An interface authentication detection method and device, electronic equipment and storage medium

Abstract

The application discloses an interface authentication detection method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring traffic information transmitted and received by a target interface in a historical time period; and determining whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that meets an authentication feature. The application realizes automatic and effective detection of the interface authentication mechanism by acquiring the traffic information transmitted and received by the interface in a historical time period and based on the authentication field in the acquired traffic information that meets the authentication feature, so as to remind the interface provider to add the authentication mechanism. Since the interface authentication detection is realized based on the historical traffic feature analysis, no request needs to be sent to the interface, so that no impact is caused on the normal operation of the interface, and no pollution is caused on the data of the interface.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a detection method, apparatus, electronic device, and storage medium for interface authentication. Background Technology

[0002] APIs (Application Programming Interfaces) are a common way for business providers to offer services to the outside world. They carry important business functions and sensitive data, making them frequent targets for attackers. To ensure that APIs are only invoked by authorized users, authentication is one of the security protection mechanisms for APIs.

[0003] However, due to the lack of security awareness or oversights in the development process by business providers, no corresponding authentication mechanism has been configured for the API interface. As a result, any user can use the business functions or obtain sensitive data through the API interface, which makes the API interface a significant security threat. Summary of the Invention

[0004] The purpose of this application is to provide an interface authentication detection method, apparatus, electronic device, and storage medium to address the shortcomings of the prior art. This purpose is achieved through the following technical solutions.

[0005] The first aspect of this application proposes a detection method for interface authentication, the method comprising:

[0006] Obtain traffic information sent and received by the target interface within a historical time period;

[0007] Based on at least one authentication field in the traffic information that meets the authentication characteristics, determine whether the target interface has an authentication mechanism.

[0008] In some embodiments of this application, the traffic information includes responses returned for each request received within the historical time period; determining whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that conforms to authentication characteristics includes:

[0009] The baseline characteristics required for a normal response are obtained from the response logs of the target interface recorded locally. The normal response is the response in which the target interface successfully returns data according to the request. From the responses returned for each request, abnormal responses that do not meet the baseline characteristics are obtained. Based on at least one authentication field in the abnormal response that meets the authentication characteristics, it is determined whether the target interface has an authentication mechanism.

[0010] In some embodiments of this application, determining whether the target interface has an authentication mechanism based on at least one authentication field in the abnormal response that conforms to authentication characteristics includes:

[0011] Determine whether any of the abnormal responses contains an authentication field that meets the preset authentication failure characteristics, wherein the authentication characteristics include the preset authentication failure characteristics; if not, determine that the target interface has no authentication mechanism; if so, determine that the target interface has an authentication mechanism.

[0012] In some embodiments of this application, the traffic information further includes multiple requests received within the historical time period; determining whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that conforms to authentication characteristics includes:

[0013] From the responses returned for each request, obtain the normal response that meets the baseline characteristics, which are the characteristics that a normal response must have; obtain the target request corresponding to the normal response from the multiple requests; and determine whether the target interface has an authentication mechanism based on at least one authentication field in the target request that meets the authentication characteristics.

[0014] In some embodiments of this application, determining whether the target interface has an authentication mechanism based on at least one authentication field in the target request that conforms to authentication characteristics includes:

[0015] In each target request, fields that conform to preset authentication identification features are extracted as authentication fields, and the authentication features include the preset authentication identification features; the extracted authentication fields are used to determine whether the target interface has an authentication mechanism.

[0016] In some embodiments of this application, determining whether the target interface has an authentication mechanism based on the extracted authentication fields includes:

[0017] Determine whether any of the extracted authentication fields exist in each target request; if so, determine that the target interface has an authentication mechanism; otherwise, determine that the target interface does not have an authentication mechanism.

[0018] In some embodiments of this application, obtaining the baseline characteristics required for a normal response based on the locally recorded response logs of the target interface includes:

[0019] Extract the fields contained in each response and the parameter values ​​of each field from the response log; determine the baseline characteristics that a normal response should have based on each field and its corresponding parameter value.

[0020] A second aspect of this application proposes an interface authentication detection device, the device comprising:

[0021] The traffic acquisition module is used to acquire traffic information sent and received by the target interface within a historical time period;

[0022] The authentication detection module is used to determine whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that meets the authentication characteristics.

[0023] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to perform the steps of the method as described in the first aspect above.

[0024] The fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, the program being executed by a processor to perform the steps of the method as described in the first aspect above.

[0025] Based on the interface authentication detection method and apparatus described in the first and second aspects above, this application has at least the following beneficial effects or advantages:

[0026] By acquiring traffic information sent and received by the interface over a historical period, and based on authentication fields that conform to authentication characteristics within the acquired traffic information, the interface authentication mechanism is automatically and effectively detected, thus reminding the interface provider to add an authentication mechanism. Since this application implements interface authentication detection based on historical traffic characteristic analysis, it does not require sending any requests to the interface. This not only avoids affecting the normal operation of the interface but also prevents data corruption. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0028] Figure 1 This is a flowchart illustrating an embodiment of an interface authentication detection method according to an exemplary embodiment of this application;

[0029] Figure 2 For the purposes of this application Figure 1 The embodiment shown illustrates a schematic diagram of a specific implementation process for target interface authentication and detection based on traffic information;

[0030] Figure 3 This is a schematic diagram of the structure of an interface authentication detection device according to an exemplary embodiment of this application;

[0031] Figure 4 This is a schematic diagram of the hardware structure of an electronic device according to an exemplary embodiment of this application;

[0032] Figure 5 This is a schematic diagram illustrating the structure of a storage medium according to an exemplary embodiment of this application. Detailed Implementation

[0033] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0034] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0035] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0036] Regarding the detection of interface authentication, the inventors found through research that the industry typically uses an active scanning method to detect the authentication mechanism of an interface. That is, a request is intercepted from the request traffic of the interface, and the fields suspected of being authentication are deleted or modified in the intercepted request. The request is then replayed, and the response content for the replayed request and the response content for the original request are obtained. The two response contents are then compared for consistency. If they match, it is determined that the interface has no authentication mechanism. If they do not match, it is determined that the interface has an authentication mechanism.

[0037] However, when the interface has anti-replay and anti-tampering protection mechanisms, this active scanning method cannot achieve the purpose of interface authentication and detection. Furthermore, the replay request requires the interface to return a corresponding response, which not only affects the normal operation of the interface, but also brings the risk of data pollution to the interface. For example, if the replay is a request to modify data, it may cause business data to be modified. If the replay is a request to delete data, it may cause business data to be accidentally deleted.

[0038] To address the aforementioned technical problems, the inventors, starting with the historical traffic of the interface, achieve fully automated detection of the interface authentication mechanism through traffic feature analysis. Specifically, by acquiring the traffic information sent and received by the interface over a historical period, and based on authentication fields within the acquired traffic information that conform to authentication characteristics, the interface authentication mechanism is automatically and effectively detected, thus prompting the interface provider to add an authentication mechanism. Since this application implements interface authentication detection based on historical traffic feature analysis, it does not require sending any requests to the interface. This not only avoids affecting the normal operation of the interface but also prevents data corruption. Furthermore, this application is also applicable when the interface has anti-replay and anti-tampering mechanisms.

[0039] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0040] Figure 1 This is a flowchart illustrating an embodiment of an interface authentication detection method according to an exemplary embodiment of this application. The detection method includes the following steps:

[0041] Step 101: Obtain the traffic information sent and received by the target interface within the historical time period.

[0042] The target interface is the API interface whose authentication mechanism is to be tested, such as an interface for querying orders or a payment interface. If the target interface is accessed and called by unauthorized users, attackers can use the target interface to improperly use business functions and obtain sensitive data, posing a security threat to the target interface.

[0043] Furthermore, the target interface typically returns corresponding responses based on the received requests. Since both requests and responses belong to the traffic passing through the target interface, the requests received by the target interface and / or the responses sent for each received request can be considered as traffic information.

[0044] Specifically, the historical time period can be the period closest to the current time, such as obtaining the traffic information sent and received by the target interface in the past week.

[0045] Step 102: Based on at least one authentication field in the traffic information that meets the authentication characteristics, determine whether the target interface has an authentication mechanism.

[0046] In this context, the authentication field in traffic information refers to the field used for authentication verification or the field used to indicate the authentication verification result. Accordingly, the authentication features include preset authentication failure features and preset authentication recognition features. The preset authentication failure features are used to match the field indicating the authentication verification result, and the preset authentication recognition features are used to match the field indicating that authentication verification is being performed.

[0047] In an optional embodiment, when the traffic information includes responses returned for each request received within a historical time period, the baseline characteristics that a normal response should have are first obtained from the response logs of the target interface recorded locally. Then, abnormal responses that do not meet the baseline characteristics requirements are obtained from the responses returned for each request. Based on at least one authentication field in these abnormal responses that meets the authentication characteristics, it is determined whether the target interface has an authentication mechanism.

[0048] The response returned by the target interface includes two types: normal response and abnormal response. A normal response is the response of the target interface that successfully returned data according to the request, while an abnormal response is the response of the target interface that failed to return data according to the request.

[0049] Furthermore, baseline features specify the format requirements for the parameter values ​​of each field in a normal response. For example, the parameter value for the mobile phone number field in the response must be a numeric type with a length of 13 digits. Therefore, by using baseline features, abnormal and normal responses can be distinguished. That is, if the response returned for the request does not meet the baseline feature requirements, it is an abnormal response; if the response returned for the request meets the baseline feature requirements, it is a normal response.

[0050] In one specific implementation, for the process of obtaining the baseline characteristics that a normal response should have based on the response log of the target interface recorded locally, the fields contained in each response in the response log and the parameter values ​​of each field are extracted, and then the baseline characteristics that a normal response should have are determined based on each field and the corresponding parameter values.

[0051] Since the response log contains the content of all responses sent by the target interface, the baseline characteristics of a normal response can be accurately obtained by using the fields and parameter values ​​contained in each response in the response log.

[0052] Specifically, a baseline feature of a normal response can be obtained by using deep learning methods based on the fields and parameter values ​​contained in each response.

[0053] In a specific embodiment, for the process of determining whether a target interface has an authentication mechanism based on at least one authentication field that conforms to authentication characteristics in an abnormal response, it may be determined whether any abnormal response among the abnormal responses includes an authentication field that conforms to a preset authentication failure characteristic. If yes, it is determined that the target interface has an authentication mechanism; if no, it is determined that the target interface does not have an authentication mechanism.

[0054] Wherein, the preset authentication failure characteristic is one type of authentication characteristics, and the authentication field conforming to the preset authentication failure characteristic is a field used to represent an authentication verification result. Therefore, as long as one abnormal response includes an authentication field conforming to the preset authentication failure characteristic, it indicates that the target interface has an authentication mechanism. Thus, authentication detection of the target interface can be directly implemented by analyzing the abnormal responses in the traffic information.

[0055] In another embodiment, it may also be determined that the target interface has an authentication mechanism when the number of abnormal responses including authentication fields conforming to the preset authentication failure characteristic is greater than a certain threshold. This can improve the accuracy of authentication detection.

[0056] In an example, the preset authentication failure characteristic may include response status code 401, or the response content includes content that conforms to the following regular expression: the regular expression is specifically: authentication|certification|signature|permission|secret key|private key|token|credential|land|login|verification|signature verification|authorization|identity|token|sign|auth|access|ticket|key|login).*(not|empty|no|lacking|required|need|none|error|missing|expired|mistake|error|not|fail|no|need|not|fail|illegal|deny|please). Wherein, ".*" indicates that one or more characters appear in the preceding part and one or more characters appear in the following part.

[0057] In another optional embodiment, the traffic information further includes a plurality of requests received within a historical time period. After obtaining the baseline characteristics that a normal response needs to have, a normal response meeting the baseline characteristic requirement may also be obtained from responses returned for each request, and a target request corresponding to the normal response is obtained from the plurality of requests, and then whether the target interface has an authentication mechanism is determined according to at least one authentication field conforming to authentication characteristics in the target request.

[0058] Wherein, by filtering out requests corresponding to normal responses from the plurality of requests included in the traffic information and detecting the authentication mechanism of the target interface based on the requests corresponding to normal responses, the influence of requests with abnormal responses on the determination of the detection result is avoided.

[0059] In one specific implementation, the process of determining whether a target interface has an authentication mechanism based on at least one authentication field in the target request that conforms to authentication characteristics is carried out by extracting fields that conform to preset authentication identification characteristics from each target request as authentication fields, and then determining whether the target interface has an authentication mechanism based on the extracted authentication fields.

[0060] In one example, the preset authentication identification features may include any one or more combinations of token, sign, code, session, segiupt, cookie, openid, key, secret, auth, id, hash, md5, passwd, password, pwd, and ticket.

[0061] Specifically, the authentication field in each target request can be extracted using the following regular expression:

[0062] token|sign|code|session|segiupt|cookie|openid|key|secret|auth|id|hash|md5|passwd|password|pwd|ticket

[0063] It is worth noting that the authentication fields extracted from each target request may be the same or different, and the number of authentication fields extracted from each target request may also be different. Moreover, these extracted authentication fields represent suspected authentication fields, and whether they actually function for authentication needs further determination.

[0064] In an exemplary scenario, assuming there are four target requests, suspected authentication fields that match any preset authentication identification feature are extracted sequentially from each target request. For example, suspected authentication field a and suspected authentication field b are extracted from request 1; suspected authentication field c and suspected authentication field b are extracted from request 2; suspected authentication field c and suspected authentication field b are extracted from request 3; and suspected authentication field d, suspected authentication field b, and suspected authentication field e are extracted from request 4.

[0065] It is understood that the authentication fields extracted from the four requests given above are merely illustrative examples and do not constitute a specific limitation on the scope of protection of this application.

[0066] It should be noted that if no authentication field is extracted from each target request, it can be directly determined that the target interface has no authentication mechanism.

[0067] Optionally, for the process of determining whether the target interface has an authentication mechanism based on the extracted authentication fields, it is determined whether any of the extracted authentication fields exist in each target request. If so, it is determined that the target interface has an authentication mechanism; otherwise, it is determined that the target interface does not have an authentication mechanism.

[0068] Specifically, if any of the extracted authentication fields appears in all target requests, it indicates that the authentication field actually applies to all request traffic, making it a genuine authentication field, and confirming that the target interface has an authentication mechanism. Conversely, if none of the extracted authentication fields appear in all target requests, it indicates that the authentication field does not apply to all request traffic, making it a non-genuine authentication field, and confirming that the target interface lacks an authentication mechanism.

[0069] This completes the above. Figure 1 The interface authentication detection process shown acquires the traffic information sent and received by the interface over a historical period and, based on the authentication fields in the acquired traffic information that conform to authentication characteristics, automatically and effectively detects the interface authentication mechanism, thus reminding the interface provider to add an authentication mechanism. Since this application implements interface authentication detection based on historical traffic characteristic analysis, it does not require sending any requests to the interface. This not only avoids affecting the normal operation of the interface but also prevents data corruption.

[0070] Example 2:

[0071] Based on the above Figure 1 Based on the illustrated embodiment, since the target interface's send and receive traffic information can specifically include received requests and responses returned for requests, and the presence of an authentication mechanism for the target interface can be directly determined based on abnormal responses in these responses, as well as on requests with normal responses in these responses, the presence of an authentication mechanism for the target interface can also be determined. However, if the presence of an authentication mechanism for the target interface is directly determined based on abnormal responses, there may be a problem of missed detection. For example, if there is no abnormal response or the cause of the abnormal response is not the reason for authentication failure, then interface authentication cannot be achieved.

[0072] Based on this, such as Figure 2 The specific implementation process of target interface authentication detection based on traffic information is shown. By combining the judgment process based on abnormal response with the judgment process based on normal response, the target interface authentication mechanism can be fully and effectively detected.

[0073] The above Figure 2 The specific implementation process of target interface authentication and detection based on traffic information, as shown, includes the following steps:

[0074] Step 201: Obtain the multiple requests received by the target interface within the historical time period and the response returned for each request.

[0075] Step 202: Obtain the baseline characteristics that a normal response should have based on the response logs of the target interface recorded locally.

[0076] Step 203: Extract abnormal responses that do not meet the baseline characteristics from the responses returned for each request.

[0077] Step 204: Based on at least one authentication field in the exception response that meets the authentication characteristics, determine whether the target interface has an authentication mechanism. If it does, end the current process; otherwise, proceed to step 205.

[0078] Step 205: Obtain normal responses that meet the baseline characteristics from the responses returned for each request.

[0079] Step 206: Obtain the target request corresponding to the normal response from multiple requests.

[0080] Step 207: Determine whether the target interface has an authentication mechanism based on at least one authentication field in the target request that meets the authentication characteristics.

[0081] For the specific implementation process of each step in steps 201 to 207 above, please refer to the relevant description in the above embodiments, which will not be repeated here.

[0082] This completes the above. Figure 2 The target interface authentication detection process shown first determines whether the target interface has an authentication mechanism based on abnormal responses in the traffic information. If no authentication mechanism is found, the target interface is then determined to have an authentication mechanism based on normal response requests in the traffic information. This can quickly, effectively, and comprehensively realize interface authentication detection, and also avoid potential missed detection problems.

[0083] Corresponding to the embodiments of the aforementioned interface authentication detection method, this application also provides embodiments of the interface authentication detection device.

[0084] Figure 3 This is a schematic diagram illustrating the structure of an interface authentication detection device according to an exemplary embodiment of this application. The device is used to execute the interface authentication detection method provided in any of the above embodiments, such as... Figure 3 As shown, the detection device for interface authentication includes:

[0085] The traffic acquisition module 310 is used to acquire traffic information sent and received by the target interface within a historical time period;

[0086] The authentication detection module 320 is used to determine whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that meets the authentication characteristics.

[0087] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0088] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0089] This application also provides an electronic device corresponding to the interface authentication detection method provided in the foregoing embodiments, for executing the aforementioned interface authentication detection method.

[0090] Figure 4 This application illustrates a hardware structure diagram of an electronic device according to an exemplary embodiment. The electronic device includes a communication interface 601, a processor 602, a memory 603, and a bus 604. The communication interface 601, processor 602, and memory 603 communicate with each other via the bus 604. The processor 602 can execute the interface authentication detection method described above by reading and executing machine-executable instructions corresponding to the control logic of the interface authentication detection method in the memory 603. The specific content of this method is described in the above embodiment and will not be repeated here.

[0091] The memory 603 mentioned in this application can be any electronic, magnetic, optical, or other physical storage device, and can contain stored information such as executable instructions, data, etc. Specifically, the memory 603 can be RAM (Random Access Memory), flash memory, storage drive (such as hard disk drive), any type of storage disk (such as optical disc, DVD, etc.), or similar storage media, or combinations thereof. Communication between this system network element and at least one other network element is achieved through at least one communication interface 601 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc., can be used.

[0092] Bus 604 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 603 is used to store programs, and the processor 602 executes the programs after receiving execution instructions.

[0093] Processor 602 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 602 or by instructions in software form. The processor 602 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), an On-Premises Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor.

[0094] The electronic device provided in this application embodiment and the interface authentication detection method provided in this application embodiment are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0095] This application also provides a computer-readable storage medium corresponding to the interface authentication detection method provided in the foregoing embodiments. Please refer to... Figure 5 As shown, the computer-readable storage medium is an optical disc 30, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it executes the interface authentication detection method provided in any of the aforementioned embodiments.

[0096] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0097] The computer-readable storage medium provided in the above embodiments of this application and the interface authentication detection method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0098] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0099] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0100] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting interface authentication, characterized in that, The method includes: Obtain traffic information sent and received by the target interface within a historical time period; the traffic information includes responses returned for each request received within the historical time period; Based on at least one authentication field in the traffic information that conforms to the authentication features, it is determined whether the target interface has an authentication mechanism; the authentication features include preset authentication failure features and / or preset authentication identification features, the authentication field that conforms to the preset authentication failure features is a field used to indicate the authentication verification result, and the authentication field that conforms to the preset authentication identification features is a field used to indicate that authentication verification is performed. The step of determining whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that conforms to the authentication characteristics includes: obtaining the baseline characteristics that a normal response should have based on the response log of the target interface recorded locally, wherein the normal response is the response in which the target interface successfully returns data according to the request; obtaining abnormal responses that do not meet the baseline characteristics requirements from the responses returned for each request; and determining whether the target interface has an authentication mechanism based on at least one authentication field in the abnormal response that conforms to the authentication characteristics.

2. The method according to claim 1, characterized in that, The step of determining whether the target interface has an authentication mechanism based on at least one authentication field in the abnormal response that meets the authentication characteristics includes: Determine whether any of the abnormal responses contains an authentication field that meets the preset authentication failure characteristics, wherein the authentication characteristics include the preset authentication failure characteristics; If not, then it is determined that the target interface has no authentication mechanism; If so, then it is determined that the target interface has an authentication mechanism.

3. The method according to claim 1, characterized in that, The traffic information also includes multiple requests received within the historical time period; The step of determining whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that conforms to authentication characteristics includes: From the responses returned for each request, obtain normal responses that meet the baseline characteristics requirements, which are the characteristics that a normal response should have; Obtain the target request corresponding to the normal response from the plurality of requests; Based on at least one authentication field in the target request that conforms to the authentication characteristics, determine whether the target interface has an authentication mechanism.

4. The method according to claim 3, characterized in that, The step of determining whether the target interface has an authentication mechanism based on at least one authentication field in the target request that conforms to the authentication characteristics includes: In each target request, fields that conform to preset authentication identification features are extracted as authentication fields, and the authentication features include the preset authentication identification features; The extraction of authentication fields determines whether the target interface has an authentication mechanism.

5. The method according to claim 4, characterized in that, The step of determining whether the target interface has an authentication mechanism based on the extracted authentication fields includes: Determine whether any of the extracted authentication fields exist in each target request; If so, then it is determined that the target interface has an authentication mechanism; Otherwise, it is determined that the target interface has no authentication mechanism.

6. The method according to claim 1, characterized in that, The step of obtaining the baseline characteristics required for a normal response based on the locally recorded response logs of the target interface includes: Extract the fields contained in each response and the parameter values ​​of each field from the response log; Based on each field and its corresponding parameter value, determine the baseline characteristics that a normal response should have.

7. A detection device for interface authentication, characterized in that, The device includes: The traffic acquisition module is used to acquire traffic information sent and received by the target interface within a historical time period; the traffic information includes responses returned for each request received within the historical time period. An authentication detection module is used to determine whether the target interface has an authentication mechanism based on at least one authentication field in the traffic information that conforms to the authentication features; the authentication features include preset authentication failure features and / or preset authentication identification features, the authentication field that conforms to the preset authentication failure features is a field used to indicate the authentication verification result, and the authentication field that conforms to the preset authentication identification features is a field used to indicate that authentication verification is performed. The authentication detection module is specifically used to obtain the baseline characteristics that a normal response should have based on the response logs of the target interface recorded locally, wherein the normal response is the response in which the target interface successfully returns data according to the request; to obtain abnormal responses that do not meet the baseline characteristics requirements from the responses returned for each request; and to determine whether the target interface has an authentication mechanism based on at least one authentication field in the abnormal response that meets the authentication characteristics.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the program to implement the steps of the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by a processor to implement the steps of the method as described in any one of claims 1-6.

Images