Processing method and device of access request, electronic equipment and storage medium

Abstract

The embodiments of the present specification provide a processing method, device, electronic equipment and storage medium for an access request. The method comprises: receiving a first access request; in the case that an access page pointed by the first access request is a first page, generating and storing a first specified identifier; sending the first specified identifier and page data of the first page to a request sender of the first access request; receiving a second access request sent by the request sender; in the case that a matching result of matching the first specified identifier in the second access request indicates a matching failure, identifying the second access request as an attack behavior. The identification accuracy for the attack behavior can be improved.

Description

Technical Field

[0001] The embodiments described in this specification relate to the field of network security, specifically to a method, apparatus, electronic device, and storage medium for processing access requests. Background Technology

[0002] With the rapid development of computer networks, network security is becoming increasingly important. In current technologies, network attacks are often mixed with normal network access, posing a significant challenge to network security protection.

[0003] In existing technologies, regular expression matching is typically used to identify attack behavior. Specifically, a regular expression library can be set up, which includes multiple regular expressions. Received network access requests are matched against the regular expressions in the library; if a match is found, the network access request is considered an attack.

[0004] However, as attackers employ increasingly sophisticated attack methods, the accuracy of regular expression matching in identifying cyberattacks is gradually decreasing. Summary of the Invention

[0005] This specification provides a method, apparatus, electronic device, and storage medium for processing access requests through various embodiments. These methods can improve the accuracy of identifying network attack behaviors to a certain extent.

[0006] One embodiment of this specification provides a method for processing access requests, applied to a server. The method includes: receiving a first access request; generating and storing a first designated identifier if the access page pointed to by the first access request is a first page; sending the first designated identifier and page data of the first page to the requester of the first access request; receiving a second access request sent by the requester; and identifying the second access request as an attack if the matching result of the first designated identifier in the second access request indicates a matching failure.

[0007] One embodiment of this specification provides an access request processing apparatus, the apparatus comprising: a first receiving unit for receiving a first access request; a generating unit for generating and storing a first designated identifier when the access page pointed to by the first access request is a first page; a sending unit for sending the first designated identifier and page data of the first page to the requester of the first access request; a second receiving unit for receiving a second access request sent by the requester; and a determining unit for determining the second access request as an attack behavior when the matching result of the second access request with the first designated identifier indicates a matching failure.

[0008] One embodiment of this specification provides an electronic device, the electronic device including: a memory, and one or more processors communicatively connected to the memory; the memory stores instructions executable by the one or more processors, the instructions being executed by the one or more processors to cause the one or more processors to implement the method described in any one of the above embodiments.

[0009] One embodiment of this specification provides a computer storage medium storing a computer program that, when executed by a processor, implements the method described in any one of the above embodiments.

[0010] The various implementation methods provided in this specification utilize the fact that in network communication protocols, parameters are passed between access requests and response data sent by the requester and responder respectively during multiple normal communications. Thus, by feeding back a specified identifier and page data to the requester of the first access request, if the specified identifier is not present in the second access request based on the page data, it indicates that the second access request has been modified, and the second access request can be identified as an attack. This allows for timely detection of network attacks and improves the accuracy of network attack identification. Attached Figure Description

[0011] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0012] Figure 1 The diagram shown is a schematic representation of a network interaction provided in one embodiment of this specification.

[0013] Figure 2 The diagram shows a flowchart of an access request processing method provided in one embodiment of this specification.

[0014] Figure 3 The diagram shown is an interactive schematic of an access request processing method provided in one embodiment of this specification.

[0015] Figure 4 The diagram shown is a schematic representation of an access request processing apparatus provided in one embodiment of this specification.

[0016] Figure 5 The diagram shown is a schematic representation of an electronic device provided in one embodiment of this specification. Detailed Implementation

[0017] In related technologies, cyberattacks involve exploiting vulnerabilities and security flaws in network information systems to attack systems and resources. Therefore, network security measures are becoming increasingly important.

[0018] Some solutions employ large datasets combined with machine learning algorithms to train attack identification models on both normal and abnormal logs for intelligent identification. These models require a large number of training samples to improve their accuracy. However, in some cases, once the attack behavior changes, the model struggles to accurately identify the attack, leading to a decrease in accuracy.

[0019] In some solutions, regular expression matching can be used to identify attack behavior. A large number of regular expressions can be deployed on the server, and attack behavior can be identified from network access requests when the logic matches the regular expressions. However, in some cases, when attack behavior changes, it becomes difficult to identify the attack using regular expressions.

[0020] Therefore, it is necessary to provide a method for processing access requests that can improve the accuracy of attack behavior identification. This method involves adding a specified identifier to the feedback data sent to the requester after receiving the request. This identifier serves as a distinguishing feature between normal access behavior and attack behavior. That is, when the requester resends an access request, if the request carries this specified identifier, the access request can be considered a normal access behavior; if it does not carry this identifier, the access request can be considered an attack, and the requester can be identified as a network attacker. This improves the accuracy of attack behavior identification.

[0021] Please see Figure 1 , Figure 2 and Figure 3 One embodiment of this specification provides a method for processing access requests. This method can be applied to a server. The server can be an electronic device with certain computing power. It may have a network communication module, a processor, and a memory, etc. Of course, the server can also refer to software running on the electronic device. The server can also be a distributed server, which can be a system with multiple processors, memory, network communication modules, etc., operating collaboratively. Alternatively, the server can be a server cluster formed by several servers. Alternatively, with the development of science and technology, the server can also be a new technical means capable of realizing the corresponding functions of the embodiments described in this specification. For example, it can be a new form of "server" based on quantum computing. The method for processing access requests may include the following steps.

[0022] Step S110: Receive the first access request.

[0023] In this embodiment, the first access request may be generated according to a network communication protocol. The first access request may include an access path to indicate the page to which the first access request points. Specifically, for example, the first access request may conform to the HTTP protocol and have multiple parts such as a request line and request headers. The request line may contain the access path, and the request header may contain the identity and authorization information of the requester sending the first access request. In some embodiments, the first access request may also have a request body, which may carry the parameters and values ​​to be transmitted.

[0024] Step S120: If the access page pointed to by the first access request is the first page, generate and store the first specified identifier.

[0025] In this embodiment, the server can maintain page data for multiple pages. These multiple pages can have a certain hierarchical relationship. The first page can be a pre-designated entry page among the multiple pages. The first page provides access paths to the other pages. Specifically, for example, a website can include multiple pages, where the first page can be the website's homepage.

[0026] To identify attack behavior in access requests, the server can be configured to require all page access requests to begin with the first page. Furthermore, access requests for the first page do not necessarily include a specified identifier; instead, the server can send the page data of the first page to the requester, containing the first specified identifier. This allows the requester to automatically include the first specified identifier in subsequent access requests, based on the first page.

[0027] In some implementations, the page targeted by the first access request may be the first page, and the first access request may also carry a specified identifier. In this case, it can be indicated that the sender of the first access request may not be accessing a page provided by the server for the first time. The server can verify the specified identifier carried in the first access request. That is, it verifies whether the specified identifier is the first specified identifier that the server previously added to the page data. In some implementations, the first specified identifier may include specified parameters and parameter values. The server can first determine whether the access request carries specified parameters. If it does not carry specified parameters, it then determines whether the page accessed by the first access request is the first page, so the first page can be the homepage. Further matching and verification are only performed if the request header carries specified parameters, checking whether the parameter values ​​are correct. In some specific implementations, the server can first determine whether the request header of the access request is empty. If the request header is empty, it then determines whether the page accessed by the first access request is the first page, so the first page can be the homepage.

[0028] The server can generate a first designated identifier. This first designated identifier can be used to represent a permission level. That is, if the access request carries this first designated identifier, the server will consider the access request legitimate and execute the corresponding response behavior, sending response data back to the requester. The first designated identifier can be a pre-defined string. Methods for generating the first designated identifier include: modifying some parameters in the protocol header based on the network communication protocol and using the modified parameters as the first designated identifier; or adding a custom parameter to the protocol header, which can then serve as the first designated identifier. Specifically, for example, in the HTTP header, the "a" in the regular field "Authorization" can be changed to "o" to obtain "Authorizotion," which can then be used as the first designated identifier. Alternatively, a custom field can be added to a cookie and used as the first designated identifier. For example, the original cookie could be "Cookie:PHPSESSID=298zf09hf012fh2;", and the modified one could be "Cookie:PHPSESSID=298zf09hf012fh2; uuID=RTYUSDFGHJXCVBNM;". Here, "uuID=RTYUSDFGHJXCVBNM" can be used as the primary identifier, or it can be further refined, with "uuID" as the primary identifier and "RTYUSDFGHJXCVBNM" as the value of the primary identifier. In the specific interaction between the requester and the server, the requester's access request may include request headers, and the server's response data may include response headers. Both request and response headers can be HTTP headers, allowing the identifier to be passed in both the response and the access request during normal interaction.

[0029] Step S130: Send the first designated identifier and the page data of the first page to the request sender of the first access request.

[0030] The first designated identifier can be sent together with the page data of the first page to the requester. In some embodiments, the server sends the first designated identifier in the response header and the page data in the response body. This allows the first designated identifier and the page data of the first page to be sent together to the requester. Of course, those skilled in the art may make other modifications based on this embodiment, which will not be elaborated further.

[0031] Step S140: Receive the second access request sent by the request sender.

[0032] Step S150: If the matching result of the second access request with the first specified identifier fails, the second access request is identified as an attack.

[0033] In some cases, after receiving the page data of the first page, the requesting party can further access other pages based on that page data. In this case, a second access request can be issued. If the requesting party is a normal user, its computer device will render and display the first page based on the received page data. Based on the user's actions on the first page, a second access request is generated. In this case, the second access request can carry the first specified identifier. Specifically, for example, based on the HTTP protocol, the second access request header can carry the specified identifier.

[0034] In some cases, the request sender may be engaging in malicious attacks. In such situations, the request sender might modify the browser-generated second access request to exploit server vulnerabilities. Specifically, for example, suppose the first specified identifier is "uuID=RTYUSDFGHJXCVBNM", and the browser-generated second access request header contains this first specified identifier. However, the request sender might, according to the server's vulnerability-hunting logic, remove the first specified identifier "uuID=RTYUSDFGHJXCVBNM". Alternatively, the request sender might use "uuID" as a field and "RTYUSDFGHJXCVBNM" as a field value, potentially modifying the field values ​​to uncover server vulnerabilities. In some cases, the request sender might even completely reconstruct the second access request instead of based on the received page data; in this case, the first specified identifier would not be present in the second access request.

[0035] In some cases, normal web browsing typically begins with a specific page and then proceeds to other pages via links provided on that page. For example, browsing usually starts from the homepage. However, some attacks might not begin with the homepage but instead directly access pages that are not part of the homepage. In this case, the access request will not contain a first specified identifier. Therefore, access requests to non-specific pages without a first specified identifier can be identified as attacks.

[0036] In this embodiment, after receiving the second access request, the server can determine whether the second access request carries a first specified identifier. If the second access request does not contain the first specified identifier, it can be determined that the second access request is an attack. Accordingly, the sender of the second access request can be considered a network attacker. Specifically, for example, the server can check whether the first specified identifier exists in the request header of the second access request.

[0037] In this embodiment, by adding a specified identifier to the response data of the first access to the first page, the system leverages the network communication protocol where normal access behavior generates an access request based on the response data, ensuring that the specified identifier is carried in the normal access request. Thus, the server can determine whether an access request is an attack or a normal access based on whether subsequent access requests carry the specified identifier, improving the accuracy of attack detection. Furthermore, the various implementation methods described in this specification can be easily deployed on a server without significantly increasing the server's load.

[0038] In some implementations, the method for processing the access request may further include: if the matching result of the first specified identifier in the second access request indicates a successful match, obtaining the page data of the second page pointed to by the second access request; generating a second specified identifier; and sending the second specified identifier and the page data of the second page to the request sender who issued the second access request, so that the access request issued by the request sender based on the page data of the second page carries the second specified identifier.

[0039] In some cases, after receiving a second access request, the server can check whether the second access request carries a first specified identifier. Thus, based on whether the second access request contains the first specified identifier, it can determine whether the second access request is a legitimate access request or an attack. Specifically, for example, if the second access request contains the first specified identifier "uuID=RTYUSDFGHJXCVBNM", it is considered a legitimate access request.

[0040] In this implementation, after receiving an access request, the server sends a specified identifier along with page data to the requester. This ensures that after the server receives the first access request for the homepage, it can send the specified identifier to the requester. This means that subsequent access requests from the requester will include the specified identifier, except for the initial request to the homepage. Consequently, every access request from a legitimate user, except for the initial homepage visit, will carry the specified identifier. Therefore, the presence or absence of the specified identifier in the access request can be used to determine whether an access request is legitimate.

[0041] In some implementations, matching the first designated identifier in the second access request may include: matching the second access request with valid identifiers included in the valid identifier set; wherein, if the matching result is that there is a first designated identifier in the valid identifier set that matches the second access request, the matching result indicates a successful match; if the matching result is that there is no first designated identifier in the valid identifier set that matches the second access request, the matching result indicates a failed match; wherein, the valid identifier set includes multiple first designated identifiers that are in a valid state.

[0042] In some cases, a server can maintain a set of valid identifiers consisting of a first specified identifier. All first specified identifiers in this set are valid. Removing a first specified identifier from this set indicates that the first specified identifier has become invalid. This allows the server to avoid regenerating a new first specified identifier after each access request. Specifically, the server can generate multiple first specified identifiers at once, and retrieve them from the set of valid identifiers each time they are needed. This reduces server overhead and improves server performance. For example, the server can generate multiple fields and their values ​​at once for inclusion in the HTTP header of a cookie.

[0043] In some implementations, the first designated identifier that successfully matches the second access request in the set of valid identifiers is removed from the set of valid identifiers; or, the number of times the first designated identifier that successfully matches the second access request in the set of valid identifiers is used is incremented; or, if the number of times the first designated identifier is used reaches a set threshold, the first designated identifier is removed from the set of valid identifiers.

[0044] In this embodiment, the first designated identifier in the valid identifier set may have a usage count. Each time the first designated identifier is read, a corresponding cumulative count is performed. When the usage count reaches a set threshold, the first designated identifier is removed from the valid identifier set. Specifically, for example, a first designated identifier can be "UUname=zhuanlijuli", and the set threshold for this first designated identifier is 3 times. At this time, the number of times the first designated identifier is read and fed back to the request sender must not exceed the set threshold. Furthermore, when the number of second access requests successfully matching the first designated identifier "UUname=zhuanlijuli" reaches 3, the first designated identifier "UUname=zhuanlijuli" will be removed from the valid identifier set.

[0045] Of course, the first specified identifier can also be used only once. That is, after a second access request is successfully matched, the first specified identifier is removed from the set of valid identifiers.

[0046] In some implementations, the server stores a specified identifier corresponding to the request sender of the access request; matching the specified identifier in the second access request may include: matching the first specified identifier stored corresponding to the request sender of the second access request with the second access request.

[0047] In this embodiment, the server can store a first designated identifier corresponding to the request sender. That is, after receiving an access request, the server can obtain the identity information of the request sender from the access request. After generating the first designated identifier, the server can store the first designated identifier in correspondence with the identity information. In this way, when the request sender sends an access request again, the server can match the access request with the first designated identifier stored by the corresponding request sender. This quickly identifies the first designated identifier that needs to be matched with the access request, reducing the server's computational load.

[0048] In this embodiment, a usage threshold can also be set for the same first designated identifier. Specifically, a first designated identifier can be associated with a request sender, and a usage threshold can be set for that first designated identifier. When the number of times the first designated identifier is carried in the access requests sent by the request sender reaches the usage threshold, the first designated identifier is set to invalid. This ensures that if the first designated identifier is carried in the access requests sent by the request sender again, the match will fail.

[0049] In some embodiments, the method for processing the access request may further include sending a bait to the sender of the second access request.

[0050] In some cases, after a server detects an attack, it indicates that a cyber attacker is conducting a network attack on the server. To mitigate the impact of the attack, a honeypot can be packaged and sent to the attacker. In some implementations, the honeypot can be disguised data that appears valuable to the attacker. Specifically, for example, the honeypot might be a file that lures the attacker to open or download. For instance, if an attacker sees a file like "XX Second Half-Year Work Plan.docx", "XX Environment Operation and Maintenance Manual.pdf", or "Employee Salary List - 20210630.xslx", and downloads or subsequently opens the honeypot, the attacker's computer device can be tracked based on the embedded points in the honeypot. Furthermore, the honeypot can be used to lure the attacker into a honeypot. In some implementations, honeypot technology is a proactive defense technique that deploys a system without real business data to deceive attackers, record their attack behavior, and learn their attack objectives and methods, thereby continuously improving the server's security capabilities.

[0051] In some embodiments, the method for processing the access request further includes: establishing identity information of the requester of the second access request based on the second access request; and sending the identity information of the requester to a computer device associated with the server, so that the computer device can identify the requester based on the identity information.

[0052] In some cases, a server may be associated with multiple computer devices. If the server is subjected to a cyberattack, these multiple computer devices may also be vulnerable. After the server identifies an attack, it can construct an identity identifier for the request sender, using this identifier to identify the attacker, and then send this identifier to the computer devices associated with the server. This allows the computer devices to quickly determine whether a received access request contains an attack from the attacker based on the identifier, thus improving security.

[0053] In this embodiment, the identification information can be the attacker's device fingerprint or IP address, etc. This identification information allows the attacker to be identified. In this embodiment, the sender of the second access request is identified as the attacker. This allows the identification information to also identify the sender of the second access request.

[0054] In some implementations, after determining that the second access request is an attack, the method for processing the access request may further include: generating response data for the second access request; and analyzing the vulnerabilities of the server based on the response data.

[0055] In some cases, as technology advances, new vulnerabilities may be discovered in servers. To facilitate vulnerability discovery by maintainers, after detecting attack behavior, the attack behavior can be used to verify whether a vulnerability exists.

[0056] In this embodiment, the server can generate response data for the second access request, which does not need to be sent to the requester of the second access request. The response data for the second access request can be analyzed to determine whether vulnerabilities exist and whether sensitive data has been leaked. Alternatively, it can be used to verify whether pre-defined defensive measures are effective.

[0057] Please see Figure 3 This specification also provides an example application scenario for processing an access request. The server receives an access request from a computer device, for example, a request with the action "POST / quandashi / user.html HTTP / 1.1" and a request header of "Accept:XXXXX / Referer:http: / / 195.145.123.123:8088 / quandashi / user / shouye.html / Cookie:juli=123456789". After receiving the access request, the server checks whether the request carries a specified identifier. Assume the server's rule for specifying the identifier is that it requires a specified parameter in the Cookie header, such as the hhID parameter. If the server finds that the access request does not carry the hhID parameter, it further determines whether the page the access request points to is the initial entry point, i.e., whether it is the homepage. Assume the server finds that the page "http: / / 195.145.123.123:8088 / quandashi / user / shouye.html" is the homepage. The server generates a specified identifier "hhID = anjianjuli123456". This identifier can be included in the response header of the response data sent to the computer device. The server sends the response data and the homepage data to the computer device. The server can also store this specified identifier in correspondence with a communication address or device identifier representing the computer device's identity information.

[0058] After receiving the response data and page data, the computer device may further send an access request to the server. Suppose the computer device is a network attacker, sending an access request to probe for vulnerabilities in the server. In this case, the computer device may have testing tools configured to analyze the received data, as well as a scanner to generate access requests. Of course, the testing tools may also modify the access request. The scanner might directly generate an access request; in the newly generated request, the request line may remain unchanged, but the request header will be changed to "Accept:XXXXX / Referer:http: / / 195.145.123.123:8088 / quandashi / user / register.html / Cookie:juli=123456789". The computer device then sends this access request to the server.

[0059] After the server receives another access request from the computer device, it finds that the request header lacks the hhID parameter and the requested page is not the homepage. Therefore, the server can conclude that the access request is an attack, and the computer device may be the target of the network attack.

[0060] In some scenarios, after a computer device receives response data and page data, the scanner may generate a default access request based on the response data, such as "Accept:XXXXX / Referer:http: / / 195.145.123.123:8088 / quandashi / user / shouye.html / Cookie:juli=123456789hhID=anjianjuli123456". The scanner may modify the default access request to explore whether vulnerabilities can be found. For example, "Accept:XXXXX / Referer:http: / / 195.145.123.123:8088 / quandashi / user / shouye.html / Cookie:juli=123456789hhID=anjianjuli123455", changing the value of hhID from "anjianjuli123456" to "anjianjuli123455" in the default access request. This modified access request is then sent to the server.

[0061] After receiving the access request, the server finds the hhID parameter in the request header and can further determine whether the hhID parameter value is the same as the parameter value in the specified identifier stored in the corresponding computer device. The server compares the parameters and finds that the parameter value "anjianjuli123455" in the network request is different from the parameter value "anjianjuli123456" in the stored specified identifier; therefore, the server considers the access request to be an attack.

[0062] In some scenarios, after receiving response data and page data, a computer device, based on user actions, renders a page using the page data and issues a further access request. This computer device might be used by a legitimate user, not a network attacker. In this case, the browser running on the computer device might further generate an access request based on the response data, automatically adding "hhID=anjianjuli123456" to the request body. Upon receiving the access request, the server compares it with a stored identifier. If the match is successful, the server considers the access request a legitimate request. It can then continue generating a new identifier and including it in the response data sent to the computer device, facilitating subsequent verification to determine if the access request constitutes an attack.

[0063] This specification also provides a method for processing access requests, which may include the following steps.

[0064] Step S210: Receive access request.

[0065] Step S212: Determine whether the request header of the access request is empty. If the request header is empty, proceed to step S214. If the request header is not empty, proceed to step S218.

[0066] Step S214: If the request header of the access request is empty, determine whether the page requested by the access request is the homepage.

[0067] Step S216: If the page requested for access is the homepage, generate a first designated identifier and send the first designated identifier and the page data of the homepage to the computer device that issued the access request.

[0068] Step S218: Determine whether the request header contains a specified identifier. If the specified identifier exists, proceed to step S220. If the specified identifier does not exist, proceed to step S222.

[0069] Step S220: If a specified identifier exists in the request header, generate a second specified identifier and send the second specified identifier and the page data pointed to by the access request to the computer device that issued the access request.

[0070] Step S222: If the request header does not contain a specified identifier, the access request is identified as an attack.

[0071] Please see Figure 4 One embodiment of this specification also provides an access request processing apparatus. The access request processing apparatus may include: a first receiving unit for receiving a first access request; a generating unit for generating and storing a first designated identifier when the access page pointed to by the first access request is a first page; a sending unit for sending the first designated identifier and page data of the first page to the requester of the first access request; a second receiving unit for receiving a second access request sent by the requester; and a determining unit for determining the second access request as an attack if the matching result of the first designated identifier in the second access request indicates a matching failure.

[0072] The specific functions and effects of the access request processing device can be explained by referring to other embodiments in this specification, and will not be repeated here. Each unit in the access request processing device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0073] In some embodiments, the access request processing apparatus further includes: an acquisition unit, configured to acquire page data of a second page pointed to by the second access request if the matching result of the first specified identifier in the second access request indicates a successful match; an identifier generation unit, configured to generate a second specified identifier; and a sending unit, configured to send the second specified identifier and the page data of the second page to the request sender who issued the second access request, so that the access request issued by the request sender based on the page data of the second page carries the second specified identifier.

[0074] In some implementations, the server stores a specified identifier corresponding to the request sender of the access request to form a valid identifier set; the matching unit includes a matching submodule, used to match the second access request with the valid identifiers included in the valid identifier set; wherein, if the matching result is that there is a specified identifier in the valid identifier set that matches the second access request, the matching result indicates a successful match; if the matching result is that there is no specified identifier in the valid identifier set that matches the second access request, the matching result indicates a failed match; wherein, the valid identifier set includes multiple specified identifiers that are in a valid state.

[0075] In some embodiments, the access request processing apparatus further includes: a processing unit, configured to remove a first designated identifier that successfully matches the second access request from the set of valid identifiers; or, increment the number of times the first designated identifier that successfully matches the second access request is used in the set of valid identifiers; or, remove the first designated identifier from the set of valid identifiers when the number of times the first designated identifier is used reaches a set threshold.

[0076] In some implementations, the server stores a specified identifier corresponding to the request sender of the access request; the acquisition unit includes: an identifier matching module, used to match the first specified identifier stored corresponding to the request sender of the second access request with the second access request.

[0077] In some embodiments, the access request processing apparatus further includes: an establishment unit, configured to establish identity information of the requester of the second access request based on the second access request; and a second sending unit, configured to send the identity information of the requester to a computer device associated with the server, so that the computer device can identify the requester based on the identity information.

[0078] In some embodiments, the access request processing apparatus further includes: a data generation unit for generating response data in response to the second access request; and an analysis unit for analyzing vulnerabilities in the server based on the response data.

[0079] Please see Figure 5 This description describes an embodiment that can provide an electronic device, the electronic device including: a memory, and one or more processors communicatively connected to the memory; the memory stores instructions that can be executed by the one or more processors, the instructions being executed by the one or more processors to cause the one or more processors to implement the data feedback method in any of the above embodiments.

[0080] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described in any of the above embodiments.

[0081] This specification also provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the methods described in any of the above embodiments.

[0082] It is understood that the specific examples in this document are only intended to help those skilled in the art better understand the embodiments described herein, and are not intended to limit the scope of the invention.

[0083] It is understood that in the various embodiments described in this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments described in this specification.

[0084] It is understood that the various implementation methods described in this specification can be implemented individually or in combination, and the implementation methods in this specification are not limited in this respect.

[0085] Unless otherwise stated, all technical and scientific terms used in the embodiments of this specification have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of this specification. The term "and / or" as used in this specification includes any and all combinations of one or more of the associated listed items. The singular forms "a," "the," and "the" as used in the embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0086] It is understood that the processor in the embodiments of this specification can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this specification. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this specification can be directly implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above methods.

[0087] It is understood that the memory in the embodiments of this specification may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM). It should be noted that the memory in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0088] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this specification.

[0089] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the aforementioned method implementations, and will not be repeated here.

[0090] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0091] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0092] In addition, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0093] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this specification, in essence, or the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of software products. These computer software products are stored in a storage medium and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0094] The above description is merely a specific embodiment of this specification, but the scope of protection of this invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this specification should be included within the scope of protection of this specification. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A method for processing access requests, characterized in that, Applied to a server, the method includes: Receive the first access request; If the access page pointed to by the first access request is the first page, generate and store the first specified identifier; Send the first designated identifier and the page data of the first page to the request sender of the first access request; Receive the second access request sent by the request sender after receiving the page data of the first page; If the matching result of the second access request against the first specified identifier indicates a failure, the second access request will be identified as an attack. If the matching result of the first specified identifier in the second access request indicates a successful match, then obtain the page data of the second page pointed to by the second access request; Generate a second specified identifier; The second designated identifier and the page data of the second page are sent to the request sender who issued the second access request, so that the access request issued by the request sender based on the page data of the second page carries the second designated identifier.

2. The method according to claim 1, characterized in that, Matching the first specified identifier in the second access request includes: The second access request is matched with valid identifiers included in the valid identifier set; wherein, if the matching result is that there is a specified identifier in the valid identifier set that matches the second access request, the matching result indicates a successful match; if the matching result is that there is no specified identifier in the valid identifier set that matches the second access request, the matching result indicates a failed match; wherein, the valid identifier set includes multiple specified identifiers that are in a valid state.

3. The method according to claim 2, characterized in that, The method further includes: Remove the first specified identifier from the set of valid identifiers that successfully matches the second access request; or... Increment the number of times the first specified identifier, which successfully matches the second access request, is used in the set of valid identifiers; or... If the number of times the first designated identifier is used reaches a set threshold, the first designated identifier will be removed from the set of valid identifiers.

4. The method according to claim 1, characterized in that, Matching the specified identifier in the second access request includes: The first specified identifier stored by the sender of the second access request is matched with the second access request.

5. The method according to claim 1, characterized in that, The method further includes: establishing the identity information of the requester of the second access request based on the second access request; The identity information of the request sender is sent to a computer device associated with the server, so that the computer device can identify the request sender based on the identity information.

6. The method according to claim 1, characterized in that, The method further includes: Generate response data for the second access request; The server's vulnerabilities are analyzed based on the response data.

7. An access request processing apparatus, characterized in that, The device includes: The first receiving unit is used to receive the first access request; The generation unit is used to generate and store a first specified identifier when the access page pointed to by the first access request is the first page; The sending unit is used to send the first designated identifier and the page data of the first page to the request sender of the first access request; The second receiving unit is used to receive the second access request sent by the request sender; The identification unit is used to identify the second access request as an attack if the matching result of the first specified identifier in the second access request indicates that the matching fails. The acquisition unit is used to acquire page data of the second page pointed to by the second access request when the matching result of the first specified identifier in the second access request indicates a successful match. The identifier generation unit is used to generate a second specified identifier; The sending unit is further configured to send the second designated identifier and the page data of the second page to the request sender who issued the second access request, so that the access request issued by the request sender based on the page data of the second page carries the second designated identifier.

8. An electronic device, characterized in that, The electronic device includes: A memory, and one or more processors communicatively connected to the memory; The memory stores instructions that can be executed by the one or more processors to cause the one or more processors to implement the method as described in any one of claims 1 to 6.

9. A computer storage medium storing a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images