Code detection method and apparatus

Abstract

The application provides a code detection method and device. The method comprises: obtaining access data generated by a code to be detected access service; determining access features of the code to be detected access service based on the access data; clustering the code to be detected based on the access features to obtain a clustering result; and determining a security level of each code to be detected based on the access features and the clustering result, which can improve the effectiveness of identifying attack codes to a certain extent, and can use big data processing technology and natural language processing methods in artificial intelligence basic technology to process the access data, thereby improving the efficiency of identifying attack codes.

Description

Technical Field

[0001] This application relates to the fields of computer and communication technology, and in particular to a code detection method and apparatus. Background Technology

[0002] With the development of information technology, the Internet has been widely used, and Internet security has received increasing attention.

[0003] In existing technologies, attack code is usually identified by searching existing dangerous code databases. However, attack code not recorded in dangerous code databases cannot be identified, thus failing to effectively identify attack code. Summary of the Invention

[0004] This application aims to provide a code detection method and apparatus, which can improve the effectiveness of identifying attack code to a certain extent.

[0005] According to one aspect of the embodiments of this application, a code detection method is provided, comprising: acquiring access data generated by the code to be detected accessing a service; determining access characteristics of the code to be detected accessing the service based on the access data; clustering the code to be detected based on the access characteristics to obtain clustering results; and determining the security level of each code to be detected based on the access characteristics and the clustering results.

[0006] According to one aspect of the embodiments of this application, a code detection device is provided, comprising: an acquisition module configured to acquire access data generated by a code to be detected accessing a service; a first determination module configured to determine access characteristics of the code to be detected accessing the service based on the access data; a clustering module configured to cluster the code to be detected based on the access characteristics; and a second determination module configured to determine the security level of each code to be detected based on the access characteristics and the clustering results.

[0007] In one embodiment of this application, based on the foregoing scheme, the clustering module is configured as follows: select any code to be detected from the codes to be detected as the target code, and classify the codes to be detected other than the target code as other codes; if the number of other codes corresponding to access features whose distances from the access features of the target code are within a set distance reaches a set number, then the target code is designated as the core point; classify the other codes corresponding to access features whose distances from the access features of the core point are within a set distance and the target code into the same category.

[0008] In one embodiment of this application, based on the foregoing scheme, the code density of different classes in the clustering results is different. The second determining module is configured to: determine the security level of the code to be detected contained in the class with the highest code density in the clustering results as a first level or pending based on the access characteristics; determine the security level of the code to be detected contained in the class with the second highest code density in the clustering results as a second level or pending based on the access characteristics, wherein the security level represented by the second level is lower than that of the first level; and determine the security level of the code to be detected in the clustering results other than the class with the highest code density and the class with the second highest code density as a third level or pending based on the access characteristics, wherein the security level represented by the third level is lower than that of the second level.

[0009] In one embodiment of this application, based on the foregoing scheme, the access feature includes the parameter access order of the code to be detected for the service, and the second determining module is configured to: obtain the parameter access order of the code to be detected for the service contained in the clustering result of the class with the highest code density; determine a unified parameter access order based on the parameter access order of the code to be detected for the service contained in the class with the highest code density; among the code to be detected contained in the class with the highest code density, determine the security level of the code to be detected whose parameter access order for the service reaches a set similarity with the unified parameter access order as a first level; and determine the security level of the code to be detected other than the code to be detected whose security level is the first level among the code to be detected contained in the class with the highest code density as undetermined.

[0010] In one embodiment of this application, based on the aforementioned scheme, the access characteristics include the number of times each of the codes to be detected accesses the service and the number of times each of the codes to be detected accesses parameters in the service. The second determining module is configured to: take the codes to be detected contained in the class with the second highest code density as pre-detection codes; if the number of times the pre-detection codes access parameters in the service increases proportionally with the number of times the pre-detection codes access the service, then determine the security level of the pre-detection codes as the second level; and determine the security level of the codes to be detected other than the codes to be detected with the second level of security as undetermined.

[0011] In one embodiment of this application, based on the aforementioned scheme, the access characteristics include the number of times and access time of the code to be detected accessing each parameter in the service. The second determining module is configured to: take the code to be detected other than the class with the highest code density and the class with the second highest code density in the clustering results as pre-hazard codes; if the number of times the pre-hazard code accesses some parameters in the service is greater than the number of times the pre-hazard code accesses other parameters in the service other than the some parameters, the security level of the pre-hazard code is determined to be the third level; the security level of the pre-hazard codes other than the code with the third level of security is determined to be undetermined.

[0012] In one embodiment of this application, based on the foregoing scheme, the access feature includes the parameter value combination generated by the code to be detected accessing the service. The second determining module is configured to: determine the probability of the code to be detected appearing based on the parameter value combination generated by the code to be detected accessing the service, and obtain a prediction result; cluster the prediction result, and determine the security level of the code to be detected contained in the cluster with the lowest probability as the fourth level; determine the security level of the code to be detected contained in the cluster with the highest probability as the third level, wherein the security level represented by the fourth level is lower than that of the third level; and determine the security level of the code to be detected contained in the cluster other than the cluster with the lowest probability and the cluster with the highest probability as undetermined.

[0013] In one embodiment of this application, based on the foregoing scheme, the second determining module is configured to: segment the combination of parameter values ​​generated by the code to be detected accessing the service to obtain words corresponding to the code to be detected; obtain the relationship between each word in the words corresponding to the code to be detected; and determine the probability that the words corresponding to the code to be detected form the combination of parameter values ​​based on the relationship between each word in the words corresponding to the code to be detected, as the probability of the code to be detected appearing.

[0014] In one embodiment of this application, based on the foregoing scheme, the second determining module is configured to: based on the relationship between the words in the words corresponding to the code to be detected, when a set number of words corresponding to the code to be detected are known as a preliminary combination, predict the probability that the next word appearing after the preliminary combination is the next word adjacent to the preliminary combination in the parameter value combination, and obtain the probability of the next word appearing after the preliminary combination; multiply the probabilities of each word appearing in the words corresponding to the code to be detected by themselves, and obtain the probability that the words corresponding to the code to be detected form the parameter value combination.

[0015] According to one aspect of the embodiments of this application, a computer-readable program medium is provided, which stores computer program instructions that, when executed by a computer, cause the computer to perform any of the methods described above.

[0016] According to one aspect of the embodiments of this application, an electronic device is provided, including: a processor; and a memory storing computer-readable instructions, which, when executed by the processor, implement the method as described in any of the preceding claims.

[0017] According to one aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the message processing methods provided in the various optional embodiments described above.

[0018] The technical solutions provided by the embodiments of this application may include the following beneficial effects:

[0019] In some embodiments of this application, the technical solutions are provided by acquiring access data generated by the access service of the code to be detected, determining the access characteristics of the access service of the code to be detected based on the access data, clustering the code to be detected based on the access characteristics, obtaining the clustering results, and determining the security level of each code to be detected based on the access characteristics and the clustering results. Even if the code to be detected is not recorded in the existing dangerous code database, the security level of the code to be detected can still be identified, which can improve the effectiveness of identifying attack code to a certain extent.

[0020] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the specification, serve to explain the principles of this application.

[0022] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown; Figure 2 A flowchart illustrating a code detection method according to an embodiment of this application is shown schematically; Figure 3 This illustration schematically shows a clustering result diagram according to an embodiment of the present application; Figure 4A flowchart illustrating a code detection method according to an embodiment of this application is shown schematically; Figure 5 A block diagram of a code detection apparatus according to an embodiment of this application is shown schematically; Figure 6 This is a hardware diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0023] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0024] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0025] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0026] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0027] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0028] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, and smart customer service. It is believed that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0029] Artificial intelligence (AI) technology encompasses both hardware and software aspects. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0030] Big data refers to data sets that cannot be captured, managed, and processed within a certain timeframe using conventional software tools. It represents massive, rapidly growing, and diverse information assets that require new processing models to achieve stronger decision-making, insightful discovery, and process optimization capabilities. With the development of artificial intelligence, big data has attracted increasing attention. Big data requires specialized technologies to effectively process large amounts of data within a tolerable timeframe. Technologies suitable for big data include massively parallel processing databases, data mining, distributed file systems, distributed databases, cloud computing platforms, the internet, and scalable storage systems.

[0031] Big data processing technology can be applied to collect and process access data generated by the code access business to be detected. Due to its powerful data processing capabilities, it can significantly improve the efficiency and accuracy of data collection and processing.

[0032] Natural Language Processing (NLP) is an important field within computer science and artificial intelligence. It studies the theories and methods for enabling effective communication between humans and computers using natural language. NLP is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field involves natural language—the language people use in daily life—and thus it has a close relationship with linguistic research. NLP techniques typically include text processing, semantic understanding, machine translation, question answering, and knowledge graphs.

[0033] Cloud technology refers to a managed technology that unifies a series of resources such as hardware, software, and networks within a wide area network or local area network to achieve data computing, storage, processing, and sharing.

[0034] Cloud technology is a collective term for network technologies, information technologies, integration technologies, management platform technologies, and application technologies applied to the cloud computing business model. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will all require robust system support, which can only be achieved through cloud computing.

[0035] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0036] The main research directions in cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0037] In one embodiment of this application, the code detection method of this application can be applied to cloud security, which can improve the effectiveness of cloud security in identifying attack code.

[0038] Figure 1 A schematic diagram of an exemplary system architecture 100 to which the technical solutions of the embodiments of this application can be applied is shown.

[0039] like Figure 1As shown, system architecture 100 may include client 101, network 102, and server 103. Network 102 is used as a medium to provide a communication link between user client 101 and server 103. Network 102 may include various connection types, such as wired communication links, wireless communication links, etc., which are not limited herein.

[0040] It should be understood that Figure 1 The number of clients 101, networks 102, and servers 103 shown is merely illustrative. Depending on implementation needs, there can be any number of clients 101, networks 102, and servers 103. For example, server 103 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. User clients 101 and event tracking clients can be smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, etc., but are not limited to these.

[0041] In one embodiment of this application, server 103 obtains access data generated by the access service of the code to be detected, determines the access characteristics of the access service of the code to be detected based on the access data, clusters the code to be detected based on the access characteristics, obtains the clustering results, and determines the security level of each code to be detected based on the access characteristics and the clustering results. Even if the code to be detected is not recorded in the existing dangerous code database, the security level of the code to be detected can still be identified, which can improve the effectiveness of identifying attack code to a certain extent.

[0042] It should be noted that the code detection method provided in this application embodiment is generally executed by server 103, and correspondingly, the code detection device is generally set in server 103. However, in other embodiments of this application, client 101 may also have similar functions to server 103, thereby executing the code detection method provided in this application embodiment.

[0043] The implementation details of the technical solutions in the embodiments of this application are described in detail below: Figure 2 The flowchart illustrating a code detection method according to an embodiment of this application is shown in the schematic diagram. The execution entity of the code detection method may be a server, for example, a... Figure 1 Server 103 is shown in the image.

[0044] Reference Figure 2 As shown, this code detection method includes at least steps S210 to S240, which are described in detail below: In step S210, the access data generated by the code to be detected accessing the service is obtained.

[0045] In one embodiment of this application, the access data may be data from the access logs generated by the code to be detected accessing the service.

[0046] In one embodiment of this application, the accessed data may be data in the Hypertext Transfer Protocol (HTTP).

[0047] In one embodiment of this application, the access data can be parameters in the HTTP protocol, such as User-Agent (UA), Common Gateway Interface (CGI), HOST (the association between a website domain name and an Internet Protocol address), param (the content of the URL parameter part), referer (the way to enter the website), webpage cache (cookie), and content, etc. The type of access data and the corresponding value can be split into key-value pairs.

[0048] In one embodiment of this application, the access data can be all parameters in the HTTP protocol to identify attack code placed anywhere in the HTTP protocol.

[0049] In step S220, the access characteristics of the code access service to be detected are determined based on the access data.

[0050] In one embodiment of this application, the access characteristics may include the number of times the code to be detected accesses the service, the number of times the code to be detected accesses each parameter in the service, the time of the code to be detected accessing each parameter in the service, the order of the parameters accessed by the code to be detected, the combination of parameter values ​​generated by the code to be detected accessing the service, and the number of times the code to be detected accesses the parameters in the service.

[0051] In one embodiment of this application, when there are multiple codes to be detected and multiple services, the parameter values ​​generated by each code to be detected accessing each service in the access data can be combined to obtain the parameter value combination generated by the code to be detected accessing the service in the access features.

[0052] In one embodiment of this application, the combination of parameter values ​​with the same HOST value and CGI value in the access data can be identified as the same code under test accessing the same service. The number of times the combination of parameter values ​​with the same HOST value and CGI value appears can be identified as the number of times the same code under test accesses the same service in the access features.

[0053] In one embodiment of this application, the generation time of each access parameter in the access data can be used to determine the time and order of the access parameters of the code to be detected in the access features.

[0054] In one embodiment of this application, access data generated after the same code to be detected accesses the same service can be obtained. The number of parameters appearing in the access data is determined as the number of times the code to be detected accesses the parameters in the service. In step S230, the code to be detected is clustered based on the access features to obtain the clustering results.

[0055] In one embodiment of this application, any code to be detected can be selected as the target code, and the other codes in the code to be detected besides the target code can be designated as other codes. If the number of other codes corresponding to access features whose distance from the target code is within a set distance reaches a set number, then the target code is designated as the core point, and the other codes corresponding to access features whose distance from the core point is within a set distance are classified as the same type as the target code.

[0056] In one embodiment of this application, the set distance can be determined based on the desired number of classes. A preset distance can be set, and the preset distance can be adjusted based on the pre-clustering results obtained from clustering at the preset distance until a suitable preset distance is found as the set distance.

[0057] In one embodiment of this application, the access features of the target code and the access features of other codes can be hashed to obtain the sequence corresponding to the target code and the sequence corresponding to other codes. The Euclidean distance, Chebyshev distance or Hamming distance between the sequence corresponding to the target code and the sequence corresponding to other codes can be calculated to obtain the calculation result. The calculation result is used as the distance between the access features of the target code and the access features of other codes.

[0058] In one embodiment of this application, a density-based clustering algorithm can be used to cluster access features, and a baseline algorithm (Density-Based Spatial Clustering of Applications with Noise, DBSCAN) can be used to cluster access features.

[0059] In one embodiment of this application, the number of clusters in the clustering result can correspond to the number of set security levels. Since more dangerous attack code is more difficult to design, it can be confirmed that the more clusters there are in the clustering result, the more secure they are. Figure 3 As shown, the clustering results are represented by a funnel-shaped design. Figure 3The diagram illustrates the clustering results according to an embodiment of this application, wherein the number of codes to be detected is the largest, the number of codes with the first security level is the second largest, the number of codes with the second security level is the third largest, the number of codes with the third security level is the fourth largest, and the number of codes with the fourth security level is the smallest.

[0060] In step S240, the security level of each code to be detected is determined based on access characteristics and clustering results.

[0061] In one embodiment of this application, the security level of the code to be detected contained in the class with the highest code density in the clustering results can be determined as the first level or pending based on access characteristics.

[0062] In one embodiment of this application, code with a security level of Level 1 can be risk-free code that does not require interception.

[0063] In one embodiment of this application, the access features may include the parameter access order of the code to be detected for the business. The parameter access order of the code to be detected for the business can be obtained from the clustering results of the class with the highest code density. Based on the parameter access order of the code to be detected for the business in the class with the highest code density, a unified parameter access order is determined. Among the code to be detected in the class with the highest code density, the security level of the code to be detected whose parameter access order for the business reaches a set similarity with the unified parameter access order is determined as the first level. The security level of the code to be detected in the class with the highest code density, excluding the code to be detected with the first level of security, is determined as undetermined.

[0064] In one embodiment of this application, the parameter access order that appears most frequently in the parameter access order of the business logic contained in the class with the highest code density can be determined as the unified parameter access order.

[0065] In one embodiment of this application, the parameter access order of the code to be detected contained in the class with the highest code density for the business purpose can be compared bit by bit with the unified parameter access order. The number of bits with the same parameter value is divided by the total number of bits in the parameter value as the similarity between the parameter access order of the code to be detected contained in the class with the highest code density for the business purpose and the unified parameter access order.

[0066] In one embodiment of this application, the value of the similarity can be set based on experience. For example, the similarity can be set to 1. If the parameter access order of the code to be detected contained in the class with the highest code density is completely consistent with the unified parameter access order, then the security level of the code to be detected contained in the class with the highest code density is determined as the first level.

[0067] In one embodiment of this application, the code to be detected with a security level of pending can be identified by comparing it with an existing dangerous code database. If it is not in the existing dangerous code database, it can be sent to a verification client for manual verification.

[0068] In one embodiment of this application, the code to be detected with a security level of pending determination can be added to the class with the second highest code density in the clustering results, and the processing procedure of the code to be detected contained in the class with the second highest code density is consistent.

[0069] In one embodiment of this application, the security level of the code to be detected contained in the class with the second highest code density in the clustering results can be determined as the second level or undetermined based on access characteristics. The security level represented by the second level is lower than that of the first level.

[0070] In one embodiment of this application, the access characteristics may include the number of times each code to be detected accesses the service and the number of times each code to be detected accesses parameters within the service. The code to be detected contained in the class with the second highest code density may be used as pre-detection code. If the number of times a pre-detection code accesses parameters within the service increases proportionally with the number of times the pre-detection code accesses the service, then the security level of the pre-detection code is determined to be level two. The security level of the code to be detected other than the code with a security level of level two is determined to be undetermined. For example, if, in the access data of a certain service corresponding to a certain pre-detection code, the number of parameters in the access data increases by one for each additional access to the service by the pre-detection code, then it is determined that the pre-detection code accesses different parameters each time it accesses the service, and therefore the security level of the pre-detection code can be determined to be level two.

[0071] In this embodiment, the pre-probe code may be malicious probe code. By comparing the number of times the pre-probe code probes the service with the number of parameters appearing in the access data of the corresponding service, malicious probe code that probes each parameter in the service the same number of times in order to find vulnerabilities can be identified.

[0072] In one embodiment of this application, the access feature may include the number of times each of the codes to be detected accesses each parameter in the service. The number of times the code to be detected contained in the class with the second highest code density accesses each parameter in the service may be obtained, and multiple counts corresponding to the code to be detected contained in the class with the second highest code density may be obtained. If the difference between the multiple counts is less than a first set difference value, the security level of the code to be detected contained in the class with the second highest code density is determined as the second level.

[0073] In one embodiment of this application, based on access characteristics, the security level of the code to be detected, excluding the class with the highest code density and the class with the second highest code density in the clustering results, can be determined as the third level or undetermined. The security level represented by the third level is lower than that of the second level.

[0074] In one embodiment of this application, the access characteristics may include the number of accesses and the access time of each parameter in the access service of the code to be detected. The code to be detected, excluding the class with the highest code density and the class with the second highest code density in the clustering results, may be regarded as a pre-hazard code. If the number of accesses of some parameters in the access service of the pre-hazard code is greater than the number of accesses of other parameters in the access service of the pre-hazard code, the security level of the pre-hazard code is determined to be the third level; the security level of the pre-hazard code other than the code with the third level of security is determined to be undetermined.

[0075] In one embodiment of this application, the code whose security level is to be determined in the clustering result containing the second highest code density class can be added to the clustering result other than the highest code density class and the second highest code density class as pre-hazard code.

[0076] In one embodiment of this application, the access features may include the number of accesses, access times, and combinations of access parameters for each parameter in the access service of the code to be detected. If the number of accesses for some parameters in the access service of the pre-hazardous code is greater than the number of accesses for other parameters in the access service of the pre-hazardous code except for some parameters, and the difference in access time between two consecutive accesses of some parameters by the pre-hazardous code is less than a set time, and the similarity of the access parameter combinations between the pre-hazardous codes meets the set conditions, then the security level of the pre-hazardous code is determined to be the third level.

[0077] In this embodiment, the code with a security level of three can be attack code that steals benefits. Using the above method, it is possible to identify attack code that continuously steals benefits based on its characteristics such as persistence, similar content, and specific target.

[0078] In one embodiment of this application, the access features may include a combination of parameter values ​​generated by the access service of the code to be detected. Based on the combination of parameter values ​​generated by the access service of the code to be detected, the probability of the code to be detected appearing can be determined to obtain a prediction result. The prediction result is then clustered. The security level of the code to be detected contained in the cluster with the lowest probability is determined as the fourth level; the security level of the code to be detected contained in the cluster with the highest probability is determined as the third level, wherein the fourth level represents a lower security level than the third level; and the security level of the code to be detected contained in the clusters other than the lowest probability and the highest probability is determined as undetermined.

[0079] In one embodiment of this application, the combination of parameter values ​​generated by the code to be detected access service can be segmented to obtain words corresponding to the code to be detected, the relationship between each word in the words corresponding to the code to be detected can be obtained, and based on the relationship between each word in the words corresponding to the code to be detected, the probability of the words corresponding to the code to be detected forming a combination of parameter values ​​can be determined as the likelihood of the code to be detected appearing.

[0080] In one embodiment of this application, when segmenting the combination of parameter values, words can be distinguished according to delimiters (delimiters include: space, newline, carriage return), and each special character is treated as a word. If there are other words and special characters without a delimiter between them, they are also treated as having special characters. For example, a@b will be segmented into three characters: a, @, and b.

[0081] In one embodiment of this application, the parameter values ​​of the code to be detected can be combined in the form of key-value pairs, and the values ​​in the key-value pairs can be segmented.

[0082] In one embodiment of this application, based on the relationship between the words in the words corresponding to the code to be detected, when a set number of words corresponding to the code to be detected are known as a preliminary combination, the probability that the next word appearing after the preliminary combination is the next word adjacent to the parameter value combination of the preliminary combination can be predicted, and the probability of the next word appearing after the preliminary combination can be obtained. The probability of each word appearing in the words corresponding to the code to be detected is multiplied to obtain the probability of the words corresponding to the code to be detected forming a parameter value combination.

[0083] In one embodiment of this application, the embodiments described above for determining the security level of each code to be detected based on access features and clustering results can be used in combination, and no limitation is imposed here.

[0084] exist Figure 2In this embodiment, by acquiring access data generated by the access service of the code to be detected, the access characteristics of the access service of the code to be detected are determined based on the access data, the code to be detected is clustered based on the access characteristics to obtain the clustering results, and the security level of each code to be detected is determined based on the access characteristics and the clustering results. Even if the code to be detected is not recorded in the existing dangerous code database, the security level of the code to be detected can still be identified, which can improve the effectiveness of identifying attack code to a certain extent.

[0085] Figure 4 The flowchart illustrating a code detection method according to an embodiment of this application is shown in the schematic diagram. The execution entity of the code detection method may be a server, for example, a... Figure 1 Server 103 is shown in the image.

[0086] Reference Figure 4 As shown, after obtaining the access data of the code to be detected, the parameters in the access data are extracted, and the extracted parameters are then subjected to word segmentation, basic statistics, and time-series statistics. The segmented parameters are processed using the N-gram algorithm and the baseline algorithm, classifying the code to be detected into four levels: Level 4, Level 3, and undetermined. The parameters after basic and time-series statistics are processed using the baseline algorithm, classifying the code to be detected into three levels: Level 3, Level 2, Level 1, and undetermined. Among these, Level 1 security code can be non-threatening secure code; Level 2 security code can be malicious scanning code for vulnerabilities, characterized by indiscriminate targeting, wide scope, simple methods, fixed behavior, and a try-and-go nature; Level 3 security code can be attack code for theft, characterized by simple methods and clear targets; Level 4 security code can be code that causes significant losses to core business or poses a national-level threat, characterized by sophisticated methods and clear targets; and undetermined security code can be code accessed through abnormal business channels but without obvious attack intent or methods.

[0087] In one embodiment of this application, basic statistics may include statistics on the occurrence of key (parameter values) among major parameters such as param, referer, cookie, and content under the same HOST and CGI conditions, in order to determine the most frequently occurring combination of parameter values ​​in normal business operations.

[0088] In one embodiment of this application, timing statistics can be used to count the sequence of each client IP accessing the HOST and CGI, in order to determine the most frequently accessed parameter order in normal business operations.

[0089] In one embodiment of this application, the parameters after word segmentation are processed by a Chinese language model and a baseline algorithm, and can be combined with a funnel-shaped design to identify the security level of the code to be detected.

[0090] In one embodiment of this application, the 3-tuple N-gram algorithm can be used to process the parameters after word segmentation. Because the algorithm uses a 3-tuple structure, and the first and second words in the string do not satisfy this structure, padding is used to fill the first and second words during model statistics. That is, the sequence a, b, c will be counted in the form of padding, padding, a, b, c. The statistics are calculated using the following formula: P(w) = C(w) / C(1) P(wi-1, wi) = C(wi-1, wi) / C(2) P(wi-2, wi-1, wi) = C(wi-2, wi-1, wi) / C(3) P(wi|wi 2, wi 1)=P(wi 2, wi 1,wi) / P(wi 2,wi 1) Where P(w) represents the probability of a single word appearing, C(w) represents the number of times a single word appears in the whole, and C(1) represents the total number of single words; P(wi-1,wi) represents the probability of wi-1 and wi appearing in order, C(wi-1,wi) represents the number of times wi-1 and wi appear in order in the whole, and C(2) represents the total number of sets of two words appearing in order; and so on, P(wi-2,wi-1,wi), C(wi-2,wi-1,wi) and C(3) are the representations of the three words; P(wi|wi 2, wi 1) represents the probability that wi appears after wi-1 and wi-2.

[0091] The advantage of the Ngram algorithm lies in its assessment of the probability of content occurrence, thus enabling the use of probabilistic identification of sophisticated attack methods.

[0092] In one embodiment of this application, because sophisticated attack methods have a low probability of occurrence, the security level of the code to be detected with the lowest probability of occurrence can be determined as the fourth level code, which has the highest threat level. When a single service is continuously subjected to sophisticated attack events, this event is treated as a critical threat traffic requiring close attention.

[0093] In one embodiment of this application, high-probability events encountered in the Ngram algorithm can be characterized as single-means attack events, high-probability events can be identified as events that steal benefits, and the security level of the code to be detected corresponding to the high-probability event can be determined as the third level.

[0094] In one embodiment of this application, the security level of the code to be detected corresponding to an event in the buffer space area left between high-probability events and low-probability events can be determined as pending. The code with a pending security level is observed to avoid false alarms.

[0095] pass Figure 4 The illustrated embodiment analyzes the parameters of the code to be detected and classifies it according to factors such as the sophistication of the attack methods, the clarity of the attacker's target, and the persistence of the attack behavior. This allows limited operations personnel to focus on solving important problems.

[0096] The following describes an apparatus embodiment of this application, which can be used to execute the code detection method described above in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the code detection method described above in this application.

[0097] Figure 5 A block diagram of a code detection apparatus according to an embodiment of this application is shown schematically.

[0098] Reference Figure 5 As shown, a code detection device 500 according to an embodiment of this application includes an acquisition module 501, a first determination module 502, a clustering module 503, and a second determination module 504.

[0099] In some embodiments of this application, based on the foregoing scheme, the acquisition module 501 is configured to acquire access data generated by the access service of the code to be detected; the first determination module 502 is configured to determine the access characteristics of the access service of the code to be detected based on the access data; the clustering module 503 is configured to cluster the code to be detected based on the access characteristics; and the second determination module 504 is configured to determine the security level of each code to be detected based on the access characteristics and the clustering results.

[0100] In one embodiment of this application, based on the aforementioned scheme, the clustering module 503 is configured as follows: select any code to be detected as the target code from the code to be detected, and treat the other codes in the code to be detected besides the target code as other codes; if the number of other codes whose distance to the access features of the target code is within a set distance reaches a set number, then the target code is used as the core point; and classify the other codes and the target code corresponding to the access features whose distance to the core point is within a set distance into the same category.

[0101] In one embodiment of this application, based on the aforementioned scheme, the code density of different classes in the clustering results is different. The second determining module 504 is configured to: determine the security level of the code to be detected contained in the class with the highest code density in the clustering results as a first level or pending based on access characteristics; determine the security level of the code to be detected contained in the class with the second highest code density in the clustering results as a second level or pending based on access characteristics, wherein the security level represented by the second level is lower than that of the first level; and determine the security level of the code to be detected in the clustering results other than the class with the highest code density and the class with the second highest code density as a third level or pending based on access characteristics, wherein the security level represented by the third level is lower than that of the second level.

[0102] In one embodiment of this application, based on the aforementioned scheme, the access features include the parameter access order of the code to be detected for the business. The second determining module 504 is configured to: obtain the parameter access order of the code to be detected for the business contained in the clustering result of the class with the highest code density; determine a unified parameter access order based on the parameter access order of the code to be detected for the business contained in the class with the highest code density; among the code to be detected contained in the class with the highest code density, determine the security level of the code to be detected whose similarity between the parameter access order for the business and the unified parameter access order reaches a set similarity as the first level; and determine the security level of the code to be detected other than the code to be detected whose security level is the first level among the code to be detected contained in the class with the highest code density as undetermined.

[0103] In one embodiment of this application, based on the aforementioned scheme, the access characteristics include the number of times each code to be detected accesses the service and the number of times each code to be detected accesses parameters in the service. The second determining module 504 is configured to: take the code to be detected contained in the class with the second highest code density as the pre-detection code; if the number of times the pre-detection code accesses parameters in the service increases proportionally with the number of times the pre-detection code accesses the service, then the security level of the pre-detection code is determined to be the second level; and the security level of the code to be detected other than the code to be detected with the second level of security is determined to be undetermined.

[0104] In one embodiment of this application, based on the aforementioned scheme, the access features include the number of accesses and the access time of each parameter in the access service of the code to be detected. The second determining module 504 is configured to: take the code to be detected, excluding the class with the highest code density and the class with the second highest code density in the clustering results, as the pre-hazard code; if the number of times some parameters in the access service of the pre-hazard code is greater than the number of times other parameters in the access service of the pre-hazard code is greater than a second set difference, then the security level of the pre-hazard code is determined to be the third level; the security level of the pre-hazard code other than the code with the third level of security is determined to be undetermined.

[0105] In one embodiment of this application, based on the aforementioned scheme, the access features include a combination of parameter values ​​generated by the access service of the code to be detected. The second determining module 504 is configured to: determine the probability of the code to be detected appearing based on the combination of parameter values ​​generated by the access service of the code to be detected, and obtain a prediction result; cluster the prediction result, and determine the security level of the code to be detected contained in the cluster with the lowest probability as the fourth level; determine the security level of the code to be detected contained in the cluster with the highest probability as the third level, wherein the security level represented by the fourth level is lower than that of the third level; and determine the security level of the code to be detected contained in the cluster other than the cluster with the lowest probability and the cluster with the highest probability as undetermined.

[0106] In one embodiment of this application, based on the aforementioned scheme, the second determining module 504 is configured to: segment the combination of parameter values ​​generated by the code access service to be detected to obtain words corresponding to the code to be detected; obtain the relationship between each word in the words corresponding to the code to be detected; and determine the probability of the words corresponding to the code to be detected forming a combination of parameter values ​​based on the relationship between each word in the words corresponding to the code to be detected, as the probability of the code to be detected appearing.

[0107] In one embodiment of this application, based on the aforementioned scheme, the second determining module 504 is configured to: based on the relationship between the words in the words corresponding to the code to be detected, when a set number of words corresponding to the code to be detected are known as a preliminary combination, predict the probability that the next word appearing after the preliminary combination is the next word adjacent to the parameter value combination of the preliminary combination, and obtain the probability of the next word appearing after the preliminary combination; multiply the probabilities of each word appearing in the words corresponding to the code to be detected by themselves, and obtain the probability of the words corresponding to the code to be detected forming a parameter value combination.

[0108] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0109] The following reference Figure 6 To describe an electronic device 60 according to this embodiment of the present application. Figure 6 The electronic device 60 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0110] like Figure 6As shown, the electronic device 60 is presented in the form of a general-purpose computing device. The components of the electronic device 60 may include, but are not limited to: at least one processing unit 61, at least one storage unit 62, a bus 63 connecting different system components (including storage unit 62 and processing unit 61), and a display unit 64.

[0111] The storage unit stores program code that can be executed by the processing unit 61, causing the processing unit 61 to perform the steps described in the "Embodiment Method" section above according to various exemplary embodiments of this application.

[0112] Storage unit 62 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 621 and / or a cache memory unit 622, and may further include a read-only memory unit (ROM) 623.

[0113] Storage unit 62 may also include a program / utility 624 having a set (at least one) program module 625, such program module 625 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0114] Bus 63 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the multiple bus structures.

[0115] Electronic device 60 can also communicate with one or more external devices (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 60, and / or with any device that enables electronic device 60 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 65. Furthermore, electronic device 60 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 66. As shown, network adapter 66 communicates with other modules of electronic device 60 via bus 63. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 60, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0116] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this application.

[0117] According to one embodiment of this application, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above in this specification is stored. In some possible implementations, various aspects of this application may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this application described in the "Exemplary Methods" section of this specification.

[0118] According to one embodiment of this application, the program product for implementing the above method can be a portable compact disc read-only memory (CD-ROM) and include program code, and can run on a terminal device, such as a personal computer. However, the program product of this application is not limited thereto. In this document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0119] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0120] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0121] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0122] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0123] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0124] The data collection and processing plan outlined in this application must be implemented in strict accordance with the requirements of relevant national laws and regulations, obtaining the informed consent or separate consent of the data subject (or having a legal basis as stipulated by the relevant national laws and regulations), and conducting subsequent data use and processing within the scope authorized by laws and regulations and the data subject.

[0125] It should be understood that this application is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A code detection method, characterized in that, include: Obtain access data generated by the code to be detected accessing the service, wherein the access data is parameters in the Hypertext Transfer Protocol. Based on the access data, the access characteristics of the code to be detected accessing the service are determined; The code to be detected is clustered based on the access characteristics to obtain clustering results; The security level of each of the codes to be detected is determined based on the access characteristics and the clustering results. The step of determining the security level of each code to be detected based on the access features and the clustering results includes: based on the access features, determining the security level of the code to be detected contained in the class with the highest code density in the clustering results as a first level or undetermined; the security level of the code to be detected is one of multiple security levels, including a first level, a second level, and a third level; the second level represents a lower level of security than the first level, and the third level represents a lower level of security than the second level.

2. The code detection method according to claim 1, characterized in that, The clustering of the code to be detected based on the access features includes: Select any code to be detected from the code to be detected as the target code, and take the other codes in the code to be detected besides the target code as other codes; If the number of other codes corresponding to access features whose distance to the target code is within a set distance reaches a set number, then the target code is taken as the core point; Other codes corresponding to access features whose distance from the access features of the core point is within a set distance are classified into the same category as the target code.

3. The code detection method according to claim 1, characterized in that, The code density differs among different clustering results. Determining the security level of each piece of code to be detected based on the access features and the clustering results includes: Based on the access characteristics, the security level of the code to be detected contained in the class with the second highest code density in the clustering results is determined as Level 2 or undetermined; Based on the access characteristics, the security level of the code to be detected, excluding the class with the highest code density and the class with the second highest code density in the clustering results, is determined to be level three or undetermined.

4. The code detection method according to claim 3, characterized in that, The access characteristics include the parameter access order of the code to be detected for the service. Based on the access characteristics, determining the security level of the code to be detected contained in the cluster with the highest code density in the clustering results as either Level 1 or pending includes: Obtain the parameter access order of the code to be detected for the business from the class with the highest code density in the clustering results; Based on the parameter access order of the code to be detected contained in the class with the highest code density for the business, a unified parameter access order is determined; Among the code to be detected contained in the class with the highest code density, the security level of the code to be detected that has a similarity between the parameter access order for the business and the unified parameter access order reaches a set similarity is determined as the first level; The security level of the code to be tested in the class with the highest code density, excluding the code to be tested with the first security level, is determined to be undetermined.

5. The code detection method according to claim 3, characterized in that, The access characteristics include the number of times each of the codes to be detected accesses the service and the number of times each of the codes to be detected accesses parameters in the service. Based on these access characteristics, determining the security level of the codes to be detected contained in the cluster with the second highest code density in the clustering results as level two or pending includes: The code to be detected contained in the class with the second highest code density is used as the pre-detection code; If the number of times the pre-detection code accesses parameters in the service increases proportionally with the number of times the pre-detection code accesses the service, then the security level of the pre-detection code is determined to be Level 2. The security level of the codes to be detected, excluding those with a security level of Level 2, is determined to be undetermined.

6. The code detection method according to claim 3, characterized in that, The access characteristics include the number of times and the access time of the code to be detected accessing various parameters in the service. Based on the access characteristics, the security level of the code to be detected, excluding the class with the highest code density and the class with the second highest code density in the clustering results, is determined to be level three or undetermined, including: The codes to be detected, excluding the class with the highest code density and the class with the second highest code density in the clustering results, are taken as pre-hazard codes. If the number of times the pre-hazard code accesses certain parameters in the service is greater than the number of times the pre-hazard code accesses other parameters in the service besides those parameters, then the security level of the pre-hazard code is determined to be the third level. The security level of pre-hazard codes, except for those with a security level of 3, is determined to be pending.

7. The code detection method according to claim 1, characterized in that, The access features include combinations of parameter values ​​generated by the code to be detected accessing the service. Determining the security level of each code to be detected based on the access features and the clustering results includes: Based on the combination of parameter values ​​generated by the service accessed by the code to be detected, the probability of the code to be detected appearing is determined, and a prediction result is obtained. The prediction results are clustered, and the security level of the code to be detected contained in the cluster with the lowest probability is determined as the fourth level. The security level of the code to be detected contained in the cluster with the highest probability obtained by clustering is determined as the third level, wherein the fourth level represents a lower level of security than the third level; The security level of the code to be detected, excluding the class with the lowest probability and the class with the highest probability, is determined to be undetermined.

8. The code detection method according to claim 7, characterized in that, The step of determining the probability of the occurrence of the code to be detected based on the combination of parameter values ​​generated by accessing the service through the code to be detected includes: The combination of parameter values ​​generated by the business accesses the code to be detected is used for word segmentation to obtain the words corresponding to the code to be detected. Obtain the relationship between the words in the word list corresponding to the code to be detected; Based on the relationship between the words in the words corresponding to the code to be detected, the probability that the words corresponding to the code to be detected form the combination of parameter values ​​is determined, which is taken as the probability of the code to be detected appearing.

9. The code detection method according to claim 8, characterized in that, The step of determining the probability that the words corresponding to the code to be detected form the combination of parameter values ​​based on the relationship between the words in the words corresponding to the code to be detected includes: Based on the relationship between the words in the words corresponding to the code to be detected, when a set number of words corresponding to the code to be detected are known as a preliminary combination, the probability that the next word appearing after the preliminary combination is the next word adjacent to the preliminary combination in the parameter value combination is predicted, and the probability of the next word appearing after the preliminary combination is obtained. The probability of each word appearing in the words corresponding to the code to be detected is multiplied to obtain the probability that the words corresponding to the code to be detected form the combination of the parameter values.

10. A code detection device, characterized in that, include: The acquisition module is configured to acquire access data generated by the access service of the code to be detected, wherein the access data is parameters in the Hypertext Transfer Protocol. The first determining module is configured to determine the access characteristics of the code to be detected accessing the service based on the access data; The clustering module is configured to cluster the code to be detected based on the access features; The second determining module is configured to determine the security level of each of the codes to be detected based on the access features and the clustering results; the second determining module is configured to: based on the access features, determine the security level of the code to be detected contained in the class with the highest code density in the clustering results as the first level or undetermined; the security level of the code to be detected is one of multiple security levels, the multiple security levels include the first level, the second level and the third level; the security represented by the second level is lower than the first level, and the security represented by the third level is lower than the second level.

11. A computer-readable program medium storing computer program instructions, characterized in that, When the computer program instructions are executed by a computer, the computer performs the method as described in any one of claims 1 to 9.

12. An electronic device, characterized in that, include: processor; A memory storing computer-readable instructions that, when executed by the processor, implement the method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium, wherein a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions to cause the computer device to perform the method as described in any one of claims 1 to 9.

Images