A method and device for determining unknown attacks on intranet web applications

Abstract

The present application provides a method and device for determining unknown attacks on intranet web applications, including: obtaining multiple access data corresponding to the intranet web application based on the real-time access information of the intranet and the access information of the intranet web application; determining the daily access data and historical access data of each intranet web application based on the access time; comparing the daily access data with the historical access data to determine the newly added access URL; when the user identity in the daily access data to which the newly added access URL belongs is a preset identity, and the newly added access URL is not the URL corresponding to the newly added business function, the newly added access URL is determined as the URL corresponding to the unknown attack. In this way, the present application can effectively protect the security of the web application by determining the newly added access URL and determining whether the newly added access URL is the URL corresponding to the unknown attack based on the identity of the user to whom the newly added access URL belongs.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for determining unknown attacks on intranet web applications. Background Art

[0002] With the continuous development of informatization, Web applications based on the Internet platform have developed rapidly, playing a very important role in the development of the Internet. However, with the continuous development of this technology, many security issues have also emerged, posing certain threats to Web applications.

[0003] There are three main methods for the existing intranet web application security protection: 1. Traditionally, it mainly relies on hardware facilities such as network firewalls and application firewalls to discover and detect attack behaviors. However, the intranet corresponds to the group company architecture, with many points and wide areas, complex intranet structure, and many levels, which requires more hardware security equipment. Moreover, the hardware equipment relies on the five elements of the network to formulate rules for access control. The rules are relatively simple and cannot discover unknown 0day attack URLs. 2. Rely on web application logs, matching rules and statistical data to discover and detect attack behaviors. However, the premise of using machine learning technology is to use historical data for supervised learning, and it is difficult for the company's intranet to have effective attack behavior data for machine learning models to learn. Similarly, using rules to match special characters in access records cannot discover unknown 0day attack URLs. There will also be more missed reports or false positives. At the same time, this type of technology also has high technical requirements for security risk analysis and modeling personnel. 3. Use the application layer plug-in "Runtime application self-protection" referred to as RASP to implement new application technology application security protection. This method also uses special character matching rules to check access records, and cannot discover unknown 0day attack URLs. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a method and device for determining unknown attacks on intranet web applications, which determines a newly added access URL through the network access information of the user using the intranet and the access information of the user accessing the intranet web application, and determines whether the newly added access URL is a URL generated by an unknown attack accessing the intranet web application based on the identity information of the user to which the newly added access URL belongs, thereby effectively monitoring and protecting the security of the intranet web application.

[0005] The present application embodiment provides a method for determining an unknown attack on an intranet web application, the method comprising:

[0006] Real-time acquisition of user access information for intranet use and access information for each intranet web application;

[0007] Perform information association based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application;

[0008] According to the access time in the access data, determine the daily access data and historical access data corresponding to each intranet web application;

[0009] For each intranet web application, compare the intranet web application's current day access data with the intranet web application's historical access data to find the newly accessed URL included in the current day access data;

[0010] When the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information, and the newly added access URL is not the URL generated by the newly added business function accessing the intranet web application, the newly added access URL is determined to be a URL generated by an unknown attack accessing the intranet web application.

[0011] Optionally, the network access information includes first information determined after the user is verified by an office network access system and second information determined after the user is verified by a VPN access system; wherein the network access information includes at least the verification pass time, the intranet IP address and the user identity information.

[0012] Optionally, the access information of the user accessing each intranet web application is determined in the following manner:

[0013] For the access information of each intranet web application, the access information is determined through the application log of the intranet web application; wherein the access information at least includes the access time, the client IP, the web application code and the access URL.

[0014] Optionally, the information association is performed based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application, including:

[0015] For each access information, search for network access information with the same IP data as the access information, associate the network access information with the access information, and determine the access data corresponding to the access information.

[0016] Optionally, determine the new access URL in the following way:

[0017] For each intranet web application, an access URL in the intranet web application's current day access data that does not appear in the intranet web application's historical access data is determined as a newly added access URL.

[0018] Optionally, after finding the newly added access URL, the determination method further includes:

[0019] Determine whether risk warning information of the newly added access URL has been sent to the system manager on the same day;

[0020] When the answer is no, risk warning information of the newly added access URL is sent to the system manager so that the system manager can determine whether the newly added access URL is a URL generated by the newly added business function accessing the intranet web application.

[0021] Optionally, after determining the newly added access URL as a URL generated by an unknown attack accessing the intranet web application, the determination method includes:

[0022] The behavior information corresponding to the unknown attack is sent to the target user to which the corresponding newly added access URL belongs, so that the target user can confirm the risk behavior according to the behavior information of the unknown attack.

[0023] The embodiment of the present application also provides a device for determining an unknown attack on an intranet web application, the device comprising:

[0024] An acquisition module is used to acquire in real time the network access information of the user using the intranet and the access information of the user accessing each intranet web application;

[0025] An association module, used to associate information based on the same IP data included in the network access information and the access information, to obtain multiple access data of the user accessing each intranet web application;

[0026] A first determination module is used to determine the daily access data and historical access data corresponding to each intranet web application according to the access time in the access data;

[0027] A search module is used to compare the daily access data of each intranet web application with the historical access data of the intranet web application to find the newly accessed URL included in the daily access data;

[0028] The second determination module is used to determine the newly added access URL as a URL generated by an unknown attack accessing the intranet web application when the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information and the newly added access URL is not a URL generated by a newly added business function accessing the intranet web application.

[0029] Optionally, the network access information includes first information determined after the user is verified by an office network access system and second information determined after the user is verified by a VPN access system; wherein the network access information includes at least the verification pass time, the intranet IP address and the user identity information.

[0030] Optionally, the determining device further includes a third determining module, and the third determining module is used to:

[0031] For the access information of each intranet web application, the access information is determined through the application log of the intranet web application; wherein the access information at least includes the access time, the client IP, the web application code and the access URL.

[0032] Optionally, when the association module is used to perform information association based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application, the association module is used to:

[0033] For each access information, search for network access information with the same IP data as the access information, associate the network access information with the access information, and determine the access data corresponding to the access information.

[0034] Optionally, the search module is further used to determine the newly added access URL in the following manner:

[0035] For each intranet web application, an access URL in the intranet web application's current day access data that does not appear in the intranet web application's historical access data is determined as a newly added access URL.

[0036] Optionally, the determining device further includes a sending module, and the sending module is used to:

[0037] Determine whether risk warning information of the newly added access URL has been sent to the system manager on the same day;

[0038] When the answer is no, risk warning information of the newly added access URL is sent to the system manager so that the system manager can determine whether the newly added access URL is a URL generated by the newly added business function accessing the intranet web application.

[0039] Optionally, the determining device further includes a confirmation module, and the confirmation module is used to:

[0040] The behavior information corresponding to the unknown attack is sent to the target user to which the corresponding newly added access URL belongs, so that the target user can confirm the risk behavior according to the behavior information of the unknown attack.

[0041] An embodiment of the present application also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the determination method as described above are performed.

[0042] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the determination method described above are executed.

[0043] The embodiment of the present application provides a method and device for determining an unknown attack on an intranet web application. The method comprises: obtaining in real time network access information of a user using an intranet and access information of the user accessing each intranet web application; performing information association based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application; determining the daily access data and historical access data corresponding to each intranet web application based on the access time in the access data; for each intranet web application, using the daily access data of the intranet web application to compare with the historical access data of the intranet web application to find a newly added access URL included in the daily access data; when the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information, and the newly added access URL is not a URL generated by a newly added business function accessing the intranet web application, then determining the newly added access URL as a URL generated by an unknown attack accessing the intranet web application.

[0044] In this way, the present application determines the newly added access URL through the user's access information using the intranet and the access information of the user accessing the intranet web application, and determines whether the newly added access URL is a URL generated by an unknown attack accessing the intranet web application based on the identity information of the user to which the newly added access URL belongs, thereby effectively monitoring and protecting the security of the intranet web application.

[0045] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A flowchart of a method for determining unknown attack behavior of an intranet web application provided in an embodiment of the present application;

[0048] Figure 2 One of the structural schematic diagrams of a device for determining unknown attack behaviors of an intranet web application provided in an embodiment of the present application;

[0049] Figure 3 A second structural diagram of a device for determining unknown attack behaviors of an intranet web application provided in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0052] There are three main methods for the existing intranet web application security protection: 1. Traditionally, it mainly relies on hardware facilities such as network firewalls and application firewalls to discover and detect attack behaviors. However, the intranet corresponds to the group company architecture, with many points and wide areas, complex intranet structure, and many levels, which requires more hardware security equipment. Moreover, the hardware equipment relies on the five elements of the network to formulate rules for access control. The rules are relatively simple and cannot discover unknown 0day attack URLs. 2. Rely on web application logs, matching rules and statistical data to discover and detect attack behaviors. However, the premise of using machine learning technology is to use historical data for supervised learning, and it is difficult for the company's intranet to have effective attack behavior data for machine learning models to learn. Similarly, using rules to match special characters in access records cannot discover unknown 0day attack URLs. There will also be more missed reports or false positives. At the same time, this type of technology also has high technical requirements for security risk analysis and modeling personnel. 3. Use the application layer plug-in "Runtime application self-protection" referred to as RASP to implement new application technology application security protection. This method also uses special character matching rules to check access records, and cannot discover unknown 0day attack URLs.

[0053] Based on this, the embodiment of the present application provides a method and device for determining unknown attack behaviors of intranet web applications, which determines the newly added access URL through the user's access information using the intranet and the access information of the user accessing the intranet web application, and determines whether the newly added access URL is an unknown attack behavior based on the identity information of the user to which the newly added access URL belongs, thereby effectively monitoring and protecting the security of the intranet web application.

[0054] See also Figure 1 , Figure 1 The present invention provides a flowchart of a method for determining unknown attack behaviors of an intranet web application. Figure 1 As shown in , the determination method provided in the embodiment of the present application includes:

[0055] S101. Acquire in real time the network access information of the user using the intranet and the access information of the user accessing each intranet web application.

[0056] Here, by monitoring the usage records of the intranet, the network access information of each user using the intranet and the access information of the intranet web application are obtained in real time. After the network access information and the access information are obtained, the network access information and the access information can be stored in the streaming data platform in real time for real-time processing of the obtained data.

[0057] The intranet may refer to an office network within a company. The user may refer to all employees within the company. The network access information may also be obtained through the intranet access log stored in the system background.

[0058] In one embodiment provided in the present application, the network access information includes first information determined after the user is verified by an office network access system and second information determined after the user is verified by a VPN access system; wherein the network access information includes at least the verification pass time, the intranet IP address and the user identity information.

[0059] Here, the intranet IP corresponding to different users is unique, and the user identity information may include the user name and the user's position information in the company, etc.

[0060] For example, the position information may include business personnel, security testers, and management personnel, etc.

[0061] In another embodiment provided by the present application, the access information of the user accessing each intranet web application is determined in the following manner: for the access information of each intranet web application, the access information is determined through the application log of the intranet web application; wherein the access information includes at least the access time, the client IP, the web application code and the access URL.

[0062] Here, different intranet web applications correspond to different web application codes, and the web application codes are used to distinguish different intranet web applications. Every time a user accesses an intranet web application, new access information is generated.

[0063] Here, the client IP in the access information may be the intranet IP used by the user to access the intranet web application.

[0064] S102: perform information association based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application.

[0065] Here, based on the same IP data, each access information has corresponding network access information. The associated network access information and access information are called access data for accessing the intranet web application.

[0066] Among them, the association operation of network access information and access information can be performed on the streaming data platform.

[0067] The association operation using the network access information and the access information is actually to add the user identity information in the network access information to the access information, so as to determine which user accessed the intranet web application to generate the access information.

[0068] In one embodiment provided in the present application, information association is performed based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application, including: for each access information, searching for network access information having the same IP data as the access information, associating the network access information with the access information, and determining the access data corresponding to the access information.

[0069] Here, associating the access information with the network access information is actually associating the application log of the intranet web application with the access log of the intranet.

[0070] S103: Determine the daily access data and historical access data corresponding to each intranet web application according to the access time in the access data.

[0071] Here, for each access data of each intranet web application, it is determined whether the access is the current day access data or the historical access data according to the access time in the access data, thereby determining the current day access data and the historical access data corresponding to each intranet web application.

[0072] The streaming data platform stores a large amount of daily access data and historical access data corresponding to each intranet web application. The streaming data platform can use spark, redis, clickhouse, etc.

[0073] It should be noted that this step must be completed in a near real-time manner.

[0074] S104: For each intranet web application, compare the intranet web application's current day access data with the intranet web application's historical access data to find a newly accessed URL included in the current day access data.

[0075] In an implementation provided by the present application, a newly added access URL is determined in the following manner: for each intranet web application, an access URL in the intranet web application's daily access data that does not appear in the intranet web application's historical access data is determined as a newly added access URL.

[0076] Here, when users access the same location of the same intranet web application at different times, the generated access URL is the same.

[0077] It should be noted that in the company's intranet, there will be corresponding security management systems and access management. Only explicitly authorized users can scan or penetrate the intranet web application, so a large number of ordinary business users will not generate new URL accesses when they use it normally. Only when new functions are launched in the application will there be new URL accesses generated by ordinary users. This situation can be confirmed and eliminated by system development and operation personnel. The URL generated by the detection and exploitation of the system's 0day vulnerability is completely different from the normal URL of the system, so a new URL must be generated. Therefore, by adding new access URLs, it can be determined whether the intranet web application is attacked by 0day.

[0078] In another embodiment provided by the present application, after finding a newly added access URL, the determination method also includes: determining whether risk warning information of the newly added access URL has been sent to the system person in charge on the same day; if not, sending risk warning information of the newly added access URL to the system person in charge so that the system person in charge can determine whether the newly added access URL is a URL generated by the newly added business function to access the intranet web application.

[0079] Here, determining whether the risk warning information of the newly added access URL has been sent to the system manager is to prevent the risk warning message of the newly added access URL from being sent repeatedly, thereby avoiding increasing the workload of the system manager.

[0080] Among them, the risk warning information sent to the system manager can be first sent to the risk message processing system, and the system manager logs in to the risk message processing system to confirm whether the newly added access URL is a URL generated by an unknown attack accessing the intranet web application.

[0081] S105. When the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information, and the newly added access URL is not a URL generated by a newly added business function accessing the intranet web application, the newly added access URL is determined as a URL generated by an unknown attack accessing the intranet web application.

[0082] Here, the risk message processing system can perform identity confirmation based on the user identity information in the daily access data to which the newly added access URL belongs, and determine whether the newly added access URL is an access URL generated by a user with preset identity information accessing an intranet web application. When the identity information is consistent, the system manager will determine whether the newly added access URL is a URL generated by a newly added business function. When the system manager determines that the newly added access URL is not a URL generated by a newly added business function accessing the intranet web application, the system manager can mark it in the risk message processing system. The risk message processing system will determine the newly added access URL as a URL generated by an unknown attack accessing the intranet web application based on the marking information.

[0083] Among them, the unknown attack can be a 0day attack. The risk message processing system performs identity confirmation based on the user identity information in the daily access data to which the newly added access URL belongs. When the confirmed user identity is not the preset identity information, the newly added access URL can be registered for future reference.

[0084] For example, assuming that the preset identity information is a business user, the risk message processing system will process the newly added access URL separately according to the identity information of the person to whom the newly added URL belongs. If the newly added URL is made by a security test user, it will be registered for future reference; if the newly added access URL is made by a business user, it will be sent to the system manager to confirm whether the newly added access URL is the URL generated by the newly added business function accessing the intranet web application.

[0085] In one embodiment provided in the present application, after determining the newly added access URL as a URL generated by an unknown attack accessing the intranet web application, the determination method includes: sending the behavior information corresponding to the unknown attack to the target user to which the corresponding newly added access URL belongs, so that the target user can confirm the risk behavior based on the behavior information of the unknown attack.

[0086] Here, after the behavior information corresponding to the unknown attack is sent to the target user corresponding to the newly added access URL, the target user queries the relevant forensic information to confirm the risk behavior of the unknown attack, thereby effectively protecting the security of the intranet web application.

[0087] It should be noted that this solution relies on user identity to determine whether the newly accessed URL is a 0day detection or attack behavior, and is not suitable for web applications on the Internet. Because web applications on the Internet will have a large number of anonymous users' scanning and detection behaviors, system operation and maintenance personnel cannot block or converge related user abnormal operations.

[0088] In addition, this solution is implemented for the enterprise intranet, in conjunction with the enterprise's security management system, to discover the latest access requests of web applications based on different user identities. Excluding normal business new functions and normal security tests, the algorithm is simple and reliable, and can discover unknown attack behaviors, as well as backdoor functions that developers may illegally retain. The big data processing platform based on spark, redis, and clickhouse has high operating efficiency. In a 4-node (4c32G) test environment, it can discover unknown attack behaviors in web applications (700 million visits / day) in near real time.

[0089] The embodiment of the present application provides a method and device for determining an unknown attack on an intranet web application. The method comprises: obtaining in real time network access information of a user using an intranet and access information of the user accessing each intranet web application; performing information association based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application; determining the daily access data and historical access data corresponding to each intranet web application based on the access time in the access data; for each intranet web application, using the daily access data of the intranet web application to compare with the historical access data of the intranet web application to find a newly added access URL included in the daily access data; when the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information, and the newly added access URL is not a URL generated by a newly added business function accessing the intranet web application, then determining the newly added access URL as a URL generated by an unknown attack accessing the intranet web application.

[0090] In this way, the present application determines the newly added access URL through the network access information of the user using the intranet and the access information of the user accessing the intranet web application, and determines whether the newly added access URL is a URL generated by an unknown attack accessing the intranet web application based on the identity information of the user to which the newly added access URL belongs, thereby effectively monitoring and protecting the security of the intranet web application.

[0091] See also Figure 2 , Figure 3 , Figure 2 One of the structural diagrams of a device for determining unknown attack behavior of an intranet web application provided in an embodiment of the present application, Figure 3 The second structural diagram of a device for determining unknown attack behaviors of an intranet web application provided in an embodiment of the present application. Figure 2 As shown in , the determining device 200 includes:

[0092] The acquisition module 201 is used to acquire in real time the network access information of the user using the intranet and the access information of the user accessing each intranet web application;

[0093] An association module 202 is used to associate information according to the same IP data included in the network access information and the access information, so as to obtain multiple access data of the user accessing each intranet web application;

[0094] A first determination module 203, used to determine the daily access data and historical access data corresponding to each intranet web application according to the access time in the access data;

[0095] A search module 204 is used to compare the daily access data of each intranet web application with the historical access data of the intranet web application to search for a newly accessed URL included in the daily access data;

[0096] The second determination module 205 is used to determine the newly added access URL as a URL generated by an unknown attack accessing the intranet web application when the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information and the newly added access URL is not a URL generated by a newly added business function accessing the intranet web application.

[0097] Optionally, the network access information includes first information determined after the user is verified by an office network access system and second information determined after the user is verified by a VPN access system; wherein the network access information includes at least the verification pass time, the intranet IP address and the user identity information.

[0098] Optional, such as Figure 3 As shown, the determining device 200 further includes a third determining module 206, and the third determining module 206 is used to:

[0099] For the access information of each intranet web application, the access information is determined through the application log of the intranet web application; wherein the access information at least includes the access time, the client IP, the web application code and the access URL.

[0100] Optionally, when the association module 202 is used to perform information association based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application, the association module 202 is used to:

[0101] For each access information, search for network access information with the same IP data as the access information, associate the network access information with the access information, and determine the access data corresponding to the access information.

[0102] Optionally, the search module 204 is further configured to determine a newly added access URL in the following manner:

[0103] For each intranet web application, an access URL in the intranet web application's current day access data that does not appear in the intranet web application's historical access data is determined as a newly added access URL.

[0104] Optionally, the determining device 200 further includes a sending module 207, and the sending module 207 is used to:

[0105] Determine whether risk warning information of the newly added access URL has been sent to the system manager on the same day;

[0106] When the answer is no, risk warning information of the newly added access URL is sent to the system manager so that the system manager can determine whether the newly added access URL is a URL generated by the newly added business function accessing the intranet web application.

[0107] Optionally, the determining device 200 further includes a confirmation module 208, and the confirmation module 208 is used to:

[0108] The behavior information corresponding to the unknown attack is sent to the target user to which the corresponding newly added access URL belongs, so that the target user can confirm the risk behavior according to the behavior information of the unknown attack.

[0109] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown in , the electronic device 400 includes a processor 410 , a memory 420 and a bus 430 .

[0110] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, the above-mentioned Figure 1 The specific implementation of the steps of the determination method in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0111] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The specific implementation of the steps of the determination method in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0113] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0114] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0115] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0116] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0117] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for determining unknown attacks on intranet web applications, characterized in that: The determination method comprises: Real-time acquisition of user access information for intranet use and access information for each intranet web application; Perform information association based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application; According to the access time in the access data, determine the daily access data and historical access data corresponding to each intranet web application; For each intranet web application, compare the intranet web application's current day access data with the intranet web application's historical access data to find the newly accessed URL included in the current day access data; When the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information, and the newly added access URL is not the URL generated by the newly added business function accessing the intranet web application, the newly added access URL is determined to be a URL generated by an unknown attack accessing the intranet web application.

2. The determination method according to claim 1, characterized in that: The network access information includes first information determined after the user is authenticated by the office network access system and second information determined after the user is authenticated by the VPN access system; wherein the network access information at least includes authentication passing time, intranet IP and user identity information.

3. The determination method according to claim 1, characterized in that: The access information of the user to each intranet web application is determined in the following manner: For the access information of each intranet web application, the access information is determined through the application log of the intranet web application; wherein the access information at least includes the access time, the client IP, the web application code and the access URL.

4. The determination method according to claim 1, characterized in that: The information association is performed based on the same IP data included in the network access information and the access information to obtain multiple access data of the user accessing each intranet web application, including: For each access information, search for network access information with the same IP data as the access information, associate the network access information with the access information, and determine the access data corresponding to the access information.

5. The determination method according to claim 1, characterized in that: Determine the newly added access URL in the following ways: For each intranet web application, an access URL in the intranet web application's current day access data that does not appear in the intranet web application's historical access data is determined as a newly added access URL.

6. The determination method according to claim 1, characterized in that: After finding the newly added access URL, the determination method further includes: Determine whether risk warning information of the newly added access URL has been sent to the system manager on the same day; When the answer is no, risk warning information of the newly added access URL is sent to the system manager so that the system manager can determine whether the newly added access URL is a URL generated by the newly added business function accessing the intranet web application.

7. The determination method according to claim 1, characterized in that: After determining the newly added access URL as a URL generated by an unknown attack accessing the intranet web application, the determination method includes: The behavior information corresponding to the unknown attack is sent to the target user to which the corresponding newly added access URL belongs, so that the target user can confirm the risk behavior according to the behavior information of the unknown attack.

8. A device for determining unknown attacks on intranet web applications, characterized in that: The determining device comprises: An acquisition module is used to acquire in real time the network access information of the user using the intranet and the access information of the user accessing each intranet web application; An association module, used to associate information based on the same IP data included in the network access information and the access information, to obtain multiple access data of the user accessing each intranet web application; A first determination module is used to determine the daily access data and historical access data corresponding to each intranet web application according to the access time in the access data; A search module is used to compare the daily access data of each intranet web application with the historical access data of the intranet web application to find the newly accessed URL included in the daily access data; The second determination module is used to determine the newly added access URL as a URL generated by an unknown attack accessing the intranet web application when the user identity information in the daily access data to which the newly added access URL belongs is the preset identity information and the newly added access URL is not a URL generated by a newly added business function accessing the intranet web application.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to perform the steps of the determination method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the determination method according to any one of claims 1 to 7 are executed.

Images