Business request processing method, device, storage medium and electronic device

Abstract

The embodiments of the present application disclose a service request processing method, device, storage medium and electronic device, the method comprising obtaining a first service request message representing a normal service request, and a second service request message representing a malicious service request; performing difference extraction processing on the first service request message and the second service request message to obtain first difference data; generating an intrusion defense strategy based on the first difference data, the intrusion defense strategy is used to defend against the malicious service request in a website application-level intrusion defense system. The embodiments of the present application can automatically generate an intrusion defense strategy, which can be applied to an application-level intrusion defense system, thereby ensuring the communication security of data in many application scenarios such as Internet of Vehicles, blockchain, and network security.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a method, device, storage medium, and electronic device for processing a service request. Background Art

[0002] The Web Application Firewall (WAF) is a component that provides security protection for the Internet by executing intrusion prevention strategies. In related technologies, the intrusion prevention rules executed by WAF are mainly obtained by human analysis based on their own experience and are manually input into the WAF system. As a result, the defense performance of WAF is highly dependent on human technical capabilities, and the defense quality of WAF is correspondingly difficult to control. Summary of the invention

[0003] In order to improve the defense quality of the WAF system, reduce the dependence of WAF defense on manual work, and make the defense effect stable and controllable, the embodiments of the present application provide a service request processing method, device, storage medium, and electronic device.

[0004] On the one hand, an embodiment of the present application provides a service request processing method, the method comprising:

[0005] Acquire a first service request message, where the first service request message represents a normal service request sent by a packet issuing device to a service response device;

[0006] Acquire a second service request message, where the second service request message represents a malicious service request sent by the packet issuing device to the service response device;

[0007] Performing difference extraction processing on the first service request message and the second service request message to obtain first difference data;

[0008] An intrusion prevention strategy is generated based on the first difference data, and the intrusion prevention strategy is used to defend against the malicious business request in a website application-level intrusion prevention system.

[0009] On the other hand, an embodiment of the present application provides a service request processing device, the device comprising:

[0010] A first service request message acquisition module, used to acquire a first service request message, wherein the first service request message represents a normal service request sent by a packet issuing device to a service response device;

[0011] A second service request message acquisition module, used to acquire a second service request message, where the second service request message represents a malicious service request sent by the packet issuing device to the service response device;

[0012] A difference extraction processing module, used for performing difference extraction processing on the first service request message and the second service request message to obtain first difference data;

[0013] The intrusion defense strategy automatic generation module is used to generate an intrusion defense strategy based on the first difference data, and the intrusion defense strategy is used to defend against the malicious business request in the website application level intrusion defense system.

[0014] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by a processor to implement the above-mentioned service request processing method.

[0015] On the other hand, an embodiment of the present application provides an electronic device, comprising at least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the above-mentioned service request processing method by executing the instructions stored in the memory.

[0016] On the other hand, an embodiment of the present application provides a computer program product, including a computer program or instructions, which implement the above-mentioned service request processing method when executed by a processor.

[0017] The embodiments of the present application provide a method, apparatus, storage medium and device for processing business requests. The embodiments of the present application can automatically generate an intrusion defense strategy by comparing and analyzing the difference between the traffic of normal business requests and the traffic of malicious business requests. The generation process of the intrusion defense strategy no longer relies on manual experience, and is more scientific, standardized, rigorous and rapid. The generation process of the intrusion defense strategy can take into account various difference fields and not miss important difference features, thereby having a significant advantage of high quality. The effect of intrusion defense based on the determined intrusion defense strategy is also stable and controllable. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or related technologies, the following is a brief introduction to the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is a schematic diagram of a feasible implementation framework of the service request processing method provided in the embodiment of the present application;

[0020] Figure 2 It is a flowchart of a method for processing a business request provided by an embodiment of the present application;

[0021] Figure 3 This is a schematic diagram of a process for obtaining a first service request message provided in an embodiment of the present application;

[0022] Figure 4 It is a schematic diagram of a framework for a container to communicate with a host machine based on the Bridge mode provided in an embodiment of the present application;

[0023] Figure 5 is a flow chart of a method for performing difference extraction processing provided in an embodiment of the present application;

[0024] Figure 6 is a flow chart of a method for automatically generating an intrusion defense strategy provided by an embodiment of the present application;

[0025] Figure 7 It is a flowchart of a method for processing a business request provided in an embodiment of the present application;

[0026] Figure 8 It is a schematic diagram of the working principle of the database in the master-slave mode provided in an embodiment of the present application;

[0027] Fig. 9 This is a schematic diagram of a log storage method provided in an embodiment of the present application;

[0028] Fig.10 is a block diagram of a service request processing device provided in an embodiment of the present application;

[0029] Fig.11 It is a schematic diagram of the hardware structure of a device provided in an embodiment of the present application for implementing the method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of the present application.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0032] In order to make the purpose, technical solution and advantages disclosed in the embodiments of the present application more clearly understood, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present application and are not used to limit the embodiments of the present application.

[0033] In the following, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this embodiment, unless otherwise specified, "multiple" means two or more. In order to facilitate the understanding of the above-mentioned technical solutions and the technical effects produced by the embodiments of the present application, the embodiments of the present application first explain the relevant professional terms:

[0034] WAF: Web Application Firewall is a product that provides protection for Web applications by executing a series of security policies for HTTP / HTTPS.

[0035] HTTP: Hypertext Transfer Protocol is a simple request / response protocol that usually runs on top of TCP (Transmission Control Protocol). HTTP specifies what kind of messages a client may send to a server and what kind of responses it may get. The headers of request and response messages are given in ASCII (American Standard Code for Information Interchange); while the message content has a format similar to MIME (Multipurpose Internet Mail Extensions).

[0036] HTTPS: Hyper Text Transfer Protocol over Secure Socket Layer. It is a HTTP channel with security as its goal. It ensures the security of the transmission process through transmission encryption and identity authentication based on HTTP.

[0037] IP: Internet Protocol. The purpose of IP is to improve the scalability of the network, solve Internet problems, achieve large-scale, heterogeneous network interconnection, and separate the coupling relationship between top-level network applications and bottom-level network technologies to facilitate the independent development of the two. Based on the end-to-end design principle, IP provides a connectionless, unreliable, best-effort data packet transmission service.

[0038] Docker: An open source application container engine that allows developers to package their applications and dependent packages into a portable image, and then publish it to a machine running an operating system to achieve virtualization. Containers use a complete sandbox mechanism and there are no interfaces between them.

[0039] NAT: Network Address Translation.

[0040] Httpd: The main program of the Apache Hypertext Transfer Protocol (HTTP) server, designed as an independently running background process, which establishes a pool of child processes or threads to handle requests.

[0041] Intelligent Traffic System: ITS, also known as Intelligent Transportation System, is the effective and comprehensive application of advanced science and technology (information technology, computer technology, data communication technology, sensor technology, electronic control technology, automatic control theory, operations research, artificial intelligence, etc.) to transportation, service control and vehicle manufacturing, strengthening the connection between vehicles, roads and users, thus forming a comprehensive transportation system that ensures safety, improves efficiency, improves the environment and saves energy.

[0042] In the related art, WAF rules rely almost entirely on manual analysis, which requires a lot of manpower and is difficult to control the quality. The process of manually analyzing WAF rules is difficult to record digitally, so there is no condition for review and improvement, which further increases the difficulty of WAF defense quality control. In view of this, an embodiment of the present application provides a business request processing method, which can automatically generate an intrusion defense strategy for the malicious business request by analyzing normal business requests and malicious business requests. It is not limited by human personal ability, and will not lose or omit important attack features used to determine the intrusion defense strategy, thereby significantly improving the quality of intrusion defense, making the quality of intrusion defense stable and controllable, and automatically generating intrusion defense strategies can significantly improve the generation speed of intrusion defense strategies, so that the WAF system can quickly respond to malicious attacks.

[0043] See also Figure 1 , Figure 1 is a feasible implementation framework diagram of the service request processing method provided in the embodiment of this specification, such as Figure 1 As shown, the implementation framework may include at least a packet sending device 01, a service response device 02, a traffic proxy device 03 and a message parsing device 04, wherein the packet sending device 01 may also be considered as a simulated attack device, which may send normal service requests and malicious service requests to the service response device 02, and implement malicious attacks through interaction with the service response device 02.

[0044] The traffic proxy device 03 may be located between the packet issuing device 01 and the service response device 02, and the traffic proxy device 03 does not affect the interaction process between the packet issuing device 01 and the service response device 02. Specifically, the traffic proxy device 03 may intercept the service request message sent by the packet issuing device 01 to the service response device 02, copy the service request message and forward it to the service response device 02, and the response generated by the service response device 02 to the service request may be directly transmitted to the packet issuing device 01, or forwarded to the packet issuing device 01 through the traffic proxy device 03, and the embodiment of the present application does not limit this.

[0045] The traffic proxy device 03 can send the copied service request to the message parsing device 04. The key task of the message parsing device 04 is to reorganize the binary transmission network layer message into the HTTP message of the application layer. The service request copied by the traffic proxy device 03 is stored in binary form, which is the result of the implementation of IP fragmentation technology. As an important technical means for transmitting IP messages on the network, IP fragmentation technology embodies the idea of ​​packet switching in data interaction. When various devices on the Internet transmit data, it is difficult to transmit all the data at one time. The data needs to be divided into several pieces for transmission. In the embodiment of the present application, the message parsing device 04 is used to reorganize the data copied from the traffic proxy device 03 and restore it to obtain a complete service request message.

[0046] In the IP protocol, each physical link specifies the maximum length of the link layer data frame, which is called MTU (Maximum Transmission Unit). For example, in the most common Ethernet environment, the MTU is 1500 bytes. If the size of the data frame to be transmitted exceeds 1500 bytes, that is, the length of the IP datagram is greater than 1472 (1500-20-8=1472, ordinary datagram) bytes, the data needs to be fragmented before transmission. Fragmentation and reassembly are mutually symmetrical processes. In the process of message reassembly in the message parsing device 04, a 16-bit identification number, a 13-bit fragment offset, and a 3-bit flag between 16 and 13 bits are required. Among them, the 16-bit identification number records the identification of an IP packet, and IP fragments with the same identification will be reassembled. The 13-bit fragment offset records the position of a certain IP fragment relative to the entire packet. The 3-bit flag between 16 and 13 bits records whether there are new fragments after the fragment. Based on the above information, the message parsing device 04 can restore the complete service request message.

[0047] The packet issuing device 01 may send a first service request message to the service response device 02, wherein the first service request message represents a normal service request sent by the packet issuing device 01 to the service response device 02; or may send a second service request message, wherein the second service request message represents a malicious service request sent by the packet issuing device 01 to the service response device 02. Both the first service request message and the second service request message may be obtained by the traffic proxy device 03 and restored in the message parsing device 04.

[0048] In the embodiment of the present application, an intrusion defense strategy generation device 05 may also be included, and the intrusion defense strategy generation device 05 may perform difference extraction processing on the first service request message and the second service request message to obtain first difference data; based on the first difference data, an intrusion defense strategy is generated, and the intrusion defense strategy is used to defend against the malicious service request in the website application-level intrusion defense system. In one embodiment, the intrusion defense strategy generation device 05 may also perform defense according to the determined intrusion defense strategy, and the intrusion defense strategy generation device 05 may be a WAF device.

[0049] Any of the above-mentioned devices or systems mentioned in the embodiments of the present application may be a mobile terminal, a desktop computer, a tablet computer, a laptop computer, a digital assistant, a smart wearable device, or any other physical device that has communication and navigation capabilities, and may also include software running in the physical device. Of course, it may also be a server, which may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services, and the present application does not limit this.

[0050] In some embodiments, the method provided in the embodiments of the present application may involve a blockchain, that is, the method provided in the embodiments of the present application may be implemented based on a blockchain, or the data involved in the method provided in the embodiments of the present application may be stored based on a blockchain, or the execution subject of the method provided in the embodiments of the present application may be located in a blockchain. Blockchain is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods, each of which contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain may include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0051] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operation monitoring. Among them, the user management module is responsible for the identity information management of all blockchain participants, including maintaining public and private key generation (account management), key management, and the maintenance of the correspondence between the user's real identity and the blockchain address (authority management), etc., and, under authorization, supervises and audits the transactions of certain real identities and provides risk control rule configuration (risk control audit); the basic service module is deployed on all blockchain node devices to verify the validity of business requests, and records valid requests to storage after consensus is reached. For a new business request, the basic service first adapts the interface for parsing and authentication (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management). The smart contract module is responsible for the registration and issuance of contracts, as well as contract triggering and contract execution. Developers can define the contract logic in a programming language and publish it to the blockchain (contract registration). According to the logic of the contract terms, the key or other events are called to trigger the execution and complete the contract logic. It also provides the function of contract upgrade and cancellation. The operation monitoring module is mainly responsible for the deployment, configuration modification, contract setting, cloud adaptation and real-time status visualization output of the product during the product release process, such as alarm, network monitoring, node equipment health monitoring, etc.

[0052] The platform product service layer provides the basic capabilities and implementation framework of typical applications. Developers can superimpose business features based on these basic capabilities to complete the blockchain implementation of business logic. The application service layer provides application services based on blockchain solutions for business participants to use.

[0053] In some embodiments, a service request processing method provided by the present application can be applied to scenarios such as navigation, autonomous driving, Internet of Vehicles, vehicle-road collaboration, and smart transportation. For example, in scenarios such as navigation, autonomous driving, Internet of Vehicles, vehicle-road collaboration, and smart transportation, vehicles need to interact with other devices, such as servers or other vehicles, and may be attacked by malicious parties during the data interaction process. An intrusion defense strategy can be generated based on the service request processing method provided in the embodiments of the present application, so as to defend against attacks by malicious parties based on the intrusion defense strategy, so as to ensure data security during the communication process.

[0054] The following describes a method for processing a service request in an embodiment of the present application. Figure 2A flow chart of a business request processing method provided by an embodiment of the present application is shown. The embodiment of the present application provides the method operation steps as described in the embodiment or the flow chart, but more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the order of many steps and does not represent the only execution order. When the actual system or server product is executed, it can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment) according to the method shown in the embodiment or the accompanying drawings. The above method may include:

[0055] S101. Obtain a first service request message, where the first service request message represents a normal service request sent from a packet issuing device to a service response device.

[0056] In the embodiment of the present application, the first service request message can be sent by the packet issuing device to the service response device, and is intercepted by the traffic proxy device and reassembled in the message parsing device. The first service request message corresponds to a normal service request. Specifically, parameters related to the normal service request can be configured in the packet issuing device, and the packet issuing device automatically generates the first service request message according to the above parameters.

[0057] In one embodiment, the first service request message can represent a normal HTTP request. The first service request message can be restored in the message parsing device and then enter the intrusion defense policy generating device, and be marked as a normal service traffic message in the intrusion defense policy generating device.

[0058] If the first service request message includes only one first service sub-request, it is sufficient to obtain the first service sub-request message, where the first service sub-request message represents the first first service sub-request sent by the packet issuing device to the service response device.

[0059] If the normal service request includes N first service sub-requests, where N is a positive integer greater than or equal to 2, then obtaining the first service request message includes:

[0060] Obtain a first first business sub-request message, the first first business sub-request message representing the first first business sub-request sent by the packet issuing device to the business response device; obtain the i-th first business sub-request message, the i-th first business sub-request message representing the i-th first business sub-request sent by the packet issuing device to the business response device when the packet issuing device obtains the response of the business response device to the i-1-th first business sub-request message, wherein i is a positive integer greater than 1 and less than or equal to N.

[0061] Please refer to Figure 3, which shows a schematic diagram of the process of obtaining the first service request message in an embodiment of the present application. The first service request message includes three first service sub-request messages. When the first first service sub-request message is received by the service response device, the service request message will generate a corresponding first first service sub-response. When the first first service sub-response reaches the packet issuing device, the packet issuing device can issue a second first service sub-request message and trigger the service response device to generate a corresponding second first service sub-response. After the packet issuing device receives the second first service sub-response, it can issue a third first service sub-request message and receive a third first service sub-response from the service response device. In this process, the first first service sub-request, the second first service sub-request, and the third first service sub-request are all copied by the traffic proxy device and restored in the message parsing device to obtain the first service request message. The first service request message is sent to the intrusion defense strategy generation device and is marked as a normal service request.

[0062] S102. Obtain a second service request message, where the second service request message represents a malicious service request sent by the packet issuing device to the service response device.

[0063] In the embodiment of the present application, the corresponding intrusion defense strategy can be automatically determined for different malicious business requests. The embodiment of the present application does not limit the malicious business requests. For example, it can be an attack-type business request, an injection-type business request, etc.

[0064] In one embodiment, the second service request message is an HTTP request that may represent maliciousness. The second service request message may be restored in a message parsing device and then enter an intrusion defense policy generating device, and be marked as a malicious service traffic message in the intrusion defense policy generating device.

[0065] If the second service request message includes only one second service sub-request, it is sufficient to obtain the second service sub-request message, and the second service sub-request message represents the first second service sub-request sent by the packet issuing device to the service response device. If the malicious service request includes the N second service sub-requests, the second service request message is obtained, including: obtaining the first second service sub-request message, the first second service sub-request message represents the first second service sub-request sent by the packet issuing device to the service response device; obtaining the tth second service sub-request message, the tth second service sub-request message represents the tth second service sub-request sent by the packet issuing device to the service response device when the packet issuing device obtains the response of the service response device to the t-1th second service sub-request message, wherein t is a positive integer greater than 1 and less than or equal to N. The method for obtaining the second service request message is based on the same inventive concept as the method for obtaining the first service request message, and will not be repeated here.

[0066] In order to generate intrusion defense strategies for a variety of malicious business requests, in one embodiment, a vulnerability environment corresponding to each malicious business request can be constructed based on container technology. Specifically, the vulnerability environment can be provided by a container running on a host machine. If the host machine runs M containers, each container runs a vulnerability environment for implementing a certain malicious attack, then the host machine can provide M vulnerability environments, which can be used to determine M malicious attacks accordingly.

[0067] Specifically, Docker can be used to build business response equipment. Due to the convenience of Docker, different vulnerability environments can be quickly built through Docker, so that multiple intrusion defense strategies can be determined in a short time. Docker's network architecture usually has four modes, namely Host mode, Container mode, None mode and Bridge mode.

[0068] For Host mode, in Host mode, the container in Docker will not have an independent network namespace, but will share a network with the host. The container will not have its own virtual network card and virtual IP, but will directly use the host's IP and port. In addition to the shared network namespace, the container's file system and process data are isolated from the host. The container can directly share the IP address with the host to communicate with the outside world, and the services in the container also use the host's ports, and there is no network address translation. The advantage of HOST mode is that it directly uses the host's network card, and the network performance is high. Because the port is shared with the host, the service needs to avoid the port that the host itself has already used, otherwise the service cannot be provided. Also because the network card is shared with the host, the network isolation in Host mode is slightly worse.

[0069] For Container mode, different containers communicate through IO network cards, and the file systems and process data of different containers are isolated from each other. However, they share a network namespace and port range that is isolated from the host.

[0070] For the None mode, in the None mode, the Docker container does not have its own network card, IP and routing information. It is a completely isolated system with only an IO loopback network inside the container. The container in this mode has no way to communicate with the outside world, and the completely closed network ensures the security of the container itself.

[0071] As for the Bridge mode, the Bridge mode is the default mode of the Docker platform. The principle is to create a virtual bridge named docker0 in the host machine. The virtual bridge is equivalent to a network switch. The host machine communicates with other containers through this virtual bridge. In specific implementation, docker0 will assign an IP address to all containers and set the default gateway to the IP address of docker0, so that all communications between the container and the outside world are completed through docker0. The host also accesses the container through docker0, so docker0 realizes two-way communication between the host machine and the container.

[0072] In the embodiment of the present application, each container used to run the vulnerability environment can communicate with the host machine in Bridge mode. Please refer to Figure 4 , which shows a schematic diagram of the framework of the container communicating with the host based on the Bridge mode in the embodiment of the present application. There is an eth0 network card inside the Docker container, which is assigned an IP address of 172.17.0.2. It is connected to the bridge docker0 through the virtual network card veth34c67d. The configuration address of docker0 is 172.17.0.1. At the same time, the default gateway of the container is set to 172.17.0.1, that is, docker0. A Httpd Docker is started on the host, so that the communication between the Docker container and the host is realized. Another layer of NAT forwarding is done in the host, and the external access to the host physical network card IP address 10.10.10.10 is forwarded to the container IP address 172.17.0.2, so that the external user of the host can access the service in the Docker container, so that the external first business request message and the second business request message can reach the business response device in the container, and the response generated by the business response device can also be received by the corresponding packet sending device.

[0073] In the disclosed embodiment, the packet-sending device can be configured to send the second service request message. In one embodiment, a vulnerability exploitation script can be directly written, the attack target of the script is set to the address of the service response device, and a command is executed to initiate a simulated attack. The script can then trigger the packet-sending device to send the second service request message. In another embodiment, a scanner can be used to select a specific vulnerability detection plug-in to initiate a scan, and a scan message with attack features (the second service request message) is sent via the packet-sending device. In another embodiment, an attack message (the second service request message) can also be manually constructed in the packet-sending device. Specifically, manual operations can usually be performed in the flow meter to inject dangerous instructions into the input parameters to obtain the second service request message.

[0074] S103. Perform difference extraction processing on the first service request message and the second service request message to obtain first difference data.

[0075] Please refer to Figure 5 , which shows a flow chart of a method for performing difference extraction processing in an embodiment of the present application. The difference extraction processing of the first service request message and the second service request message is performed to obtain first difference data, including:

[0076] S1031. Compare the first service request message and the second service request message field by field to determine at least one difference field.

[0077] In the embodiment of the present application, the first service request message and the second service request message obtained from the message parsing device contain complete service data, wherein the first service request message is a normal service request message, and the second service request message is a malicious service request message. By comparing the differences between the first service request message and the second service request message field by field, the differences between the service request under normal circumstances and the service request under malicious attack circumstances can be determined, and these differences are reflected in at least one determined difference field.

[0078] S1032. Determine the association relationship between the difference fields.

[0079] In the embodiment of the present application, an association relationship between the difference fields in the at least one determined difference field can also be obtained, and the association relationship also belongs to the content of the first difference data.

[0080] For example, the HTTP text in the first service request message may include the following content:

[0081] GET / shell?cmd=123HTTP / 1.1

[0082] User-Agent:Hello,world

[0083] Host:192.168.1.1:80

[0084] Accept: text / html,application / xhtmlxml,application / xml; q=0.9, image / webp,* / *; q=0.8

[0085] Connection:keep-alive

[0086] The HTTP text of the second service request message may include the following content:

[0087] GET / shell? cmd=useradd vtest HTTP / 1.1

[0088] User-Agent:Hello,world

[0089] Host:192.168.1.1:80

[0090] Accept: text / html, application / xhtmlxml, application / xml; q=0.9, image / webp,* / *; q=0.8

[0091] Connection:keep-alive

[0092] In step S103, the HTTP text may be matched field by field to obtain the first difference data, and the fields without differences are of little significance for generating an intrusion defense strategy and may be ignored. In the above example, the first difference data is "cmd=123" and "cmd=useradd vtest".

[0093] S104. Generate an intrusion defense strategy based on the first difference data, where the intrusion defense strategy is used to defend against the malicious service request in the website application-level intrusion defense system.

[0094] In the embodiment of the present application, for each of the above difference fields, an intrusion prevention rule can be obtained accordingly. Figure 6 , which shows a flow chart of a method for automatically generating an intrusion defense strategy in an embodiment of the present application. The method includes:

[0095] S1041. Determine a target matching method, a target matching string, and a target detection variable for a first target difference field, where the first target difference field is any of the above difference fields.

[0096] In the embodiment of the present application, the target matching method represents the matching method of the first target difference field when determining whether the service request to be detected is a malicious request during intrusion defense. For example, the target matching method can be regular matching, numerical value matching, content inclusion matching, etc. The target matching string represents the grammatical rules used when matching the first target difference field. The target detection variable represents the field name corresponding to the first target difference field, such as GET parameters, POST parameters or Cookies, etc.

[0097] S1042: Determine a target identifier of the intrusion prevention rule generated for the first target difference field.

[0098] In the embodiment of the present application, the target rule identifier represents a unique identifier corresponding to the first target intrusion prevention rule generated for the difference field.

[0099] S1043. Generate a first target intrusion prevention rule for the first target difference field according to the target matching method, the target matching string, the target detection variable and the target identifier.

[0100] In the embodiment of the present application, the first target intrusion defense rule includes the target matching method, the target matching string, the target detection variable and the target identifier. In some other embodiments, the first target intrusion defense rule also includes at least one of the following contents:

[0101] The target association rule identifier is an identifier of the intrusion prevention rule generated for the relevant field, and the relevant field is another difference field associated with the first target difference field. When multiple intrusion prevention rules need to be matched in linkage in the intrusion prevention policy, the target association rule identifier needs to be set.

[0102] A target priority is used to characterize the matching order of the first target intrusion prevention rule among the intrusion prevention rules in the intrusion prevention policy.

[0103] Target detection classification, the target detection classification characterizes the attack classification corresponding to the malicious service request. This parameter is a known parameter, that is, it matches the user's setting in the packet issuing device. For example, the user can set the packet issuing device to perform SQL injection, XSS attack, etc. on the service response device, so that the packet issuing device sends the second service request message, and the value of the target detection classification can be obtained according to the above setting, and its value is also corresponding to SQL injection, XSS attack, etc.

[0104] Target harm level, the target harm level represents the harm degree of the attack corresponding to the malicious service request. The target harm level matches the target detection classification, for example, it can be severe, high risk, medium risk or low risk.

[0105] Target defense action: The target defense action represents the processing method of the malicious service request. Specifically, the target defense action can be warning, blocking and releasing.

[0106] Target rule description, the target rule description represents the descriptive content of the target intrusion rule. Specifically, the target rule description can be used to describe the rule details, principles or references.

[0107] For example, the first target intrusion prevention rule generated is as follows:

[0108]

[0109] In the case where it is determined in the foregoing that at least one first target intrusion defense rule is obtained, an intrusion defense strategy can be obtained. Specifically, for business requests entering the application-level intrusion defense system, they can be matched according to the priority in the first target defense rule. When all the first target defense rules with associated relationships can be matched, it can be determined that the business request is a malicious business request and can be defended against.

[0110] In some embodiments, the intrusion defense strategy may include multiple first-target intrusion defense rules, and the intrusion defense strategy may be further characterized by further clarifying the importance of each first-target intrusion defense rule. For example, the importance of the more important first-target intrusion defense rules can be set to high, and the importance of other first-target intrusion defense rules can be set to low. For a business request entering the website application-level intrusion defense system, if the business request matches any first-target intrusion defense rule with a high importance and the intrusion defense rule associated with it, the defense can be activated, or if the business request simultaneously matches a preset number of first-target intrusion defense rules with a low importance and the intrusion defense rules associated with it, the defense can also be activated. The embodiment of the present application does not limit the above-mentioned preset number, and it can be set according to actual conditions.

[0111] In order to determine the importance of the first target intrusion defense rule, at least one third service request message may also be obtained in the embodiment of the present application. The third service request message represents a malicious service request of the same type as the second service request message and sent by the packet issuing device to the service response device. The method for obtaining the third service request message refers to the method for obtaining the second service request message, which will not be described in detail here.

[0112] Specifically, for each of the third service request messages, the second difference data between the third service request message and the first service request message can be obtained, the second difference data includes at least one second target difference field, and the second target difference field is any difference field in the second difference data; determine the second target intrusion defense rule for each of the second difference fields. In the embodiment of the present application, the method for determining the second target difference field is consistent with the method for determining the first target difference field, and the method for determining the second target intrusion defense rule is consistent with the method for determining the first target intrusion defense rule, and the foregoing text may be referred to, and no further description is given here.

[0113] Taking the malicious service request of SQL injection type as an example, in order to obtain the intrusion defense strategy corresponding to this type, the first service request message A1, the second service request message B1, and the third service request messages B2 and B3 can be sent. By comparing A1 and B1, three first target intrusion defense rules S11, S12, and S13 can be obtained, and these three rules correspond to fields z1, z2, and z3 respectively. By comparing A1 and B2, two second target intrusion defense rules S21 and S22 can be obtained, and these two rules correspond to fields z1 and z2 respectively. By comparing A1 and B3, three second target intrusion defense rules S31, S32, and S33 can be obtained, and these three rules correspond to fields z1, z2, and z3 respectively.

[0114] Furthermore, an intrusion defense strategy can be determined based on the first target intrusion defense rule and the second target intrusion defense rule obtained above. The specific determination method may include the following operations: for each difference field, determine the first target intrusion defense rule and the second target intrusion defense rule corresponding to the difference field. According to the total number of the first target intrusion defense rules and the second target intrusion defense rules corresponding to the difference field, determine the importance of the first target intrusion defense rule. According to each of the first target intrusion defense rules and the importance of the first target intrusion defense rule, obtain the intrusion defense strategy. The embodiment of the present application can generate a more accurate intrusion defense strategy by further determining the importance of the first target intrusion defense rule.

[0115] Taking the previous text as an example, for field z1, it corresponds to the first target rule S11 and the second target rules S21 and S31, and the total number of corresponding rules is 3; for field z2, it corresponds to the first target rule S12 and the second target rule S22, and the total number of corresponding rules is 2; for field z3, it corresponds to the first target rule S13 and the second target rules S23 and S33, and the total number of corresponding rules is 3. The embodiment of the present application considers that the importance of the first target rules S11 and S13 is higher than that of the first target rule S12.

[0116] Please refer to Figure 7 , which shows a flow chart of the service request processing method of the embodiment of the present application. By capturing both the traffic of normal service requests and the traffic of malicious service requests, the difference features of the traffic of these two service requests can be extracted, and then the intrusion defense strategy can be automatically determined. In other words, a service request processing method disclosed in the embodiment of the present application can automatically generate an intrusion defense strategy by comparing and analyzing the difference between the traffic of normal service requests and the traffic of malicious service requests. The generation process of the intrusion defense strategy no longer relies on manual experience, but is more scientific, standardized, rigorous and rapid. The generation process of the intrusion defense strategy can take into account various difference fields and not miss important difference features, thereby having a significant advantage of high quality. The effect of intrusion defense based on the determined intrusion defense strategy is also stable and controllable.

[0117] In one embodiment, the generated intrusion defense strategy can be further stored in a database in the active / standby mode. Of course, the active / standby mode database can also store various configuration information for automatically generating intrusion defense strategies or automatically performing intrusion defense based on certain intrusion defense strategies.

[0118] Please refer to Figure 8 , which shows a schematic diagram of the working principle of the database in the master-slave mode in this embodiment. Figure 8 Figure (a) shows the working mode of a database in master-slave mode under normal working conditions, where database A acts as the master database to carry all data reading and writing work, and database B acts as the backup database to synchronize data from database A and back up the data. Figure 8 Figure (b) shows the working mode of the database in the master-slave mode when the main database fails. Database A fails and cannot provide data read and write services to the outside world. The data read and write services are undertaken by database B, and the data synchronization between databases A and B is interrupted. Figure 8 Figure (c) shows the working mode of the database in the master-slave mode in the fault repair state. The fault of database A is repaired, but the role has been switched to the backup database, and the data will be synchronized and backed up from database B. At the same time, database B will take the role of the master database to read and write data. In the embodiment of the present application, the database in the master-slave mode can increase the stability of the execution of the business request processing method.

[0119] In one embodiment, the logs generated during the service request processing and the intrusion defense records generated by starting the above-mentioned intrusion defense strategy can also be stored in the form of logs to ensure that the determination process of the intrusion defense strategy and the specific intrusion defense process can be recorded for subsequent review. The administrator can regularly analyze the details of the strategy generation, review the strategy generation process, improve the strategy working logic, and enhance the strategy protection effect. In one embodiment, please refer to Fig. 9, which shows a schematic diagram of the log storage method in an embodiment of the present application. The above log can be stored in a log server, or a copy can be recorded locally on the device that generates the log.

[0120] In one embodiment, the logs can be divided into four levels: ERROR, WARN, INFO, and DEBUG. Among them, the ERROR log is the highest level error record, indicating that a serious failure has occurred, which directly leads to the inability to work normally. The ERROR log requires the administrator to pay special attention and solve it in time to ensure the normal operation of the business system. The WARN log is a low-level exception log, indicating that an abnormal process is triggered during the operation, but it does not affect the normal operation, and the business process of the next stage can be executed normally. The WARN log requires sufficient attention from the administrator, usually indicating that there is a certain risk in the operation of the system and the system may have an operational failure. The INFO log usually records key information and retains key operating data during normal operation. The administrator also needs to pay certain attention in daily operation and maintenance work. The DEBUG log is mainly a record of various detailed system information, which can play a debugging role, including parameter detailed information, debugging details related information, operation return information and other types of information.

[0121] The logs in the embodiments of the present application may include configuration logs, monitoring logs, alarm logs and operation logs, wherein the configuration logs are used to record the user's behavior of adding, deleting, and modifying configurations; the monitoring logs are used to record the operation behaviors of the monitoring module; the monitoring module can monitor business requests that attempt to access the application based on the intrusion prevention strategy; the alarm logs are used to record external alarm actions; and the operation logs are used to record the behaviors during the entire system background operation process involved in intrusion prevention.

[0122] Please refer to Fig.10 , which shows a block diagram of a service request processing device in this embodiment, the device includes:

[0123] The first service request message acquisition module 101 is used to acquire a first service request message, where the first service request message represents a normal service request sent from a packet issuing device to a service response device.

[0124] The second service request message acquisition module 102 is used to acquire a second service request message, where the second service request message represents a malicious service request sent by the packet issuing device to the service response device.

[0125] The difference extraction and processing module 103 is used to perform difference extraction and processing on the first service request message and the second service request message to obtain first difference data.

[0126] The intrusion defense strategy automatic generation module 104 is used to generate an intrusion defense strategy based on the first difference data, and the intrusion defense strategy is used to defend against the malicious service request in the website application-level intrusion defense system.

[0127] In one embodiment, the first difference data includes difference fields and associations between the difference fields, and the difference extraction and processing module is used to perform the following operations:

[0128] Compare the first service request message and the second service request message field by field to determine at least one difference field;

[0129] Determine the relationship between the difference fields.

[0130] In one embodiment, the intrusion prevention strategy includes an intrusion prevention rule for each of the difference fields, and the intrusion prevention strategy automatic generation module is used to perform the following operations:

[0131] Determine a target matching method, a target matching string, and a target detection variable for a first target difference field, wherein the first target difference field is any of the above difference fields;

[0132] Determine a target identifier of an intrusion prevention rule generated for the first target difference field;

[0133] A first target intrusion prevention rule for the first target difference field is generated according to the target matching mode, the target matching string, the target detection variable and the target identifier.

[0134] In one embodiment, the first target intrusion prevention rule further includes at least one of the following contents:

[0135] a target association rule identifier, where the target association rule identifier is an identifier of an intrusion prevention rule generated for a related field, and the related field is another difference field associated with the first target difference field;

[0136] a target priority, where the target priority is used to characterize the matching order of the first target intrusion prevention rule among the intrusion prevention rules in the intrusion prevention policy;

[0137] Target detection classification, the target detection classification represents the attack classification corresponding to the malicious service request;

[0138] Target harm level, the target harm level represents the harm degree of the attack corresponding to the malicious service request;

[0139] Target defense action, the target defense action represents the processing method of the malicious service request;

[0140] Target rule description, the target rule description represents the descriptive content of the target intrusion rule.

[0141] In one embodiment, the above device further includes a third service request message processing module, configured to perform the following operations:

[0142] Acquire at least one third service request message, where the third service request message represents a malicious service request of the same type as the second service request message and is sent by the packet issuing device to the service response device;

[0143] For each of the third service request messages, obtain second difference data between the third service request message and the first service request message, where the second difference data includes at least one second target difference field, and the second target difference field is any difference field in the second difference data;

[0144] Determine a second target intrusion prevention rule for each of the second difference fields;

[0145] The above-mentioned intrusion defense strategy automatic generation module is used to perform the following operations:

[0146] For each difference field, determining a first target intrusion prevention rule and a second target intrusion prevention rule corresponding to the difference field;

[0147] Determine the importance of the first target intrusion prevention rule according to the total number of the first target intrusion prevention rules and the second target intrusion prevention rules corresponding to the difference field;

[0148] The intrusion prevention strategy is obtained according to each of the first target intrusion prevention rules and the importance of the first target intrusion prevention rules.

[0149] In one embodiment, the normal service request includes N first service sub-requests, where N is a positive integer greater than or equal to 2, and the first service request message acquisition module is used to perform the following operations:

[0150] Obtaining a first first service sub-request message, wherein the first first service sub-request message represents a first first service sub-request sent by the packet issuing device to the service response device;

[0151] Obtaining an i-th first service sub-request message, where the i-th first service sub-request message represents an i-th first service sub-request sent by the packet issuing device to the service response device when the packet issuing device obtains a response from the service response device to the i-1-th first service sub-request message, wherein i is a positive integer greater than 1 and less than or equal to N;

[0152] The malicious service request includes the N second service sub-requests, and the obtaining of the second service request message includes:

[0153] Obtaining a first second service sub-request message, wherein the first second service sub-request message represents a first second service sub-request sent by the packet issuing device to the service response device;

[0154] Obtain the tth second business sub-request message, wherein the tth second business sub-request message represents the tth second business sub-request sent by the above-mentioned packet issuing device to the above-mentioned business response device when the above-mentioned packet issuing device obtains the response of the above-mentioned business response device to the t-1th second business sub-request message, wherein t is a positive integer greater than 1 and less than or equal to N.

[0155] In one embodiment, the above device further includes an environment configuration module, which is used to perform the following operations:

[0156] Obtaining a vulnerability environment for the malicious service request, where the vulnerability environment is provided by a container that communicates with the host machine based on a bridge mode;

[0157] The above-mentioned business response device is operated in the above-mentioned vulnerability environment.

[0158] In one embodiment, the above device further includes a record processing module, which is used to perform the following operations:

[0159] The intrusion prevention policy corresponding to the malicious service request is stored in the database in the active-standby mode;

[0160] The intrusion prevention strategy is started, an intrusion prevention record is generated, and the intrusion prevention record is stored in a log form.

[0161] Specifically, the service request processing device disclosed in the embodiment of the present application and the corresponding method embodiment described above are based on the same inventive concept. For details, please refer to the method embodiment, which will not be repeated here.

[0162] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above-mentioned service request processing method.

[0163] The embodiment of the present application further provides a computer-readable storage medium, which can store a plurality of instructions. The instructions can be suitable for being loaded by a processor and executing the service request processing method described in the embodiment of the present application.

[0164] Further, Fig.11 A schematic diagram of the hardware structure of a device for implementing the method provided in the embodiment of the present application is shown. The above device may participate in constituting or include the apparatus or system provided in the embodiment of the present application. Fig.11 As shown, the device 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Fig.11 The structure shown is for illustration only and does not limit the structure of the electronic device. Fig.11 More or fewer components as shown, or with Fig.11 Different configurations are shown.

[0165] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the device 10 (or mobile device). As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0166] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the above-mentioned method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned service request processing method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0167] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the device 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0168] The display may be, for example, a touch screen liquid crystal display (LCD) that may enable a user to interact with a user interface of device 10 (or mobile device).

[0169] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of the embodiments of the present application are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0170] Each embodiment in the embodiments of the present application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and server embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0171] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program. The above program may be stored in a computer-readable storage medium, and the above storage medium may be a read-only memory, a disk or an optical disk, etc.

[0172] The above is only a preferred embodiment of the embodiment of the present application and is not intended to limit the embodiment of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiment of the present application should be included in the protection scope of the embodiment of the present application.

Claims

1. A method for processing a business request, characterized in that: The method comprises: Acquire a first service request message, where the first service request message represents a normal service request sent by a packet issuing device to a service response device; Acquire a second service request message, where the second service request message represents a malicious service request sent by the packet issuing device to the service response device; Performing difference extraction processing on the first service request message and the second service request message to obtain first difference data, where the first difference data includes a difference field; generating an intrusion defense strategy based on the first difference data, wherein the intrusion defense strategy is used to defend against the malicious service request in the website application-level intrusion defense system; The intrusion prevention strategy includes an intrusion prevention rule for each of the difference fields, and the generating of the intrusion prevention strategy based on the first difference data includes: Determine a target matching mode, a target matching string, and a target detection variable for a first target difference field, wherein the first target difference field is any of the difference fields; Determining a target identifier of an intrusion prevention rule generated for the first target difference field; A first target intrusion prevention rule for the first target difference field is generated according to the target matching mode, the target matching string, the target detection variable and the target identifier.

2. The method according to claim 1, characterized in that The first difference data includes an association relationship between the difference fields, and the first difference data is obtained by performing difference extraction processing on the first service request message and the second service request message, including: Compare the first service request message and the second service request message field by field to determine at least one difference field; Determine the relationship between the difference fields.

3. The method according to claim 1, characterized in that The first difference data includes an association relationship between the difference fields, and the first target intrusion prevention rule also includes at least one of the following contents: a target association rule identifier, where the target association rule identifier is an identifier of an intrusion prevention rule generated for a related field, where the related field is another difference field associated with the first target difference field; a target priority, where the target priority is used to characterize the matching order of the first target intrusion prevention rule among the intrusion prevention rules in the intrusion prevention policy; A target detection classification, wherein the target detection classification represents an attack classification corresponding to the malicious service request; A target harm level, wherein the target harm level represents the harm degree of the attack corresponding to the malicious service request; a target defense action, wherein the target defense action represents a processing method for the malicious service request; A target rule description, wherein the target rule description represents descriptive content of the target intrusion rule.

4. The method according to claim 1 or 3, characterized in that: The method further comprises: Acquire at least one third service request message, where the third service request message represents a malicious service request of the same type as the second service request message and is sent by the packet issuing device to the service response device; For each of the third service request messages, obtain second difference data between the third service request message and the first service request message, where the second difference data includes at least one second target difference field, and the second target difference field is any difference field in the second difference data; determining a second target intrusion prevention rule for each of the second target difference fields; The generating of the intrusion prevention strategy based on the first difference data further includes: For each difference field, determining a first target intrusion prevention rule and a second target intrusion prevention rule corresponding to the difference field; Determine the importance of the first target intrusion prevention rule corresponding to the difference field according to the total number of the first target intrusion prevention rule and the second target intrusion prevention rule corresponding to the difference field; The intrusion prevention strategy is determined according to each of the first target intrusion prevention rules and the importance of the first target intrusion prevention rules.

5. The method according to claim 1, characterized in that The normal service request includes N first service sub-requests, where N is a positive integer greater than or equal to 2, and obtaining the first service request message includes: Acquire a first first service sub-request message, where the first first service sub-request message represents a first first service sub-request sent by the packet issuing device to the service response device; Obtaining an i-th first service sub-request message, wherein the i-th first service sub-request message represents an i-th first service sub-request sent by the packet issuing device to the service response device when the packet issuing device obtains a response of the service response device to the i-1-th first service sub-request message, wherein i is a positive integer greater than 1 and less than or equal to N; The malicious service request includes N second service sub-requests, and obtaining the second service request message includes: Acquire a first second service sub-request message, where the first second service sub-request message represents a first second service sub-request sent by the packet issuing device to the service response device; Obtain a t-th second service sub-request message, wherein the t-th second service sub-request message represents the t-th second service sub-request sent by the packet issuing device to the service response device when the packet issuing device obtains the response of the service response device to the t-1-th second service sub-request message, wherein t is a positive integer greater than 1 and less than or equal to N.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining a vulnerability environment for the malicious service request, where the vulnerability environment is provided by a container that communicates with a host machine based on a bridge mode; The service response device is operated in the vulnerability environment.

7. The method according to claim 1, characterized in that The method further comprises: Storing the intrusion prevention policy corresponding to the malicious service request in a database in a primary-backup mode; The intrusion prevention strategy is started, an intrusion prevention record is generated, and the intrusion prevention record is stored in a log form.

8. A service request processing device, characterized in that: The device comprises: A first service request message acquisition module, used to acquire a first service request message, wherein the first service request message represents a normal service request sent by a packet issuing device to a service response device; A second service request message acquisition module, used to acquire a second service request message, where the second service request message represents a malicious service request sent by the packet issuing device to the service response device; a difference extraction processing module, configured to perform difference extraction processing on the first service request message and the second service request message to obtain first difference data, wherein the first difference data includes a difference field; an intrusion defense strategy automatic generation module, configured to generate an intrusion defense strategy based on the first difference data, wherein the intrusion defense strategy is used to defend against the malicious service request in a website application-level intrusion defense system; The intrusion prevention strategy includes an intrusion prevention rule for each of the difference fields, and the generating of the intrusion prevention strategy based on the first difference data includes: Determine a target matching mode, a target matching string, and a target detection variable for a first target difference field, wherein the first target difference field is any of the difference fields; Determining a target identifier of an intrusion prevention rule generated for the first target difference field; A first target intrusion prevention rule for the first target difference field is generated according to the target matching mode, the target matching string, the target detection variable and the target identifier.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement a service request processing method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements a service request processing method as described in any one of claims 1 to 7 by executing the instructions stored in the memory.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, a service request processing method according to any one of claims 1 to 7 is implemented.

Images