Anti-sniffer method, device, terminal equipment and computer-readable storage medium

Abstract

This application provides an anti-sniffing method, apparatus, terminal device, and computer-readable storage medium. The anti-sniffing method includes: intercepting interactive information sent by a second device before a first device receives the information; parsing the interactive information to determine content to be filtered within the interactive information; generating customized interactive information based on the content to be filtered and combined with the interactive information; and sending the customized interactive information to the first device. This method can filter out interactive information that does not conform to preset rules, reducing the likelihood of sniffing and SQL injection attacks. Furthermore, by customizing the structure of returned information, it prevents attackers from sniffing critical system information, thereby improving system security.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular relates to an anti-sniffing method, apparatus, terminal device, and computer-readable storage medium. Background Art

[0002] With the rapid development of network technology, security issues are receiving increasing attention. Sniffing is a fundamental technique. From an attack perspective, sniffing programs can be used to illegally obtain large amounts of sensitive information transmitted within a system. For example, in application development based on the ASP.NET application framework, the controller cannot capture illegal or malicious requests, and the returned responses may expose critical system information. Attackers may exploit these vulnerabilities to attack the system. Summary of the Invention

[0003] The embodiments of the present application provide a method and device for preventing sniffing, which can solve the problem that the system cannot capture malicious or illegal requests and cannot filter sensitive information in response information.

[0004] A first aspect of an embodiment of the present application provides an anti-sniffing method, comprising:

[0005] Before the first device receives the interaction information sent by the second device, intercepting the interaction information;

[0006] Parsing the interaction information to determine content to be filtered in the interaction information;

[0007] Based on the content to be filtered, generating customized interaction information in combination with the interaction information;

[0008] The customized interaction information is sent to the first device.

[0009] In an optional embodiment, the interaction information includes request information sent by the second device to the first device, or response information generated by the second device based on the request information of the first device.

[0010] In an optional embodiment, parsing the interaction information and determining the content to be filtered in the interaction information includes:

[0011] Splitting the interactive information into at least one content segmentation word based on a preset dictionary;

[0012] Comparing all content segmentations with at least one set database to determine whether each content segmentation is in the at least one set database;

[0013] If yes, the content segment is determined as content to be filtered, and the interactive information including the content to be filtered is determined as information to be filtered.

[0014] In an optional embodiment, generating customized interaction information based on the content to be filtered and in combination with the interaction information specifically includes:

[0015] Based on the content to be filtered, at least one phrase unit is generated, and the phrase unit contains at least one content to be filtered. The phrase unit is matched with a set general sentence database, and the general sentence database contains a correspondence table between the phrase units to be filtered and the general sentences. According to the phrase unit, the corresponding general sentence is searched from the general sentence database, and the information to be filtered is replaced with the general sentence found to obtain the customized interaction information.

[0016] In an optional embodiment, parsing the interaction information and determining the content to be filtered in the interaction information specifically includes: performing semantic analysis on the interaction information in combination with a semantic analysis algorithm to obtain the content to be filtered in the interaction information, and determining the interaction information containing the content to be filtered as the information to be filtered.

[0017] In an optional embodiment, based on the content to be filtered, the content to be filtered is matched with a set general statement database, and the general statement database contains a correspondence table between the content to be filtered and the general statements. According to the content to be filtered, the corresponding general statement is searched from the general statement database, and the general statement found is used to replace the information to be filtered to obtain the customized interaction information.

[0018] In an optional embodiment, the response information further includes: a status code and a status code description, and the method includes:

[0019] Parsing the response information to obtain a status code and a status code description in the response information;

[0020] Comparing the status code in the response information with a set response database, wherein the response database includes each status code to be filtered, as well as a custom status code and a custom status code description corresponding to each status code to be filtered;

[0021] If the comparison is successful, the status code and status code description in the response information are determined as the content to be filtered, and the status code and status code description in the response information are replaced with the custom status code and the custom status code description respectively.

[0022] A second aspect of an embodiment of the present application provides an anti-sniffing device, including:

[0023] an interception module, configured to intercept the interaction information sent by the second device before the first device receives the interaction information;

[0024] An analysis module is configured to analyze the interaction information and determine content to be filtered in the interaction information;

[0025] An information generation module, which generates customized interaction information based on the content to be filtered and in combination with the interaction information;

[0026] The sending module replaces the interaction information containing the content to be filtered with the customized interaction information, and sends the replaced interaction information to the first device.

[0027] A third aspect of an embodiment of the present application provides an anti-sniffing terminal device, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the anti-sniffing method described in the first aspect above can be implemented.

[0028] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the anti-sniffing method described in the first aspect above.

[0029] Compared with the prior art, the present embodiment has the following advantages: the present method intercepts and analyzes the interaction information between the first device and the second device to determine the content to be filtered in the interaction information; based on the content to be filtered and combined with the interaction information, it generates customized interaction information, and finally sends the customized interaction information to the first device. This method can filter out interaction information that does not meet the set rules, such as illegal request information and response information that exposes sensitive system information, thus helping to improve the system security level. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0031] Figure 1 This is a flowchart of an anti-sniffing method provided by an embodiment of the present application;

[0032] Figure 2 This is a schematic diagram of an application scenario of an anti-sniffing device provided in one embodiment of the present application;

[0033] Figure 3 This is a structural diagram of an anti-sniffing device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0034] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0035] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0036] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0037] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0038] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0039] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0040] With the rapid development of network technology, security issues are receiving more and more attention. Sniffing technology is the most basic technology. From an attack perspective, a sniffing program can be used to illegally obtain a large amount of sensitive information transmitted in the system. Therefore, this application proposes an anti-sniffing method, which intercepts and parses the interactive information between the first device and the second device to determine the content to be filtered in the interactive information; and based on the content to be filtered, generates customized interactive information in combination with the interactive information, and finally sends the customized interactive information to the first device. This method can filter out interactive information that does not comply with the set rules, such as illegal request information and response information that exposes sensitive information of the system. This method helps to improve the security level of the system. The following is a detailed description of the method.

[0041] See Figure 1 The process of one embodiment of the anti-sniffing method shown, as an example and not a limitation, includes the following steps:

[0042] Step S101: before a first device receives interaction information sent by a second device, intercepting the interaction information;

[0043] It should be noted that both the first device and the second device can be servers or clients, and the interaction information includes request information sent by the second device to the first device, or response information generated by the second device based on the request information of the first device.

[0044] Specifically, before the first device receives the request information sent by the second device, the request information is intercepted, or before the first device receives the response information sent by the second device based on the request information of the first device, the response information is intercepted.

[0045] Exemplarily, when the first device is a server and the second device is a client, the second device sends a request message to the first device. Before the first device receives the request message, the execution subject of the anti-sniffing method intercepts the request message.

[0046] Exemplarily, when the first device is a client and the second device is a server, the first device sends a request message to the second device. When the second device responds to the message, it sends a response message to the first device. At this time, the response message is intercepted by the execution subject of the anti-sniffing method.

[0047] Exemplarily, when the first device is a server and the second device is also a server, the second device sends a request message to the first device. Before the first device receives the request message, the execution subject of the anti-sniffing method intercepts the request message.

[0048] Exemplarily, the request information may be HTTP request information, and the response information may be HTTP response information.

[0049] Exemplarily, the execution subject of the method for anti-sniffing can intercept interaction information, and the execution subject can be an anti-sniffing device.

[0050] Step S102: Analyze the interaction information to determine the content to be filtered in the interaction information.

[0051] It should be noted that according to the interaction information intercepted in step S101, the execution subject analyzes it. The analysis process can be to extract the content words in the interaction information based on a preset dictionary, and then compare the extracted content words with a set database to obtain the content to be filtered in the interaction information; or semantic analysis algorithm can be combined to perform semantic analysis on the interaction information, and then obtain the content to be filtered according to the result of the semantic analysis.

[0052] In an optional embodiment, analyzing the interaction information and determining the content to be filtered in the interaction information can be implemented by comparing the content words split from the interaction information with a database. The specific process is as follows:

[0053] Step 1: Based on a preset dictionary, split the interaction information into at least one content word.

[0054] Specifically, in step 1, word segmentation processing is performed on a certain interaction information to obtain each content word included in the interaction information. When performing word segmentation processing on the interaction information, any word segmentation method can be used, such as the forward maximum matching method, the reverse maximum matching method, the minimum segmentation method, or the bidirectional maximum matching method, etc. This specification does not limit the method of word segmentation processing.

[0055] Exemplarily, the process of performing word segmentation processing on the sentence "Operation matching name B cannot be found on controller A" in the interaction information by the forward maximum matching method is as follows: Assume Max_len = 5, that is, the maximum length of the word is 5. The words in the preset dictionary are: "on", "control", "controller", "find", "cannot find", "not find", "name", "match", "operation", "on", "A", "B", "con", "trol", "ler", "not", "find", "with", "name", "match", "of", "opera", "tion".

[0056] First, perform the first round of matching. Input "on controller A", and the matching process is as follows:

[0057] Take "on controller A", scan the 5-word words in the dictionary, no match, reduce the substring length by 1, and become "on controller".

[0058] Take "on controller", scan the 4-word words in the dictionary, no match, reduce the substring length by 1, and become "on control".

[0059] Take "under control", scan the three-character words in the dictionary, no match, reduce the substring length by 1, and change it to "in control".

[0060] Take "in control", scan the two-character words in the dictionary, no match, reduce the substring length by 1, and change it to "in".

[0061] Take "in", scan the one-character words in the dictionary, match successfully, output "in", and the input becomes "No operation matching name B can be found on controller A".

[0062] Next, perform the second-round matching. The input is "on controller A", and the matching process is as follows:

[0063] Take the substring "on controller A", scan the five-character words in the dictionary, no match, reduce the substring length by 1, and change it to "controller A".

[0064] Take "controller A", scan the four-character words in the dictionary, no match, reduce the substring length by 1, and change it to "controller".

[0065] Take "controller", scan the three-character words in the dictionary, match successfully, output "controller", and the input becomes "No operation matching name B can be found on A".

[0066] And so on, until the input length is 0, the scan terminates. Finally, the result obtained by the forward maximum matching algorithm is: in / controller / A / on / cannot find / match / with / name / B / operation.

[0067] It should be noted that the above splitting process can also be based on a preset English dictionary to split the English sentences in the interaction information into at least one content word segment.

[0068] Step 2: Compare all content word segments with at least one set database to determine whether each content word segment is in the at least one set database.

[0069] Exemplarily, when the interaction information is a response message, then compare the content word segments in the response message with the response sensitive word database in the set database. The response sensitive word database contains words that need to be filtered, such as "controller", "operation", "cannot find", etc. When the response message is "No operation matching name B can be found on controller A", based on the content word segments obtained in the above step 1, compare them with the response sensitive word database one by one. Since the response sensitive word database contains "controller", "cannot find" and "operation", the above three content word segments are successfully compared, so it is determined that the above three content word segments are content to be filtered, and it is determined that the interaction information containing the above three content word segments is information to be filtered.

[0070] Furthermore, the setting database may also include a negative word database and a sensitive public opinion word database, and the setting database may be added according to different needs.

[0071] Furthermore, different priorities may be assigned to each database. During comparison, each content segmentation word may be compared with each database in order of priority.

[0072] For example, when the interactive information is a request message, the word segmentation of the content in the request message is compared with the set database, such as the special symbol database and the SQL keyword database. It should be noted that SQL (Structured Query Language) is a structured query language used to operate database data. SQL is used when the application data of a web page interacts with the data in the backend database. Through SQL injection, an attacker can modify the original URL of the web page, form fields, or parameters input in the data packet into SQL statements, pass them to the web server, and then pass them to the database server to execute the database command. Therefore, it is necessary to treat the SQL keywords in the request information that do not meet the rules as content to be filtered.

[0073] For example, a Get request in HTTP is used to request data from the server and retrieve it. A normal Get request should not contain keywords such as select, insert, delete, and update, which are common in SQL statements. Therefore, the content segmentation obtained after splitting the request information is compared one by one with the SQL keyword database, which contains the SQL keywords to be filtered. If the comparison is successful, the content segmentation is used as the content to be filtered, and the request information containing the content segmentation is determined as the information to be filtered.

[0074] In an optional embodiment, parsing the interaction information and determining the content to be filtered in the interaction information can be achieved by performing semantic analysis on the interaction information. The specific process is as follows: In an optional embodiment, the execution entity can call a semantic parsing service. Exemplarily, the semantic parsing service includes topic classification or sentiment tendency analysis.

[0075] For example, the sentiment tendency of the interactive information can be analyzed. Taking the dictionary-based sentiment tendency analysis method as an example, the text must first be preprocessed by word segmentation and stop word processing, and then the text is matched with strings using the pre-constructed sentiment dictionary to mine positive and negative information.

[0076] Stop word processing refers to automatically filtering out certain words or terms before or after processing natural language data (or text) to save storage space and improve search efficiency. For example, in Chinese, modal particles, adverbs, prepositions, conjunctions, etc. usually have no clear meaning by themselves and only have a certain role when placed in a complete sentence, such as common words like "de" and "zai". Another example is function words in English. Compared with other words, function words have no practical meaning. The most common function words are determiners, such as "the", "a", "an", "that", and "those", as well as prepositions, such as "over", "under", "above", etc.

[0077] The sentiment dictionary consists of four parts: a positive word dictionary, a negative word dictionary, a negation word dictionary, and an adverb of degree dictionary. Each dictionary contains two parts: words and weights.

[0078] The sentiment dictionary is crucial in the entire sentiment analysis. There are now many open-source sentiment dictionaries, such as the BosonNLP sentiment dictionary, which is constructed based on data sources such as Weibo, news, and forums, and the HowNet sentiment dictionary, etc. Of course, it is also possible to train a sentiment dictionary by oneself through corpus.

[0079] The dictionary-based text matching algorithm needs to traverse each token one by one. If a token hits the dictionary, the corresponding weight processing is performed. The weight of positive words is additive, the weight of negative words is subtractive, the weight of negation words is the opposite, and the weight of adverbs of degree is multiplied by the weight of the token it modifies. Using the finally output weight value, it is possible to distinguish whether the sentiment is positive, negative, or neutral.

[0080] When the interaction information goes through the above sentiment tendency analysis process, if it is determined that the sentiment tendency of the interaction information is negative, then the negative sentiment tendency is determined as the content to be filtered.

[0081] In an optional embodiment, a topic model can also be used to analyze the topic of the interaction information, such as topics like finance, sports, military, society, etc. Of course, it may also include some illegal or unhealthy topics. When the analysis result is an illegal or unhealthy topic, that topic is determined as the content to be filtered.

[0082] S103: Generate custom interaction information based on the content to be filtered and in combination with the target interaction content;

[0083] In an optional embodiment, based on the content to be filtered determined in step S102, at least one phrase unit is generated, the phrase unit contains at least one content to be filtered, the phrase unit is matched with a set general statement database, the general statement database contains a correspondence table between the phrase units to be filtered and the general statements, according to the phrase unit, the corresponding general statement is searched from the general statement database, and the general statement obtained is used to replace the information to be filtered to obtain the customized interaction information.

[0084] For example, when the content to be filtered is "controller", "cannot find" and "operation", the generated phrase units include: [controller], [cannot find], [operation], [controller&cannot find], [controller&operation], [cannot find&operation], [controller&cannot find&operation], and the above 7 phrase units are matched with the general sentence library. Assuming that there is a correspondence between the phrase unit "[controller&cannot find&operation]" and the general sentence "You do not have access rights" in the general sentence library, "You do not have access rights" is determined as custom interaction information.

[0085] For example, when the content to be filtered is the word "select", only one phrase unit [select] is generated. Assuming that there is a corresponding relationship between the phrase unit "[select]" and the general statement "The request contains illegal database keywords, please check before submitting" in the general statement library, "The request contains illegal database keywords, please check before submitting" is determined as custom interactive information.

[0086] For example, when the content to be filtered is an interactive information topic obtained through a semantic analysis process, a common sentence corresponding to the topic is searched in the database of keywords for the topic to be filtered, and the original interactive information is replaced to generate customized interactive information. It should be noted that the database of keywords for the topic to be filtered contains keywords for the topic to be filtered and common sentences corresponding to the keywords.

[0087] S104: Send the customized interaction information to the first device.

[0088] The following uses the filtering status code in the response information as an example to fully introduce the anti-sniffing method of this solution. The details are as follows:

[0089] It's important to note that an HTTP response message consists of a response line, a response header, and a response body. The response line includes a status code and a status code description. When a request is incorrect, the status code description in the HTTP response message can expose critical system information. Attackers often exploit the erroneous information contained in the status code description to continuously change their attack methods and ultimately successfully inject malware. Therefore, it's necessary to filter the status code and status code description in the response message.

[0090] It should be understood that a status code consists of three decimal digits, the first of which defines the type of status code. Status codes are divided into five categories: (1) Message Response (1xx), which indicates that the request has been accepted and needs to be processed further; (2) Success Response (2xx), which indicates that the request has been successfully received, understood, and accepted by the server; (3) Redirection (3xx), which indicates that the client needs to take further action to complete the request; (4) Client Error (4xx), which indicates that the client may have an error that hindered the server's processing; (5) Server Error (5xx), which indicates that the server has an error or abnormal state in the process of processing the request, or it may be that the server realizes that it cannot complete the processing of the request with the current software and hardware resources.

[0091] Among them, the status code descriptions corresponding to status codes 500–599 may expose some sensitive information. Therefore, in order to avoid exposing too much server information, the status code descriptions corresponding to status codes 5xx need to be replaced.

[0092] In an optional embodiment, when the response information also includes a status code and a status code description that need to be filtered, the status code and status code description that may expose key system information in the response information can be replaced by the following steps:

[0093] Step 1: Parse the response information and obtain the status code and status code description in the response information;

[0094] Step 2: Compare the status code in the response message with a set response database, which includes each status code that needs to be filtered, as well as a custom status code and a custom status code description that corresponds to each status code that needs to be filtered;

[0095] Step 3: If the comparison is successful, the status code and status code description in the response information are determined as the content to be filtered, and the status code and status code description in the response information are replaced with the custom status code and the custom status code description respectively.

[0096] For example, the status code filtering database includes the status codes "500" and "501" to be filtered, and also includes the custom status code "200" corresponding to the status code "500" to be filtered and the custom status code description "The request is incorrect, please check and submit again"; and the custom status code "200" corresponding to the status code "501" to be filtered and the custom status code description "You do not have access rights."

[0097] When the requested address does not exist, the status code and status code description in the original response information are as follows:

[0098] "Message": No HTTP resource was found that matched the request URI 'http: / / xxxxxxx', and no action was found on controller 'A' that matched the name 'B'.

[0099] "Code": 500

[0100] This embodiment extracts the status code "500" and compares it with the status code to be filtered in the status code filtering database. Since the status code filtering database contains the status code "500", the comparison is successful. Furthermore, the status code "500" in the response message is replaced with the custom status code "200" corresponding to the status code "500" in the status code filtering database, and the custom status code explanation "The request is incorrect, please check and submit again" is replaced with "No HTTP resource matching the request URI "http: / / xxxxxxx" was found, and no operation matching the name "B" was found on controller "A".

[0101] The custom status code "200" and the custom status code description "The request is incorrect, please check and submit again" are sent to the first device as custom interaction information.

[0102] Figure 2 This paper presents a specific use case for this solution. During application development based on the ASP.NET application framework, the controller cannot capture illegal or malicious request information, while the returned response information may expose key system information. Attackers may exploit these vulnerabilities to attack the system. Therefore, this application provides a solution based on ASP.NET pipeline anti-sniffing. The specific process is as follows:

[0103] This application scenario includes a client, a server, a controller, and an anti-sniffing device. The request information sent by the client enters the anti-sniffing device through the server (Http Server). The anti-sniffing device parses the request information to determine whether it contains content to be filtered. If so, it generates custom interaction information based on the content to be filtered and the request information, and sends the custom interaction information to the client.

[0104] It is worth noting that if the request information sent by the client fails to pass the verification of the anti-sniffer device, it will no longer be passed down. Only when the request information passes the verification of the anti-sniffer device will it reach the controller for further processing.

[0105] Furthermore, the anti-sniffer device can also verify the response information. When the request information passes the verification of the anti-sniffer device, it will continue to be sent to the internal for processing. The processed business return information will also enter the anti-sniffer device. The anti-sniffer device will parse it, determine the content to be filtered, and generate custom interaction information based on the content to be filtered and the business return information, and finally send the custom interaction information to the client.

[0106] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0107] See also Figure 3 , shows a structural schematic diagram of an anti-sniffing device provided in an embodiment of the present application. For the sake of convenience, only the parts related to the embodiment of the present application are shown.

[0108] The anti-sniffing device 300 specifically includes:

[0109] The interception module 301 is configured to intercept the interaction information sent by the second device before the first device receives the interaction information;

[0110] The parsing module 302 is configured to parse the interaction information and determine the content to be filtered in the interaction information;

[0111] An information generation module 303 is configured to generate customized interaction information based on the content to be filtered and the interaction information;

[0112] The sending module 304 is configured to replace the interaction information including the content to be filtered with the customized interaction information, and send the replaced interaction information to the first device.

[0113] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0114] An embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned various method embodiments when executing the computer program.

[0115] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0116] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0117] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process of the above-mentioned method embodiment by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can at least include: any entity or device capable of carrying computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. For example, a USB flash drive, mobile hard drive, magnetic disk, or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals or telecommunication signals.

[0118] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0119] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0120] In the embodiments provided in this application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely illustrative. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0121] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0122] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A method for preventing sniffing, characterized in that: include: Before the first device receives the interaction information sent by the second device, intercepting the interaction information; Parsing the interaction information to determine content to be filtered in the interaction information; Based on the content to be filtered, generating customized interaction information in combination with the interaction information; Sending the customized interaction information to the first device; The generating of customized interaction information based on the content to be filtered and in combination with the interaction information specifically includes: Based on the content to be filtered, at least one phrase unit is generated, the phrase unit containing at least one content to be filtered; the phrase unit is matched with a set general sentence database, the general sentence database containing a correspondence table between phrase units to be filtered and general sentences; based on the phrase unit, a corresponding general sentence is searched in the general sentence database, and the information to be filtered is replaced with the searched general sentence to obtain the customized interaction information, wherein the information to be filtered is the interaction information containing the content to be filtered; The interaction information includes request information sent by the second device to the first device, or response information generated by the second device based on the request information of the first device; the response information also includes: a status code and a status code description. The method includes: Parsing the response information to obtain a status code and a status code description in the response information; Comparing the status code in the response information with a set response database, wherein the response database includes each status code to be filtered, as well as a custom status code and a custom status code description corresponding to each status code to be filtered; If the comparison is successful, the status code and status code description in the response information are determined as the content to be filtered, and the status code and status code description in the response information are replaced with the custom status code and the custom status code description respectively.

2. The method according to claim 1, characterized in that The parsing the interaction information and determining the content to be filtered in the interaction information includes: Splitting the interactive information into at least one content segmentation word based on a preset dictionary; Comparing all content segmentations with at least one set database to determine whether each content segmentation is in the at least one set database; If yes, the content segment is determined as a content to be filtered, and the interactive information containing the content to be filtered is determined as the information to be filtered.

3. The method according to claim 1, characterized in that Parsing the interaction information and determining the content to be filtered in the interaction information specifically includes: performing semantic analysis on the interaction information in combination with a semantic analysis algorithm to obtain the content to be filtered in the interaction information, and determining the interaction information containing the content to be filtered as the information to be filtered.

4. The method according to claim 3, characterized in that Based on the content to be filtered, the content to be filtered is matched with a set general statement database, the general statement database contains a correspondence table between the content to be filtered and the general statements, and according to the content to be filtered, the corresponding general statement is searched from the general statement database, and the general statement found is used to replace the information to be filtered to obtain the customized interaction information.

5. An anti-sniffing device, characterized in that: include: an interception module, configured to intercept the interaction information sent by the second device before the first device receives the interaction information; An analysis module is configured to analyze the interaction information and determine content to be filtered in the interaction information; An information generation module, which generates customized interaction information based on the content to be filtered and in combination with the interaction information; a sending module, which replaces the interaction information containing the content to be filtered with the custom interaction information, and sends the replaced interaction information to the first device; The information generation module is specifically used to: Based on the content to be filtered, at least one phrase unit is generated, the phrase unit containing at least one content to be filtered; the phrase unit is matched with a set general sentence database, the general sentence database containing a correspondence table between phrase units to be filtered and general sentences; based on the phrase unit, a corresponding general sentence is searched in the general sentence database, and the information to be filtered is replaced with the searched general sentence to obtain the customized interaction information, wherein the information to be filtered is the interaction information containing the content to be filtered; The interaction information includes request information sent by the second device to the first device, or response information generated by the second device based on the request information of the first device; the response information also includes: a status code and a status code description, and the apparatus is further configured to: Parsing the response information to obtain a status code and a status code description in the response information; Comparing the status code in the response information with a set response database, wherein the response database includes each status code to be filtered, as well as a custom status code and a custom status code description corresponding to each status code to be filtered; If the comparison is successful, the status code and status code description in the response information are determined as the content to be filtered, and the status code and status code description in the response information are replaced with the custom status code and the custom status code description respectively.

6. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images