Attack detection method, attack detection device, and computer-readable storage medium

Abstract

The present invention discloses an attack detection method, an attack detection device, and a computer-readable storage medium for detecting whether request data successfully attacks a server while improving attack detection accuracy. The method comprises: obtaining request data sent by a client to a server, identifying whether the request data contains at least one of an attack detection bypass character and echo encrypted data; if so, determining the attack intent of the request data; obtaining response data returned by the server to the client based on the request data; identifying whether the response data contains attack features corresponding to the attack intent; obtaining an identification result; and determining whether the request data successfully attacks the server based on the identification result.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of attack detection, and more specifically, to an attack detection method, an attack detection device, and a computer-readable storage medium. Background Art

[0002] During the operation and maintenance of network security, the operation and maintenance personnel need to know whether the client has successfully attacked the server so that they can perform operation and maintenance according to the attack situation. Therefore, an attack detection method is needed.

[0003] The existing attack detection method is: obtain the request data sent by the client to the server, and detect whether the request data has attack characteristics through a string or regular expression. If so, determine the attack intention of the request data, and obtain the response data returned by the server to the client according to the request data, and detect whether the response data has attack characteristics corresponding to the attack intention through a string or regular expression to obtain a judgment result, and determine whether the client has successfully attacked the server based on the judgment result. If so, it is determined that the request data has successfully attacked the server; if not, it is determined that the request data has not successfully attacked the server.

[0004] However, string or regular expression attack detection methods can only detect features with relatively fixed characteristics. If the request data and / or response data use various means to change or hide the features that can be detected by string or regular expression attack detection methods, the existing attack detection can be bypassed. In this case, the string or regular expression cannot be used to detect whether the request data successfully attacks the server. Therefore, the accuracy of existing attack detection is low. Summary of the Invention

[0005] The embodiments of the present application provide an attack detection method, an attack detection device, and a computer-readable storage medium, which can improve the accuracy of attack detection and detect whether request data successfully attacks a server.

[0006] In a first aspect, an embodiment of the present application provides an attack detection method, comprising:

[0007] Get the request data sent by the client to the server;

[0008] identifying whether the request data contains at least one of an attack detection bypass character and echo encrypted data;

[0009] If so, determining the attack intent of the request data;

[0010] Obtaining response data returned by the server to the client according to the request data, identifying whether the response data has an attack feature corresponding to the attack intent, and obtaining an identification result;

[0011] Determine whether the request data successfully attacks the server based on the identification result.

[0012] Optionally, the identifying whether the request data contains at least one of attack detection bypass characters and echo encrypted data includes:

[0013] Scanning the requested data to obtain scan data;

[0014] Identify whether the scanned data contains at least one of the attack detection bypass character and the echo encryption method data, and obtain an identification result; wherein, if the identification result is yes, it indicates that at least one of the attack detection bypass character and the echo encryption method data exists in the request data, and if the identification result is no, it indicates that at least one of the attack detection bypass character and the echo encryption method data does not exist in the request data.

[0015] Optionally, if the request data exists, determining the attack intent of the request data includes:

[0016] If the request data contains the attack detection bypass character and has a command separator, extracting first-type detection bypass data and / or second-type detection bypass data from the request data according to the command separator; wherein the first-type detection bypass data is data that bypasses detection of attack content, and the second-type detection bypass data is data that bypasses detection using an echo encryption method;

[0017] Deleting the attack detection bypass character from the first type detection bypass data and / or the second type detection bypass data to obtain target attack content and / or target echo encryption method;

[0018] Identify the attack intent of the target attack content, and identify the attack intent of the target echo encryption method.

[0019] Optionally, if the request data exists, determining the attack intent of the request data includes:

[0020] If the request data contains the attack detection bypass character and does not contain a command separator, determining the data in the request data including the attack detection bypass character as first type detection bypass data; wherein the first type detection bypass data is data that bypasses detection attack content;

[0021] deleting the attack detection bypass character from the first type of detection bypass data to obtain target attack content;

[0022] Identify the attack intent of the target attack content.

[0023] Optionally, the identifying whether the response data has an attack feature corresponding to the attack intent to obtain an identification result includes:

[0024] Identify whether the response data has a preset sensitive feature corresponding to the target attack content to obtain an identification result; wherein, a recognition result of yes indicates that the response data has the attack feature corresponding to the attack intention, and a recognition result of no indicates that the response data does not have the attack feature corresponding to the attack intention.

[0025] Optionally, if the request data exists, determining the attack intent of the request data includes:

[0026] If the request data contains echo encryption method data and has a command separator, extracting target attack content and target echo encryption method from the request data according to the command separator;

[0027] Identify the attack intent of the target attack content, and identify the attack intent of the target echo encryption method.

[0028] Optionally, the identifying whether the response data has an attack feature corresponding to the attack intent to obtain an identification result includes:

[0029] If the target echo encryption method is a preset restorable method, decrypting and restoring the response data according to the target echo encryption method to obtain target response data;

[0030] Identify whether the target response data has a preset sensitive feature corresponding to the target attack content to obtain an identification result; wherein, a recognition result of yes indicates that the response data has the attack feature corresponding to the attack intention, and a recognition result of no indicates that the response data does not have the attack feature corresponding to the attack intention.

[0031] Optionally, the identifying whether the response data has an attack feature corresponding to the attack intent to obtain an identification result includes:

[0032] If the target echo encryption method is not a preset reversible method, determining a target encryption feature corresponding to the target attack content and the target echo encryption method;

[0033] Identify whether the response data has the target encryption feature to obtain an identification result; wherein, if the identification result is yes, it indicates that the response data has the attack feature corresponding to the attack intention, and if the identification result is no, it indicates that the response data does not have the attack feature corresponding to the attack intention.

[0034] In a second aspect, an embodiment of the present application provides an attack detection device, including:

[0035] An obtaining unit, used for obtaining request data sent by the client to the server;

[0036] an identification unit, configured to identify whether the request data contains at least one of an attack detection bypass character and echo encrypted data;

[0037] a determining unit, configured to determine the attack intent of the request data, if any;

[0038] The identification unit is further configured to obtain response data returned by the server to the client according to the request data, identify whether the response data has an attack feature corresponding to the attack intention, and obtain an identification result;

[0039] The determining unit is further configured to determine whether the request data successfully attacks the server based on the identification result.

[0040] In a third aspect, an embodiment of the present application provides an attack detection device, including:

[0041] CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply;

[0042] The memory is a transient storage memory or a persistent storage memory;

[0043] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the aforementioned attack detection method.

[0044] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the aforementioned attack detection method.

[0045] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when the computer program product is run on a computer, enables the computer to execute the aforementioned attack detection method.

[0046] It can be seen from the above technical solution that the embodiments of the present application have the following advantages: the request data sent by the client to the server can be obtained, and it can be identified whether the request data contains at least one of the attack detection bypass character and the echo encrypted data. If so, the attack intention of the request data is determined, and the response data returned by the server to the client according to the request data is obtained, and it is identified whether the response data has the attack feature corresponding to the attack intention, and the identification result is obtained. According to the identification result, it is determined whether the request data successfully attacks the server. If the request data and / or response data use various means to change or hide the features that can be detected by the attack detection method of the string or regular expression, the attack intention of the request data can still be determined, and it can be judged whether the response data has the attack feature corresponding to the attack intention. It can still be determined whether the request data successfully attacks the server, and the accuracy of the attack detection is relatively high. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a schematic diagram of the architecture of an attack detection system disclosed in an embodiment of the present application;

[0048] Figure 2 A flowchart of an attack detection method disclosed in an embodiment of the present application;

[0049] Figure 3 A flowchart of another attack detection method disclosed in an embodiment of the present application;

[0050] Figure 4 A flowchart of another attack detection method disclosed in an embodiment of the present application;

[0051] Figure 5 A schematic diagram of the structure of an attack detection device disclosed in an embodiment of the present application;

[0052] Figure 6 This is a schematic diagram of the structure of another attack detection device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0053] Embodiments of the present application provide an attack detection method, an attack detection device, and a computer-readable storage medium for detecting whether request data successfully attacks a server while improving attack detection accuracy.

[0054] See also Figure 1 , the architecture of the attack detection system in the embodiment of the present application includes:

[0055] Client 101, attack detection device 102, and server 103. When performing attack detection, attack detection device 102 can connect to client 101 and server 103, and client 101 can connect to server 103. Attack detection device 102 can obtain request data sent by client 101 to server 103 and response data sent by server 103 to client 101. Based on the request data and response data, it can determine whether the request data 101 has successfully attacked the server.

[0056] The client 101 may be a device that provides local service programs to clients.

[0057] The attack detection device 102 may be a device capable of performing attack detection, such as a router and a firewall, or may be a functional module embedded in a client and / or a server.

[0058] The server 103 may be a standalone server or a server cluster.

[0059] based on Figure 1 The attack detection system shown is Figure 2 , Figure 2 This is a flow chart of an attack detection method disclosed in an embodiment of the present application, the method comprising:

[0060] 201. Obtain request data sent by the client to the server.

[0061] In this embodiment, when attack detection is performed, request data sent by the client to the server can be obtained.

[0062] 202. Identify whether the request data contains at least one of an attack detection bypass character and echo encryption method data.

[0063] After obtaining the request data sent by the client to the server, it is possible to identify whether the request data contains at least one of the attack detection bypass character and the echo encryption method data, and obtain an identification result. If the request data contains at least one of the attack detection bypass character and the echo encryption method data, step 203 is executed. If the request data does not contain at least one of the attack detection bypass character and the echo encryption method data, step 207 is executed. It is understood that in addition to the attack detection bypass character and the echo encryption method data, other reasonable attack detection bypass data may also be used, and the specific details are not limited here.

[0064] 203. Determine the attack intent of the request data.

[0065] The attack intent of the requested data can be determined.

[0066] It is understandable that different attack detection bypass data may correspond to different bypass features, and the attack intent of the request data may be determined based on the different bypass features. The specific determination method is not limited here.

[0067] 204. Identify whether the response data has attack features corresponding to the attack intent.

[0068] After determining the attack intent of the request data, the response data returned by the server to the client based on the request data can be obtained. After obtaining the response data, it can be identified whether the response data has an attack feature corresponding to the attack intent to obtain an identification result. If the response data has an attack feature corresponding to the attack intent, step 205 is executed; if the response data does not have an attack feature corresponding to the attack intent, step 206 is executed.

[0069] 205. Determine that the request data successfully attacks the server.

[0070] It can be determined that the request data successfully attacks the server.

[0071] 206. It is determined that the request data did not successfully attack the server.

[0072] It can be determined that the request data did not successfully attack the server.

[0073] 207. No steps are executed.

[0074] No steps may be performed.

[0075] In an embodiment of the present application, the request data sent by the client to the server can be obtained, and it can be identified whether the request data contains at least one of the attack detection bypass character and the echo encrypted data. If so, the attack intention of the request data is determined, and the response data returned by the server to the client according to the request data is obtained. It is identified whether the response data has the attack feature corresponding to the attack intention, and the identification result is obtained. According to the identification result, it is determined whether the request data successfully attacks the server. If the request data and / or response data use various means to change or hide the features that can be detected by the attack detection method of the string or regular expression, the attack intention of the request data can still be determined, and it can be judged whether the response data has the attack feature corresponding to the attack intention. It can still be determined whether the request data successfully attacks the server, and the accuracy of the attack detection is relatively high.

[0076] In an embodiment of the present application, if the request data contains at least one of attack detection bypass characters and echo encryption method data, there are multiple methods for determining the attack intent of the request data, which are described below.

[0077] 1. If the request data contains attack detection bypass characters, determine the attack intent of the request data.

[0078] In the embodiment of the present application, if the request data contains at least one of the attack detection bypass character and the echo encryption method data, the attack intention of the request data may be determined as follows: if the request data contains the attack detection bypass character, the attack intention of the request data is determined. Figure 3 , Figure 3 This is a flow chart of another attack detection method disclosed in an embodiment of the present application, the method comprising:

[0079] 301. Obtain the request data sent by the client to the server.

[0080] In this embodiment, when attack detection is performed, the request data sent by the client to the server can be obtained. It should be understood that the request data is the valid data (payload) in the request packet.

[0081] 302. Scan the requested data to obtain scan data.

[0082] After obtaining the request data sent by the client to the server, the request data can be scanned to obtain scan data.

[0083] 303. Identify whether the scanned data contains attack detection bypass characters and obtain an identification result. A yes identification result indicates that the request data contains attack detection bypass characters, and a no identification result indicates that the request data does not contain attack detection bypass characters.

[0084] After obtaining the scan data, the scan data can be identified to determine whether it contains attack detection bypass characters, and an identification result can be obtained. A "yes" identification result indicates that the request data contains attack detection bypass characters, while a "no" identification result indicates that the request data does not contain attack detection bypass characters. If the request data contains attack detection bypass characters, step 304 is executed; if not, step 308 is executed. Specifically, attack detection bypass characters can include single quotes ', backslashes \, or brackets [, etc., but are not limited to these characters.

[0085] 304. Determine attack detection bypass data in the request data based on the attack detection bypass character, and determine the attack intent of the request data based on the attack detection bypass data.

[0086] The attack detection bypass data in the request data can be determined based on the attack detection bypass character, and the attack intent of the request data can be determined based on the attack detection bypass data. Specifically, there are multiple methods for determining the attack intent of the request data based on the attack detection bypass data, which are described below:

[0087] A. If the request data contains attack detection bypass characters and command separators.

[0088] If the request data contains attack detection bypass characters and a command delimiter, first-type detection bypass data and / or second-type detection bypass data can be extracted from the request data based on the command delimiter. The first-type detection bypass data is data that bypasses detection of the attack content, and the second-type detection bypass data is data that bypasses detection using an echo encryption method. After extracting the first-type detection bypass data and / or the second-type detection bypass data, the attack detection bypass characters can be deleted from the first-type detection bypass data and / or the second-type detection bypass data to obtain the target attack content and / or the target echo encryption method. After obtaining the target attack content and / or the target echo encryption method, the attack intent of the target attack content and the attack intent of the target echo encryption method can be identified.

[0089] Specifically, the request data can be subjected to lexical analysis and syntactic analysis, breaking the request data into tokens and constructing a grammar tree to decompose the most basic grammar. The first type of detection bypass data and / or the second type of detection bypass data can then be converted into the most basic, original target attack content and / or target echo encryption method. Syntactic analysis involves combining word sequences into various grammatical phrases, such as "program," "statement," "expression," etc., based on lexical analysis. The grammatical analysis program determines whether the source program is structurally correct. The structure of the source program is described by a context-free grammar. Semantic analysis involves performing context-related property checks and type checks on the structurally correct source program based on grammatical analysis.

[0090] To make it easier to understand, here are a few examples:

[0091] A1. The request data contains "w'ho'am'i'|ba\se\64":

[0092] The request data contains "w'ho'am'i'|ba\se\64", where the command delimiter is |. The first type of detection bypass data and the second type of detection bypass data can be extracted from the request data. The first type of detection bypass data is "w'ho'am'i'", and the second type of detection bypass data is "ba\se\64". After deleting the attack detection bypass characters, the target attack content is "whoami" and the target echo encryption method is "base64". It can be identified that the attack intent of the target attack content is to obtain username information, and the attack intent of the target echo encryption method is to encrypt the returned username information using base64 encoding.

[0093] A2. The request data contains "whoami|ba\se\64":

[0094] The request data contains "whoami|ba\se\64", where the command delimiter is |. The second type of detection bypass data in the request data can be extracted. The second type of detection bypass data is "ba\se\64". After deleting the attack detection bypass characters, the target echo encryption method is obtained as "base64", and the target attack content is obtained as "whoami". It can be identified that the attack intent of the target attack content is to obtain username information, and the attack intent of the target echo encryption method is to encrypt the returned username information using base64 encoding.

[0095] A3. The request data contains "w'ho'am'i'|base64":

[0096] The request data contains "w'ho'am'i'|base64", where the command delimiter is |. The first type of detection bypass data in the request data can be extracted. The first type of detection bypass data is "w'ho'am'i'". After deleting the attack detection bypass characters, the target attack content is "whoami" and the target echo encryption method is "base64". It can be identified that the attack intent of the target attack content is to obtain username information, and the attack intent of the target echo encryption method is to encrypt the returned username information using base64 encoding.

[0097] B. If the request data contains attack detection bypass characters but does not have command separators.

[0098] If the request data contains attack detection bypass characters but no command delimiters, the data in the request data containing the attack detection bypass characters can be determined as first-type detection bypass data; the first-type detection bypass data is data that bypasses detection of attack content. After determining the data as first-type detection bypass data, the attack detection bypass characters can be removed from the first-type detection bypass data to obtain the target attack content. After obtaining the target attack content, the attack intent of the target attack content can be identified.

[0099] For ease of understanding, let's take an example: the request data contains "w'ho'am'i'". The first type of detection bypass data can be "w'ho'am'i'". After deleting the attack detection bypass characters from the first type of detection bypass data, the target attack content can be obtained as "whoami". It can be identified that the attack intent of the target attack content is to obtain username information.

[0100] 305. Identify whether the response data has attack features corresponding to the attack intent.

[0101] After determining the attack intent of the request data, the response data returned by the server to the client based on the request data can be obtained. After obtaining the response data returned by the server to the client based on the request data, it can be identified whether the response data has the attack signature corresponding to the attack intent, and an identification result can be obtained. If the response data has the attack signature corresponding to the attack intent, step 306 is executed; if the response data does not have the attack signature corresponding to the attack intent, step 307 is executed. It is understood that different methods for determining the attack intent of the request data correspond to different methods for identifying whether the response data has the attack signature. Based on the two methods A and B for determining the attack intent in step 304, the methods for identifying whether the response data has the attack signature corresponding to the two methods A and B for determining the attack intent are described below:

[0102] A. If the request data contains attack detection bypass characters and command separators.

[0103] After obtaining the target attack content and the target echo encryption method, it is possible to determine whether the target echo encryption method is a preset reversible method. If so, the response data is decrypted and restored according to the target echo encryption method to obtain the target response data. After obtaining the target response data, it is possible to determine whether the target response data possesses the preset sensitive characteristics corresponding to the target attack content, obtaining an identification result. A "yes" identification result indicates that the response data possesses the attack characteristics corresponding to the attack intent, while a "no" identification result indicates that the response data does not possess the attack characteristics corresponding to the attack intent. For example, the base64 encoding method is a preset reversible method, while the md5 encoding method is not. It is understood that each target attack content corresponds to a preset sensitive characteristic. For example, the preset sensitive characteristic of the target attack content "whoami" could be "admin" or "root," though this is not limited here.

[0104] Continuing with the examples of cases A1, A2 and A3 in step 304:

[0105] For the cases where the request data contains "w'ho'am'i'|ba\se\64", "whoami|ba\se\64", and "w'ho'am'i'|base64", after obtaining the target attack content and the target echo encryption method, it can be determined that base64 is the preset reversible method. The response data can then be decrypted and restored using the base64 encoding method to obtain the target response data. After obtaining the target response data, it can be determined whether the target response data has the preset sensitive features corresponding to the target attack content "whoami", and an identification result can be obtained. A "yes" identification result indicates that the response data has the attack features corresponding to the attack intent, while a "no" identification result indicates that the response data does not have the attack features corresponding to the attack intent.

[0106] B. If the request data contains attack detection bypass characters but does not have command separators.

[0107] After obtaining the target attack content, it is possible to identify whether the response data has the preset sensitive features corresponding to the target attack content and obtain an identification result; wherein, a recognition result of yes indicates that the response data has the attack features corresponding to the attack intent, and a recognition result of no indicates that the response data does not have the attack features corresponding to the attack intent.

[0108] Continuing with the example of case B in step 304:

[0109] In the case where the request data contains "w'ho'am'i'", after obtaining the target attack content "whoami", it can be identified whether the response data has the preset sensitive features such as "admin" or "root" corresponding to the target attack content "whoami". If it has the preset sensitive features, it is determined that the response data has the attack features corresponding to the attack intention; if it does not have the preset sensitive features, it is determined that the response data does not have the attack features corresponding to the attack intention.

[0110] 306. Determine that the request data successfully attacks the server.

[0111] 307. It is determined that the request data did not successfully attack the server.

[0112] 308. No steps are executed.

[0113] Steps 306 to 308 in this embodiment are similar to those in the previous embodiment. Figure 2 Steps 205 to 207 in the illustrated embodiment are similar and will not be described in detail here.

[0114] In this embodiment, the request data sent by the client to the server can be obtained, and the request data can be identified as containing at least one of the attack detection bypass character and the echo encrypted data. If so, the attack intent of the request data can be determined. The response data returned by the server to the client based on the request data can be obtained, and the response data can be identified as containing attack features corresponding to the attack intent. A recognition result can be obtained, and based on the recognition result, it can be determined whether the request data successfully attacks the server. If the request data and / or response data use various means to modify or hide features that can be detected by the attack detection method using a string or regular expression, the attack intent of the request data can still be determined, and it can be determined whether the response data contains attack features corresponding to the attack intent. It can still be determined whether the request data successfully attacks the server, and the accuracy of attack detection is relatively high. Secondly, as the attack detection bypass method is continuously updated, the preset attack detection bypass conditions can also be continuously updated. The attack intent can be restored through a grammatical and semantic method, which improves the feasibility of restoring the attack intent and the accuracy of attack detection.

[0115] 2. If the request data contains encryption method data, echo it.

[0116] In the embodiment of the present application, if the request data contains at least one of the attack detection bypass character and the echo encryption method data, the attack intention of the request data may be determined. If the request data contains the echo encryption method data, the attack intention of the request data is determined. Figure 4 , Figure 4 This is a flow chart of another attack detection method disclosed in an embodiment of the present application, the method comprising:

[0117] 401. Get the request data sent by the client to the server.

[0118] Step 401 in this embodiment is the same as the aforementioned Figure 3 Step 301 in the illustrated embodiment is similar and will not be described in detail here.

[0119] 402. Scan the requested data to obtain scan data.

[0120] After obtaining the request data sent by the client to the server, the request data can be scanned to obtain scan data.

[0121] 403. Identify whether the scanned data contains echo encryption method data and obtain an identification result. A yes identification result indicates that the request data contains echo encryption method data, and a no identification result indicates that the request data does not contain echo encryption method data.

[0122] After obtaining the scanned data, the scanned data can be identified to determine whether it contains echo encryption method data, thereby obtaining an identification result. A "yes" identification result indicates that the request data contains echo encryption method data, while a "no" identification result indicates that the request data does not contain echo encryption method data. If the request data contains echo encryption method data, step 404 is executed; if not, step 408 is executed. The echo encryption method data can be "base64" or "md5," and the specifics are not limited here.

[0123] 404. Determine the attack intent of the request data.

[0124] The attack intent of the requested data can be determined.

[0125] Specifically, a method for determining the attack intent of the request data may be: if the request data contains echo encryption method data and a command delimiter, the target attack content and target echo encryption method may be extracted from the request data based on the command delimiter. After extracting the target attack content and target echo encryption method, the attack intent of the target attack content and the attack intent of the target echo encryption method may be identified. The command delimiter may be |, (), or other symbols, and the specifics are not limited here.

[0126] To make it easier to understand, here are a few examples:

[0127] If the request data contains "ifconfig|md5sum", it can be determined that the request data contains the echo encryption method data "md5" and has the command separator |. The target attack content "ifconfig" and the target echo encryption method "md5" can be extracted from the request data based on the command separator |. It can be identified that the attack intent of the target attack content "ifconfig" is to query the host's network information, and it can be identified that the attack intent of the target echo encryption method "md5" is to encrypt the returned host's network information using the md5 encoding method.

[0128] If the request data contains "whoami|base64", it can be determined that the request data contains the echo encryption method data "base64" and has the command delimiter |. The target attack content "whoami" and the target echo encryption method "base64" can be extracted from the request data based on the command delimiter |. It can be identified that the attack intent of the target attack content "whoami" is to obtain username information, and it can be identified that the attack intent of the target echo encryption method "base64" is to encrypt the returned username information using the base64 encoding method.

[0129] If the request data contains "base64EncodeChars(system('ifconfig'))", it can be determined that the request data contains the echo encryption method data "base64" and has a command separator (). The target attack content "ifconfig" and the target echo encryption method "base64" can be extracted from the request data based on the command separator (). It can be identified that the attack intent of the target attack content "ifconfig" is to query the host's network information, and it can be identified that the attack intent of the target echo encryption method "base64" is to encrypt the returned host's network information using the base64 encoding method.

[0130] 405. Identify whether the response data has attack features corresponding to the attack intent.

[0131] After determining the attack intent of the request data, the response data returned by the server to the client based on the request data can be obtained. After obtaining the response data returned by the server to the client based on the request data, it is possible to identify whether the response data has an attack feature corresponding to the attack intent and obtain an identification result. If the response data has an attack feature corresponding to the attack intent, step 406 is executed; if the response data does not have an attack feature corresponding to the attack intent, step 407 is executed.

[0132] Among them, the method for identifying whether the response data has attack characteristics corresponding to the attack intent can be to first determine whether the target echo encryption method is a preset reversible method and obtain a determination result. If the target echo encryption method is a preset reversible method, the response data is decrypted and restored according to the target echo encryption method to obtain the target response data. Then, it can be determined whether the target response data has preset sensitive characteristics corresponding to the target attack content to obtain an identification result. Wherein, a recognition result of yes indicates that the response data has the attack characteristics corresponding to the attack intent, and a recognition result of no indicates that the response data does not have the attack characteristics corresponding to the attack intent. If the target echo encryption method is not a preset reversible method, the target encryption characteristics corresponding to the target attack content and the target echo encryption method are determined, and whether the response data has the target encryption characteristics is identified to obtain an identification result. Wherein, a recognition result of yes indicates that the response data has the attack characteristics corresponding to the attack intent, and a recognition result of no indicates that the response data does not have the attack characteristics corresponding to the attack intent. It is understood that different methods for determining the attack intent of the request data correspond to different methods for identifying whether the response data has attack characteristics. Based on the method for determining the attack intent in step 404, the following describes the methods for identifying whether the response data has attack characteristics corresponding to the method for determining the attack intent in step 404:

[0133] Continuing with the example of step 404:

[0134] If the request data contains "ifconfig|md5sum", after determining that the attack intention is to query the host's network information and encrypt the returned host's network information using the md5 encoding method, it can be determined that the target echo encryption method "md5" is not a preset restorable method. Therefore, the target encryption characteristics corresponding to the target attack content "ifconfig" and the target echo encryption method "md5" can be determined, and whether the response data has the target encryption characteristics can be identified to obtain an identification result; if the response data has the target encryption characteristics, it is determined that the response data has the attack characteristics; if the response data does not have the target encryption characteristics, it is determined that the response data does not have the attack characteristics.

[0135] If the request data contains "whoami|base64", the attack intention is determined to obtain username information, and after the returned username information is encrypted using the base64 encoding method, it can be determined that the target echo encryption method "base64" is the preset restorable method. The response data can be decrypted and restored according to "base64" to obtain the target response data. It can be identified whether the response data has the preset sensitive features "admin" or "root" corresponding to the target attack content "whoami". If it has the preset sensitive features, it is determined that the response data has attack features. If it does not have the preset sensitive features, it is determined that the response data does not have attack features.

[0136] If the request data contains "base64EncodeChars(system('ifconfig'))", the attack intent is determined to be querying the host's network information. After encrypting the returned host's network information using base64 encoding, it can be determined that the target echo encryption method "base64" is the preset restorable method. The response data can then be decrypted and restored using "base64" to obtain the target response data "inet 10.0.20.8 netmask 255.255.252.0 broadcast 10.0.23.255". The target response data can be identified to determine whether it contains the preset sensitive features "inet", "netmask", and "broadcast" corresponding to the target attack content "ifconfig". The identification result is obtained. If it does, the response data is determined to have attack features. If it does not, the response data is determined to not have attack features.

[0137] 406. Confirmation that the request data successfully attacks the server.

[0138] 407. Confirmed that the request data did not successfully attack the server.

[0139] 408. No step executed.

[0140] Steps 406 to 408 in this embodiment are similar to those in the aforementioned Figure 2 Steps 205 to 207 in the illustrated embodiment are similar and will not be described in detail here.

[0141] In this embodiment, the request data sent by the client to the server can be obtained, and whether the request data contains at least one of the attack detection bypass character and the echo encrypted data can be identified. If so, the attack intent of the request data can be determined. The response data returned by the server to the client based on the request data can be obtained, and whether the response data has the attack characteristics corresponding to the attack intent can be identified. The identification result can then be obtained. Based on the identification result, it can be determined whether the request data successfully attacks the server. If the request data and / or response data use various means to change or hide the characteristics that can be detected by the attack detection method of the string or regular expression, the attack intent of the request data can still be determined, and whether the response data has the attack characteristics corresponding to the attack intent can still be determined. It is still possible to determine whether the request data successfully attacks the server, and the accuracy of attack detection is relatively high. Secondly, as the attack detection bypass method is continuously updated, the preset attack detection bypass conditions can also be continuously updated. The attack intent is restored through the grammatical and semantic methods, which improves the feasibility of restoring the attack intent and improves the accuracy of attack detection.

[0142] The attack detection method in the embodiment of the present application is described above. The attack detection device in the embodiment of the present application is described below. Figure 5 , an embodiment of the attack detection device in the embodiment of the present application includes:

[0143] The obtaining unit 501 is used to obtain the request data sent by the client to the server;

[0144] An identification unit 502 is configured to identify whether the request data contains at least one of an attack detection bypass character and echo encrypted data;

[0145] a determining unit 503, configured to determine the attack intention of the request data, if any;

[0146] The identification unit 502 is further configured to obtain response data returned by the server to the client according to the request data, identify whether the response data has an attack feature corresponding to the attack intent, and obtain an identification result;

[0147] The determining unit 504 is further configured to determine whether the request data successfully attacks the server based on the identification result.

[0148] In an embodiment of the present application, the request data sent by the client to the server can be obtained, and it can be identified whether the request data contains at least one of the attack detection bypass character and the echo encrypted data. If so, the attack intention of the request data is determined, and the response data returned by the server to the client according to the request data is obtained. It is identified whether the response data has the attack feature corresponding to the attack intention, and an identification result is obtained. According to the identification result, it is determined whether the request data successfully attacks the server. If the request data and / or response data use various means to change or hide the features that can be detected by the attack detection method of the string or regular expression, the attack intention of the request data can still be determined, and it can be judged whether the response data has the attack feature corresponding to the attack intention, thereby determining whether the client successfully attacks the server, and the accuracy of the attack detection is relatively high.

[0149] See below Figure 6 Another embodiment of the attack detection device 600 in the embodiment of the present application includes:

[0150] CPU 601, memory 605, input / output interface 604, wired or wireless network interface 603 and power supply 602;

[0151] The memory 605 is a temporary storage memory or a permanent storage memory;

[0152] The CPU 601 is configured to communicate with the memory 605 and execute the instructions in the memory 605 to perform the aforementioned Figures 2 to 4 The method in the embodiment shown.

[0153] The embodiment of the present application further provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the aforementioned Figures 2 to 4 The method in the embodiment shown.

[0154] The present application also provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the aforementioned Figures 2 to 4 The method in the embodiment shown.

[0155] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0156] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0157] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0158] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0159] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0160] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk, and other media that can store program code.

Claims

1. An attack detection method, characterized in that: include: Get the request data sent by the client to the server; identifying whether the request data contains at least one of an attack detection bypass character and echo encryption method data; If so, determining the attack intent of the request data; Obtaining response data returned by the server to the client according to the request data, identifying whether the response data has an attack feature corresponding to the attack intent, and obtaining an identification result; Determine whether the request data successfully attacks the server based on the identification result.

2. The method according to claim 1, characterized in that The identifying whether the request data contains at least one of an attack detection bypass character and echo encryption method data includes: Scanning the requested data to obtain scan data; Identify whether the scanned data contains at least one of the attack detection bypass character and the echo encryption method data, and obtain an identification result; wherein, if the identification result is yes, it indicates that at least one of the attack detection bypass character and the echo encryption method data exists in the request data, and if the identification result is no, it indicates that at least one of the attack detection bypass character and the echo encryption method data does not exist in the request data.

3. The method according to claim 1, characterized in that If the request data exists, determining the attack intent of the request data; including: If the request data contains the attack detection bypass character and has a command separator, extracting first-type detection bypass data and / or second-type detection bypass data from the request data according to the command separator; wherein the first-type detection bypass data is data that bypasses detection of attack content, and the second-type detection bypass data is data that bypasses detection using an echo encryption method; Deleting the attack detection bypass character from the first type detection bypass data and / or the second type detection bypass data to obtain target attack content and / or target echo encryption method; Identify the attack intent of the target attack content, and identify the attack intent of the target echo encryption method.

4. The method according to claim 1, wherein If so, determining the attack intent of the request data includes: If the request data contains the attack detection bypass character and does not contain a command separator, determining the data in the request data including the attack detection bypass character as first type detection bypass data; wherein the first type detection bypass data is data that bypasses detection attack content; deleting the attack detection bypass character from the first type of detection bypass data to obtain target attack content; Identify the attack intent of the target attack content.

5. The method according to claim 4, characterized in that The identifying whether the response data has the attack feature corresponding to the attack intention to obtain an identification result includes: Identify whether the response data has a preset sensitive feature corresponding to the target attack content to obtain an identification result; wherein, a recognition result of yes indicates that the response data has the attack feature corresponding to the attack intention, and a recognition result of no indicates that the response data does not have the attack feature corresponding to the attack intention.

6. The method according to claim 1, characterized in that If so, determining the attack intent of the request data includes: If the request data contains echo encryption method data and has a command separator, extracting target attack content and target echo encryption method from the request data according to the command separator; Identify the attack intent of the target attack content, and identify the attack intent of the target echo encryption method.

7. The method according to claim 3 or 6, characterized in that The identifying whether the response data has the attack feature corresponding to the attack intention to obtain an identification result includes: If the target echo encryption method is a preset restorable method, decrypting and restoring the response data according to the target echo encryption method to obtain target response data; Identify whether the target response data has a preset sensitive feature corresponding to the target attack content to obtain an identification result; wherein, a recognition result of yes indicates that the response data has the attack feature corresponding to the attack intention, and a recognition result of no indicates that the response data does not have the attack feature corresponding to the attack intention.

8. The method according to claim 3 or 6, characterized in that The identifying whether the response data has the attack feature corresponding to the attack intention to obtain an identification result includes: If the target echo encryption method is not a preset reversible method, determining a target encryption feature corresponding to the target attack content and the target echo encryption method; Identify whether the response data has the target encryption feature to obtain an identification result; wherein, if the identification result is yes, it indicates that the response data has the attack feature corresponding to the attack intention, and if the identification result is no, it indicates that the response data does not have the attack feature corresponding to the attack intention.

9. An attack detection device, characterized in that: include: CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply; The memory is a transient storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium comprises instructions, which, when executed on a computer, enable the computer to perform the method according to any one of claims 1 to 8.

Images