An interface attack detection method and device, electronic equipment and storage medium

Abstract

This application provides an interface attack detection method, apparatus, electronic device, and storage medium. The method includes: collecting original request data; the original request data includes original request parameters and original return parameters; the original request parameters include original pagination data; performing comparative analysis on the original request parameters and original return parameters, and determining the interface to be detected from the interfaces corresponding to the original request data based on the analysis results; generating a payload request based on the original request data corresponding to the interface to be detected; wherein the first pagination data included in the payload request is different from the original pagination data; and determining whether an attack exists on the interface to be detected based on the original request data and the payload request corresponding to the interface to be detected. By analyzing the interface components, the security risks of the interface can be predicted in advance, improving the detection coverage, reducing the input of human resources, and improving the accuracy and efficiency of interface attack detection results.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to an interface attack detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the development of information technology, while we enjoy the convenience it brings, security vulnerabilities in the online world also exist constantly and can launch attacks at any time. CC (Challenge Collapsar) is a typical example of such an attack, which malicious actors can use to compromise servers, affecting the availability of information systems and causing significant impact on service operators and users. Current attack detection methods include manual testing and code auditing, but the effectiveness of these methods is highly dependent on the experience and skills of the personnel involved, thus the accuracy and efficiency of the detection results cannot be guaranteed. Summary of the Invention

[0003] The purpose of this invention is to provide an interface attack detection method, device, electronic device, and storage medium. By performing in-depth analysis of interface data, the invention reduces labor costs and improves detection accuracy and efficiency while ensuring the accuracy of detection results.

[0004] In a first aspect, embodiments of this application provide an interface attack detection method, comprising: collecting original request data; the original request data includes original request parameters and original return parameters; the original request parameters include original pagination data; performing comparative analysis on the original request parameters and original return parameters, and determining the interface to be detected from the interfaces corresponding to the original request data based on the analysis results; generating a payload request based on the original request data corresponding to the interface to be detected; wherein the first pagination data included in the payload request is different from the original pagination data; and determining whether an attack exists on the interface to be detected based on the original request data and the payload request corresponding to the interface to be detected.

[0005] In the above implementation process, paginated queries are used to compare and analyze the original request parameters and original return parameters. Interfaces to be detected are identified from those corresponding to the original request data; these interfaces are those with potential CC attack risks. The components of the interfaces are analyzed to predict their security risks. Finally, by constructing a payload request, the accuracy and efficiency of attack detection results are improved.

[0006] Optionally, in this embodiment, the original request parameters and the original return parameters are compared and analyzed, and the interface to be tested is determined from the interface corresponding to the original request data based on the analysis results. This includes: modifying the value of the original request parameters and receiving the modified original return parameters corresponding to the modified original request parameters; determining the correspondence between the original request parameters and the original return parameters based on the modified original request parameters and the modified original return parameters; and determining the interface to be tested from the interface corresponding to the original request data based on the correspondence between the original request parameters and the original return parameters.

[0007] In the above implementation process, by modifying the values ​​of the original request parameters, the modified original return parameters corresponding to the modified original request parameters are received and compared with them to determine whether the original return parameters are affected by the original request parameters. If affected, the interface corresponding to the original request data has a vulnerability and is designated as an interface to be tested. By conducting in-depth analysis of the interface components, the security risks of the interface can be predicted, thereby improving the accuracy of the interface attack detection method.

[0008] Optionally, in this embodiment, the payload request includes a first payload request and a second payload request; the first payload request includes a first request parameter and a first return parameter; the second payload includes a second request parameter and a second return parameter; determining whether an attack exists on the interface to be detected based on the original request data and payload request corresponding to the interface to be detected includes: judging whether the return parameter value of the interface to be detected is affected by the request parameter value according to the original request parameter, the original return parameter, the first request parameter, the first return parameter, the second request parameter, and the second return parameter; if it is determined that the return parameter value of the interface to be detected is affected by the request parameter value, and the interface to be detected passes the interface verification, then the interface to be detected is attacked.

[0009] In the above implementation process, two payload requests are constructed based on the interface to be detected. The two payload requests, along with the original request data, are used to determine whether the returned parameter values ​​of the interface to be detected are affected by the request parameter values. Furthermore, based on these three request data sets, it is possible to accurately determine which returned parameter is affected by the request parameter. By precisely customizing the payload requests used for attack detection, the number of payload requests is reduced while ensuring coverage of risk points, thereby improving detection accuracy and efficiency.

[0010] Optionally, in this embodiment of the application, determining whether the return parameter value of the interface to be tested is affected by the request parameter value based on the original request parameter, the original return parameter, the first request parameter, the first return parameter, the second request parameter, and the second return parameter includes: if the value of the original pagination data in the original request parameter is consistent with the length of the original return parameter, and the value of the first pagination data in the first request parameter is consistent with the length of the first return parameter, and the value of the second pagination data in the second request parameter is consistent with the length of the second return parameter, then it is determined that the return parameter value of the interface to be tested is affected by the request parameter value.

[0011] In the above implementation process, by using the original request data and the two constructed payload data, it is possible to accurately determine which return parameter is affected by the request parameter, thereby improving the accuracy and efficiency of detection while ensuring coverage of risk points.

[0012] Optionally, in this embodiment, if it is determined that the returned parameter value of the interface to be detected is affected by the requested parameter value, and the interface to be detected passes the interface verification, then the interface to be detected is attacked. This includes: obtaining detection pagination data according to a preset pagination threshold, wherein the detection pagination data is greater than the preset pagination threshold; generating a detection payload request based on the detection pagination data; determining whether the detection returned parameter value of the detection payload request is consistent with the detection pagination data; if so, the interface to be detected passes the interface verification, and it is determined that the interface to be detected is attacked.

[0013] In the above implementation process, after determining the affected return parameter values, a detection payload request is constructed to detect whether a CC attack exists on the interface to be detected, thereby reducing the false alarm rate of attack detection, improving detection accuracy, and enhancing the security of the interface.

[0014] Optionally, in this embodiment, generating a payload request based on the original request data corresponding to the interface to be detected includes: modifying the original pagination data in the original request data corresponding to the interface to be detected to obtain first pagination data and second pagination data; wherein the first pagination data and the second pagination data are inconsistent; generating a first payload request based on the first pagination data; and generating a second payload request based on the second pagination data.

[0015] In the above implementation process, by constructing two payload requests, the number of payload requests is reduced while ensuring coverage of risk points, thus saving computing power and improving detection efficiency.

[0016] Optionally, in this embodiment of the application, after collecting the original request data, the method further includes: formatting the interface corresponding to the original request data to obtain a formatted interface; the formatted interface includes interface key elements; normalizing the interface according to the interface key elements to obtain a normalized interface; determining the interface to be detected from the interfaces corresponding to the original request data, including: determining the interface to be detected from the normalized interfaces.

[0017] In the above implementation process, by formatting and normalizing the interface, redundant scanning and detection are avoided, ensuring full detection coverage while reducing resource waste, saving computing power, and improving detection efficiency.

[0018] Optionally, in this embodiment of the application, before comparing and analyzing the original request parameters and the original return parameters, the method further includes: obtaining the interface corresponding to the original request data; configuring the authentication field of the interface; obtaining the authentication information of the interface through the authentication field, and storing the authentication information in the interface authentication pool; the interface authentication pool is used to retrieve the authentication information corresponding to the interface when the interface authentication fails, so that the interface that failed authentication can pass the authentication.

[0019] In the above implementation process, by configuring the specified authentication field on the interface corresponding to the original request data, the authentication information of the interface is obtained and stored in the interface authentication pool. This allows the interface to pass the verification when the interface authentication fails, thus ensuring the success rate of the interface detection.

[0020] Optionally, in this embodiment of the application, after generating a payload request based on the original request data corresponding to the interface to be detected, the method further includes: adding preset key parameters to the request header parameters of the original request data and the payload request respectively; the preset key parameters are used to identify the original request data and the payload request for attack detection.

[0021] In the above implementation process, both the original request data and the constructed payload request are colored. That is, preset key parameters are added to the request header parameters to determine whether the request is for security detection based on the preset key parameters, and to locate the corresponding request when an error occurs based on the preset key parameters.

[0022] Secondly, embodiments of this application also provide an interface attack detection device, comprising: a collection module for collecting original request data; the original request data includes original request parameters and original return parameters; the original request parameters include original pagination data; a comparison and analysis module for comparing and analyzing the original request parameters and original return parameters, and determining the interface to be detected from the interfaces corresponding to the original request data based on the analysis results; a request construction module for generating a payload request based on the original request data corresponding to the interface to be detected; wherein the first pagination data included in the payload request is different from the original pagination data; and an attack determination module for determining whether an attack exists on the interface to be detected based on the original request data and the payload request corresponding to the interface to be detected.

[0023] Thirdly, embodiments of this application also provide an electronic device, including: a processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method described above.

[0024] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the methods described above.

[0025] This application utilizes the interface attack detection method, apparatus, electronic device, and storage medium provided to analyze and compare original request parameters and original return parameters. It identifies the interfaces to be detected from those corresponding to the original request data, identifying interfaces potentially vulnerable to attack. The method analyzes interface components and predicts interface security risks, improving the accuracy and efficiency of attack detection results. Both original request data and constructed payload requests are colored; when an error occurs, the corresponding request is located based on preset key parameters, resolving the data location issue. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 A flowchart illustrating an interface attack detection method provided in an embodiment of this application;

[0028] Figure 2 The diagram shown is a request data collection illustration of an embodiment of this application;

[0029] Figure 3This is a schematic diagram of the interface attack detection device provided in the embodiments of this application;

[0030] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this application.

[0033] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0034] Before describing the interface attack detection method, apparatus, electronic device and storage medium provided in this application, the concepts involved in the embodiments of this application will be briefly described first.

[0035] Paging is a memory management technique in operating systems that allows a computer's main memory to access data stored in secondary storage. The operating system partitions the data in secondary storage (usually a disk) into fixed-size blocks called "pages".

[0036] CC attack: Attackers use proxy servers to generate legitimate requests directed to the victim host, achieving DDoS attacks and impersonation; this is called CC (Challenge Collapsar). CC attacks are primarily used to attack web pages. CC attacks target web services at OSI layer 7, where attackers meticulously mimic normal user web page request behavior. They are easy to launch, difficult to filter, and extremely prone to exhausting the target server's resources, rendering it unable to provide service.

[0037] In business systems, pagination is a common function. If the backend system does not impose a maximum limit on the page size, the cost of a CC attack will be greatly reduced. In extreme cases, a single request can produce the effect of a CC attack, causing the service to become unavailable.

[0038] Existing countermeasures against CC attacks are primarily based on passive defense. Compared to other network attacks, CC attacks lack typical attack characteristics, rendering common protective measures largely ineffective. Therefore, this application provides an interface attack detection method that reduces labor costs and improves detection effectiveness while ensuring the accuracy of detection results.

[0039] Please see Figure 1 The illustration shows a flowchart of an interface attack detection method provided in an embodiment of this application. The interface attack detection method provided in this application can be applied to electronic devices, which may include a terminal and a server; wherein the terminal may specifically be a smartphone, tablet computer, computer, personal digital assistant (PDA), etc.; the server may specifically be an application server or a web server. The interface attack detection method may include the following steps:

[0040] Step S110: Collect raw request data; the raw request data includes raw request parameters and raw return parameters; the raw request parameters include raw pagination data.

[0041] Raw request data is collected through the original interfaces, which can be any interface in a system capable of receiving user requests. The raw request data can be the raw web request data from all users, i.e., real-time traffic data during web application runtime. This effectively ensures interface coverage. Methods for collecting raw request data include traffic mirroring technology. Traffic mirroring provides traffic collection services that can filter traffic within a specified range according to different filtering conditions, copy network traffic, and forward it to a specified network.

[0042] Each original request data includes corresponding original request parameters and original return parameters. The original request parameters are the original pagination data, and may also include request headers, request parameters, and request body. The original return parameters may include the response body.

[0043] Step S120: Compare and analyze the original request parameters and the original return parameters, and determine the interface to be tested from the interfaces corresponding to the original request data based on the analysis results.

[0044] By using paginated queries, the original request parameters and original return parameters in the original request data are compared and analyzed. Specifically, by changing the value of the original request parameter, the changes in the corresponding original return parameter after each change are recorded, thus obtaining the analysis results. The analysis results show the correspondence between the original request parameters and the original return parameters. If the correspondence indicates that the original request parameters can control the original return parameters, it is preliminarily determined that the original request data can control the resource consumption in business processing, such as CPU resources, memory resources, and cache resources. Therefore, the interface corresponding to the original request data is identified as the interface to be tested, and the interface to be tested is an interface with potential attack risks.

[0045] Step S130: Generate a payload request based on the original request data corresponding to the interface to be detected; wherein the first pagination data contained in the payload request is different from the original pagination data.

[0046] The payload request is a request for data transmission. In the field of computer science and technology, the payload is the actual information to be transmitted in data transmission, also known as the actual data or data body. Usually, the payload is the data that is useful to the receiver or of interest to the receiver. In this embodiment of the application, the payload is the payload data used for attack detection.

[0047] In the specific implementation process, a corresponding payload request is constructed for the identified interface to be detected. By combining the payload request and the original request data, it is determined which return value in the original return parameters is affected by the original request parameters, and it can be further determined whether the interface to be detected is subject to a CC attack.

[0048] The specific steps for constructing the payload request corresponding to the interface to be tested are as follows: For example, modify the original pagination data in the original request data corresponding to the interface to be tested. Based on the modified original pagination data, use the interface to be tested to generate a payload request. The payload request is a request with a vulnerability detection payload. The modified original pagination data is the first pagination data of the payload request, and the first pagination data is inconsistent with the original pagination data.

[0049] It is understandable that there can be at least one payload request, or two or more. If there are two or more, the paging data for each payload request is different from the original paging data, and the paging data between different payload requests is also different.

[0050] Step S140: Based on the original request data and payload request corresponding to the interface to be detected, determine whether the interface to be detected is attacked.

[0051] Based on the correspondence between the original request parameters and the original return parameters in the original request data corresponding to the interface to be detected, and the correspondence between the request parameters and the return parameters in the payload request, the original return parameters affected by the original request parameters are determined. After determining the controlled return values ​​in the original return parameters, a detection payload request can be reconstructed, and the presence of a CC attack on the interface to be detected can be determined by detecting the payload request.

[0052] In the above implementation process, paginated queries are used to compare and analyze the original request parameters and original return parameters. The interfaces to be detected are identified from the interfaces corresponding to the original request data; these interfaces are those potentially vulnerable to CC attacks. The interface components are analyzed to predict the security risks of the interfaces. Then, by constructing a payload request, the interfaces vulnerable to attacks are located, improving the accuracy and efficiency of attack detection results.

[0053] Optionally, in this embodiment, the original request parameters and the original return parameters are compared and analyzed, and the interface to be tested is determined from the interface corresponding to the original request data based on the analysis results. This includes: modifying the value of the original request parameters and receiving the modified original return parameters corresponding to the modified original request parameters; determining the correspondence between the original request parameters and the original return parameters based on the modified original request parameters and the modified original return parameters; and determining the interface to be tested from the interface corresponding to the original request data based on the correspondence between the original request parameters and the original return parameters.

[0054] In the specific implementation process: The original pagination data in the original request parameters is modified; the modified original return parameters corresponding to the modified original request parameters are received; and a comparative analysis is performed on each set of modified original request parameters and modified original return parameters to determine the correspondence between them. For example, analysis shows that the modified original request parameter `request_body.pageSize` has a value of 10, and the length of the modified original return parameter `response_body.data.list` is also 10.

[0055] It can be preliminarily determined that the value of request_body.pageSize in the original request parameters can control the length of the returned parameter response_body.data.list. The value of request_body.pageSize and the length of the returned parameter response_body.data.list have a corresponding relationship. Therefore, the interface corresponding to the original request data is identified as the interface to be tested.

[0056] In the above implementation process, by modifying the values ​​of the original request parameters, the modified original return parameters corresponding to the modified original request parameters are received and compared with them to determine whether the original return parameters are affected by the original request parameters. If affected, the interface corresponding to the original request data has a vulnerability and is designated as an interface to be tested. By conducting in-depth analysis of the interface components, the security risks of the interface can be predicted, thereby improving the accuracy of the interface attack detection method.

[0057] Optionally, in this embodiment, the payload request includes a first payload request and a second payload request; the first payload request includes a first request parameter and a first return parameter; the second payload includes a second request parameter and a second return parameter; determining whether an attack exists on the interface to be detected based on the original request data and payload request corresponding to the interface to be detected includes: judging whether the return parameter value of the interface to be detected is affected by the request parameter value according to the original request parameter, the original return parameter, the first request parameter, the first return parameter, the second request parameter, and the second return parameter; if it is determined that the return parameter value of the interface to be detected is affected by the request parameter value, and the interface to be detected passes the interface verification, then the interface to be detected is attacked.

[0058] In the specific implementation process: the payload request includes a first payload request and a second payload request. The pagination data of the first payload request and the second payload request are different, and each payload request includes request parameters and return parameters.

[0059] Based on the original request data, the request parameters and return parameters corresponding to the first and second payloads, it can be determined whether the return parameter value of the interface under test is affected by the request parameter value. Furthermore, based on these three request data, it is possible to accurately determine which return parameter is affected by the request parameter. After determining the affected return parameter value, a CC attack detection request is constructed to determine if the interface under test passes interface verification. If the interface passes interface verification, it is considered that a CC attack surface exists on the interface under test.

[0060] Determining whether the return parameter value of the interface to be tested is affected by the request parameter value includes: if the value of the original pagination data in the original request parameter has the same length as the original return parameter, and the value of the first pagination data in the first request parameter has the same length as the first return parameter, and the value of the second pagination data in the second request parameter has the same length as the second return parameter, then it is determined that the return parameter value of the interface to be tested is affected by the request parameter value.

[0061] For example, if the value of the original pagination data in the original request parameters is request_body.pageSize = 10, the length of the original return parameter response_body.data.list is also 10; if the value of the first pagination data in the first request parameters is request_body.pageSize = 1, the length of the first return parameter response_body.data.list is also 1; if the value of the second pagination data in the second request parameters is request_body.pageSize = 3, the length of the second return parameter response_body.data.list is also 3; then it can be determined that the value of request_body.pageSize and the length of response_body.data.list correspond, the return parameter value of the interface to be tested is affected by the request parameter value, and the affected return parameter is the length of response_body.data.list.

[0062] In the above implementation process, two payload requests are constructed based on the interface to be detected. The two payload requests, along with the original request data, are used to determine whether the returned parameter values ​​of the interface to be detected are affected by the request parameter values. Furthermore, based on these three request data sets, it is possible to accurately determine which returned parameter is affected by the request parameter. By precisely customizing the payload requests used for attack detection, the number of payload requests is minimized while ensuring coverage of risk points, thereby improving detection accuracy and efficiency.

[0063] Optionally, in this embodiment, if it is determined that the returned parameter value of the interface to be detected is affected by the requested parameter value, and the interface to be detected passes the interface verification, then the interface to be detected is attacked. This includes: obtaining detection pagination data according to a preset pagination threshold, wherein the detection pagination data is greater than the preset pagination threshold; generating a detection payload request based on the detection pagination data; determining whether the detection returned parameter value of the detection payload request is consistent with the detection pagination data; if so, the interface to be detected passes the interface verification, and it is determined that the interface to be detected is attacked.

[0064] In the specific implementation process: After determining the affected return parameter values, it is necessary to construct a detection payload request again, that is, a detection payload request. The detection payload request is used to determine whether a CC attack exists on the interface to be detected.

[0065] The detection pagination data for the payload request exceeds a preset pagination threshold. The preset pagination threshold can be a maximum reference value, which can be configured according to requirements. For example, if the preset pagination threshold is 100, the detection pagination data for the payload request can be set to 110, and the payload request is generated based on the detection pagination data.

[0066] The system determines whether the detection return parameter value of the detection payload request is consistent with the detection paging data. The detection return parameter value is the affected return parameter value determined in the above embodiment. If the detection return parameter value is consistent with the detection paging data, it is determined that a CC attack exists on the interface to be detected. If they are inconsistent, it is determined that no CC attack exists on the interface to be detected.

[0067] In the above implementation process, after determining the affected return parameter values, a detection payload request is constructed to detect whether a CC attack exists on the interface to be detected, thereby reducing the false alarm rate of attack detection, improving detection accuracy, and enhancing the security of the interface.

[0068] Optionally, in this embodiment, generating a payload request based on the original request data corresponding to the interface to be detected includes: modifying the original pagination data in the original request data corresponding to the interface to be detected to obtain first pagination data and second pagination data; wherein the first pagination data and the second pagination data are inconsistent; generating a first payload request based on the first pagination data; and generating a second payload request based on the second pagination data.

[0069] As an optional implementation, this application embodiment adopts the "three-gun positioning method", that is, by using two pre-constructed payload requests and the original request data, the return value affected by the input parameters is determined. The two pre-constructed payload requests can be a first payload request and a second payload request.

[0070] The payload request construction process is as follows: Modify the original pagination data in the original request data corresponding to the interface to be tested. For example, if the original pagination data request_body.pageSize = 10, we can determine that the first pagination data pageSize = 1 and the second pagination data pageSize = 3; construct a first payload request with the first pagination data pageSize = 1 and a second payload request with the second pagination data pageSize = 3. Other request parameters in the first and second payload requests can be the same as those in the original request data.

[0071] It is understood that the first page data and the second page data are determined according to actual needs. The first page data can also be 3 or other values, and the second page data can be 5 or other values, etc. This application embodiment does not limit this.

[0072] In the above implementation process, by constructing two payload requests, the number of payload requests is reduced while ensuring coverage of risk points, thereby improving detection accuracy and efficiency.

[0073] Optionally, in this embodiment of the application, after collecting the original request data, the method further includes: formatting the interface corresponding to the original request data to obtain a formatted interface; the formatted interface includes interface key elements; normalizing the interface according to the interface key elements to obtain a normalized interface; determining the interface to be detected from the interfaces corresponding to the original request data, including: determining the interface to be detected from the normalized interfaces.

[0074] Please see Figure 2 The diagram shown illustrates the request data collection of an embodiment of this application.

[0075] In the specific implementation process: the client sends the original request data to the Nginx server. The Nginx server includes a traffic mirroring module, which is used to copy the original request data. By configuring the Nginx server, the original request data can be copied to a dedicated traffic collection and processing module in real time.

[0076] After collecting the raw request data, the corresponding interface data is placed into the Kafka message queue. The formatting module consumes Kafka messages and performs uniform formatting processing on the interface. This formatting process, using a unified standard, reduces the complexity of the interface data structure, facilitating front-end calls to the interface.

[0077] Because the traffic data is very large, with hundreds of thousands of URLs (Uniform Resource Locator) every day, and most of them are duplicates, it is necessary to normalize the interface data in order to avoid doing repetitive scanning and detection work.

[0078] A web interface can include the following key elements: PROTOCOL: the protocol adopted by the interface; DOMAIN: the domain name of the interface; PATH: the request path of the interface; PARAM: the request parameters of the interface (the parameter part in the URL); BODY: the request body of the interface; METHOD: the request method. After obtaining the interface data corresponding to the original request data, the interface data is classified according to the above key elements, and interfaces with the same key elements are grouped into a unified interface. As one implementation method, after obtaining the interface data corresponding to the original request data, a digest algorithm is used to calculate the key elements in the interface data to generate a normalized value for the interface, and interfaces with the same normalized value are grouped together.

[0079] The following is an example. The first interface uses the HTTP protocol; the domain name of the interface is www.abc.com; the request path of the interface is / api / list; the request parameter of the interface is appKey; the request body of the interface consists of name and age; and the request method is POST. The digest algorithm used is the MD5 message digest algorithm, so the normalized value of this first interface is MD5(http.www.abc.com / api / listappkeynameagepost).

[0080] Once the second interface is obtained, its normalized value is calculated. If the normalized value of the second interface is the same as that of the first interface (MD5(http: / / www.abc.com / api / listappkeynameagepost)), then the first and second interfaces can be classified into the same category, thus achieving interface normalization.

[0081] In an optional embodiment, if the request path elements of the interface are irregular, such as the URL path containing sequence codes, pure numbers, tags, or Chinese characters, regular expressions can be used to transform the request path elements for this type of interface, and the interfaces after the path elements are transformed can be classified into one category.

[0082] In the above implementation process, by formatting and normalizing the interface, repetitive scanning and detection work is avoided, ensuring full detection coverage while reducing resource waste, saving computing power, and improving detection efficiency.

[0083] Optionally, in this embodiment of the application, before comparing and analyzing the original request parameters and the original return parameters, the method further includes: obtaining the interface corresponding to the original request data; configuring the authentication field of the interface; obtaining the authentication information of the interface through the authentication field, and storing the authentication information in the interface authentication pool; the interface authentication pool is used to retrieve the authentication information corresponding to the interface when the interface authentication fails, so that the interface that failed authentication can pass the authentication.

[0084] In the specific implementation process: In order to ensure the success rate of interface detection, the authentication type of the interface will be accurately identified and the authentication information of the interface will be obtained. When the original request authentication information is invalid, the corresponding authentication information of the interface will be pulled through the interface authentication pool so that the invalid interface can be authenticated.

[0085] Users configure specific authentication fields for the interface corresponding to the original request data. For example, when configuring the interface for the abc.com service, there are two authentication fields: the cookie field in the request_header and the token field in the request_body.

[0086] After obtaining the authentication fields of the configured interface, the system automatically "picks up" several corresponding authentication information entries from the real-time traffic based on these fields. This yields the authentication information for the interface corresponding to the requested data, including the configured authentication fields. The obtained authentication information is stored in the interface authentication pool. In subsequent cases where an interface experiences authentication failure or invalidation, the authentication information is retrieved from the pool to enable successful authentication and allow the interface to continue testing.

[0087] In the above implementation process, by configuring the specified authentication field on the interface corresponding to the original request data, the authentication information of the interface is obtained and stored in the interface authentication pool. This allows the interface to pass the verification when the interface authentication fails, thus ensuring the success rate of the interface detection.

[0088] Optionally, in this embodiment of the application, after generating a payload request based on the original request data corresponding to the interface to be detected, the method further includes: adding preset key parameters to the request header parameters of the original request data and the payload request respectively; the preset key parameters are used to identify the original request data and the payload request for attack detection.

[0089] In the specific implementation process: the original request data and the payload request are colored separately. That is, preset key parameters are added to the request header parameters of the original request data and the payload request respectively. The preset key parameters can include interface identification information, such as "scan-request-id-security". The preset key parameters are used to identify the original request data and payload request for attack detection. The original request data and payload request for attack detection can be located directly according to the preset parameters, and the business side can determine whether it is the original request data or payload request for security detection according to the preset key parameters.

[0090] In the above implementation process, both the original request data and the constructed payload request are colored. That is, preset key parameters are added to the request header parameters to determine whether the request is for security detection based on the preset key parameters, and to locate the corresponding request when an error occurs based on the preset key parameters.

[0091] Please see Figure 3 The diagram shown is a structural schematic of the interface attack detection device provided in an embodiment of this application; this application provides an interface attack detection device 200, including:

[0092] The acquisition module 210 is used to acquire raw request data; the raw request data includes raw request parameters and raw return parameters; the raw request parameters include raw pagination data.

[0093] The comparative analysis module 220 is used to compare and analyze the original request parameters and the original return parameters, and to determine the interface to be tested from the interface corresponding to the original request data based on the analysis results.

[0094] The request construction module 230 is used to generate a payload request based on the original request data corresponding to the interface to be detected; wherein the first pagination data contained in the payload request is different from the original pagination data.

[0095] The attack detection module 240 is used to determine whether an attack exists on the interface to be detected based on the original request data and payload request corresponding to the interface to be detected.

[0096] Optionally, in this embodiment of the application, the interface attack detection device, the comparison and analysis module 220, is specifically used to modify the value of the original request parameter and receive the modified original return parameter corresponding to the modified original request parameter; based on the modified original request parameter and the modified original return parameter, determine the correspondence between the original request parameter and the original return parameter; and determine the interface to be detected from the interface corresponding to the original request data according to the correspondence between the original request parameter and the original return parameter.

[0097] Optionally, in this embodiment, the payload request includes a first payload request and a second payload request; the first payload request includes a first request parameter and a first return parameter; the second payload includes a second request parameter and a second return parameter; the interface attack detection device includes an attack determination module 240, specifically used to determine whether the return parameter value of the interface to be detected is affected by the request parameter value based on the original request parameter, the original return parameter, the first request parameter, the first return parameter, the second request parameter, and the second return parameter; if it is determined that the return parameter value of the interface to be detected is affected by the request parameter value, and the interface to be detected passes the interface verification, then the interface to be detected is under attack.

[0098] Optionally, in this embodiment of the application, the interface attack detection device, the attack determination module 240, is further configured to determine that the return parameter value of the interface to be detected is affected by the request parameter value if the value of the original pagination data in the original request parameter is consistent with the length of the original return parameter, and the value of the first pagination data in the first request parameter is consistent with the length of the first return parameter, and the value of the second pagination data in the second request parameter is consistent with the length of the second return parameter.

[0099] Optionally, in this embodiment of the application, the interface attack detection device, the attack determination module 240, is further configured to obtain detection paging data according to a preset paging threshold, wherein the detection paging data is greater than the preset paging threshold; generate a detection payload request based on the detection paging data; determine whether the detection return parameter value of the detection payload request is consistent with the detection paging data, and if so, the interface to be detected passes the interface verification, and it is determined that the interface to be detected is under attack.

[0100] Optionally, in this embodiment of the application, the interface attack detection device includes a request construction module 230, which is specifically used to modify the original pagination data in the original request data corresponding to the interface to be detected to obtain first pagination data and second pagination data; wherein the first pagination data and the second pagination data are inconsistent; a first payload request is generated based on the first pagination data; and a second payload request is generated based on the second pagination data.

[0101] Optionally, in this embodiment of the application, the interface attack detection device further includes: an interface processing module, used to format the interface corresponding to the original request data to obtain a formatted interface; the formatted interface includes interface key elements; the interface is normalized according to the interface key elements to obtain a normalized interface; the interface to be detected is determined from the interfaces corresponding to the original request data, including: determining the interface to be detected from the normalized interfaces.

[0102] Optionally, in this embodiment of the application, the interface attack detection device further includes: an authentication module, used to obtain the interface corresponding to the original request data; configure the authentication field of the interface; obtain the authentication information of the interface through the authentication field, and store the authentication information in the interface authentication pool; the interface authentication pool is used to retrieve the authentication information corresponding to the interface when the interface authentication fails, so that the interface that failed authentication can pass the authentication.

[0103] Optionally, in this embodiment of the application, the interface attack detection device includes a request coloring module, which is used to add preset key parameters to the request header parameters of the original request data and the payload request, respectively; the preset key parameters are used to identify the original request data and the payload request for attack detection.

[0104] It should be understood that this device corresponds to the interface attack detection method embodiment described above and is capable of performing the various steps involved in the above method embodiment. The specific functions of this device can be found in the description above, and detailed descriptions are omitted here to avoid repetition. The device includes at least one software functional module that can be stored in memory or embedded in the device's operating system (OS) in the form of software or firmware.

[0105] Please see Figure 4The diagram shows a structural schematic of an electronic device provided in an embodiment of this application. An electronic device 300 provided in this application includes a processor 310 and a memory 320. The memory 320 stores machine-readable instructions executable by the processor 310. When the machine-readable instructions are executed by the processor 310, the method described above is performed.

[0106] This application also provides a storage medium storing a computer program, which is executed by a processor to perform the above-described method.

[0107] The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0108] It should be understood that the disclosed apparatus and methods can also be implemented in other ways, given the several embodiments provided in this application. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0109] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0110] The above description is only an optional implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application.

Claims

1. A method for detecting interface attacks, characterized in that, include: Collect the original request data; The original request data includes the original request parameters and the original return parameters; The original request parameters include the original pagination data; The original request parameters and the original return parameters are compared and analyzed, and the interface to be detected is determined from the interface corresponding to the original request data based on the analysis results; A payload request is generated based on the original request data corresponding to the interface to be detected; wherein the first pagination data contained in the payload request is different from the original pagination data; Based on the original request data and payload request corresponding to the interface to be detected, determine whether the interface to be detected is attacked; The original request parameters and the original return parameters are compared and analyzed. Based on the analysis results, the interfaces to be detected are determined from the interfaces corresponding to the original request data, including: Modify the value of the original request parameter, and receive the modified original return parameter corresponding to the modified original request parameter; Based on the modified original request parameters and the modified original return parameters, determine the correspondence between the original request parameters and the original return parameters; Based on the correspondence between the original request parameters and the original return parameters, the interface to be detected is determined from the interfaces corresponding to the original request data; The step of determining whether an interface to be detected is attacked based on the original request data and payload request corresponding to the interface to be detected includes: determining the original return parameters affected by the original request parameters based on the correspondence between the original request parameters and the original return parameters in the original request data corresponding to the interface to be detected, and the correspondence between the request parameters and the return parameters in the payload request; and determining whether an interface to be detected is attacked by reconstructing a detection request.

2. The method according to claim 1, characterized in that, The payload request includes a first payload request and a second payload request; the first payload request includes a first request parameter and a first return parameter; the second payload includes a second request parameter and a second return parameter. Based on the original request data and payload request corresponding to the interface to be detected, determine whether the interface to be detected is attacked, including: Based on the original request parameters, the original return parameters, the first request parameters, the first return parameters, the second request parameters, and the second return parameters, it is determined whether the return parameter value of the interface to be tested is affected by the request parameter value. If it is determined that the return parameter value of the interface to be tested is affected by the request parameter value, and the interface to be tested passes the interface verification, then the interface to be tested is under attack.

3. The method according to claim 2, characterized in that, The step of determining whether the return parameter value of the interface to be tested is affected by the request parameter value based on the original request parameters, the original return parameters, the first request parameters, the first return parameters, the second request parameters, and the second return parameters includes: If the value of the original pagination data in the original request parameters is consistent with the length of the original return parameters, and the value of the first pagination data in the first request parameters is consistent with the length of the first return parameters, and the value of the second pagination data in the second request parameters is consistent with the length of the second return parameters, then it is determined that the return parameter value of the interface to be tested is affected by the request parameter value.

4. The method according to claim 2, characterized in that, If it is determined that the returned parameter value of the interface to be tested is affected by the requested parameter value, and the interface to be tested passes the interface verification, then the interface to be tested is vulnerable to attack, including: Detected pagination data is obtained based on a preset pagination threshold, wherein the detected pagination data is greater than the preset pagination threshold; Based on the detection pagination data, generate a detection payload request; Determine whether the detection return parameter value of the detection payload request is consistent with the detection pagination data. If so, the interface to be detected passes the interface verification, and it is determined that the interface to be detected is under attack.

5. The method according to claim 3, characterized in that, Based on the original request data corresponding to the interface to be detected, a payload request is generated, including: The original pagination data in the original request data corresponding to the interface to be detected is modified to obtain the first pagination data and the second pagination data; wherein the first pagination data and the second pagination data are inconsistent. The first payload request is generated based on the first pagination data; The second payload request is generated based on the second pagination data.

6. The method according to claim 1, characterized in that, After collecting the original request data, the method further includes: The interface corresponding to the original request data is formatted to obtain a formatted interface; the formatted interface includes key interface elements. Based on the key elements of the interface, the interface is normalized to obtain a normalized interface. The interface to be detected is determined from the interfaces corresponding to the original request data, including: The interface to be detected is determined from the normalized interface.

7. The method according to claim 1, characterized in that, Before comparing and analyzing the original request parameters and the original return parameters, the method further includes: Obtain the interface corresponding to the original request data; Configure the authentication fields for the interface; The authentication information of the interface is obtained through the authentication field and stored in the interface authentication pool. The interface authentication pool is used to retrieve the authentication information corresponding to the interface when the interface authentication fails, so that the interface that failed authentication can be authenticated.

8. The method according to any one of claims 1-7, characterized in that, After generating a payload request based on the original request data corresponding to the interface to be detected, the method further includes: Preset key parameters are added to the request header parameters of the original request data and the payload request, respectively; the preset key parameters are used to identify the original request data and the payload request for attack detection.

9. An interface attack detection device, characterized in that, include: The data acquisition module is used to collect raw request data; The original request data includes the original request parameters and the original return parameters; The original request parameters include the original pagination data; The comparison analysis module is used to perform a comparison analysis on the original request parameters and the original return parameters, and determine the interface to be detected from the interface corresponding to the original request data based on the analysis results; A request construction module is used to generate a payload request based on the original request data corresponding to the interface to be detected; wherein the first pagination data included in the payload request is different from the original pagination data; An attack detection module is used to determine whether an attack exists on the interface to be detected based on the original request data and payload request corresponding to the interface to be detected. The comparison analysis module is specifically used to modify the value of the original request parameter and receive the modified original return parameter corresponding to the modified original request parameter; based on the modified original request parameter and the modified original return parameter, determine the correspondence between the original request parameter and the original return parameter; and determine the interface to be detected from the interface corresponding to the original request data according to the correspondence between the original request parameter and the original return parameter. The device is further configured to determine the original return parameters affected by the original request parameters based on the correspondence between the original request parameters and the original return parameters in the original request data corresponding to the interface to be detected, and the correspondence between the request parameters and the return parameters in the payload request; and to determine whether the interface to be detected is attacked by reconstructing the detection request.

10. An electronic device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the method as described in any one of claims 1 to 8.

Images