Information leakage detection method and device, storage medium and electronic device

Abstract

The present disclosure relates to the field of computer technology, and to information leakage detection methods and devices, computer-readable storage media, and electronic devices, including: intercepting and obtaining business request information before a business request enters an application programming interface service, wherein the business logic corresponding to the business request is executed through the application programming interface service; performing information leakage detection on the business request according to the business request information; after the business logic corresponding to the business request is executed, intercepting and obtaining a request response result, and performing information leakage detection on the request response result; wherein, in response to the detection result of the information leakage detection indicating that there is a leakage risk, responding to the detection result. The present disclosure improves the comprehensiveness and accuracy of information leakage detection by performing information leakage detection before the business request enters the API service and before the business logic processing is completed to generate a complete request response result.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and more specifically, to an information leakage detection method, an information leakage detection device, a computer-readable storage medium, and an electronic device. Background Art

[0002] With the development of computer and Internet technology, the ways of information leakage are becoming more and more diverse, such as information leakage caused by attacks on API (Application Program Interface). Therefore, it is particularly important to prevent information leakage through effective detection of information leakage.

[0003] Related technologies determine whether there is information leakage by detecting the response traffic of business requests. This not only causes underreporting, but also fails to prevent information leakage from occurring in a timely manner.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide an information leakage detection method and device, a computer-readable storage medium and an electronic device, thereby improving the accuracy of information leakage detection and the effectiveness of protection.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, there is provided an information leakage detection method, comprising:

[0008] Before the business request enters the application programming interface service, intercept and obtain the business request information, wherein the business logic corresponding to the business request is executed through the application programming interface service;

[0009] Performing information leakage detection on the service request according to the service request information;

[0010] After executing the business logic corresponding to the business request, intercept and obtain the request response result, and perform information leakage detection on the request response result;

[0011] In which, in response to the detection result of the information leakage detection indicating that there is a leakage risk, a response process is performed on the detection result.

[0012] In an exemplary embodiment of the present disclosure, before initiating the service request, the method further includes:

[0013] Setting a first hook point in a first target function in a request processing flow, wherein the request processing flow refers to a processing flow before the business request enters the application programming interface service;

[0014] Setting a second hook point in a second target function in a response processing flow, wherein the response processing flow refers to a processing flow after the service request is executed and before a target response result is generated;

[0015] Among them, the first hook point is used to intercept the business request information, and perform information leakage detection and result response based on the business request information according to the first processing logic; the second hook point is used to intercept the request response result, and perform information leakage detection and result response on the request response result according to the second processing logic.

[0016] In an exemplary embodiment of the present disclosure, the performing information leakage detection on the service request according to the service request information includes:

[0017] Parse token information and verify it;

[0018] Perform feature matching and limit crossing judgment on request parameters to detect injection attack behaviors;

[0019] An operation permission check is performed based on the token information and the application programming interface information to detect unauthorized access behavior.

[0020] In an exemplary embodiment of the present disclosure, performing feature matching processing and over-limit judgment on request parameters to detect injection attack behavior includes:

[0021] Matching the request parameter with a preset injection attack behavior feature to detect the injection attack behavior in the service request according to the matching result;

[0022] The request parameters are compared with a preset parameter usage range, and the over-limit behavior in the service request is detected according to the comparison result.

[0023] In an exemplary embodiment of the present disclosure, the operation permission check based on the token information and the application programming interface information to detect unauthorized access behavior includes:

[0024] Obtain the user role information in the token information;

[0025] The user role information is verified using the user authority information in the application programming interface information to detect unauthorized access behavior in the service request.

[0026] In an exemplary embodiment of the present disclosure, after executing the business logic corresponding to the business request, intercepting and obtaining the request response result, and performing information leakage detection on the request response result, include:

[0027] Intercept and obtain abnormal response results and normal response results;

[0028] Performing information leakage detection on the abnormal response result;

[0029] Perform information leakage detection on the normal response result.

[0030] In an exemplary embodiment of the present disclosure, the performing information leakage detection on the abnormal response result includes:

[0031] Performing semantic analysis on the abnormal response result to obtain abnormal indication information;

[0032] The abnormal indication information is feature-compared with preset leakage indication information, and the leakage information in the abnormal response result is determined according to the comparison result.

[0033] In an exemplary embodiment of the present disclosure, the performing information leakage detection on the normal response result includes:

[0034] By performing data flow analysis on the normal response result, a target entity class in the normal response result is obtained;

[0035] Parsing the target entity class, if the type of the target entity class is the entity class corresponding to the database, the normal response result has the risk of information leakage;

[0036] If the parsing result shows that the normal response result carries serialized plaintext of sensitive information, the normal response result has the risk of information leakage.

[0037] In an exemplary embodiment of the present disclosure, in response to the detection result of the information leakage detection indicating that there is a leakage risk, responding to the detection result includes:

[0038] In response to an information leakage detection result of the service request indicating that there is a leakage risk, rejecting the service request;

[0039] In response to the information leakage detection result of the request response result indicating that there is a leakage risk, recording the leakage risk;

[0040] Among them, for abnormal response results, the prompt information is reset, and for normal response results, the business remains running normally.

[0041] According to one aspect of the present disclosure, there is provided an information leakage detection device, the device comprising:

[0042] A first interception module is used to intercept and obtain business request information before the business request enters the application programming interface service, wherein the business logic corresponding to the business request is executed through the application programming interface service;

[0043] The first interception module is further used to perform information leakage detection on the service request according to the service request information;

[0044] A second interception module is used to intercept and obtain the request response result after executing the business logic corresponding to the business request, and perform information leakage detection on the request response result;

[0045] The result processing module is used to respond to the detection result of the information leakage detection indicating that there is a leakage risk and to respond to the detection result.

[0046] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any one of the above methods is implemented.

[0047] According to one aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned methods by executing the executable instructions.

[0048] The information leakage detection method in the exemplary embodiment of the present disclosure, on the one hand, intercepts and obtains business request information before the business request enters the application interface service, and performs information leakage detection on the business request based on the business request information, so as to effectively protect against information leakage before the information leakage occurs and timely prevent information leakage; on the other hand, after executing the business logic corresponding to the business request, intercepts and obtains the request response result, and performs information leakage detection on the request response result. By intercepting and obtaining the request response result, all responses can be detected, including normal responses and abnormal responses, thereby reducing the missed detection of information detection; on another hand, when the information leakage detection result indicates that there is a leakage risk, a timely response can be made to the detection result to effectively prevent information leakage.

[0049] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0051] Figure 1 An application scenario diagram according to an exemplary embodiment of the present disclosure is shown;

[0052] Figure 2 A flowchart of an information leakage detection method according to an exemplary embodiment of the present disclosure is shown;

[0053] Figure 3 A flow chart of performing information leakage detection on a service request according to service request information according to an exemplary embodiment of the present disclosure is shown;

[0054] Figure 4 A processing flow chart of a request response result according to an exemplary embodiment of the present disclosure is shown;

[0055] Figure 5 A schematic diagram of a flow chart of an information leakage detection method in an application scenario according to an exemplary embodiment of the present disclosure is shown;

[0056] Figure 6 A schematic diagram of the architecture of an information leakage detection device according to an exemplary embodiment of the present disclosure is shown;

[0057] Figure 7 A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown.

[0058] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0059] The exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the present disclosure will be more comprehensive and complete and the concepts of the exemplary embodiments will be fully conveyed to those skilled in the art. The same reference numerals in the figures represent the same or similar structures, and thus their detailed description will be omitted.

[0060] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known structures, methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0061] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or these functional entities or parts of functional entities may be implemented in one or more software hardened modules, or these functional entities may be implemented in different networks and / or processor devices and / or microcontroller devices.

[0062] In the related technologies in this field, the main method for information leakage caused by attacking APIs is to detect the response traffic of business requests to determine whether there is information leakage. However, this method matches traffic characteristics based on the abnormal traffic in the response, and cannot timely prevent information leakage by verifying after the response. Moreover, even normal responses may have information leakage, such as unauthorized access, direct return of database entity classes, etc. It is difficult to detect whether there is information leakage through traffic detection, which leads to the problem of missed detection of information leakage detection. In addition, after detecting information leakage, the related technology cannot prevent the continued occurrence of information leakage in a timely manner, which may still cause further information leakage and affect the safe operation of the system.

[0063] Based on this, in an exemplary embodiment of the present disclosure, a method for detecting information leakage is first provided. Figure 1 FIG. 1 is an application scenario diagram involved in the exemplary embodiment of the present disclosure. Figure 1 As shown in the figure, in the complete process from initiating a business request to generating a target response result, the business request includes a filter chain and an executor chain before entering the API service, and is bound to match the API service through path mapping parameters, and finally enters the API service. After entering the API service, the specific business logic corresponding to the business request is executed. In the process from the completion of business logic processing to the generation of a complete target response result, it also includes return value processing, executor chain, view parsing and rendering, executor chain, and filter chain.

[0064] Among them, information leakage detection of business request information before the business request enters the API service can achieve effective detection and protection before the business is executed. Before the API service completes the business logic processing and generates the target response result, the request response result is detected without distinguishing whether it is an abnormal response, thereby reducing missed detections.

[0065] It is worth noting that the information leakage detection method of the embodiment of the present disclosure can be applied in API security protection scenarios, such as WEB applications, system applications, etc., without any special limitation.

[0066] It is worth mentioning that Figure 1 The specific implementation method of each step is set according to actual implementation needs. For example, whether to perform service degradation processing in the view parsing and rendering part is set according to actual business needs, and this disclosure does not make any special limitations on this.

[0067] like Figure 2 A flow chart of an information leakage detection method according to an embodiment of the present disclosure is shown. Figure 2 As shown, the information leakage detection method of the embodiment of the present disclosure may include steps S210 to S230:

[0068] Step S210: before the business request enters the application programming interface service, intercept and obtain the business request information, wherein the business logic corresponding to the business request is executed through the application programming interface service;

[0069] Step S220: performing information leakage detection on the service request according to the service request information;

[0070] Step S230: After executing the business logic corresponding to the business request, intercept and obtain the request response result, and perform information leakage detection on the request response result;

[0071] In which, in response to the detection result of the information leakage detection indicating that there is a leakage risk, a response process is performed on the detection result.

[0072] According to the information leakage detection method of the embodiment of the present disclosure, before the business request enters the application program interface service, the business request information is intercepted and obtained, and information leakage detection is performed on the business request based on the business request information, so that effective protection can be performed before information leakage occurs and information leakage can be prevented in time; after the business logic corresponding to the business request is executed, the request response result is intercepted and obtained, and information leakage detection is performed on the request response result. By intercepting and obtaining the request response result, all responses can be detected, including normal responses and abnormal responses, thereby reducing missed detections of information detection; when the information leakage detection result indicates that there is a leakage risk, a timely response can be made to the detection result to effectively prevent information leakage.

[0073] Combine the following Figure 2 The information leakage detection method of the embodiment of the present disclosure is elaborated in detail.

[0074] In step S210, before the service request enters the application programming interface service, the service request information is intercepted and obtained.

[0075] In the exemplary embodiment of the present disclosure, the business logic corresponding to the business request is executed through the application programming interface API service. The attacker accesses the API service through fuzz testing or invalid / cross-border methods, verifies the response information, and thus obtains system information. The embodiment of the present disclosure can intercept and obtain business request information before the business request enters the API service.

[0076] Business request information includes cookie / token information in the request header, specific request parameters, API name and other request parameters. By intercepting business request information, information leakage detection can be achieved before executing specific business logic.

[0077] In an exemplary embodiment, a hook point is inserted in an agent manner to intercept and obtain relevant information. The first hook point is set in the first target function in the request processing flow, and the request processing flow refers to the processing flow before the business request enters the application programming interface service. The first hook point is used to intercept the business request information and perform information leakage detection and result response based on the business request information according to the first processing logic. By setting the first hook point in the first target function, information leakage detection and protection are performed before executing the business logic related to the business request, so as to achieve timely detection and protection of information leakage.

[0078] For example, you can insert the first hook point in the preHandle of the executor chain as an agent, see Figure 1 As shown, the first hook point can be inserted in the preHandle of the executor chain of the Interceptor. Since the path parameter binding process is a process of determining the target API through API comparison and matching, for example, it is implemented by a custom gateway. In the embodiment of the present disclosure, the first hook point is inserted in the preHandle of the executor chain before the path parameter binding process. Not only is the user unaware, but the execution logic will not be excessively affected during the self-decoding process of the first hook point.

[0079] It is worth noting that before the business request performs the API service, the embodiment of the present disclosure may also select other first objective functions to be inserted into the first hook point according to actual business requirements, etc., and there is no special limitation on this.

[0080] A second hook point is set in the second target function in the response processing flow, and the response processing flow refers to the processing flow before generating the target response result after completing the execution of the business request. The second hook point is used to intercept the request response result and perform information leakage detection and result response on the request response result according to the second processing logic.

[0081] In this case, the second hook point is inserted into the second objective function in an agent-like manner. Figure 1 As shown, in the process from the completion of business logic processing to the generation of a complete request response, it is necessary to first perform view parsing and rendering, and then enter the afterCompletion method of the executor chain. In the afterCompletion method, the embodiment of the present disclosure inserts a second hook point in an agent manner.

[0082] Since there may be service degradation processing for global exception handling during view rendering, for example, when parsing and rendering the view, the existing exceptions are processed for service degradation to prevent information leakage, so inserting the second hook point in the afterCompletion method in an agent manner can avoid the response result being the response result before the global exception handling, so that the normal response result and the abnormal response result can be obtained through the second hook point, and the data stream of the response parameters can be obtained during the execution of afterCompletion.

[0083] It is worth noting that, in the process from the completion of business logic processing to the generation of a complete request response, the embodiment of the present disclosure can also select other second objective functions to insert into the second hook point according to actual business needs, etc., and there is no special limitation on this.

[0084] The disclosed embodiment inserts hook points before the business request enters the API service and before the business request generates the target response result. The business request can be detected, and all response results of the business request can be detected without distinguishing whether it is an abnormal response, avoiding missed detection and improving the overall effectiveness of information detection.

[0085] In step S220, information leakage detection is performed on the service request according to the service request information.

[0086] In the exemplary embodiment of the present disclosure, information leakage detection is performed on the intercepted service request information to prevent information leakage in time. Figure 3 As shown, performing information leakage detection on a service request according to the service request information may include:

[0087] Parse token information and verify it;

[0088] Perform feature matching and limit crossing judgment on request parameters to detect injection attack behaviors;

[0089] Perform operation permission verification based on token information and application programming interface information to detect unauthorized access behavior.

[0090] The token information includes user information, user role, timestamp information, etc. When an attacker obtains a token in some way, he can modify the token to increase the role authority or use an expired token to access the system to obtain system information. The disclosed embodiment analyzes and verifies the token information to determine whether the token time has expired, whether the user role is correct, etc. to detect whether there is an attack in the service request.

[0091] For example, when a user refreshes or logs out of a page, the token time is updated when logging in again, but an attacker may still use an expired token to initiate access. In this case, the token information is detected to determine whether there is an attack.

[0092] The request parameters are processed for feature matching and limit crossing to detect injection attack behaviors, which may include:

[0093] Match the request parameters with the preset injection attack behavior features to detect the injection attack behavior in the business request based on the matching results;

[0094] The request parameters are compared with the preset parameter usage range, and the over-limit behavior in the service request is detected according to the comparison result.

[0095] Among them, injection attack behavior is one of the main information leakage attack methods by obtaining system sensitive information or user information. Before the business request enters the API service, the request parameters can be matched with the preset injection attack behavior characteristics, and the injection behavior attack in the business request can be detected based on the matching results.

[0096] An attacker can also access an application by using a value outside the range, for example, by setting the value of the ID to -1, and obtaining system information or system code information by judging the response of the application. The disclosed embodiment compares the request parameters with the preset parameter usage range, and detects whether there is an over-limit behavior in the service request based on the comparison result, so as to avoid malicious access by using parameters outside the range.

[0097] In an exemplary embodiment, performing an operation permission check based on token information and application programming interface information to detect unauthorized access behavior may include:

[0098] Get the user role information in the token information;

[0099] The user role information is verified using the user permission information in the application programming interface information to detect unauthorized access behavior in business requests.

[0100] Among them, the user role information in the token information can be used in combination with the API information to determine whether there is any unauthorized access behavior. During the detection process, the user center of the application can be combined to verify the token information and user permission information to determine whether there is any unauthorized access behavior.

[0101] The disclosed embodiment performs information leakage detection on the business request according to the business request information, so as to timely detect the leakage risk existing in the business request, respond to the detection result and avoid the occurrence of information leakage.

[0102] In step S230, after the business logic corresponding to the business request is executed, the request response result is intercepted and obtained, and information leakage detection is performed on the request response result.

[0103] In the exemplary embodiment of the present disclosure, there are two situations for the request response result of the business request, one is that the business processing returns the request result normally, and the other is that the business processing fails and returns an error message and prompt. The embodiment of the present disclosure takes into account that information leakage exists not only in abnormal response results, but also in normal response results, such as unauthorized access, direct return of database entity classes, etc. It is difficult to detect whether there is a problem with these information leaks through traffic detection. Therefore, after executing the business logic corresponding to the business request, the request response result is intercepted and information leakage detection is performed on the request response results.

[0104] like Figure 4 FIG. 4 shows a processing flow chart of a request response result according to an exemplary embodiment of the present disclosure. Figure 4 As shown, the request response result can be intercepted and obtained. In step S410, the abnormal response result and the normal response result are distinguished by judging whether the business is processed normally. In step S420, the abnormal response result is detected for information leakage, and in step S430, the normal response result is detected for information leakage.

[0105] Among them, information leakage detection of abnormal response results may include:

[0106] The abnormal response result is semantically analyzed to obtain abnormal indication information, and the abnormal indication information is feature-compared with preset leakage indication information, and the leakage information in the abnormal response result is determined according to the comparison result.

[0107] In actual implementation, when a business process is abnormal, the abnormal response includes an abnormal prompt. For example, when a business process is abnormal, the application program displays relevant error information and program stack information. If this information is directly returned, it will cause system information and code leakage. In order to facilitate problem location, developers may add sensitive information to the error prompt, such as failure to access a certain connection, the reason for the failure, etc., but there is a risk of information leakage. The disclosed embodiment performs semantic analysis on the abnormal response result to obtain abnormal indication information, performs feature comparison on the abnormal indication information and the preset leakage indication information, and determines the leakage information in the abnormal response result according to the comparison result.

[0108] Among them, the presence of the above abnormal indication information can be determined by detecting the key characters in the abnormal response result, without spending too much detection time, thus avoiding the impact of hook point insertion on the overall time consumption of the business.

[0109] Exemplarily, a semantic analysis is performed on the exception response result to obtain exception indication information, for example, the exception indication information is an error prompt, and then the error prompt is feature matched with stack information and common SQL (Structured Query Language) exception prompts to detect information leakage in the exception error prompt.

[0110] Among them, information leakage detection of normal response results may include:

[0111] First, the data flow of the normal response result is analyzed to obtain the target entity class in the normal response result; secondly, the target entity class is parsed. If the type of the target entity class is the entity class corresponding to the database, the normal response result has the risk of information leakage. In addition, if the parsing result shows that the normal response result carries the serialized plaintext of sensitive information, the normal response result has the risk of information leakage.

[0112] In actual implementation, since a hook point is inserted into the business processing flow, the data flow data of the business processing can be obtained through the hook point. Therefore, when the business is processed normally, the correct request response is returned, and the normal response result can be analyzed for data flow. The Class class of the response parameter is determined through data flow analysis, and then the Class class is analyzed.

[0113] By analyzing the Class class, we can determine whether the Class is the entity class corresponding to the database. For example, if there are Entity and Table annotations, it indicates that it belongs to the entity class corresponding to the database. In this case, the normal response result may have the risk of information leakage.

[0114] Analyzing the Class class can also determine whether sensitive information is directly serialized and returned as plain text, such as passwords. Even if it is a normal response result, if the above two situations exist, there is a risk of system information leakage.

[0115] The disclosed embodiment intercepts and obtains the request response result through the second hook point, and performs information leakage detection on both the abnormal response result and the normal response result in the request response result, thereby reducing the underreporting of the detection and improving the overall effectiveness of the information detection.

[0116] In an exemplary embodiment, in response to the detection result of the information leakage detection indicating that there is a leakage risk, a response process is performed on the detection result, which may at least include:

[0117] In response to the information leakage detection result of the service request indicating that there is a leakage risk, reject the service request;

[0118] In response to the information leakage detection result of the request response result indicating that there is a leakage risk, the leakage risk is recorded;

[0119] Among them, for abnormal response results, the prompt information is reset, and for normal response results, the business remains running normally.

[0120] In actual implementation, if any parameter in the business request information has the risk of information leakage, an error message will be directly returned and the business request will be rejected. For example, a prompt that the system is busy will be returned. When the business returns normally, the response will not be modified without affecting the normal operation of the business, but the access will be recorded through the log to inform the developer to make subsequent processing through the behavior recorded in the log. When the business returns abnormally, the request response result can be reset, and the abnormal response result with information leakage can be reset to a system-friendly prompt, such as the system is busy, to prevent information leakage.

[0121] like Figure 5 The flow chart of the information leakage detection method in the application scenario is shown below. Figure 1 and Figure 5 , the information leakage detection method in the application scenario is explained.

[0122] Step S510, setting a first hook point in the first target function in the request processing flow.

[0123] Among them, by inserting the first hook point before the business request enters the API service, the request header and request parameters can be verified, and behaviors such as unauthorized access can be detected.

[0124] Step S520: Setting a second hook point in the second target function in the response processing flow.

[0125] By inserting a second hook point between the completion of business logic processing and the generation of the target response result, all abnormal response results can be detected. At the second hook point, data flow analysis can be used to detect normal response results, thereby performing information leakage detection on both abnormal / normal response results and detecting missed reports.

[0126] Step S530: Perform information leakage detection on the service request according to the service request information.

[0127] The cookie / token information and request parameters can be verified.

[0128] Step S540: Perform information leakage detection on the intercepted request response result.

[0129] Step S550: In response to the detection result of the information leakage detection indicating that there is a leakage risk, a response process is performed on the detection result.

[0130] If no leakage risk is detected, the information will be released normally. If there is a leakage risk, the response will be processed according to the preset response method to ensure that information leakage is prevented without affecting the running application.

[0131] It is worth noting that the information leakage detection method of the embodiment of the present disclosure has a wide range of application scenarios. For example, it can be used in API security protection to protect online services from information leakage to reduce API information leakage; another example is used in development, security and operation DevSecOps to maintain the safe operation of services after they are launched; another example is to reduce information leakage caused by attacks on system applications by applying the information leakage detection method of the embodiment of the present disclosure in the red-blue confrontation, etc., which will not be listed one by one here.

[0132] As can be seen from the above, the information leakage detection method of the disclosed embodiment inserts hook points in the process of service request Request and request response Response in the API access process, detects service request parameters and response parameters, determines whether there is over-limit access, impersonation access, injection attack, unauthorized access, and determines whether there is information leakage in the response, thereby increasing the attack types that can be detected in terms of API security information leakage. By inserting the hook point in an agent manner, not only the Request parameter can be detected at the hook point, but also the normal response result and abnormal response result of the Response parameter can be detected, thereby improving the coverage of information leakage detection. In addition, after detecting the existence of information leakage, at the hook point and responding processing, the normal business is recorded in a log manner, so as not to affect the operation of normal business, and the abnormal request and abnormal response are downgraded, and the response to the existing information leakage is reset to a friendly prompt to prevent information leakage, thereby improving the overall effectiveness of information detection.

[0133] In addition, according to an exemplary embodiment of the present disclosure, an information leakage detection device is also provided, such as Figure 6 As shown, the device 600 includes:

[0134] A first interception module 610 is used to intercept and obtain business request information before the business request enters the application programming interface service, wherein the business logic corresponding to the business request is executed through the application programming interface service;

[0135] The first interception module 610 is further configured to perform information leakage detection on the service request according to the service request information;

[0136] The second interception module 620 is used to intercept and obtain the request response result after executing the business logic corresponding to the business request, and perform information leakage detection on the request response result;

[0137] The result processing module 630 is used to respond to the detection result of the information leakage detection indicating that there is a leakage risk and to perform response processing on the detection result.

[0138] In an exemplary embodiment of the present disclosure, the information leakage detection device 600 further includes:

[0139] A first setting module, used to set a first hook point in a first target function in a request processing flow, wherein the request processing flow refers to a processing flow before the business request enters the application programming interface service;

[0140] A second setting module is used to set a second hook point in a second target function in a response processing flow, wherein the response processing flow refers to a processing flow after completing the execution of the business request and before generating a target response result;

[0141] Among them, the first hook point is used to intercept the business request information, and perform information leakage detection and result response based on the business request information according to the first processing logic; the second hook point is used to intercept the request response result, and perform information leakage detection and result response on the request response result according to the second processing logic.

[0142] In an exemplary embodiment of the present disclosure, the first interception module 610 may include:

[0143] The first detection unit is used to parse the token information and perform verification;

[0144] The second detection unit is used to perform feature matching processing and limit crossing judgment on the request parameters to detect injection attack behavior;

[0145] The third detection unit is used to perform operation permission verification based on the token information and application programming interface information to detect unauthorized access behavior.

[0146] In an exemplary embodiment of the present disclosure, the second detection unit is configured as follows:

[0147] Matching the request parameter with a preset injection attack behavior feature to detect the injection attack behavior in the service request according to the matching result;

[0148] The request parameters are compared with a preset parameter usage range, and the over-limit behavior in the service request is detected according to the comparison result.

[0149] In an exemplary embodiment of the present disclosure, the third detection unit is configured as follows:

[0150] Obtain the user role information in the token information;

[0151] The user role information is verified using the user authority information in the application programming interface information to detect unauthorized access behavior in the service request.

[0152] In an exemplary embodiment of the present disclosure, the second interception module 620 may further include:

[0153] An interception unit, used for intercepting and obtaining abnormal response results and normal response results;

[0154] A fourth detection unit, configured to perform information leakage detection on the abnormal response result;

[0155] The fifth detection unit is used to perform information leakage detection on the normal response result.

[0156] In an exemplary embodiment of the present disclosure, the fourth detection unit is configured as follows:

[0157] Performing semantic analysis on the abnormal response result to obtain abnormal indication information;

[0158] The abnormal indication information is feature-compared with preset leakage indication information, and the leakage information in the abnormal response result is determined according to the comparison result.

[0159] In an exemplary embodiment of the present disclosure, the fifth detection unit is configured as follows:

[0160] By performing data flow analysis on the normal response result, a target entity class in the normal response result is obtained;

[0161] Parsing the target entity class, if the type of the target entity class is the entity class corresponding to the database, the normal response result has the risk of information leakage;

[0162] If the parsing result shows that the normal response result carries serialized plaintext of sensitive information, the normal response result has the risk of information leakage.

[0163] In an exemplary embodiment of the present disclosure, the result processing module 630 may include:

[0164] A first response unit, configured to reject the service request in response to an information leakage detection result indicating that there is a leakage risk;

[0165] A second response unit, configured to record the leakage risk in response to the information leakage detection result of the request response result indicating that there is a leakage risk;

[0166] Among them, for abnormal response results, the prompt information is reset, and for normal response results, the business remains running normally.

[0167] Since the specific details of each functional module (unit) of the information leakage detection device of the exemplary embodiment of the present disclosure have been described in detail in the inventive embodiment of the above-mentioned information leakage detection method, they will not be repeated here.

[0168] It should be noted that although several modules or units of the information leakage detection device are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0169] In addition, in the exemplary embodiment of the present disclosure, a computer storage medium capable of implementing the above method is also provided. A program product capable of implementing the above method of this specification is stored thereon. In some possible embodiments, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of this specification.

[0170] The embodiment of the present disclosure also provides a program product for implementing the above method, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0171] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0172] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0173] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0174] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0175] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided. It will be appreciated by those skilled in the art that various aspects of the present disclosure may be implemented as a system, method, or program product. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which may be collectively referred to herein as a "circuit", "module", or "system".

[0176] Refer to the following Figure 7 hereinafter describes an electronic device 700 according to such an embodiment of the present disclosure. Figure 7 The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0177] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include, but are not limited to: the at least one processing unit 710, the at least one storage unit 720, a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710), and a display unit 740.

[0178] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 executes the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification.

[0179] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 721 and / or a cache memory unit 722 , and may further include a read-only memory unit (ROM) 723 .

[0180] The storage unit 720 may also include a program / utility 724 having a set (at least one) of program modules 725, such program modules 725 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0181] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0182] The electronic device 700 may also communicate with one or more external devices 800 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0183] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0184] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0185] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A method for detecting information leakage, characterized in that: include: Before the business request enters the application programming interface service, intercept and obtain the business request information, wherein the business logic corresponding to the business request is executed through the application programming interface service; Performing information leakage detection on the service request according to the service request information; After executing the business logic corresponding to the business request, intercept and obtain the request response result, and perform information leakage detection on the request response result; the request response result includes an abnormal response result and a normal response result; wherein, in response to a detection result of the information leakage detection indicating that there is a leakage risk, a response process is performed on the detection result; Performing information leakage detection on the normal response result includes: By performing data flow analysis on the normal response result to obtain the target entity class in the normal response result, and parsing the target entity class, if the type of the target entity class is the entity class corresponding to the database or if the parsing result reflects that the normal response result carries serialized plaintext of sensitive information, it is determined that the normal response result has an information leakage risk.

2. The method according to claim 1, characterized in that Before initiating the service request, the method further includes: Setting a first hook point in a first target function in a request processing flow, wherein the request processing flow refers to a processing flow before the business request enters the application programming interface service; Setting a second hook point in a second target function in a response processing flow, wherein the response processing flow refers to a processing flow after the service request is executed and before a target response result is generated; Among them, the first hook point is used to intercept the business request information, and perform information leakage detection and result response based on the business request information according to the first processing logic; the second hook point is used to intercept the request response result, and perform information leakage detection and result response on the request response result according to the second processing logic.

3. The method according to claim 1, characterized in that The performing information leakage detection on the service request according to the service request information includes: Parse token information and verify it; Perform feature matching and limit crossing judgment on request parameters to detect injection attack behaviors; An operation permission check is performed based on the token information and the application programming interface information to detect unauthorized access behavior.

4. The method according to claim 3, characterized in that The request parameters are subjected to feature matching and limit crossing judgment to detect injection attack behaviors, including: Matching the request parameter with a preset injection attack behavior feature to detect the injection attack behavior in the service request according to the matching result; The request parameters are compared with a preset parameter usage range, and the over-limit behavior in the service request is detected according to the comparison result.

5. The method according to claim 3, characterized in that: The operation permission verification based on the token information and the application programming interface information to detect unauthorized access behavior includes: Obtain the user role information in the token information; The user role information is verified using the user authority information in the application programming interface information to detect unauthorized access behavior in the service request.

6. The method according to claim 1, characterized in that After the business logic corresponding to the business request is executed, intercepting and obtaining the request response result, and performing information leakage detection on the request response result, includes: Intercept and obtain abnormal response results and normal response results; Performing information leakage detection on the abnormal response result; Perform information leakage detection on the normal response result.

7. The method according to claim 6, characterized in that The performing information leakage detection on the abnormal response result includes: Performing semantic analysis on the abnormal response result to obtain abnormal indication information; The abnormal indication information is feature-compared with preset leakage indication information, and the leakage information in the abnormal response result is determined according to the comparison result.

8. The method according to any one of claims 1 to 7, characterized in that In response to the detection result of the information leakage detection indicating that there is a leakage risk, responding to the detection result includes: In response to an information leakage detection result of the service request indicating that there is a leakage risk, rejecting the service request; In response to the information leakage detection result of the request response result indicating that there is a leakage risk, recording the leakage risk; Among them, for abnormal response results, the prompt information is reset, and for normal response results, the business remains running normally.

9. An information leakage detection device, characterized in that: include: A first interception module is used to intercept and obtain business request information before the business request enters the application programming interface service, wherein the business logic corresponding to the business request is executed through the application programming interface service; The first interception module is further used to perform information leakage detection on the service request according to the service request information; A second interception module is used to intercept and obtain a request response result after executing the business logic corresponding to the business request, and perform information leakage detection on the request response result; the request response result includes an abnormal response result and a normal response result; A result processing module, configured to respond to the detection result of the information leakage detection indicating that there is a leakage risk, and to respond to the detection result; Performing information leakage detection on the normal response result includes: By performing data flow analysis on the normal response result to obtain the target entity class in the normal response result, and parsing the target entity class, if the type of the target entity class is the entity class corresponding to the database or if the parsing result reflects that the normal response result carries serialized plaintext of sensitive information, it is determined that the normal response result has an information leakage risk.

Images