Attack detection method and device, electronic equipment and computer readable storage medium

Abstract

The application provides an attack detection method and device, electronic equipment and a computer readable storage medium, and belongs to the computer field. The attack detection method comprises the following steps: first, obtaining an XML document to be detected; then, detecting external entities in the XML document based on a preset first detection rule to obtain a first detection result representing a probability of an XXE attack existing in the XML document; detecting the XML document based on a preset second detection rule to obtain a second detection result representing a probability of the XXE attack existing in the XML document; and finally, obtaining a target detection result based on the first detection result and the second detection result. The XML document is detected by two methods, and the final target detection result is obtained by comprehensively considering the two detection results, so that the target detection result is more accurate, and the false positive rate can be reduced, so that the reference of the external entity does not need to be limited, and the XXE attack can be prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to an attack detection method and device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] XXE (Extensible Markup Language eXternal Entity) is a common application vulnerability. Attackers can launch malicious requests to the server through the XXE vulnerability, such as command execution, reading server files, internal network scanning, DOS (Denial of Service), etc.

[0003] Currently, XXE vulnerabilities are usually prevented by limiting the reference of external entities, but this method not only disables XXE vulnerabilities, but also greatly affects the normal reference of external entities in XML documents, reducing the efficiency of data transmission using XML documents. SUMMARY

[0004] The present application provides an attack detection method and device, an electronic device and a computer readable storage medium to solve the problem that the existing method of preventing XXE attacks by limiting the reference of external entities reduces the efficiency of data transmission using XML documents.

[0005] In a first aspect, the present application provides an attack detection method, comprising: obtaining an XML document to be detected; detecting an external entity in the XML document based on a preset first detection rule to obtain a first detection result representing the probability of XXE attack in the XML document; detecting the XML document based on a preset second detection rule to obtain a second detection result representing the probability of XXE attack in the XML document; and obtaining a target detection result based on the first detection result and the second detection result.

[0006] In the present application, the XML document is detected by two methods, and the final target detection result is obtained by combining the two detection results, so that the target detection result is more accurate, and the false positive rate can be reduced, so that XXE attacks can be prevented without limiting the reference of external entities.

[0007] In combination with the technical solution of the above first aspect, in some possible implementation manners, the obtaining of the XML document to be detected comprises: obtaining a traffic data packet; and determining that the traffic data packet includes a preset key field, wherein the traffic data packet containing the preset key field is the XML document to be detected.

[0008] With the technical solution provided in the first aspect above, in some possible implementation manners, before the external entity in the XML document is detected based on the preset first detection rule, the method further includes: determining that the type of the external entity in the XML document is an entity type present in a preset white list.

[0009] In the embodiments of the present application, by determining whether the type of the external entity in the XML document is an entity type present in a preset white list, the XML document can be pre-detected, so that a part of XML documents with attacks can be quickly excluded. Meanwhile, the detection of the XML document from the dimension of the entity type is realized, so that the detection of the XML document is more comprehensive, and the accuracy of the final detection result is improved.

[0010] With the technical solution provided in the first aspect above, in some possible implementation manners, before the external entity in the XML document is detected based on the preset first detection rule, the method further includes: when the type of the external entity in the XML document is http or https, obtaining domain name information or a network address in the external entity; and determining that the domain name information or the network address does not exist in a preset malicious library, wherein the malicious library includes malicious domain names and malicious addresses.

[0011] In the embodiments of the present application, by detecting the domain name information or the network address included in the external entity of the type of http or https, the XML document related to the malicious domain name or the malicious address can be quickly excluded. Meanwhile, the detection of the XML document from the dimension of the domain name information or the network address is realized, so that the detection of the XML document is more comprehensive, and the accuracy of the final detection result is improved.

[0012] With the technical solution provided in the first aspect above, in some possible implementation manners, if the network address is included in the external entity, after it is determined that the domain name information or the network address does not exist in the preset malicious library, the method further includes: determining that the network address is not a private network address.

[0013] In the embodiments of the present application, the XML document in which the network address included in the external entity is a private network address can be further excluded, so that the fineness of the detection of the XML document from the dimension of the domain name information or the network address is further improved.

[0014] In some possible implementation manners of the first aspect, the detecting, based on the first detection rule, the external entities in the XML document to obtain a first detection result comprises: obtaining a name and a declaration of each of the external entities; determining, for the name of each of the external entities, a number of nested references in which the name of the external entity appears in the declaration of another external entity; and obtaining the first detection result based on the number of nested references corresponding to all the external entities and a preset correspondence between the number of nested references and a probability of attack.

[0015] In the embodiments of the present application, the greater the number of nested references in which each external entity appears in another external entity, the higher the probability of attack of the XML document. Therefore, the probability of XXE attack in the XML document can be accurately determined based on the correspondence between the number of nested references and the probability of attack.

[0016] In some possible implementation manners of the first aspect, the obtaining, based on the first detection result and the second detection result, of a target detection result comprises: performing weighted summation processing on the first detection result and the second detection result based on a preset weight value to obtain the target detection result.

[0017] In the embodiments of the present application, the target detection result is obtained by performing weighted summation processing on the first detection result and the second detection result, so that the target detection result sufficiently considers both detection manners, and the target detection result is more accurate.

[0018] In some possible implementation manners of the first aspect, the detecting, based on the second detection rule, of the XML document to obtain a second detection result representing a probability of XXE attack in the XML document comprises: performing vectorization processing on content included in the XML document to obtain a to-be-detected vector; and obtaining the second detection result based on the to-be-detected vector and a preset detection model.

[0019] In a second aspect, the present application provides an attack detection apparatus, comprising: an obtaining module, a first detection module, a second detection module, and a result generating module. The obtaining module is configured to obtain an XML document to be detected. The first detection module is configured to detect, based on a first detection rule, external entities in the XML document to obtain a first detection result representing a probability of XXE attack in the XML document. The second detection module is configured to detect, based on a second detection rule, the XML document to obtain a second detection result representing the probability of XXE attack in the XML document. The result generating module is configured to obtain, based on the first detection result and the second detection result, a target detection result.

[0020] In a third aspect, the embodiments of the present application further provide an electronic device, comprising: a memory and a processor, which are connected; the memory is used for storing programs; the processor is used for calling the programs stored in the memory to execute the method provided in the first aspect and / or any possible implementation manner of the first aspect.

[0021] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, and the computer program is run by a computer to execute the method provided in the first aspect and / or any possible implementation manner of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be considered as a limitation to the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0023] Figure 1 a flowchart of a first attack detection method shown in the embodiments of the present application;

[0024] Figure 2 a flowchart of a second attack detection method shown in the embodiments of the present application;

[0025] Figure 3 a structural block diagram of an attack detection device shown in the embodiments of the present application;

[0026] Figure 4 a structural block diagram of an electronic device shown in the embodiments of the present application. DETAILED DESCRIPTION

[0027] The technical solutions of the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0028] It should be noted that similar reference numerals and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, relational terms such as "first," "second," etc., in the description of this application are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0029] Furthermore, the term "and / or" in this application is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0030] The technical solution of this application will now be described in detail with reference to the accompanying drawings.

[0031] Given that existing methods of preventing XXE vulnerabilities by restricting references to external entities reduce the efficiency of data transmission using XML documents, the inventors, after careful consideration, proposed an attack detection method that combines two detection methods to detect XML documents. This method makes the attack detection results more accurate, thus eliminating the need to restrict references to external entities and preventing XXE attacks.

[0032] Please see Figure 1 , Figure 1 This is a flowchart illustrating an attack detection method according to an embodiment of this application. The following will be combined with... Figure 1 The steps involved are explained.

[0033] S100: Obtain the XML document to be inspected.

[0034] The XML document to be tested can be pre-fetched and stored in a local database, and can be directly called when needed. Alternatively, the XML document can be fetched in real time.

[0035] The manner of acquiring the XML document to be detected in real time can be: first acquiring a traffic data packet, then determining whether the traffic data packet includes a preset key field, if the traffic data packet includes the preset key field, the traffic data packet including the preset key field is the XML document to be detected. If the traffic data packet does not include the preset key field, it is determined that the traffic data packet is not the XML document to be detected.

[0036] In an implementation, the preset key field can be a field unique to the XML document, for example, can be an "xml version" field in the document declaration of the first line of the XML document. Since the document declaration format of the XML document is <?xml version="1.0" encoding="utf-8" standalone="no"? >, when the "xml version" field exists in the traffic data packet, it is determined that the traffic data packet is the XML document.

[0037] Further, the preset key field can include a field unique to an external entity in addition to the field unique to the XML document. Correspondingly, after detecting that the field unique to the XML document exists in the traffic data packet, it can be further detected whether the field unique to the external entity exists in the XML document. When the field unique to the external entity exists, it is considered that the traffic data packet is the XML document to be detected. If the field unique to the external entity does not exist, it is determined that the traffic data packet is not the XML document to be detected.

[0038] Since <!ENTITY entity-name SYSTEM "URI / URL" > is a fixed format of the external entity, the "ENTITY" field can be used as the field unique to the external entity. The field unique to the external entity is not limited to the above implementation.

[0039] In order to more comprehensively detect the XML document and quickly exclude a part of the XML documents with attacks before steps S200 and S300, in an implementation, it can be determined that the type of the external entity in the XML document is an entity type existing in a preset white list.

[0040] Optionally, when the type of the external entity in the XML document is not the entity type existing in the preset white list, it can be determined that the XML document has an attack.

[0041] The type of the external entity can be file, http, https, etc., and the specific type of the external entity is not limited here.

[0042] For the convenience of understanding, taking the example that the preset white list includes two entity types of http and https, if the external entity type in the XML document is file type, it is confirmed that the XML document has attack behavior. If the external entity type in the XML document is http, subsequent steps are continued. The example is only for the convenience of understanding, and should not be regarded as a limitation to the present application.

[0043] Optionally, since the XML document can include multiple external entities, the external entities of the XML document can be segmented according to the flex lexical tool used by the XML syntax engine, and multiple external entities are obtained. Then, the type of each external entity is respectively judged as the entity type existing in the preset white list.

[0044] For example, the xml object can be first created in flex, and the xml document is assigned to the object, and then the xml object is processed by the program language extension E4X, and finally multiple external entities are obtained. The example is only for the convenience of understanding, and should not be regarded as a limitation to the present application.

[0045] Taking the format of the xml data as <book> <test>Test< / test> < / book> For example, the xml data is first assigned to the variable var xml, at this time the var xml includes all the text content of the xml data. Then the tag <test>The corresponding content, namely, the external entity can be obtained. Herein, the example is only for the convenience of understanding, and the label corresponding to different entities can be different. Herein, the <test>The examples are made for the purpose of convenience only and should not be taken as limiting the application.

[0046] In one embodiment, if the type of the external entity in the XML document is http or https, the domain name information or network address (Internet Protocol Address, IP address) in the external entity can also be obtained, and then it is determined whether the domain name information or network address exists in the preset malicious library. If not, the subsequent steps are continued. If the domain name information or network address exists in the preset malicious library, it is confirmed that the XML document is attacked.

[0047] The way to obtain the domain name information or network address in the external entity can be that the URL information of the external entity is first obtained, and then the host value in the URL information is intercepted, which is the domain name information or network address. The URL information is the node and the corresponding value obtained after flex processing.

[0048] The malicious library can include malicious domain names and malicious network addresses. When it is determined whether the domain name information or network address exists in the preset malicious library, the domain name information or network address can be compared with each piece of data in the malicious library. If the comparison is successful, that is, there is the same data as the domain name information or network address, it is considered that the domain name information or network address exists in the preset malicious library. If the comparison fails, that is, there is no data same as the domain name information or network address, it is considered that the domain name information or network address does not exist in the preset malicious library.

[0049] In one embodiment, when the network address is included in the external entity, it can also be determined whether the network address is a private network address. If the network address is a private network address, it is confirmed that the XML document is attacked. If the network address is not a private network address, the subsequent steps are continued.

[0050] The way to determine whether the network address is a private network address is known to those skilled in the art, and will not be described here for briefness.

[0051] It can be understood that the network address in the external entity of the XML document to be detected can be directly determined after the XML document to be detected is obtained. If the network address exists, it is determined whether the network address is a private network address.

[0052] Alternatively, after obtaining the XML document to be detected, it is determined whether the type of the external entity in the XML document is http or https, and when the type of the external entity in the XML document is http or https, the network address in the external entity is obtained, and it is determined whether the network address exists in the preset malicious database. When the network address does not exist in the malicious database, it is determined whether the network address is a private network address.

[0053] S200: detecting the external entity in the XML document based on the preset first detection rule to obtain a first detection result representing the probability of existence of XXE attack in the XML document.

[0054] After obtaining the XML document to be detected, the entity in the XML document can be detected based on the preset first detection rule, and then the first detection result is obtained.

[0055] In an implementation, the specific implementation of detecting the external entity in the XML document based on the preset first detection rule to obtain the first detection result representing the probability of existence of XXE attack in the XML document can be: first, obtaining the name and declaration of each external entity, then for the name of each external entity, determining the number of nested references of the name of the external entity appearing in the declaration of other external entities, and finally, based on the number of nested references corresponding to all external entities and the preset corresponding relationship between the number of nested references and the probability of attack, obtaining the first detection result.

[0056] The fixed format of the external entity is <!ENTITY entity-name SYSTEM "URI / URL">, wherein the "entity-name SYSTEM" field corresponds to the name of the external entity, and the content in the double quotes after SYSTEM, that is, "URI / URL", is the declaration of the external entity.

[0057] For ease of understanding, the external entities are taken as <!ENTITY lo "lol">, <!ENTITY lol1 "&lo; &lo; &lo; &lo; "> and <!ENTITY lol2 "&lol1; &lol1; &lol1; &lol1; "> for example. Among them, the external entity "lo" appears in the declaration of the external entity "lol1", so the number of nested references corresponding to "lo" is 1. Similarly, the external entity "lol1" appears in the declaration of the external entity "lol2", so the number of nested references corresponding to "lol1" is 1; the external entity "lol2" does not appear in the declaration of other external entities, so the number of nested references corresponding to "lol2" is 0. In summary, the total number of nested references of the external entities in the XML document is 2.

[0058] The correspondence between the preset nested reference quantity and the attack probability can include N attack probabilities and N nested reference quantity ranges. Each nested reference quantity range and each attack probability correspond one-to-one, wherein the greater the value of the nested reference quantity range, the higher the corresponding attack probability. At this time, based on the corresponding nested reference quantity of all external entities and the preset correspondence between the nested reference quantity and the attack probability, the process of obtaining the first detection result can be: determining the target nested reference quantity range corresponding to the corresponding nested reference quantity of all external entities, and the attack probability corresponding to the target nested reference quantity range is the first detection result.

[0059] For ease of understanding, it is assumed that the preset correspondence between the nested reference quantity and the attack probability includes two attack probabilities of 0 and 1, and two nested reference quantity ranges of 0-3 and 4-+∞, and the attack probability 0 corresponds to the nested reference quantity range 0-3, and the attack probability 1 corresponds to the nested reference quantity range 4-+∞. If the sum of the corresponding nested reference quantities of all external entities is within the range of 0-3, the first detection result is 0; if the sum of the corresponding nested reference quantities of all external entities is within the range of 4-+∞, the first detection result is 1.

[0060] Further, it is assumed that the preset correspondence between the nested reference quantity and the attack probability includes three attack probabilities of 0, 0.5, and 1, and three nested reference quantity ranges of 0-3, 4-7, and 7-+∞, and the attack probability 0 corresponds to the nested reference quantity range 0-3, the attack probability 0.5 corresponds to the nested reference quantity range 4-7, and the attack probability 1 corresponds to the nested reference quantity range 7-+∞. If the sum of the corresponding nested reference quantities of all external entities is within the range of 0-3, the first detection result is 0; if the sum of the corresponding nested reference quantities of all external entities is within the range of 4-7, the first detection result is 0.5; if the sum of the corresponding nested reference quantities of all external entities is within the range of 7-+∞, the first detection result is 1.

[0061] The examples provided herein are for ease of understanding only and should not be construed as limiting the present application.

[0062] S300: detecting the XML document based on a preset second detection rule to obtain a second detection result representing a probability of XXE attack existing in the XML document.

[0063] After obtaining the XML document to be detected, the entities in the XML document can be detected based on the preset second detection rule, and then the second detection result is obtained.

[0064] In an implementation, the process of detecting the XML document based on the preset second detection rule to obtain a second detection result representing a probability of an XXE attack in the XML document can be: first, vectorizing the content included in the XML document to obtain a to-be-detected vector; and then, based on the to-be-detected vector and a preset detection model, obtaining the second detection result.

[0065] The vectorization of the content included in the XML document can be one-hot vectorization of the content included in the XML document.

[0066] Specifically, the XML document can be first tokenized, and then each word in the XML document can be vectorized by a bag-of-words model to obtain a vector matrix with text features.

[0067] The preset detection model is used to detect a probability of an attack in an input vector. The preset detection model can be pre-acquired and stored in a database, and can be directly called when needed. Alternatively, the preset detection model can be obtained by training.

[0068] In an implementation, the detection model can be obtained in the following manner: first, a training data set is acquired, wherein the training data set includes a plurality of XML documents labeled with whether an attack exists or not. Then, the initial detection model is trained by using the training data set to obtain the preset detection model.

[0069] In the training process, an XML document can be acquired from the training data set, and the XML document can be vectorized to obtain a first training vector. Then, the first training vector can be input into the initial detection model to obtain a first training detection result. The parameters of the initial detection model can be modified based on the gradient descent method, the first training detection result, and a first actual detection result. Then, an XML document can be acquired from the remaining XML documents in the training data set, and the XML document can be vectorized to obtain a second training vector. The second training vector can be input into the initial detection model with the modified parameters to obtain a second training detection result. The parameters of the initial detection model can be modified based on the gradient descent method, the second training detection result, and a second actual detection result, until the training detection result output by the initial detection model meets a preset requirement, or the initial detection model is trained for a preset number of times, to obtain a trained detection model.

[0070] The detection model can be a CNN model, and the number of iterations of the model can be set to 30,000. To prevent overfitting, the number of iterations needs to be adjusted constantly. The learning rate can be set to 0.1, 0.05, 0.01, or 0.005, and the stride can be set to 1 or 2. The convolution kernel of the model can be set to 3, and the sliding window can be set to 2.

[0071] The formula of the gradient descent method is where θ is a parameter vector, α is a learning rate, J(θ) is a cost function, i is a partial derivative of the cost function with respect to the parameter.

[0072] It should be noted that the above S200 and S300 steps do not have a fixed execution order, and can be executed simultaneously, or S200 can be executed first, then S300, or S300 can be executed first, then S200.

[0073] S400: Obtain a target detection result based on the first detection result and the second detection result.

[0074] After obtaining the first detection result and the second detection result, the target detection result can be obtained by combining the first detection result and the second detection result.

[0075] The target detection result can be the probability of an attack on the XML document, or the target detection result can also be a prompt message.

[0076] When the target detection result is the probability of an attack on the XML document, in one embodiment, a weight value can be preset, so that the first detection result and the second detection result can be weighted and summed based on the preset weight value to obtain the target detection result.

[0077] For example, the weight of the first detection result can be preset as 0.6, and the weight of the second detection result can be preset as 0.4, so that the target detection result = 0.6*first detection result + 0.4*second detection result. The specific implementation of the preset weight value is not limited to the above manner.

[0078] When the target detection result is also a prompt message, in one embodiment, the probability of an attack on the XML document can be calculated first, and then based on the probability of an attack on the XML document and the corresponding relationship between the probability of an attack on the XML document and the prompt message, the corresponding prompt message is output.

[0079] The calculation of the probability of an attack on the XML document is the same as the calculation of the probability of an attack on the XML document described above, and will not be described again here for brevity.

[0080] The corresponding relationship between the probability of an attack on the XML document and the prompt message can include a plurality of probability intervals and the prompt message corresponding to each probability interval.

[0081] ​For example, the probability interval of the XML document existing attack can be set as 0-0.2 to represent no risk, the probability interval of the XML document existing attack can be set as 0.2-0.4 to represent suspected XXE attack, and the probability interval of the XML document existing attack can be set as 0.4-1 to represent XXE attack. Correspondingly, when the probability of the XML document existing attack is 0.1, no risk is output; when the probability of the XML document existing attack is 0.3, suspected XXE attack is output; and when the probability of the XML document existing attack is 0.5, XXE attack is output. The examples are only for easy understanding and should not be regarded as a limitation to the present application.

[0082] For further understanding of the attack detection method described above, please refer to Figure 2 . It should be noted that Figure 2 the principle shown in FIG. 1 is one of numerous embodiments of the attack detection method of the present application, and therefore, the manner shown in FIG. 1 should not be understood as a limitation to the present application. Figure 2

[0083] As shown in FIG. 2, first, the traffic data packet is acquired, and then it is judged whether the traffic data packet includes a preset key field. If not, the traffic data packet is discarded. If the preset key field is included, it is determined that the traffic data packet including the preset key field is an XML document to be detected. Figure 2

[0084] Then, it is determined whether the type of the external entity in the XML document is an entity type existing in the preset whitelist. When the type of the external entity in the XML document is not an entity type existing in the preset whitelist, it can be determined that the XML document exists attack.

[0085] When the type of the external entity in the XML document is an entity type existing in the preset whitelist, it is judged whether the type of the external entity in the XML document is http or https. If the type of the external entity is not http or https, the external entity in the XML document is detected based on the preset first detection rule to obtain a first detection result representing the probability of the XML document existing XXE attack; and the XML document is detected based on the preset second detection rule to obtain a second detection result representing the probability of the XML document existing XXE attack.

[0086] If the type of the external entity is http or https, the domain name information or network address in the external entity is acquired, and then it is judged whether the domain name information or network address exists in the preset malicious library. If the domain name information or network address exists in the preset malicious library, it is confirmed that the XML document exists attack.

[0087] ​​If the domain name information or the network address does not exist in the preset malicious library and the network address is included in the external entity, it is determined whether the network address is a private network address. If the network address is a private network address, it is confirmed that the XML document exists attack.

[0088] If the network address is not a private network address, the external entity in the XML document is detected based on a preset first detection rule to obtain a first detection result representing a probability of existence of XXE attack in the XML document; and the XML document is detected based on a preset second detection rule to obtain a second detection result representing a probability of existence of XXE attack in the XML document.

[0089] Finally, the target detection result is obtained based on the first detection result and the second detection result.

[0090] Wherein, Figure 2 The specific implementation modes of each step shown in the foregoing are described in the foregoing, and will not be described here for brief description.

[0091] Based on the same inventive concept, the application also provides an attack detection device, as shown in the accompanying drawings. Figure 3 The attack detection device includes an acquisition module, a first detection module, a second detection module, and a result generation module.

[0092] The acquisition module is configured to acquire an XML document to be detected.

[0093] The first detection module is configured to detect an external entity in the XML document based on a preset first detection rule to obtain a first detection result representing a probability of existence of XXE attack in the XML document.

[0094] The second detection module is configured to detect the XML document based on a preset second detection rule to obtain a second detection result representing a probability of existence of XXE attack in the XML document.

[0095] The result generation module is configured to obtain a target detection result based on the first detection result and the second detection result.

[0096] The acquisition module is specifically configured to acquire a traffic data packet; and determine that the traffic data packet includes a preset key field, wherein the traffic data packet containing the preset key field is the XML document to be detected.

[0097] The attack detection device further includes a third detection module, and the third detection module is configured to determine that a type of the external entity in the XML document is an entity type existing in a preset white list.

[0098] The third detection module is further configured to, before detecting the external entity in the XML document based on the preset first detection rule, the method further includes: when a type of the external entity in the XML document is http or https, obtaining domain name information or a network address in the external entity; and determining that the domain name information or the network address does not exist in a preset malicious library, wherein the malicious library includes malicious domain names and malicious addresses.

[0099] The third detection module is further configured to, if the external entity includes the network address, after determining that the domain name information or the network address does not exist in the preset malicious library, the method further includes: determining that the network address is not a private network address.

[0100] The first detection module is specifically configured to: obtain a name and a declaration of each external entity; for the name of each external entity, determine a number of nested references in which the name of the external entity appears in the declarations of other external entities; and based on a correspondence between the number of nested references corresponding to all external entities and a preset correspondence between a number of nested references and an attack probability, obtain the first detection result.

[0101] The result generation module is specifically configured to: perform weighted summation processing on the first detection result and the second detection result based on a preset weight value, and obtain the target detection result.

[0102] The second detection module is specifically configured to: perform vectorization processing on content included in the XML document, and obtain a to-be-detected vector; and based on the to-be-detected vector and a preset detection model, obtain the second detection result.

[0103] The attack detection apparatus 100 provided in the embodiments of the present application has the same implementation principle and technical effects as the attack detection method embodiments, and for brevity of description, the part not mentioned in the apparatus embodiment can refer to the corresponding content in the attack detection method embodiments.

[0104] Please refer to Figure 4 The electronic device 200 provided in the embodiments of the present application. The electronic device 200 includes: a transceiver 210, a memory 220, a communication bus 230, and a processor 240.

[0105] The transceiver 210, the memory 220, and the processor 240 are directly or indirectly electrically connected to each other to realize data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses 230 or signal lines. Among them, the transceiver 210 is used for transceiving data. The memory 220 is used for storing computer programs, such as storing Figure 3 The software function module shown in the middle is the attack detection apparatus 100. The attack detection apparatus 100 includes at least one software function module stored in the memory 220 in the form of software or firmware or solidified in an operating system (OS) of the electronic device 200. The processor 240 is configured to execute the executable modules stored in the memory 220, such as the software function module or computer program included in the attack detection apparatus 100. At this time, the processor 240 is configured to obtain an XML document to be detected; detect external entities in the XML document based on a preset first detection rule to obtain a first detection result representing a probability of an XXE attack existing in the XML document; detect the XML document based on a preset second detection rule to obtain a second detection result representing a probability of the XXE attack existing in the XML document; and obtain a target detection result based on the first detection result and the second detection result.

[0106] The memory 220 can be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0107] The processor 240 can be an integrated circuit chip with a processing capability of signals. The processor described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The processor can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application. The general-purpose processor can be a microprocessor or the processor 240 can also be any conventional processor or the like.

[0108] The electronic device 200 includes, but is not limited to, a personal computer, a server, and the like.

[0109] The embodiment of the present application further provides a nonvolatile computer readable storage medium (hereinafter referred to as a storage medium) having a computer program stored thereon, and the computer program is run by a computer such as the electronic device 200 to execute the attack detection method shown above. The computer readable storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various storage medium capable of storing program codes.

[0110] The above merely provides preferred embodiments of the present application but should not be used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, and the like within the spirit and principle of the present application shall be included in the protection scope of the present application.< / test> < / test>

Claims

1. An attack detection method characterized by, The method comprises the following steps: obtaining an XML document to be detected; detecting external entities in the XML document based on a preset first detection rule to obtain a first detection result representing a probability of an XXE attack in the XML document; detecting the XML document based on a preset second detection rule to obtain a second detection result representing a probability of an XXE attack in the XML document; obtaining a target detection result based on the first detection result and the second detection result; wherein the detection of the external entities in the XML document based on the preset first detection rule to obtain the first detection result comprises: obtaining the name and declaration of each external entity; determining, for the name of each external entity, the number of nested references of the name of the external entity appearing in the declaration of other external entities; and obtaining the first detection result based on the number of nested references corresponding to all external entities and a preset correspondence between the number of nested references and the probability of an attack. The detection of the XML document based on the preset second detection rule to obtain the second detection result representing the probability of an XXE attack in the XML document comprises: vectorizing the content included in the XML document to obtain a detection vector; and obtaining the second detection result based on the detection vector and a preset detection model.

2. The method of claim 1, wherein, The method further comprises the following steps before the detection of the external entities in the XML document based on the preset first detection rule: determining that the type of the external entities in the XML document is an entity type present in a preset white list. The method further comprises the following steps before the detection of the external entities in the XML document based on the preset first detection rule:

3. The method of claim 1, wherein, when the type of the external entities in the XML document is http or https, obtaining domain name information or a network address in the external entities; determining that the domain name information or the network address does not exist in a preset malicious library, wherein the malicious library includes malicious domain names and malicious addresses.

4. The method of claim 1, wherein, If the external entities include a network address, the method further comprises the following steps after determining that the domain name information or the network address does not exist in the preset malicious library: determining that the network address is not a private network address. The method further comprises the following steps of obtaining the target detection result based on the first detection result and the second detection result:

5. The method of claim 4, wherein, performing weighted summation processing on the first detection result and the second detection result based on a preset weight value to obtain the target detection result. The method comprises the following steps:

6. The method of claim 1, wherein, an obtaining module configured to obtain an XML document to be detected; a first detection module configured to detect external entities in the XML document based on a preset first detection rule to obtain a first detection result representing a probability of an XXE attack in the XML document; 7. An attack detection apparatus characterized by comprising: ​ ​ ​ The second detection module is configured to detect the XML document based on a preset second detection rule to obtain a second detection result representing a probability of an XXE attack existing in the XML document. The result generation module is configured to obtain a target detection result based on the first detection result and the second detection result. The first detection module is specifically configured to acquire the name and declaration of each external entity, determine, for each external entity name, a number of nested references in which the name of the external entity appears in the declaration of another external entity, and obtain the first detection result based on the number of nested references corresponding to all external entities and a preset correspondence between the number of nested references and the probability of an attack. The second detection module is specifically configured to perform vectorization processing on content included in the XML document to obtain a to-be-detected vector, and obtain the second detection result based on the to-be-detected vector and a preset detection model.

8. An electronic device, comprising: comprising: a memory and a processor, the memory and the processor being connected; the memory is configured to store a program; the processor calls the program stored in the memory to execute the method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, a computer program is stored thereon, and the computer program is executed by a computer to perform the method of any one of claims 1-6.

Images