Web server, and perform feature matching and identification on the device type related information of the Web server in the error response page returned by the Web server, so as to determine the device type of the Web server. However, since some Web server operation and maintenance personnel will actively forge or erase the device type related information of the Web server, these two identification methods will have a high false positive rate and a high false positive rate when performing feature matching on the device type related information of the Web server to determine the device type of the Web server.

[0004] In summary, there is an urgent need for a method for identifying a Web service device to effectively improve the accuracy of identifying the device type of the Web service device. Summary of the invention

[0005] The embodiment of the present invention provides a method and apparatus for identifying a Web service device, so as to effectively improve the accuracy of identifying the device type of the Web service device.

[0006] In a first aspect, an embodiment of the present invention provides a method for identifying a Web service device, comprising:

[0007] The Web client constructs a first access request and at least one second access request for accessing the Web service device; the first access request is used to represent a request constructed by performing multi-parameter value contamination on a contaminable parameter in the access request of the Web service device; each second access request is used to represent a request constructed by not performing contamination on a contaminable parameter in the access request of the Web service device;

[0008] For each second response page of the second access request, the Web client performs a similarity operation on the first response page of the first access request and the second response page of the second access request to determine a first similarity value;

[0009] If the Web client determines that the first similarity value is greater than a similarity threshold, determining a first device type that matches the programming language used by the Web service device from the device type of at least one Web service device that matches the second response page;

[0010] The Web client determines a target device type of the Web service device based on the first device type.

[0011] In the above technical scheme, since the existing technical scheme is to obtain the device type related information of the Web server from the response page returned by the Web server, and perform feature matching on the device type related information of the Web server to determine the device type of the Web server, if the operation and maintenance personnel of the Web server forge or erase the device type related information of the Web server, or the operation and maintenance personnel customize the returned server information field, then the device type of the Web server cannot be accurately identified by the feature matching recognition method. Based on this, the technical scheme in the present invention jointly identifies the device type of the Web service device by introducing the parameter pollution method, and can accurately detect the real response status of the Web service device to the parameter pollution access request, and according to the real response status of the Web service device to the parameter pollution access request and the real response status of the Web service device to the access request without parameter pollution, the response behavior characteristics of the Web service device can be accurately identified, so that the device type of the Web service device can be accurately identified, thereby effectively improving the recognition accuracy of the device type of the Web service device, thereby effectively reducing the false alarm rate and false alarm rate generated by feature matching recognition. Specifically, the Web client constructs a first access request and at least one second access request for accessing the Web service device; the first access request is used to represent a request constructed by performing multi-parameter value contamination on the contaminable parameters in the access request to the Web service device; each second access request is used to represent a request constructed by not performing contamination on the contaminable parameters in the access request to the Web service device. Then, for the second response page of each second access request, a similarity operation is performed on the first response page of the first access request and the second response page of the second access request, so as to determine a first similarity value, and the first similarity value is compared with a similarity threshold, so as to determine whether the response behavior of the Web service device to the first access request is the same as the response behavior to the second access request, thereby providing support for preliminarily determining the device type of the Web service device. Then, when it is determined that the first similarity value is greater than the similarity threshold, the first device type can be further determined from the device types of at least one Web service device that matches the second response page based on the programming language used by the Web service device, and based on the first device type, the target device type of the Web service device can be accurately determined, thereby effectively improving the recognition accuracy of the device type of the Web service device, thereby effectively reducing the missed alarm rate and false alarm rate generated during feature matching recognition.

[0012] Optionally, the method further comprises:

[0013] The Web client constructs a third access request and a fourth access request for accessing the Web service device; the third access request is used to represent a request for normal access to the Web service device; the fourth access request is used to represent a request for abnormal access to the Web service device;

[0014] The Web client determines the second device type of the Web service device by performing feature matching on the third response page of the third access request, and determines the third device type of the Web service device by performing feature matching on the fourth response page of the fourth access request;

[0015] The Web client determines the target device type of the Web service device based on the first device type, including:

[0016] The Web client determines a target device type of the Web service device according to the first device type, the second device type, and the third device type.

[0017] In the above technical solution, in order to more accurately identify the device type of the Web service device, the technical solution of the present invention introduces the construction of normal access request and abnormal access request, and determines the second device type of the corresponding Web service device according to the response behavior of the Web service device to the normal access request, and determines the third device type of the corresponding Web service device according to the response behavior of the Web service device to the abnormal access request. Then, combining the first device type, the second device type and the third device type can help to more accurately identify the actual device type to which the Web service device belongs.

[0018] Optionally, if the Web client determines that the first similarity value is greater than a similarity threshold, determining a first device type that conforms to the programming language used by the Web service device from the device type of at least one Web service device that matches the second response page includes:

[0019] The Web client determines, for the second response page whose first similarity value is greater than the similarity threshold, when determining that a first parameter value of the contaminable parameter in the first response page is the same as a second parameter value of the contaminable parameter in the second response page, from a device type library at least one device type matching the second parameter value;

[0020] The Web client determines the first device type of the Web service device from at least one device type matching the second parameter value according to a programming language used by the Web service device.

[0021] In the above technical solution, after determining that the first similarity value is greater than the similarity threshold, the device type range of the Web service device can be further determined by judging whether the first parameter value of the contaminable parameter in the first response page is the same as the second parameter value of the contaminable parameter in the second response page. If the parameter value of the contaminable parameter selected by the Web service device for the first access request is the same as the parameter value of the contaminable parameter selected for the second access request, and because the parameter value of the contaminable parameter selected by the Web service device for the second access request is fixed and single, it is possible to determine which device types of Web service devices that select a single parameter value based on the historical performance behavior data of Web service devices of each device type for contaminable parameters with multiple parameter values. For example, for a contaminable parameter with multiple parameter values, it is possible to determine which device types of Web service devices that select the First parameter value of the contaminable parameter and which device types of Web service devices that select the Last parameter value of the contaminable parameter based on the historical performance behavior data of Web service devices of each device type for the contaminable parameter with multiple parameter values. Then, according to the programming language used by the Web service device, the device type range of the Web service device can be further narrowed, thereby providing support for the subsequent accurate identification of the actual device type of the Web service device. In addition, by determining whether the first similarity value is greater than the similarity threshold, the solution can accurately determine whether the first response page is substantially the same as the second response page, thereby directly eliminating the need to determine whether the first parameter value is the same as the second parameter value if the response pages are different, and also reducing potential underreporting (for example, the parameter value does not exist, but the response pages are actually substantially the same).

[0022] Optionally, the method further comprises:

[0023] If the Web client determines that the first similarity values ​​of the second response pages are all less than or equal to the similarity threshold or the first parameter value is different from the second parameter value, then when determining that the first parameter value is a combination of the second parameter values, constructing a fifth access request for accessing the Web service device according to the second parameter values;

[0024] The Web client determines, for a fifth response page of the fifth access request, a second similarity value between the fifth response page and the first response page;

[0025] If the Web client determines that the second similarity value is greater than the similarity threshold, determining at least one device type matching the first parameter value from the device type library;

[0026] The Web client determines a first device type of the Web service device from at least one device type matching the first parameter value according to a programming language used by the Web service device.

[0027] In the above technical solution, if it is determined that the first similarity value of each second response page is less than or equal to the similarity threshold, or assuming that there are two second response pages, the first similarity value between the first second response page and the first response page is greater than the similarity threshold, but the first parameter value is different from the second parameter value in the first second response page, and the first similarity value between the second second response page and the first response page is less than or equal to the similarity threshold, or the first similarity value between the second second response page and the first response page is greater than the similarity threshold, but the first parameter value is different from the second parameter value in the second second response page, it is necessary to determine whether the first parameter value in the first response page is a combination of the second parameter values, so as to determine the device type range of the Web service device, thereby providing support for subsequent accurate identification of the actual device type of the Web service device.

[0028] Optionally, the method further comprises:

[0029] If the Web client determines that the second similarity value is less than or equal to the similarity threshold or the first parameter value is not a combination of the second parameter values, determining the maximum similarity value from the first similarity values ​​and the second similarity values;

[0030] If the Web client determines that the maximum similarity value is less than the similarity threshold, the Web client determines the first device type of the Web service device from the device type library according to the programming language used by the Web service device.

[0031] In the above technical solution, if it is determined that the second similarity value is less than or equal to the similarity threshold or the first parameter value is not a combination of the second parameter values, it is necessary to compare the first similarity values ​​and the second similarity values ​​to determine the maximum similarity value, and judge whether the maximum similarity value is greater than the similarity value threshold. If the maximum similarity value is less than the similarity threshold, the first device type of the Web service device can be preliminarily determined from the device type library based on the programming language used by the Web service device, thereby providing support for the subsequent accurate identification of the actual device type of the Web service device.

[0032] Optionally, the method further comprises:

[0033] If the Web client determines that the maximum similarity value is greater than or equal to the similarity threshold, then when determining that the maximum similarity value is any one of the first similarity values, the Web client determines the first device type of the Web service device from at least one device type that matches the second parameter value based on the programming language used by the Web service device; or, when determining that the maximum similarity value is the second similarity value, the Web client determines the first device type of the Web service device from at least one device type that matches the first parameter value based on the programming language used by the Web service device.

[0034] In the above technical solution, if the maximum similarity value is greater than the similarity threshold, the maximum similarity value can be compared with the first similarity value and the second similarity value. If it is determined that the maximum similarity value is the same as a certain similarity value, the device type range corresponding to the similarity value can be used as the device type range of the Web service device. Then, according to the programming language used by the Web service device, the device type range of the Web service device can be further narrowed, so that a smaller device type range can be obtained. This can help improve the subsequent recognition efficiency of the device type of the Web service device, and can provide support for more accurate identification of the device type of the Web service device in the future.

[0035] Optionally, the Web client performs a similarity operation on a first response page of the first access request and a second response page of the second access request to determine a first similarity value, including:

[0036] The Web client obtains the page source code of the first response page and the page source code of the second response page, and performs word segmentation processing on the page source code of the first response page and the page source code of the second response page respectively to determine a first word segmentation set corresponding to the first response page and a second word segmentation set corresponding to the second response page;

[0037] The Web client combines and removes duplicates of each first word segmentation in the first word segmentation set and each second word segmentation in the second word segmentation set to obtain a third word segmentation set;

[0038] The Web client uses each third word in the third word set as a key, sets a corresponding value for each key, and obtains a key-value data set;

[0039] The Web client converts each first word in the first word set into a corresponding numerical value according to the key-value data set to obtain a first numerical value set, and converts each second word in the second word set into a corresponding numerical value to obtain a second numerical value set;

[0040] The Web client encodes the first value set to obtain a first vector set, and encodes the second value set to obtain a second vector set;

[0041] The Web client determines the first similarity value by using a set similarity algorithm for the first vector set and the second vector set.

[0042] In the above technical solution, since the page source code of the response page can truly reflect the actual behavioral characteristics of the response page, by calculating the similarity value between the first response page and the second response page based on the page source code of the first response page and the page source code of the second response page, it is possible to accurately determine whether the response behavior of the first response page and the response phase of the second response page are roughly the same, and thus it is possible to accurately determine whether the first response page and the second response page are roughly the same.

[0043] Optionally, the Web client determines the target device type of the Web service device according to the first device type, the second device type, and the third device type, including:

[0044] If the Web client determines that there is only one sub-device type in the first device type, the sub-device type is determined as the target device type of the Web service device;

[0045] If the Web client determines that there are at least two sub-device types in the first device type, then when it is determined that the third device type exists in the first device type, the third device type is determined as the target device type of the Web service device; or, when it is determined that the third device type is a null value and when it is determined that the second device type exists in the first device type, the second device type is determined as the target device type of the Web service device.

[0046] In the above technical solution, since the first device type of the Web service device is determined based on the real response behavior of the Web service device, the real response behavior of the Web service device can reflect the specific behavior characteristics of the Web service device for parameter pollution access requests, and the specific behavior characteristics of the Web service device cannot be easily changed, such as the behavior characteristics of an object cannot be easily changed, so it has non-repudiation. Therefore, the first device type of the determined Web service device is more accurate than the second device type and the third device type, and can better reflect the actual device type to which the Web service device belongs. Therefore, the technical solution of the present invention further accurately determines the target device type of the Web service device by first determining whether there are multiple sub-device types in the first device type. If it is determined that there is only one sub-device type in the first device type, the sub-device type can be directly used as the target device type of the Web service device; if it is determined that there are multiple sub-device types in the first device type, it is necessary to combine the second device type and / or the third device type for further determination, so that the target device type of the Web service device can be determined more accurately, that is, the real device type of the Web service device.

[0047] Optionally, the method further comprises:

[0048] When the Web client determines that there are at least two subtypes in the first device type, if it is determined that the second device type and the third device type are both null values ​​or it is determined that the second device type and the third device type do not exist in the first device type, any subtype in the first device type is determined as the target device type of the Web service device.

[0049] In the above technical solution, under the premise that there are at least two sub-types in the first device type, if it is determined that the second device type and the third device type are both null values ​​or the second device type and the third device type do not exist in the first device type, and because the first device type can more accurately reflect the actual device type of the Web service device, any sub-device type in the first device type can be directly used as the target device type of the Web service device.

[0050] In a second aspect, an embodiment of the present invention further provides an identification device for a Web service device, comprising:

[0051] A construction unit, configured to construct a first access request and at least one second access request for accessing a Web service device; the first access request is used to represent a request constructed by performing multi-parameter value contamination on a contaminable parameter in an access request to the Web service device; and each second access request is used to represent a request constructed by performing no contamination on a contaminable parameter in an access request to the Web service device;

[0052] A processing unit is used to perform a similarity operation on the first response page of the first access request and the second response page of the second access request for each second response page of the second access request to determine a first similarity value; if it is determined that the first similarity value is greater than a similarity threshold, determine a first device type that conforms to the programming language used by the Web service device from the device type of at least one of the Web service devices matching the second response page; and determine a target device type of the Web service device based on the first device type.

[0053] Optionally, the processing unit is further configured to:

[0054] Constructing a third access request and a fourth access request for accessing a Web service device; the third access request is used to represent a request for normal access to the Web service device; the fourth access request is used to represent a request for abnormal access to the Web service device;

[0055] Determine the second device type of the Web service device by performing feature matching on the third response page of the third access request, and determine the third device type of the Web service device by performing feature matching on the fourth response page of the fourth access request;

[0056] The processing unit is specifically used for:

[0057] A target device type of the Web service device is determined according to the first device type, the second device type, and the third device type.

[0058] Optionally, the processing unit is specifically configured to:

[0059] For a second response page whose first similarity value is greater than a similarity threshold, when it is determined that a first parameter value of a contaminable parameter in the first response page is the same as a second parameter value of the contaminable parameter in the second response page, determining at least one device type matching the second parameter value from a device type library;

[0060] According to the programming language used by the Web service device, a first device type of the Web service device is determined from at least one device type matching the second parameter value.

[0061] Optionally, the processing unit is further configured to:

[0062] If it is determined that the first similarity values ​​of the second response pages are all less than or equal to the similarity threshold or the first parameter value is different from the second parameter value, when it is determined that the first parameter value is a combination of the second parameter values, constructing a fifth access request for accessing the Web service device according to the second parameter values;

[0063] For a fifth response page of the fifth access request, determining a second similarity value between the fifth response page and the first response page;

[0064] If it is determined that the second similarity value is greater than the similarity threshold, determining at least one device type matching the first parameter value from the device type library;

[0065] According to a programming language used by the Web service device, a first device type of the Web service device is determined from at least one device type matching the first parameter value.

[0066] Optionally, the processing unit is further configured to:

[0067] If it is determined that the second similarity value is less than or equal to the similarity threshold or the first parameter value is not a combination of the second parameter values, determining a maximum similarity value from the first similarity values ​​and the second similarity values;

[0068] If it is determined that the maximum similarity value is less than the similarity threshold, then according to the programming language used by the Web service device, a first device type of the Web service device is determined from the device type library.

[0069] Optionally, the processing unit is further configured to:

[0070] If it is determined that the maximum similarity value is greater than or equal to the similarity threshold, then when it is determined that the maximum similarity value is any one of the first similarity values, the first device type of the Web service device is determined from at least one device type that matches the second parameter value based on the programming language used by the Web service device; or, when it is determined that the maximum similarity value is the second similarity value, the first device type of the Web service device is determined from at least one device type that matches the first parameter value based on the programming language used by the Web service device.

[0071] Optionally, the processing unit is specifically configured to:

[0072] Obtaining the page source code of the first response page and the page source code of the second response page, and performing word segmentation processing on the page source code of the first response page and the page source code of the second response page respectively, to determine a first word segmentation set corresponding to the first response page and a second word segmentation set corresponding to the second response page;

[0073] Merge and remove duplicates of each first segmentation word in the first segmentation word set and each second segmentation word in the second segmentation word set to obtain a third segmentation word set;

[0074] Taking each third word in the third word set as a key, setting a corresponding value for each key to obtain a key-value data set;

[0075] According to the key-value data set, convert each first participle in the first participle set into a corresponding numerical value to obtain a first numerical value set, and convert each second participle in the second participle set into a corresponding numerical value to obtain a second numerical value set;

[0076] Performing encoding processing on the first value set to obtain a first vector set, and performing encoding processing on the second value set to obtain a second vector set;

[0077] The first vector set and the second vector set are subjected to a set similarity algorithm to determine the first similarity value.

[0078] Optionally, the processing unit is specifically configured to:

[0079] If it is determined that there is only one sub-device type in the first device type, determining the sub-device type as the target device type of the Web service device;

[0080] If it is determined that there are at least two sub-device types in the first device type, then when it is determined that the third device type exists in the first device type, the third device type is determined as the target device type of the Web service device; or, when it is determined that the third device type is a null value and it is determined that the second device type exists in the first device type, the second device type is determined as the target device type of the Web service device.

[0081] Optionally, the processing unit is further configured to:

[0082] When it is determined that there are at least two subtypes in the first device type, if it is determined that the second device type and the third device type are both null values ​​or it is determined that the second device type and the third device type do not exist in the first device type, any subtype in the first device type is determined as the target device type of the Web service device.

[0083] In a third aspect, an embodiment of the present invention provides a computing device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any method for identifying a Web service device as described in the first aspect above.

[0084] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing a computer program executable by a computing device, wherein when the program is run on the computing device, the computing device executes any of the Web service device identification methods described in the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0086] Figure 1 A schematic diagram of a flow chart of a method for identifying a Web service device provided by an embodiment of the present invention;

[0087] Figure 2 A schematic diagram of a process for determining a device type C of a Web server provided by an embodiment of the present invention;

[0088] Figure 3 A schematic diagram of a process for determining a target device type of a Web service device provided by an embodiment of the present invention;

[0089] Figure 4 A schematic diagram of the structure of an identification device for a Web service device provided by an embodiment of the present invention;

[0090] Figure 5 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0091] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0092] First, some terms involved in the embodiments of the present invention are explained below to facilitate understanding by those skilled in the art.

[0093] (1) Web (World Wide Web) server: Also known as WWW server, generally refers to a website server, which mainly provides online information browsing and downloading services, can process requests from web clients such as browsers and return corresponding responses. Among them, common types of web server devices include Apache, IIS, Tomcat, etc.

[0094] (2) HTTP (HyperText Transfer Protocol): is a simple request-response protocol that specifies what messages a client may send to a server and what responses it may receive.

[0095] (3) HTTP Parameter Pollution: This is a common attack method to bypass security devices. This problem is mainly due to the fact that the current HTTP standard does not define which value the Web server should use as the final value of a parameter when it has multiple values. This results in different WEB servers having different processing methods when encountering a parameter with multiple values. Therefore, the device type of the backend Web server can be derived through HTTP parameter pollution.

[0096] (4) One-Hot Coding: Also known as one-bit effective coding, it mainly uses an N-bit state register to encode N states. Each state has its own independent register bit, and only one bit is valid at any time.

[0097] As mentioned above, some terms involved in the embodiments of the present invention are introduced. Now, the technical features involved in the embodiments of the present invention are introduced.

[0098] Figure 1 The process of a method for identifying a Web service device provided by an embodiment of the present invention is exemplarily shown, and the process can be executed by an identification device of a Web service device.

[0099] like Figure 1 As shown in the figure, the process specifically includes:

[0100] Step 101: A Web client constructs a first access request and at least one second access request for accessing a Web service device.

[0101] In an embodiment of the present invention, a Web client constructs a first access request formed by performing parameter contamination on a certain parameter that can be contaminated in a Web page of a Web service device, and constructs at least one second access request formed by accessing at least one Web page of the Web service device. The first access request is used to represent a request constructed by performing multi-parameter value contamination on a contaminated parameter in an access request to a Web service device; each second access request is used to represent a request constructed by performing uncontaminated contaminated parameters in an access request to a Web service device. Moreover, in order to more accurately identify the device type of a Web service device, the technical solution of the present invention introduces the construction of a normal access request and an abnormal access request, that is, constructs a third access request and a fourth access request for accessing a Web service device. The third access request is used to represent a request for normal access to a Web service device; the fourth access request is used to represent a request for abnormal access to a Web service device. Then, after constructing each access request, the Web client will initiate each access request to the Web service device respectively. After receiving each access request, the Web service device will process the access request and return a corresponding response page. After receiving the third access request, the Web service device will process the third access request and return a third response page to be displayed on the Web client, and after receiving the fourth access request, the Web service device will process the fourth access request and return a fourth response page to be displayed on the Web client. The Web client determines the second device type of the Web service device by performing feature matching on the third response page of the third access request, and determines the third device type of the Web service device by performing feature matching on the fourth response page of the fourth access request.

[0102] Exemplarily, when it is necessary to identify the device type of a certain Web server, a certain number of access requests will be constructed first through the Web client corresponding to the Web server, such as the first one is an access request A to access the default page of the Web server, that is, to access the Web server normally through the default URL of the Web server, such as URL (Uniform Resource Locator). The second is to construct an access request B that causes the Web server to report an error, that is, an abnormal access request B, such as by constructing a non-existent access path in a certain URL of the Web server, adding illegal parameters or constructing illegal protocol fields, etc., which can cause an error response page to appear when accessing the Web server, or pre-constructing a URL carrying non-real information to access the Web server, which will also cause an error response page to appear when accessing the Web server. The third is to construct an access request formed after parameter pollution of a certain parameter in the Web page of the Web server, and to construct at least one request for normal access to at least one Web page of the Web server. Specifically, a web page crawling operation is performed on the web server to obtain the relevant parameter information of each web page of the web server, and the URL of each web page of the web server can be obtained at the same time, and the parameters that can be used for HTTP parameter pollution are identified from the relevant parameter information of each web page for parameter pollution, such as page parameters or ID (Identification) parameters. After the parameter is polluted, a new URL is constructed to initiate an access request to the web server, such as access request C, and the new URL is input in the web client corresponding to the web server to access the web server. At the same time, access requests are initiated to the web server through the URLs of each web page of the web server, such as access request D and access request E. For example, taking the page parameter as a parameter that can be polluted by parameters as an example, it is assumed that the web server has two web pages, that is, the URL 1 of the first web page is https: / / example.com / i.php? page=1, and the URL 2 of the second web page is https: / / example.com / i.php? page=2, wherein the page parameter is a parameter that can be polluted by HTTP parameters.After the page parameter is polluted, a new page parameter is formed as page=1&page=2, and a new URL, URL3, can be constructed based on the new page parameter. The URL3 is https: / / example.com / i.php?page=1&page=2, and the Web server is accessed through the URL3.

[0103] Step 102: For each second response page of the second access request, the Web client performs a similarity operation on the first response page of the first access request and the second response page of the second access request to determine a first similarity value.

[0104] In an embodiment of the present invention, after receiving a first access request, the Web service device will process the first access request and return a first response page to be displayed on the Web client, and after receiving a second access request, the Web service device will process the second access request and return a second response page to be displayed on the Web client. For each second response page of the second access request, the Web client obtains the page source code of the first response page and the page source code of the second response page, and performs word segmentation processing on the page source code of the first response page to obtain the first word segmentation set corresponding to the first response page, and performs word segmentation processing on the page source code of the second response page to obtain the second word segmentation set corresponding to the second response page. Then, by merging and deduplicating each first word segmentation in the first word segmentation set with each second word segmentation in the second word segmentation set, a third word segmentation set can be obtained, and each third word segmentation in the third word segmentation set is used as a key, and a corresponding numerical value is set for each key to obtain a key-value data set. Then, according to the key-value data set, each first word segment in the first word segment set is converted into a corresponding numerical value to obtain a first numerical value set, and each second word segment in the second word segment set is converted into a corresponding numerical value to obtain a second numerical value set, and the first numerical value set is encoded to obtain a first vector set, and the second numerical value set is encoded to obtain a second vector set. Finally, the first vector set and the second vector set are similarly calculated by the set similarity algorithm, and the first similarity value of the first response page and the second response page can be calculated. In this way, since the page source code of the response page can truly reflect the actual behavior characteristics of the response page, the scheme can accurately determine whether the response behavior of the first response page and the response phase of the second response page are roughly the same by calculating the similarity value between the first response page and the second response page based on the page source code of the first response page and the page source code of the second response page, so as to accurately determine whether the first response page and the second response page are roughly the same.

[0105] Step 103: If the Web client determines that the first similarity value is greater than a similarity threshold, the Web client determines a first device type that matches the programming language used by the Web service device from the device type of at least one Web service device that matches the second response page.

[0106] In the embodiment of the present invention, under the premise that the first similarity value is greater than the similarity threshold, for the second response page whose first similarity value is greater than the similarity threshold, when it is determined that the first parameter value of the contaminable parameter in the first response page is the same as the second parameter value of the contaminable parameter in the second response page, and because the parameter value of the contaminable parameter selected by the Web service device for the second access request is fixed and single, at least one device type matching the second parameter value can be determined from the device type library. Then, according to the programming language used by the Web service device, the first device type of the Web service device is determined from the at least one device type matching the second parameter value, so as to further narrow the device type range of the Web service device, thereby providing support for subsequent accurate identification of the actual device type of the Web service device. Among them, the device type library is used to store each parameter value (such as the First parameter value and / or the Last parameter value) and the device type corresponding to the parameter value and the programming language used. For example, for a contaminable parameter with multiple parameter values, the device types of the Web service devices that select the First parameter value of the contaminable parameter, the device types of the Web service devices that select the Last parameter value of the contaminable parameter, or the device types of the Web service devices that select All parameter values ​​(including the First parameter value and the Last parameter value) of the contaminable parameter can be determined based on the historical performance behavior data of the Web service devices of each device type for the contaminable parameter with multiple parameter values. Among them, the similarity threshold can be set according to the experience of those skilled in the art or according to the specific application scenario of the technical solution, and the embodiment of the present invention does not limit this.

[0107] If it is determined that the first similarity value of each second response page is less than or equal to the similarity threshold, or if there are two second response pages, the first similarity value between the first second response page and the first response page is greater than the similarity threshold, but the first parameter value is different from the second parameter value in the first second response page, and the first similarity value between the second second response page and the first response page is less than or equal to the similarity threshold, or the first similarity value between the second second response page and the first response page is greater than the similarity threshold, but the first parameter value is different from the second parameter value in the second second response page, then it is necessary to determine whether the first parameter value in the first response page is a combination of the second parameter values, so as to determine the device type range of the Web service device. If the first parameter value is a combination of the second parameter values, a fifth access request for accessing the Web service device can be constructed according to the second parameter values, and the fifth access request is initiated to the Web service device. After receiving the fifth access request, the Web service device will process the fifth access request and return a fifth response page to display on the Web client. The Web client determines the second similarity value between the fifth response page and the first response page by using a set similarity algorithm for the fifth response page of the fifth access request. If it is determined that the second similarity value is greater than the similarity threshold, at least one device type that matches the first parameter value (a combination of multiple second parameter values) is determined from the device type library. For example, if the Web service device selects the All parameter value (including the First parameter value and the Last parameter value) of the contaminable parameter as the parameter value for final processing, then based on the All parameter value, the device types of the Web service device that selects the All parameter value of the contaminable parameter can be determined based on the historical performance behavior data of the Web service devices of each device type for the contaminable parameter with multiple parameter values. Then, based on the programming language used by the Web service device, the device type range of the Web service device can be further narrowed, that is, the first device type of the Web service device is determined from at least one device type that matches the first parameter value, thereby providing support for the subsequent accurate identification of the actual device type of the Web service device. In addition, if it is determined that the second similarity value is less than or equal to the similarity threshold or the first parameter value is not a combination of the second parameter values, it is necessary to compare the first similarity values ​​and the second similarity values ​​to determine the maximum similarity value, and judge whether the maximum similarity value is greater than the similarity value threshold; if the maximum similarity value is less than the similarity threshold, the first device type of the Web service device can be preliminarily determined from the device type library based on the programming language used by the Web service device.If it is determined that the maximum similarity value is greater than or equal to the similarity threshold, the maximum similarity value can be compared with each first similarity value and the second similarity value. If it is determined that the maximum similarity value is the same as a certain similarity value (such as any one of the similarity values ​​or the second similarity value), the device type range corresponding to the similarity value can be used as the device type range of the Web service device. Then, according to the programming language used by the Web service device, the device type range of the Web service device is further narrowed, so that a smaller device type range can be obtained. For example, if the maximum similarity value is any one of the first similarity values, the first device type of the Web service device can be determined from at least one device type matching the second parameter value according to the programming language used by the Web service device; or, if it is determined that the maximum similarity value is the second similarity value, according to the programming language used by the Web service device, the first device type of the Web service device can be determined from at least one device type matching the first parameter value. In this way, the scheme can help improve the subsequent recognition efficiency of the device type of the Web service device, and can provide support for more accurate subsequent recognition of the device type of the Web service device.

[0108] For example, continuing to take the above-mentioned Web server with two Web pages as an example, and assuming that the page parameter is a parameter that can be contaminated, a user can enter the default URL for accessing the Web server in the URL input interface provided by the Web client, that is, initiate an access request A to the Web server. After receiving the access request A, the Web server processes the access request A and returns a response page for the access request A to display on the Web client. At this time, the device type A of the Web server can be obtained by performing feature matching processing on the returned response page, such as obtaining the value corresponding to the server field from the header of the response message returned by the Web server, and the value is the device type A of the Web server. At the same time, the URL reported by the Web server is also entered in the URL input interface provided by the Web client, that is, initiate an access request B to the Web server. After receiving the access request B, the Web server processes the access request B and returns an error response page for the access request B to display on the Web client. At this time, the device type B of the Web server can be obtained by performing feature matching processing on the returned error response page. Also, in the URL input interface provided by the Web client, the URLs of each Web page (for example, two Web pages) of the Web server are respectively entered, such as URL1 and URL2, that is, an access request D and an access request E are initiated to the Web server. After receiving the access request D, the Web server processes the access request D and returns a response page 1 for the access request D for display on the Web client. At the same time, after receiving the access request E, the Web server also processes the access request E and returns a response page 2 for the access request E for display on the Web client. At this time, the Page parameter value 1 of the response page 1 can be obtained through the response page 1 for the access request D, and the Page parameter value 2 of the response page 2 can be obtained through the response page 2 for the access request E. Moreover, a new URL constructed after parameter pollution, such as URL3, will be input in the URL input interface provided by the Web client, that is, an access request C is initiated to the Web server. After receiving the access request C, the Web server processes the access request C and returns a response page 3 for the access request C for display on the Web client. At this time, the Page parameter value 3 of the response page 3 can be obtained through the response page 3 for the access request C. The page parameter value 3 of the response page 3 may be a single one or a combination of multiple page parameter values, such as a combination of Page parameter value 1 and Page parameter value 2.Then, by performing similarity calculation on response page 1, response page 2, and response page 3, and combining the programming language used by the Web server, the device type C of the Web server can be obtained.

[0109] Combine the following Figure 2 , the implementation process of determining the device type C of the Web server by performing similarity calculation on response page 1, response page 2 and response page 3 in the embodiment of the present invention is described in detail. Figure 2 A schematic diagram of a flow chart for determining a device type C of a Web server provided in an embodiment of the present invention.

[0110] Step 201, obtaining response page 1 for URL1, response page 2 for URL2, and response page 3 for URL3.

[0111] After inputting URL1, URL2 and URL3 respectively through the Web client to obtain response page 1, response page 2 and response page 3, the page parameter value 1 of response page 1 is determined based on the relevant information in response page 1, the page parameter value 2 of response page 2 is determined based on the relevant information in response page 2, and the page parameter value 3 of response page 3 is determined based on the relevant information in response page 3. Among them, the page parameter value 1 of response page 1 is single, the page parameter value 2 of response page 2 is single, and the page parameter value 3 of response page 3 may be single or a combination of multiple page parameter values. At the same time, a Web response page similarity operation can be performed through a similarity algorithm (such as a Euclidean distance algorithm, a Pearson correlation coefficient algorithm or a cosine similarity algorithm, etc.), for example, the similarity value between response page 1 and response page 3 or the similarity value between response page 2 and response page 3 can be calculated.

[0112] Step 202, determine whether the similarity value a1 between the response page 1 and the response page 3 is greater than the similarity threshold. If yes, execute step 203; if no, execute step 204.

[0113] As an example, taking the cosine similarity algorithm as an example, the cosine similarity algorithm is used to perform similarity calculation on response page 1 and response page 3, and the similarity value a1 between response page 1 and response page 3 can be calculated. Then, it is determined whether the similarity value a1 is greater than the similarity threshold. If the similarity value a1 is greater than the similarity threshold, step 203 is executed; if the similarity value a1 is less than or equal to the similarity threshold, step 204 is executed. Among them, the similarity threshold can range from 0 to 1, and the closer the similarity value is to 1, the higher the similarity, and the closer the similarity value is to 0, the lower the similarity. For example, a similarity threshold is set to 0.7 or 0.75, etc., or a specific similarity threshold can be set according to the experience of those skilled in the art or according to the actual application scenario of the embodiment of the present invention, such as 0.75 or 0.8, etc., and the embodiment of the present invention does not limit this.

[0114] Step 203, determine whether the page parameter value 1 of the response page 1 is the same as the page parameter value 3 of the response page 3. If yes, execute step 204; if no, execute step 205.

[0115] Step 204: determine a Web server device type set 1 that matches the page parameter value 1 from the Web server device type library.

[0116] If it is determined that the page parameter value 1 of the response page 1 is the same as the page parameter value 3 of the response page 3, it can be explained that the Web server has selected a parameter value of the page parameter as the final processing parameter value. At this time, the device type of at least one Web server corresponding to a parameter value can be determined from the Web server device type library shown in Table 1. For example, for a page parameter with multiple parameter values, the Web server selects the First parameter value of the page parameter as the final processing parameter value, or the Web server selects the Last parameter value of the page parameter as the final processing parameter value. Then, the device type set 1 of the Web server can be obtained from the Web server device type library. For example, assuming that the page parameter value 1 is the First parameter value of the page parameter, that is, the Web server selects the First parameter value of the page parameter as the final processing parameter value, the device type set 1 includes {JSP / Tomcat, Perl (CGI) / Apache}. It should be noted that Table 1 is only a simple example for the convenience of explaining the technical solution in the embodiment of the present invention, and does not constitute a limitation on the technical solution in the embodiment of the present invention.

[0117] Table 1

[0118]

[0119] With respect to Table 1, different HTTP parameter pollution behaviors will occur when a specific Web server is combined with a website programming language. For example, the Apache server in Table 1, with PHP as the website programming language, will take the Last parameter value of the same parameter as the final value of the parameter, while with Perl as the website programming language, will take the First parameter value of the same parameter as the final value of the parameter. For example, taking URL3 in the above example, assuming that the device type of the Web server is IIS, if the website programming language of the Web server is ASP, the parameter value of the page parameter obtained by the back end of the Web server is 1, 2 (a combination of multiple page parameter values). Alternatively, assuming that the device type of the Web server is Apache, if the website programming language of the Web server is PHP, the back end of the Web server will take the last parameter value of the page parameter as the final value for processing. In this way, by utilizing this difference, the device type range of a certain Web server can be obtained without relying on feature matching for identification.

[0120] Step 205 , determining whether the similarity value a2 between the response page 2 and the response page 3 is greater than a similarity threshold. If yes, executing step 206 ; if no, executing step 207 .

[0121] As an example, taking the cosine similarity algorithm as an example, by performing a similarity operation on response page 2 and response page 3 using the cosine similarity algorithm, a similarity value a2 between response page 2 and response page 3 can be calculated. Then, it is determined whether the similarity value a2 is greater than the similarity threshold. If the similarity value a2 is greater than the similarity threshold, step 206 is executed; if the similarity value a2 is less than or equal to the similarity threshold, step 207 is executed.

[0122] Step 206, determining whether the page parameter value 2 of the response page 2 is the same as the page parameter value 3 of the response page 3. If yes, executing step 207; if no, executing step 208.

[0123] Step 207: Determine a Web server device type set 2 that matches the page parameter value 2 from the Web server device type library.

[0124] If it is determined that the page parameter value 2 of the response page 2 is the same as the page parameter value 3 of the response page 3, it can be explained that the Web server has selected a parameter value of the page parameter as the final processing parameter value. At this time, the device type of at least one Web server corresponding to a parameter value can be determined from the Web server device type library shown in Table 1. For example, for a page parameter with multiple parameter values, the Web server selects the Last parameter value of the page parameter as the final processing parameter value, or the Web server selects the First parameter value of the page parameter as the final processing parameter value. Then, the device type set 2 of the Web server can be obtained from the Web server device type library. For example, assuming that the page parameter value 2 is the Last parameter value of the page parameter, that is, the Web server selects the Last parameter value of the page parameter as the final processing parameter value, the device type set 2 includes {PHP / Apache}.

[0125] Step 208, determining whether the page parameter value 3 of the response page 3 is a combination of the page parameter value 1 and the page parameter value 2. If yes, executing step 209; if no, executing step 212.

[0126] If the page parameter value 3 of the response page 3 has multiple sub-parameter values, and it is determined that the multiple sub-parameter values ​​are composed of a combination of the page parameter value 1 and the page parameter value 2, a URL 4 for accessing the Web server is constructed through the page parameter value 1 and the page parameter value 2, and after the Web client enters the URL 4, the response page 4 for the URL 4 can be obtained. If the page parameter value 3 of the response page 3 is a single value, or the page parameter value 3 of the response page 3 has multiple sub-parameter values, but the multiple sub-parameter values ​​are not composed of a combination of the page parameter value 1 and the page parameter value 2, step 212 is executed.

[0127] Step 209 , constructing a URL 4 for accessing the Web server according to the page parameter value 1 and the page parameter value 2 , and obtaining a response page 4 for the URL 4 .

[0128] Step 210, determine whether the similarity value a3 between the response page 3 and the response page 4 is greater than the similarity threshold. If yes, execute step; if no, execute step.

[0129] As an example, taking the cosine similarity algorithm as an example, by performing a similarity operation on response page 3 and response page 4 using the cosine similarity algorithm, a similarity value a3 between response page 3 and response page 4 can be calculated. Then, it is determined whether the similarity value a3 is greater than the similarity threshold. If the similarity value a3 is greater than the similarity threshold, step 211 is executed; if the similarity value a3 is less than or equal to the similarity threshold, step 212 is executed.

[0130] Step 211: determine a Web server device type set 3 that matches the page parameter value 3 from the Web server device type library.

[0131] If the similarity value a3 is greater than the similarity threshold, it means that the Web server has selected the multiple parameter values ​​of the page parameter as the final processing parameter value. At this time, the device type of at least one Web server corresponding to the multiple parameter values ​​can be determined from the Web server device type library shown in Table 1. For example, for a page parameter with multiple parameter values, the Web server selects the All parameter value of the page parameter as the final processing parameter value. Then, the device type set 3 of the Web server can be obtained from the Web server device type library, and the device type set 3 includes {ASP / IIS, Python / Apache}.

[0132] Step 212: Compare the similarity value a1, the similarity value a2 and the similarity value a3 to determine the maximum similarity value a0.

[0133] Step 213, determine whether the maximum similarity value a0 is greater than the similarity threshold. If yes, execute step 215; if no, execute step 214.

[0134] Step 214: Determine the device type C of the Web server from the Web server device type library according to the programming language used by the Web server.

[0135] Step 215, if it is determined that the maximum similarity value a0 is equal to the similarity value a1, then the device type set of the Web server is determined to be device type set 1; if it is determined that the maximum similarity value a0 is equal to the similarity value a2, then the device type set of the Web server is device type set 2; if it is determined that the maximum similarity value a0 is equal to the similarity value a3, then the device type set of the Web server is determined to be device type set 3.

[0136] Step 216: Determine the device type C of the Web server from device type set 1, device type set 2, or device type set 3 according to the programming language used by the Web server.

[0137] After determining device type set 1, device type C of the Web server can be determined from device type set 1 according to the programming language used by the Web server. For example, assuming that the programming language used by the Web server is JSP, device type C of the Web server can be determined from device type set 1 as Tomcat. Alternatively, after determining device type set 2, device type C of the Web server can be determined from device type set 2 according to the programming language used by the Web server. For example, assuming that the programming language used by the Web server is PHP, device type C of the Web server can be determined from device type set 2 as Apache. Alternatively, after determining device type set 3, device type C of the Web server can be determined from device type set 3 according to the programming language used by the Web server. For example, assuming that the programming language used by the Web server is ASP, device type C of the Web server can be determined from device type set 3 as IIS.

[0138] As an example, the following describes the specific implementation process of determining the similarity value between response pages by taking the calculation of the similarity value between response page 1 and response page 3 as an example.

[0139] Step a, obtaining page source code 1 of response page 1 and page source code 3 of response page 3.

[0140] For example, assume that the acquired page source code 1 is:

[0141]

[0142]

[0143] <title> test1< / title>

[0144]

[0145]

[0146] Just a test1

[0147]

[0148]

[0149] And assume that page source 3 is:

[0150]

[0151]

[0152] <title> test2< / title>

[0153]

[0154]

[0155] Just a test2

[0156]

[0157]

[0158] Step b, performing word segmentation processing on page source code 1 to obtain word segmentation set 1 corresponding to response page 1, and performing word segmentation processing on page source code 3 to obtain word segmentation set 3 corresponding to response page 3.

[0159] Among them, the word segmentation processing for the page source code is mainly based on the HTML tags and the intermediate entities of the page source code. After the word segmentation processing for the page source code 1, the word segmentation set 1 = [,, <title> ,test1,< / title> ,,,Just a test1,,], and after word segmentation processing on page source code 2, we can get word segmentation set 2 = [,, <title> ,test2,< / title> ,,,Just a test2,,].

[0160] Step c: merge and remove duplicates of word set 1 and word set 3 to obtain a merged word set list.

[0161] For example, after the above-mentioned word set 1 and word set 3 are merged and deduplicated, the merged and deduplicated word set list can be obtained, that is, the word set list1 = [,, <title> ,test1,test2,< / title> ,,,Just a test1,Just a test2,,]. Then randomly sort the word set list1 to get the sorted word set list2, for example, the word set list2 = [test1, test2, just atest1, just a test2,,, <title>，< / title> ,,,,]. Then, convert the sorted word set list2 into a word set dict in key-value pair format, that is, take each word in the word set list2 as the key, and take the position order of each word in the word set list2 as the value, so that the word set dict = [test1:0, test2:1, just a test1:2, just a test2:3, :4, :5, <title>:6，< / title> :7, :8, :9, :10, :11]. Alternatively, the word set list1 may not be randomly sorted, and the word set obtained by merging and removing duplicates may be directly converted into a key-value pair format to obtain a word set dict.

[0162] Step d: According to the word set dict in the key-value pair format obtained after the conversion process, each word in the word set 1 and the word set 3 is converted into a corresponding value value.

[0163] For example, the word segmentation set dict obtained above = [test1:0, test2:1, just a test1:2, justa test2:3, :4, :5, <title>:6，< / title> :7, :8, :9, :10, :11] as an example, according to the word set dict, each word in word set 1 is converted to the corresponding value value, that is, the new word set 1 = [4, 5, 6, 0, 7, 8, 9, 2, 10, 11], and each word in word set 3 is converted to the corresponding value value, that is, the new word set 3 = [4, 5, 6, 1, 7, 8, 9, 3, 10, 11].

[0164] Step e, encode the new word set 1 to obtain the vector set vector1, and encode the new word set 3 to obtain the vector set vector3.

[0165] Exemplarily, taking the encoding algorithm used for encoding the word set as one-hot encoding as an example, the new word set 1 is one-hot encoded to obtain a vector set vector1, and the vector set vector1 = [1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1]. The new word set 3 is one-hot encoded to obtain a vector set vector3, and the vector set vector3 = [0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1].

[0166] Step f, performing similarity calculation on the vector set vector1 corresponding to the response page 1 and the vector set vector3 corresponding to the response page 3, so as to obtain the similarity value between the response page 1 and the response page 3.

[0167] For example, taking the cosine similarity algorithm as an example, the cosine similarity algorithm is used to calculate the similarity of the above-mentioned vector set vector1 and the vector set vector3, and the similarity value cos(θ) can be obtained, that is:

[0168]

[0169] Thus, the similarity value between response page 1 and response page 3 is 0.8. Assuming the similarity threshold is 0.75, 0.8 is greater than 0.75. Therefore, it can be determined that the similarity value between response page 1 and response page 3 is greater than the similarity threshold.

[0170] Step 104: The Web client determines a target device type of the Web service device based on the first device type.

[0171] In the embodiment of the present invention, in order to more accurately identify the device type of the Web service device, the technical solution of the present invention not only constructs a first access request formed by parameter contamination of a certain parameter that can be contaminated in the Web page of the Web service device, but also constructs at least one second access request formed by accessing at least one Web page of the Web service device, and also constructs a request for normal access to the default Web page of the Web service device and a request for abnormal access to the Web service device. By combining the characteristic information of the response page reflected by each access request, the target device type of the Web service device can be more accurately determined. Then, by combining the first device type, the second device type and the third device type, the actual device type to which the Web service device belongs can be more accurately identified. Specifically, since the first device type of the Web service device is determined based on the actual response behavior of the Web service device, the actual response behavior of the Web service device can reflect the specific behavior characteristics of the Web service device for parameter pollution access requests, and the specific behavior characteristics of the Web service device cannot be easily changed, such as the behavior characteristics of an object cannot be easily changed, so it has non-repudiation, then the determined first device type of the Web service device is more accurate than the second device type and the third device type, and can better reflect the actual device type to which the Web service device belongs. Therefore, the technical solution in the present invention further accurately determines the target device type of the Web service device by first determining whether there are multiple sub-device types in the first device type. If there is only one sub-device type in the first device type, the Web client can directly use the sub-device type as the target device type of the Web service device; if it is determined that there are multiple sub-device types in the first device type, when it is determined that the third device type exists in the first device type, the third device type is determined as the target device type of the Web service device; or, when it is determined that the third device type is null and the second device type is determined to exist in the first device type, the second device type is determined as the target device type of the Web service device. In addition, under the premise that there are at least two sub-types in the first device type, if it is determined that the second device type and the third device type are both null values ​​or the second device type and the third device type do not exist in the first device type, and because the first device type can more accurately reflect the actual device type of the Web service device, any sub-device type in the first device type can be directly used as the target device type of the Web service device.

[0172] Combine the following Figure 3 Taking the above determined device type A, device type B and device type C as examples, the implementation process of determining the target device type of the Web service device in the embodiment of the present invention is described. Figure 3 A schematic diagram of a process for determining a target device type of a Web service device provided by an embodiment of the present invention.

[0173] Step 301 , determining whether there is only one sub-device type in device type C. If yes, executing step 302 ; if no, executing step 303 .

[0174] Step 302: Determine the only sub-device type existing in device type C as the target device type of the Web service device.

[0175] If it is determined that there is only one sub-device type in the device type C, it means that the device type of the Web service device obtained by HTTP parameter pollution is unique, so the unique device type can be used as the target device type of the Web service device.

[0176] Step 303, determine whether device type B is not empty. If so, execute step 304; if not, execute step 306.

[0177] Determine whether the device type B is a null value. If not, execute step 304. If it is a null value, execute step 306.

[0178] Step 304 , determine whether device type B exists in device type C. If yes, execute step 305 ; if no, execute step 306 .

[0179] If it is determined that there are multiple sub-device types in device type C, then when it is determined that device type B is not a null value, it is determined whether device type B exists in device type C.

[0180] Step 305: determine device type B as the target device type of the Web service device.

[0181] Step 306, determine whether the device type A is not empty. If so, execute step 307; if not, execute step 309.

[0182] Determine whether the device type A is a null value. If it is not a null value, execute step 307. If it is a null value, execute step 309.

[0183] Step 307 , determine whether device type A exists in device type C. If yes, execute step 308 ; if no, execute step 309 .

[0184] If it is determined that there are multiple sub-device types in device type C, then when it is determined that device type B is a null value and device type A is not a null value, or when it is determined that device type B is not a null value and device type B does not exist in device type C, determine whether device type A exists in device type C.

[0185] Step 308: determine device type A as the target device type of the Web service device.

[0186] Step 309: determine any sub-device type existing in device type C as the target device type of the Web service device.

[0187] The above embodiments show that in the above technical scheme, since the prior art scheme is to obtain the device type related information of the Web server from the response page returned by the Web server and perform feature matching on the device type related information of the Web server to determine the device type of the Web server, if the operation and maintenance personnel of the Web server forge or erase the device type related information of the Web server, or the operation and maintenance personnel customize the returned server information field, then the device type of the Web server cannot be accurately identified by the feature matching recognition method. Based on this, the technical scheme in the present invention jointly identifies the device type of the Web service device by introducing parameter pollution, and can accurately detect the real response status of the Web service device to the parameter pollution access request, and according to the real response status of the Web service device to the parameter pollution access request and the real response status of the Web service device to the access request without parameter pollution, the response behavior characteristics of the Web service device can be accurately identified, so that the device type of the Web service device can be accurately identified, thereby effectively improving the recognition accuracy of the device type of the Web service device, thereby effectively reducing the false alarm rate and false alarm rate generated by feature matching recognition. Specifically, the Web client constructs a first access request and at least one second access request for accessing the Web service device; the first access request is used to represent a request constructed by performing multi-parameter value contamination on the contaminable parameters in the access request to the Web service device; each second access request is used to represent a request constructed by not performing contamination on the contaminable parameters in the access request to the Web service device. Then, for the second response page of each second access request, a similarity operation is performed on the first response page of the first access request and the second response page of the second access request, so as to determine a first similarity value, and the first similarity value is compared with a similarity threshold, so as to determine whether the response behavior of the Web service device to the first access request is the same as the response behavior to the second access request, thereby providing support for preliminarily determining the device type of the Web service device. Then, when it is determined that the first similarity value is greater than the similarity threshold, the first device type can be further determined from the device types of at least one Web service device that matches the second response page based on the programming language used by the Web service device, and based on the first device type, the target device type of the Web service device can be accurately determined, thereby effectively improving the recognition accuracy of the device type of the Web service device, thereby effectively reducing the missed alarm rate and false alarm rate generated during feature matching recognition.

[0188] Based on the same technical concept, Figure 4 An apparatus for identifying a Web service device provided by an embodiment of the present invention is exemplarily shown. The apparatus can execute the process of a method for identifying a Web service device.

[0189] like Figure 4 As shown, the device comprises:

[0190] A construction unit 401 is used to construct a first access request and at least one second access request for accessing a Web service device; the first access request is used to represent a request constructed by performing multi-parameter value contamination on a contaminable parameter in an access request to the Web service device; each second access request is used to represent a request constructed by performing non-contamination on a contaminable parameter in an access request to the Web service device;

[0191] The processing unit 402 is used to perform a similarity operation on the first response page of the first access request and the second response page of the second access request for each second access request, and determine a first similarity value; if it is determined that the first similarity value is greater than a similarity threshold, determine a first device type that conforms to the programming language used by the Web service device from the device type of at least one of the Web service devices matching the second response page; and determine a target device type of the Web service device based on the first device type.

[0192] Optionally, the processing unit 402 is further configured to:

[0193] Constructing a third access request and a fourth access request for accessing a Web service device; the third access request is used to represent a request for normal access to the Web service device; the fourth access request is used to represent a request for abnormal access to the Web service device;

[0194] Determine the second device type of the Web service device by performing feature matching on the third response page of the third access request, and determine the third device type of the Web service device by performing feature matching on the fourth response page of the fourth access request;

[0195] The processing unit 402 is specifically used for:

[0196] A target device type of the Web service device is determined according to the first device type, the second device type, and the third device type.

[0197] Optionally, the processing unit 402 is specifically configured to:

[0198] For a second response page whose first similarity value is greater than a similarity threshold, when it is determined that a first parameter value of a contaminable parameter in the first response page is the same as a second parameter value of the contaminable parameter in the second response page, determining at least one device type matching the second parameter value from a device type library;

[0199] According to the programming language used by the Web service device, a first device type of the Web service device is determined from at least one device type matching the second parameter value.

[0200] Optionally, the processing unit 402 is further configured to:

[0201] If it is determined that the first similarity values ​​of the second response pages are all less than or equal to the similarity threshold or the first parameter value is different from the second parameter value, when it is determined that the first parameter value is a combination of the second parameter values, constructing a fifth access request for accessing the Web service device according to the second parameter values;

[0202] For a fifth response page of the fifth access request, determining a second similarity value between the fifth response page and the first response page;

[0203] If it is determined that the second similarity value is greater than the similarity threshold, determining at least one device type matching the first parameter value from the device type library;

[0204] According to a programming language used by the Web service device, a first device type of the Web service device is determined from at least one device type matching the first parameter value.

[0205] Optionally, the processing unit 402 is further configured to:

[0206] If it is determined that the second similarity value is less than or equal to the similarity threshold or the first parameter value is not a combination of the second parameter values, determining a maximum similarity value from the first similarity values ​​and the second similarity values;

[0207] If it is determined that the maximum similarity value is less than the similarity threshold, then according to the programming language used by the Web service device, a first device type of the Web service device is determined from the device type library.

[0208] Optionally, the processing unit 402 is further configured to:

[0209] If it is determined that the maximum similarity value is greater than or equal to the similarity threshold, then when it is determined that the maximum similarity value is any one of the first similarity values, the first device type of the Web service device is determined from at least one device type that matches the second parameter value based on the programming language used by the Web service device; or, when it is determined that the maximum similarity value is the second similarity value, the first device type of the Web service device is determined from at least one device type that matches the first parameter value based on the programming language used by the Web service device.

[0210] Optionally, the processing unit 402 is specifically configured to:

[0211] Obtaining the page source code of the first response page and the page source code of the second response page, and performing word segmentation processing on the page source code of the first response page and the page source code of the second response page respectively, to determine a first word segmentation set corresponding to the first response page and a second word segmentation set corresponding to the second response page;

[0212] Merge and remove duplicates of each first segmentation word in the first segmentation word set and each second segmentation word in the second segmentation word set to obtain a third segmentation word set;

[0213] Taking each third word in the third word set as a key, setting a corresponding value for each key to obtain a key-value data set;

[0214] According to the key-value data set, convert each first participle in the first participle set into a corresponding numerical value to obtain a first numerical value set, and convert each second participle in the second participle set into a corresponding numerical value to obtain a second numerical value set;

[0215] Performing encoding processing on the first value set to obtain a first vector set, and performing encoding processing on the second value set to obtain a second vector set;

[0216] The first vector set and the second vector set are subjected to a set similarity algorithm to determine the first similarity value.

[0217] Optionally, the processing unit 402 is specifically configured to:

[0218] If it is determined that there is only one sub-device type in the first device type, determining the sub-device type as the target device type of the Web service device;

[0219] If it is determined that there are at least two sub-device types in the first device type, then when it is determined that the third device type exists in the first device type, the third device type is determined as the target device type of the Web service device; or, when it is determined that the third device type is a null value and it is determined that the second device type exists in the first device type, the second device type is determined as the target device type of the Web service device.

[0220] Optionally, the processing unit 402 is further configured to:

[0221] When it is determined that there are at least two subtypes in the first device type, if it is determined that the second device type and the third device type are both null values ​​or it is determined that the second device type and the third device type do not exist in the first device type, any subtype in the first device type is determined as the target device type of the Web service device.

[0222] Based on the same technical concept, the embodiment of the present invention also provides a computing device, such as Figure 5 As shown, it includes at least one processor 501 and a memory 502 connected to the at least one processor. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present invention. Figure 5 For example, the processor 501 and the memory 502 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0223] In the embodiment of the present invention, the memory 502 stores instructions that can be executed by at least one processor 501 . The at least one processor 501 can execute the steps included in the aforementioned Web service device identification method by executing the instructions stored in the memory 502 .

[0224] Among them, the processor 501 is the control center of the computing device, and can use various interfaces and lines to connect various parts of the computing device, and realize data processing by running or executing instructions stored in the memory 502 and calling data stored in the memory 502. Optionally, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0225] The processor 501 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the identification method of the Web service device may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0226] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present invention can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0227] Based on the same technical concept, an embodiment of the present invention further provides a computer-readable storage medium storing a computer program executable by a computing device. When the program runs on the computing device, the computing device executes the steps of the above-mentioned Web service device identification method.

[0228] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0229] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0230] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0231] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0232] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0233] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of this application and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for identifying a Web service device, characterized in that: include: The Web client constructs a first access request and at least one second access request for accessing the Web service device; The first access request is used to represent a request constructed by performing multi-parameter value contamination on a contaminable parameter in an access request to the Web service device; each second access request is used to represent a request constructed by not performing contamination on a contaminable parameter in an access request to the Web service device; For each second response page of the second access request, the Web client performs a similarity operation on the first response page of the first access request and the second response page of the second access request to determine a first similarity value; If the Web client determines that the first similarity value is greater than a similarity threshold, determining a first device type that matches the programming language used by the Web service device from the device type of at least one Web service device that matches the second response page; The Web client determines a target device type of the Web service device based on the first device type; If the Web client determines that the first similarity value is greater than a similarity threshold, determining a first device type that conforms to the programming language used by the Web service device from the device type of at least one Web service device that matches the second response page includes: The Web client determines, for the second response page whose first similarity value is greater than the similarity threshold, when determining that a first parameter value of the contaminable parameter in the first response page is the same as a second parameter value of the contaminable parameter in the second response page, from a device type library at least one device type matching the second parameter value; The Web client determines the first device type of the Web service device from at least one device type matching the second parameter value according to a programming language used by the Web service device.

2. The method according to claim 1, characterized in that The method further comprises: The Web client constructs a third access request and a fourth access request for accessing the Web service device; the third access request is used to represent a request for normal access to the Web service device; the fourth access request is used to represent a request for abnormal access to the Web service device; The Web client determines the second device type of the Web service device by performing feature matching on the third response page of the third access request, and determines the third device type of the Web service device by performing feature matching on the fourth response page of the fourth access request; The Web client determines the target device type of the Web service device based on the first device type, including: The Web client determines a target device type of the Web service device according to the first device type, the second device type, and the third device type.

3. The method according to claim 1, characterized in that The method further comprises: If the Web client determines that the first similarity values ​​of the second response pages are all less than or equal to the similarity threshold or the first parameter value is different from the second parameter value, then when determining that the first parameter value is a combination of the second parameter values, constructing a fifth access request for accessing the Web service device according to the second parameter values; The Web client determines, for a fifth response page of the fifth access request, a second similarity value between the fifth response page and the first response page; If the Web client determines that the second similarity value is greater than the similarity threshold, determining at least one device type matching the first parameter value from the device type library; The Web client determines a first device type of the Web service device from at least one device type matching the first parameter value according to a programming language used by the Web service device.

4. The method according to claim 3, characterized in that The method further comprises: If the Web client determines that the second similarity value is less than or equal to the similarity threshold or the first parameter value is not a combination of the second parameter values, determining the maximum similarity value from the first similarity values ​​and the second similarity values; If the Web client determines that the maximum similarity value is less than the similarity threshold, the Web client determines the first device type of the Web service device from the device type library according to the programming language used by the Web service device.

5. The method according to claim 4, characterized in that The method further comprises: If the Web client determines that the maximum similarity value is greater than or equal to the similarity threshold, then when determining that the maximum similarity value is any one of the first similarity values, the Web client determines the first device type of the Web service device from at least one device type that matches the second parameter value based on the programming language used by the Web service device; or, when determining that the maximum similarity value is the second similarity value, the Web client determines the first device type of the Web service device from at least one device type that matches the first parameter value based on the programming language used by the Web service device.

6. The method according to claim 1, characterized in that The Web client performs a similarity operation on a first response page of the first access request and a second response page of the second access request to determine a first similarity value, including: The Web client obtains the page source code of the first response page and the page source code of the second response page, and performs word segmentation processing on the page source code of the first response page and the page source code of the second response page respectively to determine a first word segmentation set corresponding to the first response page and a second word segmentation set corresponding to the second response page; The Web client combines and removes duplicates of each first word segmentation in the first word segmentation set and each second word segmentation in the second word segmentation set to obtain a third word segmentation set; The Web client uses each third word in the third word set as a key, sets a corresponding value for each key, and obtains a key-value data set; The Web client converts each first word in the first word set into a corresponding numerical value according to the key-value data set to obtain a first numerical value set, and converts each second word in the second word set into a corresponding numerical value to obtain a second numerical value set; The Web client encodes the first value set to obtain a first vector set, and encodes the second value set to obtain a second vector set; The Web client determines the first similarity value by using a set similarity algorithm for the first vector set and the second vector set.

7. The method according to claim 2, characterized in that The Web client determines the target device type of the Web service device according to the first device type, the second device type, and the third device type, including: If the Web client determines that there is only one sub-device type in the first device type, the sub-device type is determined as the target device type of the Web service device; If the Web client determines that there are at least two sub-device types in the first device type, then when it is determined that the third device type exists in the first device type, the third device type is determined as the target device type of the Web service device; or, when it is determined that the third device type is a null value and when it is determined that the second device type exists in the first device type, the second device type is determined as the target device type of the Web service device.

8. The method according to claim 7, characterized in that The method further comprises: When the Web client determines that there are at least two subtypes in the first device type, if it is determined that the second device type and the third device type are both null values ​​or it is determined that the second device type and the third device type do not exist in the first device type, any subtype in the first device type is determined as the target device type of the Web service device.

9. A Web service device identification device, characterized in that: include: A construction unit, configured to construct a first access request and at least one second access request for accessing a Web service device; The first access request is used to represent a request constructed by performing multi-parameter value contamination on a contaminable parameter in an access request to the Web service device; each second access request is used to represent a request constructed by not performing contamination on a contaminable parameter in an access request to the Web service device; a processing unit, configured to perform a similarity operation on the first response page of the first access request and the second response page of the second access request for each second access request, and determine a first similarity value; If it is determined that the first similarity value is greater than a similarity threshold, determining a first device type that conforms to the programming language used by the Web service device from the device type of at least one of the Web service devices that matches the second response page; and determining a target device type of the Web service device based on the first device type; The processing unit is specifically used to, for a second response page whose first similarity value is greater than a similarity threshold, determine from a device type library at least one device type that matches the second parameter value when it is determined that the first parameter value of the contaminable parameter in the first response page is the same as the second parameter value of the contaminable parameter in the second response page; and determine, according to a programming language used by the Web service device, a first device type of the Web service device from at least one device type that matches the second parameter value.

10. A computing device, characterized in that: The method comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computing device, and when the program is run on the computing device, the computing device executes the method according to any one of claims 1 to 8.

Images