Website application security protection method, device and equipment and storage medium

Abstract

The application provides a security protection method, device and equipment for a website application and a storage medium. The method comprises the following steps: obtaining request service data sent by a user from a background log system, wherein the request service data contains a request header field; performing risk identification on the request service data according to the request header field, and judging whether the request service data contains bypassing behavior of a protection system; and if the request service data contains bypassing behavior of the protection system, performing alarm interception processing on the request service data. Based on the method, whether the request service data contains bypassing behavior of the protection system is judged through the request header field, so that the problem that WAF is bypassed and cannot help the platform to defend against malicious attacks through WAF in the prior art can be solved.

Description

Technical Field

[0001] This application relates to the field of security protection technology, and in particular to a security protection method, device, equipment and storage medium for website applications. Background Technology

[0002] Web Application Firewall (WAF), also known as a website application-level intrusion prevention system, protects web systems from application-layer attacks. Unlike traditional hardware firewalls that handle network-layer attacks, WAFs operate at the application layer, allowing for more accurate acquisition of business request content and easier attack signature matching, thus enabling the identification of attack behaviors. Currently, existing WAFs are susceptible to being bypassed, preventing them from effectively defending platforms against malicious attacks. Summary of the Invention

[0003] In view of this, embodiments of this application provide a method, apparatus, device, and storage medium for the security protection of website applications, aiming to solve the problem in the prior art where WAFs can be bypassed, making it impossible to use WAFs to help the platform defend against malicious attacks.

[0004] The first aspect of this application provides a security protection method for a website application, comprising: obtaining user-sent request service data from a background log system, wherein the request service data includes a request header field; performing risk identification on the request service data based on the request header field to determine whether the request service data involves behavior that bypasses the protection system; and if such behavior exists, performing alarm interception processing on the request service data.

[0005] In conjunction with the first aspect, in a first possible implementation of the first aspect, the step of risk identification of the requested service data based on the request header field and determining whether the requested service data involves behavior that bypasses the protection system includes: performing address information segmentation processing on the request header field to obtain several address information; sorting each address information according to its position in the request header field to obtain a sorting corresponding to each address information; identifying the device attribute corresponding to each address information; and determining whether the requested service data involves behavior that bypasses the protection system based on the sorting corresponding to each address information and the device attribute.

[0006] In conjunction with the first possible implementation of the first aspect, in the second possible implementation of the first aspect, before the step of identifying the device attributes corresponding to each address information and determining whether the requested service data has bypassed the protection system based on the sorting and device attributes corresponding to each address information, the method further includes: determining whether the number of address information in the request header field is less than three; if the number of address information is less than three, then directly determining that the requested service data has bypassed the protection system; if the number of address information is greater than or equal to three, then identifying the device attributes corresponding to each address information and determining whether the requested service data has bypassed the protection system based on the sorting and device attributes corresponding to each address information.

[0007] In conjunction with the second possible implementation of the first aspect, in the third possible implementation of the first aspect, the step of identifying the device attribute corresponding to each address information and determining whether the requested service data has bypassed the protection system based on the order and device attribute corresponding to each address information includes: if the number of address information is equal to three, then based on the order and device attribute corresponding to each address information, obtaining the first device attribute corresponding to the first-ranked address information; based on the first device attribute, determining whether the device corresponding to the first-ranked address information is a user terminal device; if it is not a user terminal device, then determining that the requested service data has bypassed the protection system.

[0008] In conjunction with the second possible implementation of the first aspect, in the fourth possible implementation of the first aspect, the step of identifying the device attribute corresponding to each address information and determining whether the requested service data has behavior that bypasses the protection system based on the order and device attribute corresponding to each address information includes: if the number of address information is greater than three, then according to the order and device attribute corresponding to each address information, obtaining the second device attribute corresponding to the second-ranked address information; based on the second device attribute, determining whether the device corresponding to the second-ranked address information is a protection system device; if it is not a protection system device, then determining that the requested service data has behavior that bypasses the protection system.

[0009] In conjunction with the fourth possible implementation of the first aspect, the fifth possible implementation of the first aspect, after the step of determining whether the device corresponding to the second ranked address information is a protection system device based on the second device attribute, further includes: if the device corresponding to the second ranked address information is a protection system device, obtaining the third device attribute corresponding to the third ranked address information; determining whether the device corresponding to the third ranked address information is a routing device based on the third device attribute; if it is not a routing device, initiating a manual verification mechanism for manual verification and obtaining the manual verification result; and determining whether the requested service data involves behavior that bypasses the protection system based on the manual verification result.

[0010] A second aspect of this application provides a security protection device for a website application, comprising: an acquisition module, configured to acquire user-sent request service data from a background log system, the request service data including a request header field; an identification module, configured to identify risks in the request service data based on the request header field, and determine whether the request service data involves behavior that bypasses the protection system; and a processing module, configured to perform alarm interception processing on the request service data if behavior that bypasses the protection system exists.

[0011] In conjunction with the second aspect, in the first possible implementation of the second aspect, the identification module includes: a segmentation submodule, used to perform address information segmentation processing on the request header field to obtain several address information; a sorting submodule, used to sort according to the position of each address information in the request header field to obtain the sorting corresponding to each address information; and a judgment submodule, used to identify the device attribute corresponding to each address information, and determine whether the request service data has behavior that bypasses the protection system based on the sorting corresponding to each address information and the device attribute.

[0012] A third aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the electronic device, wherein the processor executes the computer program to implement the steps of the security protection method for website applications provided in the first aspect.

[0013] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the security protection method for website applications provided in the first aspect.

[0014] The security protection method, apparatus, electronic device, and storage medium for website applications provided in this application have the following beneficial effects:

[0015] This application obtains user-sent service request data from a backend log system. This service request data includes request header fields. Based on these header fields, the application performs risk identification on the service request data to determine if it involves actions that bypass the protection system. If such actions are found, the application triggers an alarm and intercepts the service request data. This method, which uses request header fields to determine if service request data involves actions that bypass the protection system, solves the problem in existing technologies where WAFs can be bypassed, preventing platforms from effectively defending against malicious attacks. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart illustrating the implementation of a security protection method for a website application provided in this application embodiment;

[0018] Figure 2 A flowchart of a method for risk identification of requested service data in a website application security protection method provided in this application embodiment;

[0019] Figure 3 A flowchart of the first method for determining whether requested service data exhibits behavior that bypasses the protection system in the security protection method for website applications provided in this application embodiment;

[0020] Figure 4 Flowchart of the first method for determining whether requested service data exhibits behavior that bypasses the protection system in the security protection method for website applications provided in this application embodiment;

[0021] Figure 5 Flowchart of the second method for determining whether requested service data exhibits behavior that bypasses the protection system in the security protection method for website applications provided in this application embodiment;

[0022] Figure 6 A flowchart of the second method for determining whether requested service data has behavior that bypasses the protection system in the security protection method for website applications provided in this application embodiment;

[0023] Figure 7 A basic structural block diagram of a security protection device for a website application provided in this application embodiment;

[0024] Figure 8A detailed structural block diagram of a security protection device for website applications provided in this application embodiment;

[0025] Figure 9 This is a basic structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0027] Please see Figure 1 , Figure 1 A flowchart illustrating the implementation of a website application security protection method provided in this application embodiment is shown below. Details are as follows:

[0028] S11: Obtain the user-sent request service data from the background log system. The request service data includes request header fields.

[0029] In this embodiment, the user accesses the website by sending service request data. After successful access, the user enters the website service backend and stores the service request data in the backend log system for processing. In this embodiment, the request header field (X-Forwarded-For, abbreviated as XFF) refers to the HTTP request header field used to identify the original IP address of the client connecting to the web server through an HTTP proxy or load balancer.

[0030] S12: Based on the request header fields, perform risk identification on the request service data to determine whether the request service data involves behavior that bypasses the protection system.

[0031] In this embodiment, for normal service request data, the request header field sequentially contains three address information: the user terminal's IP address, the Web Application Protection System's IP address, and the router's IP address. When the service request data involves actions that bypass the protection system, the request header field will be missing the Web Application Protection System's IP address or the Web Application Protection System's IP address will be in the wrong position. In this embodiment, when identifying risks in the service request data based on the request header field, it can be determined whether the service request data is normal by checking the IP address contained in the request header field. If the Web Application Protection System's IP address is missing or the Web Application Protection System's IP address is in the wrong position, it can be determined that the service request data involves actions that bypass the protection system.

[0032] S13: If there is any behavior that bypasses the protection system, then the requested service data will be intercepted with an alarm.

[0033] In this embodiment, normal service request data must first be protected by the Web Application Protection System (WAS). Service request data that is not protected by the WAS is considered an attempt to bypass the protection system. When service request data is protected by the WAS, the IP address of the WAS will be generated in the request header field of the service request data. In this embodiment, when it is determined that the service request data is attempting to bypass the protection system, it indicates that the user sending the service request data is engaging in malicious behavior. At this time, the service request data can be intercepted by issuing an alarm. The alarm can be sent to the user with an alert message indicating that the request is illegal, and the interception can be stopped from performing subsequent operations such as data processing and feedback based on the service request data in the background.

[0034] As can be seen from the above, the website application security protection method provided in this application obtains user-sent request service data from the backend log system. This request service data includes request header fields. Based on the request header fields, the request service data is risk-identified to determine whether it involves actions that bypass the protection system. If such actions exist, the request service data is intercepted with an alarm. Based on this method, determining whether request service data involves actions that bypass the protection system through request header fields can solve the problem in existing technologies where WAFs can be bypassed, making it impossible to use WAFs to help the platform defend against malicious attacks.

[0035] In some embodiments of this application, please refer to Figure 2 , Figure 2 This application provides a method for risk identification of requested service data in its website application security protection method. Details are as follows:

[0036] S21: Perform address information segmentation processing on the request header field to obtain several address information;

[0037] S22: Sort each address information according to its position in the request header field to obtain the sorting corresponding to each address information;

[0038] S23: Identify the device attributes corresponding to each address information, and determine whether the requested service data has any behavior that bypasses the protection system based on the sorting and device attributes corresponding to each address information.

[0039] In this embodiment, the request header field contains multiple address information, such as IP addresses. Each address is separated by a comma and a space. Starting from the left, the first address is the original client's address. Following the first address, multiple layers of proxies can be added from left to right. The IP address of the device corresponding to each layer of proxies is sequentially appended to the right of the first address. In this embodiment, the request header field can be segmented based on the positions of the commas and spaces, resulting in several address information entries. By sorting each address according to its position in the request header field, a sorting order can be obtained for each address, with each address corresponding to a sorting number. For each address, the corresponding device attribute is identified. This device attribute determines which device the address belongs to. After obtaining the sequence number and corresponding device attributes for each address, it's possible to determine whether a Web Application Protection System (WAS) IP address exists and whether its position in the request header field is correct. This helps determine if the requested service data involves attempts to bypass the WAS. If a WAS IP address does not exist and / or its position in the request header field is incorrect, it can be concluded that the requested service data involves attempts to bypass the WAS.

[0040] In some embodiments of this application, please refer to Figure 3 , Figure 3 The flowchart illustrates the first method for determining whether requested service data exhibits behavior that bypasses the protection system, within the website application security protection method provided in this application embodiment. Details are as follows:

[0041] S31: Determine whether the number of address information in the request header field is less than three;

[0042] S32: If the number of address information is less than three, it is directly determined that the requested service data has the behavior of bypassing the protection system;

[0043] S33: If the number of address information is greater than or equal to three, then identify the device attribute corresponding to each address information, and determine whether the requested service data has the behavior of bypassing the protection system based on the sorting and device attribute corresponding to each address information.

[0044] In this embodiment, when a user bypasses the protection system, they may use the address information of the user's terminal device and / or forge the address information of the protection system device to avoid detection. For normal service request data, the request header field contains three address information in sequence: the user's terminal IP address, the Web Application Protection System IP address, and the router IP address. Therefore, in this embodiment, it can be determined whether the number of address information in the request header field is less than three. If it is a direct bypass without forging address information, the request header field only contains the user's terminal IP address and the router IP address. Therefore, if the number of address information is less than three, the request service data is directly judged as bypassing the protection system. If it is a normal access or bypassing and forging address information, the request header field may contain the user's terminal IP address, the Web Application Protection System IP address, and the router IP address, or it may contain the user's terminal IP address, a forged user's terminal IP address, a forged Web Application Protection System IP address, and the router IP address, etc. Therefore, if the number of address information is greater than or equal to three, it is possible to identify the device attributes corresponding to each address information, and further determine whether the requested service data has bypassed the protection system based on the order and device attributes corresponding to each address information.

[0045] In some embodiments of this application, please refer to Figure 4 , Figure 4 The flowchart illustrates the first method for determining whether requested service data exhibits behavior that bypasses the protection system, within the website application security protection method provided in this application embodiment. Details are as follows:

[0046] S41: If the number of address information is equal to three, then according to the sorting and device attributes corresponding to each address information, obtain the first device attribute corresponding to the address information with the first sorting.

[0047] S42: Based on the first device attribute, determine whether the device corresponding to the address information ranked first is a user terminal device. If it is not a user terminal device, determine that the requested service data has the behavior of bypassing the protection system.

[0048] In this embodiment, when the number of address information is three, it can be a normal access scenario, where the three address information in the request header field are, in order: the user terminal's IP address, the Web Application Protection System's IP address, and the router's IP address; or it can be a scenario where the protection system is bypassed and the Web Application Protection System's IP address is forged, i.e., the Web Application Protection System's IP address, the user terminal's IP address, and the router's IP address. Therefore, in this embodiment, the first device attribute corresponding to the first-ranked address information can be obtained based on the sorting and device attributes corresponding to each address information. Then, based on the first device attribute, it is determined whether the device corresponding to the first-ranked address information is the user terminal device. If it is not the user terminal device, it is determined that the requested service data involves behavior that bypasses the protection system.

[0049] In some embodiments of this application, please refer to Figure 5 , Figure 5 The flowchart illustrates a second method for determining whether requested service data exhibits behavior that bypasses the protection system, within the website application security protection method provided in this application embodiment. Details are as follows:

[0050] S51: If the number of address information is greater than three, then according to the sorting and device attributes corresponding to each address information, obtain the second device attribute corresponding to the second sorted address information;

[0051] S52: Based on the second device attribute, determine whether the device corresponding to the address information ranked second is a protection system device. If it is not a protection system device, determine that the requested service data has the behavior of bypassing the protection system.

[0052] In this embodiment, when the number of address information is greater than three, the address information contained in the request header field is generally the IP address of the user terminal, the IP address of the Web application protection system, the IP address of the user terminal, and the IP address of the router. Therefore, in this embodiment, the second device attribute corresponding to the second-ranked address information can be obtained based on the sorting and device attributes corresponding to each address information. Then, based on the second device attribute, it is determined whether the device corresponding to the second-ranked address information is a protection system device. If it is not a protection system device, it is directly determined that the requested service data involves behavior that bypasses the protection system.

[0053] In some embodiments of this application, please refer to Figure 6 , Figure 6 The flowchart illustrates a second method for determining whether requested service data exhibits behavior that bypasses the protection system, within the website application security protection method provided in this application embodiment. Details are as follows:

[0054] S61: If the device corresponding to the second-ranked address information is a protection system device, obtain the third device attribute corresponding to the third-ranked address information.

[0055] S62: Based on the third device attribute, determine whether the device corresponding to the third address information is a routing device. If it is not a routing device, start the manual verification mechanism to perform manual verification and obtain the manual verification result.

[0056] S63: Based on the manual verification results, determine whether the requested service data involves any behavior that bypasses the protection system.

[0057] In this embodiment, when the number of address information is greater than three, the address information contained in the request header field can be the IP address of the user terminal, the IP address of the Web application protection system, the IP address of the user terminal, or the IP address of the router. In this embodiment, it can first be determined whether the device corresponding to the second-ranked address information is a protection system device. If it is a protection system device, the third device attribute corresponding to the third-ranked address information can be further obtained. Then, based on the third device attribute, it can be determined whether the device corresponding to the third-ranked address information is a routing device. If it is a routing device, it is directly allowed to pass, and the backend performs subsequent operations such as data processing and processing result feedback based on the request service data. If it is not a routing device, a manual verification mechanism is initiated to perform manual verification and obtain the manual verification result. Then, based on the manual verification result, it is determined whether the request service data has bypassed the protection system. Wherein, if the manual verification result determines that the request service data has bypassed the protection system, the request service data can be alarmed and intercepted; if the manual verification result determines that the request service data has not bypassed the protection system, the backend can perform subsequent operations such as data processing and processing result feedback based on the request service data.

[0058] It is understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0059] In some embodiments of this application, please refer to Figure 7 , Figure 7 This is a basic structural block diagram of a security protection device for a website application provided in this application embodiment. In this embodiment, the device includes units used to perform the steps in the above method embodiments. Please refer to the relevant descriptions in the above method embodiments for details. For ease of explanation, only the parts relevant to this embodiment are shown. Figure 7As shown, the security protection device for the website application includes: an acquisition module 71, an identification module 72, and a processing module 73. Specifically: the acquisition module is used to acquire user-sent request service data from the backend log system, the request service data containing request header fields; the identification module is used to perform risk identification on the request service data based on the request header fields, determining whether the request service data contains any behavior that bypasses the protection system; and the processing module is used to perform alarm interception processing on the request service data if any behavior that bypasses the protection system is found.

[0060] In some embodiments of this application, please refer to Figure 8 , Figure 8 This is a detailed structural block diagram of a security protection device for website applications provided in an embodiment of this application. For example... Figure 8 As shown, in the security protection device for website applications, the identification module 72 may further include: a segmentation submodule 81, a sorting submodule 82, and a judgment submodule 83. The segmentation submodule 81 is used to segment the request header field to obtain several address information entries. The sorting submodule 82 is used to sort the address information entries according to their positions in the request header field, obtaining a sorting order for each address information entry. The judgment submodule 83 is used to identify the device attributes corresponding to each address information entry, and based on the sorting order and device attributes, determine whether the requested service data exhibits behavior that bypasses the protection system.

[0061] It should be understood that the security protection devices of the aforementioned website applications correspond one-to-one with the security protection methods of the aforementioned website applications, and will not be elaborated here.

[0062] In some embodiments of this application, please refer to Figure 9 , Figure 9 This is a basic structural block diagram of an electronic device provided in an embodiment of this application. Figure 9 As shown, the electronic device 9 of this embodiment includes: a processor 91, a memory 92, and a computer program 93 stored in the memory 92 and executable on the processor 91, such as a program for a website application security protection method. When the processor 91 executes the computer program 93, it implements the steps in the various embodiments of the website application security protection methods described above. Alternatively, when the processor 91 executes the computer program 93, it implements the functions of each module in the embodiments corresponding to the website application security protection device described above. Please refer to the relevant descriptions in the embodiments for details, which will not be repeated here.

[0063] For example, the computer program 93 can be divided into one or more modules (units), which are stored in the memory 92 and executed by the processor 91 to complete this application. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 93 in the electronic device 9. For example, the computer program 93 can be divided into an acquisition module, an identification module, and a processing module, with the specific functions of each module as described above.

[0064] The electronic device may include, but is not limited to, a processor 91 and a memory 92. Those skilled in the art will understand that... Figure 9 This is merely an example of electronic device 9 and does not constitute a limitation on electronic device 9. It may include more or fewer components than shown, or combine certain components, or different components. For example, the electronic device may also include input / output devices, network access devices, buses, etc.

[0065] The processor 91 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0066] The memory 92 can be an internal storage unit of the electronic device 9, such as a hard disk or memory. The memory 92 can also be an external storage device of the electronic device 9, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the memory 92 can include both internal and external storage units of the electronic device 9. The memory 92 is used to store the computer program and other programs and data required by the electronic device. The memory 92 can also be used to temporarily store data that has been output or will be output.

[0067] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0068] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above. In this embodiment, the computer-readable storage medium can be either non-volatile or volatile.

[0069] This application provides a computer program product that, when run on a mobile terminal, enables the mobile terminal to implement the steps described in the above-described method embodiments.

[0070] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0071] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0072] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0073] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A security protection method for a website application, characterized by, The method comprises the following steps: obtaining user-sent request service data from a background log system, wherein the request service data comprises a request header field; performing risk identification on the request service data according to the request header field to determine whether the request service data has bypassed the protection system, comprising: performing address information segmentation processing on the request header field to obtain a plurality of address information; sorting each address information in the plurality of address information according to its position in the request header field to obtain the sorting of each address information; identifying the device attribute corresponding to each address information, and determining whether the request service data has bypassed the protection system according to the sorting and device attribute of each address information; if the request service data has bypassed the protection system, performing alarm interception processing on the request service data; wherein, before the step of identifying the device attribute corresponding to each address information, and determining whether the request service data has bypassed the protection system according to the sorting and device attribute of each address information, the method further comprises: determining whether the number of address information in the request header field is less than three; if the number of address information is less than three, directly determining that the request service data has bypassed the protection system; if the number of address information is greater than or equal to three, identifying the device attribute corresponding to each address information, and determining whether the request service data has bypassed the protection system according to the sorting and device attribute of each address information.

2. The security protection method for website application according to claim 1, characterized in that, The step of identifying the device attribute corresponding to each address information, and determining whether the request service data has bypassed the protection system according to the sorting and device attribute of each address information, comprises: if the number of address information is equal to three, obtaining the first device attribute corresponding to the address information with the first sorting according to the sorting and device attribute of each address information; determining whether the device corresponding to the address information with the first sorting is a user terminal device according to the first device attribute, and if not, determining that the request service data has bypassed the protection system.

3. The security protection method for website application according to claim 1, characterized in that, The step of identifying the device attribute corresponding to each address information, and determining whether the request service data has bypassed the protection system according to the sorting and device attribute of each address information, comprises: if the number of address information is greater than three, obtaining the second device attribute corresponding to the address information with the second sorting according to the sorting and device attribute of each address information; determining whether the device corresponding to the address information with the second sorting is a protection system device according to the second device attribute, and if not, determining that the request service data has bypassed the protection system.

4. The security protection method for website application according to claim 3, characterized in that, After the step of determining whether the device corresponding to the address information with the second sorting is a protection system device according to the second device attribute, the method further comprises: if the device corresponding to the address information with the third sorting is a protection system device, obtaining the third device attribute corresponding to the address information with the third sorting. According to the third device attribute, it is judged whether the device corresponding to the third ranked address information is a routing device, and if not, an artificial verification mechanism is started to perform artificial verification to obtain an artificial verification result; According to the artificial verification result, it is determined whether the request service data exists bypassing the protection system behavior.

5. A security device for a website application, characterized in that Comprise: The acquisition module is used for acquiring the request service data sent by the user from the background log system, and the request service data contains a request header field; The identification module is used for identifying the risk of the request service data according to the request header field, and judging whether the request service data exists bypassing the protection system behavior, comprising: The segmentation submodule is used for performing address information segmentation processing on the request header field to obtain a plurality of address information; The sorting submodule is used for sorting each address information in the plurality of address information according to the position of each address information in the request header field to obtain the sorting corresponding to each address information; The judgment submodule is used for identifying the device attribute corresponding to each address information, and judging whether the request service data exists bypassing the protection system behavior according to the sorting and the device attribute corresponding to each address information; The processing module is used for performing alarm interception processing on the request service data if the bypassing protection system behavior exists. Wherein, before the step of identifying the device attribute corresponding to each address information, judging whether the request service data exists bypassing the protection system behavior according to the sorting and the device attribute corresponding to each address information, the device is specifically used for judging whether the number of address information in the request header field is less than three; if the number of address information is less than three, it is directly judged that the request service data exists bypassing the protection system behavior; if the number of address information is greater than or equal to three, the device attribute corresponding to each address information is identified, and whether the request service data exists bypassing the protection system behavior is judged according to the sorting and the device attribute corresponding to each address information.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the steps of the method in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 6. The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 4.

Images