A webpage attack detection method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a webpage attack detection method and device, electronic equipment and storage medium, the method comprises: obtaining detection information of a webpage request, the detection information of the webpage request comprises at least one of webpage request time, webpage request quantity, webpage request response state, webpage request interface address, webpage request trigger detection attack script frequency and webpage request call chain order; then, corresponding feature information is generated according to the detection information of the webpage request, and the feature information is input into a webpage attack detection model for processing to obtain a webpage attack detection result, and it is judged whether the webpage request is a normal request according to the webpage attack detection result. The above method can not only identify attack scripts in webpage requests, but also effectively detect and protect against attack behaviors such as unauthorized access and bypassing in webpage attacks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting web page attacks. Background Technology

[0002] As the internet (web pages) plays an increasingly important role in our lives, attacks on these pages are becoming more and more intense. Analysis of the attack and penetration process reveals that the main attack methods are attacking external networks to gain control and then spreading to internal networks. Websites have become a primary entry point for hackers, and once a website is compromised, it can quickly spread to the internal network, causing even greater impact. In conclusion, websites have become one of the most crucial links in network attack defense.

[0003] Currently, there are two main methods for detecting attacks on mainstream websites: the first is detection based on security devices, and the second is the website's own filtering and protection strategies. Both methods primarily filter keywords in user requests, using script sample feature libraries to screen requests and detect whether they contain attack scripts with specific identifiers, thus determining whether the user has engaged in malicious activity.

[0004] However, in reality, logical vulnerabilities in systems, such as privilege escalation and bypass attacks, do not exhibit predictable attack script patterns. This vulnerability creates gaps in attack script-based detection and protection, hindering comprehensive detection and protection against attacks on web systems. Summary of the Invention

[0005] In view of the above problems, embodiments of the present invention are proposed to provide a web attack detection method, apparatus, electronic device and storage medium that overcomes or at least partially solves the above problems.

[0006] To address the aforementioned problems, in a first aspect, embodiments of the present invention disclose a webpage attack detection method, the method comprising:

[0007] Obtain detection information for web page requests, which includes at least one of the following: web page request time, number of web page requests, web page request response status, web page request interface address, number of times the web page request triggers the detection attack script, and web page request call chain order.

[0008] Generate corresponding feature information based on the detection information of the webpage request;

[0009] The feature information is input into the web attack detection model for processing to obtain the web attack detection result.

[0010] The webpage request is determined as a normal request based on the webpage attack detection results.

[0011] Optionally, generating corresponding feature information based on the detection information of the webpage request includes:

[0012] Obtain a preset abnormal time period interval, wherein the abnormal time period interval includes a start time;

[0013] Determine whether the webpage request time falls within the abnormal time period;

[0014] If the webpage request time is not within the abnormal time period, the webpage request time characteristic value is obtained as a first preset value;

[0015] If the webpage request time is within the abnormal time period, then calculate the time difference between the webpage request time and the starting time; calculate the ratio of the time difference to a preset unit time period, the ratio being an integer, and multiply the ratio by a preset attack risk score as the webpage request time feature value.

[0016] Optionally, generating corresponding feature information based on the detection information of the webpage request includes:

[0017] Calculate the time interval between each webpage request based on the webpage request time;

[0018] Calculate the average time interval between web page requests based on the time interval between each web page request;

[0019] The reciprocal of the average webpage request time interval is used as the characteristic value of the webpage request time interval.

[0020] Optionally, generating corresponding feature information based on the detection information of the webpage request includes:

[0021] The percentage by which the number of web page requests exceeds the average number of web page requests is used as a characteristic value of the number of web page requests.

[0022] The average number of webpage requests is calculated in advance based on the number of webpage requests from multiple users.

[0023] Optionally, generating corresponding feature information based on the detection information of the webpage request includes:

[0024] Based on the webpage request response status, count the number of webpage request response failures;

[0025] The number of webpage request response failures exceeding the average number of webpage request response failures is used as the webpage request response status feature value.

[0026] The average number of failed webpage request responses is calculated in advance based on the webpage request response status of multiple users.

[0027] Optionally, generating corresponding feature information based on the detection information of the webpage request includes:

[0028] Obtain the list of high-privilege API addresses and the total number of high-privilege API addresses;

[0029] Based on the webpage request interface address and the list of high-privilege interface addresses, count the number of webpage requests whose interface addresses are high-privilege interface addresses;

[0030] The ratio of the number of high-privilege interface addresses in the web page request to the total number of high-privilege interface addresses is used as the feature value of the web page request interface address.

[0031] Optionally, generating corresponding feature information based on the detection information of the webpage request includes:

[0032] Obtain the pre-configured call chain order;

[0033] Based on the webpage request call chain order and the pre-configured call chain order, count the number of webpage requests whose call chain order does not conform to the pre-configured call chain order;

[0034] The number of calls that do not conform to the pre-configured call chain order is used as the web page request call chain order feature value.

[0035] Optionally, the webpage attack detection result is a webpage attack probability value, and the step of determining whether the webpage request is a normal request based on the webpage attack detection result includes:

[0036] If the webpage attack probability value is greater than or equal to a preset threshold, then the webpage request is determined to be an abnormal request.

[0037] If the probability value of a webpage attack is less than a preset threshold, then the webpage request is determined to be a normal request.

[0038] Secondly, embodiments of the present invention disclose a webpage attack detection device, the device comprising:

[0039] The detection information acquisition module is used to acquire detection information of web page requests. The detection information of web page requests includes at least one of the following: web page request time, number of web page requests, web page request response status, web page request interface address, number of times the web page request triggers the detection attack script, and web page request call chain order.

[0040] The feature information generation module is used to generate corresponding feature information based on the detection information of the webpage request;

[0041] The webpage attack detection module is used to input the feature information into the webpage attack detection model for processing, and obtain the webpage attack detection result.

[0042] The webpage attack result judgment module is used to determine whether the webpage request is a normal request based on the webpage attack detection result.

[0043] Optionally, the feature information generation module is specifically used to obtain a preset abnormal time period interval, the abnormal time period interval including the start time;

[0044] Determine whether the webpage request time falls within the abnormal time period;

[0045] If the webpage request time is not within the abnormal time period, the webpage request time characteristic value is obtained as a first preset value;

[0046] If the webpage request time is within the abnormal time period, then calculate the time difference between the webpage request time and the starting time; calculate the ratio of the time difference to a preset unit time period, the ratio being an integer, and multiply the ratio by a preset attack risk score as the webpage request time feature value.

[0047] Optionally, the feature information generation module is specifically used to calculate the time interval between each webpage request based on the webpage request time;

[0048] Calculate the average time interval between web page requests based on the time interval between each web page request;

[0049] The reciprocal of the average webpage request time interval is used as the characteristic value of the webpage request time interval.

[0050] Optionally, the feature information generation module is specifically used to take the number of web page requests that exceeds the average number of web page requests as the feature value of the number of web page requests.

[0051] The average number of webpage requests is calculated in advance based on the number of webpage requests from multiple users.

[0052] Optionally, the feature information generation module is specifically used to count the number of webpage request response failures based on the webpage request response status;

[0053] The number of webpage request response failures exceeding the average number of webpage request response failures is used as the webpage request response status feature value.

[0054] The average number of failed webpage request responses is calculated in advance based on the webpage request response status of multiple users.

[0055] Optionally, the feature information generation module is specifically used to obtain a list of high-privilege interface addresses and the total number of high-privilege interface addresses;

[0056] Based on the webpage request interface address and the list of high-privilege interface addresses, count the number of webpage requests whose interface addresses are high-privilege interface addresses;

[0057] The ratio of the number of high-privilege interface addresses in the web page request to the total number of high-privilege interface addresses is used as the feature value of the web page request interface address.

[0058] Optionally, the feature information generation module is specifically used to obtain the pre-configured call chain order;

[0059] Based on the webpage request call chain order and the pre-configured call chain order, count the number of webpage requests whose call chain order does not conform to the pre-configured call chain order;

[0060] The number of calls that do not conform to the pre-configured call chain order is used as the web page request call chain order feature value.

[0061] Optionally, the webpage attack detection result is a webpage attack probability value, and the webpage attack result judgment module is specifically used to determine that the webpage request is an abnormal request if the webpage attack probability value is greater than or equal to a preset threshold.

[0062] If the probability value of a webpage attack is less than a preset threshold, then the webpage request is determined to be a normal request.

[0063] Thirdly, the present invention discloses an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the webpage attack detection method as described in the first aspect.

[0064] Fourthly, the present invention discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the webpage attack detection method as described in the first aspect.

[0065] The embodiments of the present invention have the following advantages:

[0066] First, the detection information of web page requests is obtained. This information includes at least one of the following: web page request time, number of web page requests, web page request response status, web page request interface address, number of times the web page request triggers the detection attack script, and web page request call chain order. Then, corresponding feature information is generated based on the web page request detection information, and this feature information is input into the web page attack detection model for processing to obtain the web page attack detection result. Finally, the web page attack detection result is used to determine whether the web page request is a normal request. This embodiment of the web page attack detection method combines multiple web page request detection information to detect web page attack behavior. This method can not only identify attack scripts in web page requests, but also effectively detect and prevent attacks such as privilege escalation and bypassing in web page attacks. Attached Figure Description

[0067] Figure 1 This is a flowchart of a mainstream webpage attack provided in an embodiment of the present invention;

[0068] Figure 2 This is a flowchart illustrating the steps of a webpage attack detection method provided in an embodiment of the present invention;

[0069] Figure 3 This is a flowchart of another webpage attack detection method provided in an embodiment of the present invention;

[0070] Figure 4 This is a structural block diagram of a webpage attack detection device provided in an embodiment of the present invention. Detailed Implementation

[0071] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0072] like Figure 1 As shown, a flowchart of a mainstream webpage attack provided by an embodiment of the present invention is illustrated. Figure 1 It is known that mainstream web attacks constantly probe and discover vulnerabilities in users' web pages, and then launch attacks after confirming the vulnerabilities. Analysis of current mainstream web attack methods reveals the following differences between these attacks and normal website access:

[0073] 1. Deviating from normal operating hours. To avoid detection by administrators, hackers are more likely to launch attacks at night than during normal working hours.

[0074] 2. The number of requests exceeds the average. A comparison with the number of requests from normal users reveals that hackers continuously probe for attackable points during an attack, resulting in a higher number of requests compared to normal users.

[0075] 3. User request failures exceed the average. Hackers use directory scanning, employing a directory dictionary to continuously scan and probe for existing site resources or directories. During the scan, most directories will result in request failures, leading to a significantly higher number of failures compared to normal user operations.

[0076] 4. High API request coverage. Analysis revealed that normal users' system operations are clearly purposeful, and administrator users' daily operations also have a clear objective. Hackers, however, send requests with unclear objectives. Hackers will cover all APIs to discover potential vulnerabilities, thus resulting in a high API request coverage.

[0077] 5. The number of times attack script detection is triggered is too high. Hackers often conduct probing attacks during the reconnaissance process, and obvious attack scripts can be found in some requests. The number of times normal users trigger detection scripts is far less than the number of times hacker attacks are detected.

[0078] 6. A relatively large number of API requests lacked preconditions. Analysis of the system's business logic revealed that some requests are strongly correlated. For example, in the "Add User" module, the normal browser operation should involve the user first entering the add page, filling in information, and then saving the user information. Based on these steps, the corresponding request should first call the add page's API, and only then the save API. If the user's request behavior lacks the request to open the add page, it can be inferred that a hacker may have already saved the API and is using non-browser tools to launch a probing attack on the save API.

[0079] 7. Short request intervals. Hacker attacks use brute-force attacks, sending requests quickly with short intervals between each request, which is obvious in contrast to normal user requests.

[0080] Based on this, embodiments of the present invention propose a method for detecting web page attack behavior by combining multiple web page request detection information.

[0081] Reference Figure 2 The diagram illustrates a flowchart of a webpage attack detection method provided by an embodiment of the present invention. The method may specifically include the following steps:

[0082] Step 101: Obtain the detection information of the web page request. The detection information of the web page request includes at least one of the following: web page request time, number of web page requests, web page request response status, web page request interface address, number of times the web page request triggered the detection attack script, and web page request call chain order.

[0083] The detection information for web page requests includes information obtained directly from the web page request message, information obtained by statistical processing of the web page request message, and other information about the user's web page request.

[0084] In one embodiment, information related to a user's webpage request can be obtained by: intercepting the webpage request through a system interceptor in the form of a Java component, and storing the intercepted webpage request in a database using either direct recording or asynchronous storage via message middleware. If the webpage request is stored using direct recording, real-time information acquisition and webpage attack detection can be achieved. If the webpage request is stored using asynchronous storage via message middleware, it is not affected by the performance of the database and will not affect the performance of the business system. However, compared to direct recording, there will be a certain delay in information acquisition and detection.

[0085] By further processing the intercepted web request information, we can obtain statistics on the request time, total number of web requests, response status of each web request, interface address in each web request, and call chain order of the web requests. The number of times a web request triggers a detection attack script can be obtained by acquiring interception records through the defense functions configured in the protection device or web system, and then counting the number of times a single user was blocked by the protection device or defense function.

[0086] Step 102: Generate corresponding feature information based on the detection information requested by the webpage.

[0087] In one embodiment, when the detection information of a webpage request is the webpage request time, corresponding feature information is generated based on the webpage request time, including: obtaining a preset abnormal time period interval, the abnormal time period interval including a start time; determining whether the webpage request time is within the abnormal time period interval; if the webpage request time is not within the abnormal time period interval, obtaining the webpage request time feature value as a first preset value; if the webpage request time is within the abnormal time period interval, calculating the time difference between the webpage request time and the start time; calculating the ratio of the time difference to a preset unit time period, the ratio being an integer, and multiplying the ratio by a preset attack risk score as the webpage request time feature value.

[0088] After obtaining the request time of the user's current webpage request, a webpage request time feature value can be generated based on the current webpage request time. For example, the abnormal time period can be set to 21:00 on the current day (start time) to 2:00 on the next day (end time), with the first preset value set to 0, the preset unit time period set to 15 minutes, and the preset attack risk score set to 0.5. After obtaining the user's webpage request time, it can be determined whether the webpage request time is within the abnormal time period. If the webpage request time is not within the abnormal time period, the webpage request time feature value is 0. If the webpage request time is within the abnormal time period, the time difference between the webpage request time and the start time can be calculated. Assuming the webpage request time is 22:00 on the current day, the time difference is 60 minutes. The ratio of the time difference (60 minutes) to the preset unit time period (15 minutes) is calculated, resulting in a ratio of 4. The product of the ratio (4) and the preset attack risk score (0.5) is calculated, resulting in a webpage request time feature value of 2.

[0089] Abnormal time intervals can be set based on experience or statistical analysis of user request times. For example, abnormal time intervals can be set to 21:00 on the current day to 8:00 on the next day. One or more abnormal time intervals can be set, such as 21:00 on the current day to 2:00 on the next day and 2:00 on the next day to 4:00 on the next day. When a user request time falls between 21:00 on the current day and 2:00 on the next day, the first preset value, preset unit time period, and preset attack risk score can be used to calculate the webpage request time characteristic value. When a user request time falls between 2:00 on the next day and 4:00 on the next day, the second preset value, preset unit time period, and preset attack risk score can be used to calculate the webpage request time characteristic value. The first preset value, preset unit time period, and preset attack risk score can be set by the user. The same or different first preset values, preset unit time periods, and preset attack risk scores can be set for different abnormal time intervals.

[0090] In one embodiment, when the detection information of a webpage request is the webpage request time, generating corresponding feature information based on the webpage request time further includes: calculating the time interval between each webpage request based on the webpage request time; calculating the average value of the webpage request time interval based on the time interval between each webpage request; and using the reciprocal of the average value of the webpage request time interval as the feature value of the webpage request time interval.

[0091] After obtaining the request times of each user's webpage requests, the time interval between each request within a unit of time can be calculated. The unit of time can be set arbitrarily, for example, to 1 minute. Then, the maximum time interval within the unit of time can be removed, and the average can be calculated. Finally, the reciprocal of the average is taken to obtain the characteristic value of the webpage request time interval. The specific formula is as follows:

[0092]

[0093] Where y is the characteristic value of the webpage request time interval, T n T represents the time of the nth request within a unit of time. n-1 This refers to the (n-1)th request time within a unit of time.

[0094] In one embodiment, when the detection information of a webpage request is the number of webpage requests, corresponding feature information is generated based on the number of webpage requests, including: taking the number of webpage requests that exceeds the average number of webpage requests as the feature value of the number of webpage requests; wherein, the average number of webpage requests is obtained in advance based on the number of webpage requests from multiple users.

[0095] In one embodiment, when the detection information of a webpage request is a webpage request response status, corresponding feature information is generated based on the webpage request response status, including: counting the number of webpage request response failures based on the webpage request response status; and using the value of the number of webpage request response failures exceeding the average number of webpage request response failures as the feature value of the webpage request response status; wherein the average number of webpage request response failures is obtained in advance based on the webpage request response statuses of multiple users.

[0096] After obtaining the response status of all user web page requests, count the number of times the user's response status is not 200. A non-200 status indicates that the web page request response failed. Calculate the number of times the number of user web page request response failures exceeds the average number of web page request response failures, and use this as the feature value of the web page request response status.

[0097] In one embodiment, when the detection information of a webpage request is a webpage request interface address, corresponding feature information is generated based on the webpage request interface address, including: obtaining a list of high-privilege interface addresses and the total number of high-privilege interface addresses; based on the webpage request interface address and the list of high-privilege interface addresses, counting the number of high-privilege interface addresses in the webpage request; and using the ratio of the number of high-privilege interface addresses in the webpage request to the total number of high-privilege interface addresses as the feature value of the webpage request interface address.

[0098] After obtaining the API addresses from all user web page requests, the API addresses in the web page requests can be compared with the list of high-privilege APIs configured initially in the system. The coverage rate of the API addresses in the user's web page requests over the high-privilege API addresses in this list can be calculated, which is also known as the web page request API address characteristic value. The specific formula is as follows:

[0099]

[0100] Where h(x) is the characteristic value of the web page request interface address, x is the number of high-privilege interface addresses in the user's web page request, and y is the total number of high-privilege interface addresses.

[0101] In one embodiment, when the detection information of a web page request is the call chain order of a web page request, corresponding feature information is generated based on the call chain order of the web page request, including: obtaining a pre-configured call chain order; based on the call chain order of the web page request and the pre-configured call chain order, counting the number of call chain orders in the web page request that do not conform to the pre-configured call chain order; and using the number of call chain orders that do not conform to the pre-configured call chain order as the feature value of the call chain order of the web page request.

[0102] In the system configuration, the developers configure the call chain order of the interfaces for running important business functions. After obtaining the configured call chain order, the call chain order of the user's web page request can be compared with the configured call chain order, and the number of missing steps in the call chain order of the user's web page request can be counted. Here, missing steps can be the first step that is missing, and the number of times is used as the feature value of the web page request call chain order.

[0103] Step 103: Input the feature information into the webpage attack detection model for processing to obtain the webpage attack detection result.

[0104] The web attack detection model contains a preset web attack detection algorithm. By inputting the feature information corresponding to the web request detection information into the web attack detection model, the web attack detection result can be calculated and output.

[0105] In one embodiment, the webpage attack detection algorithm can be the following algorithm:

[0106] z θ (x)=θ0+θ1x1+θ2x2+θ3x3+θ4x4+θ5x5+θ6x6+θ7x7 (3)

[0107]

[0108] Where θ0 represents the error bias, θ1-θ7 represent the influence coefficients of the seven feature information, θ0-θ7 are the pre-trained model parameters, x1-x7 represent the seven feature information, and g(z) θ(x) represents the results of webpage attack detection.

[0109] This invention acquires detection information of user webpage requests in real time, updates the corresponding feature information, and inputs the feature information into a webpage attack detection model to obtain the webpage attack detection result, thereby monitoring in real time whether the user request is a legitimate request. For example, if the detection information of the user's 36th webpage request is acquired in real time, the corresponding feature information is generated. Assume this set of feature information is as shown in the table below:

[0110] Table 1. Feature information corresponding to the detection information of the webpage request sent by the user for the 36th time.

[0111]

[0112] Substituting the feature information from Table 1 into the webpage attack detection algorithms (3) and (4), where the parameters θ0-θ7 in formula (3) are 0.0001537, 0.000364, 0.0074818, 0.0016912, 0.0033881, 0.0061081, 0.000238, and 0.0035923 respectively, the webpage attack detection result g(z) can be calculated. θ (x))=0.5105540571187034.

[0113] Step 104: Determine whether the webpage request is a normal request based on the webpage attack detection results.

[0114] In one embodiment, the webpage attack detection result is a webpage attack probability value. Determining whether a webpage request is a normal request based on the webpage attack detection result includes: if the webpage attack probability value is greater than or equal to a preset threshold, then the webpage request is determined to be an abnormal request; if the webpage attack probability value is less than the preset threshold, then the webpage request is determined to be a normal request.

[0115] For example, a preset threshold can be set to 0.5. If the probability of a webpage attack is greater than or equal to 0.5, the webpage request is determined to be an abnormal request; if the probability of a webpage attack is less than 0.5, the webpage request is determined to be a normal request. Continuing the example above, the webpage attack detection result g(z) calculated using the data in Table 1... θ If (x))=0.5105540571187034, which is greater than 0.5, then the 36th webpage request sent by the user can be determined to be an abnormal request. In other words, the 36th webpage request sent by the user is classified as an attack. At this time, an early warning can be generated based on this behavior.

[0116] like Figure 3The diagram shows a flowchart of another webpage attack detection method provided by an embodiment of the present invention. After training parameters θ0-θ7 through machine learning, the latest user request data is obtained and preprocessed to obtain seven types of feature information. The seven types of feature information are input into the webpage attack detection model for calculation to obtain an attack probability value. If the attack probability value is greater than or equal to 0.5, the user request is determined to be an attack behavior, and a warning is issued; if the attack probability is less than 0.5, the user request is determined to be a normal request.

[0117] In one embodiment, the webpage attack detection model can be trained using the gradient descent algorithm. The specific training process is as follows:

[0118] First, the loss function is determined based on the web attack detection model algorithm. The loss function can be as follows:

[0119] J(θ)=-ylog(g(z θ (x)))-(1-y)log(1-g(z θ (x))) (5)

[0120] Where y is the result of the actual attack behavior judgment. y can be 0 or 1, where 0 indicates that the web page request is a normal request and 1 indicates that the web page request is an abnormal request.

[0121] Taking the partial derivative of the loss function, we obtain the gradient function:

[0122]

[0123] The system acquires detection information of user web page requests and judgment results of actual attack behavior for each web page request within a preset time period. This data is used as sample data. The preset time period can be set by the user, for example, one month.

[0124] Randomly select n sets of detection information and corresponding actual attack behavior judgment results from the above data, where n is an integer greater than 0.

[0125] Based on these n sets of detection information, generate n sets of feature information, and substitute the n sets of feature information and the corresponding actual attack behavior judgment results into the gradient function to obtain n sets of gradient values.

[0126] The formula for calculating the average of n sets of gradient values ​​is as follows:

[0127]

[0128] in, y is the average of the gradient values. i y represents the actual attack behavior judgment result for group i. iIt can be 0 or 1, where 0 indicates that the webpage request is a normal request and 1 indicates that the webpage request is an abnormal request, and i≤n.

[0129] The parameters θ0-θ7 are updated based on the average of the gradient values, and the specific calculation formula is as follows:

[0130]

[0131] Where ε is the learning rate.

[0132] Again, randomly and without repetition select n sets of detection information and corresponding actual attack behavior judgment results. Update the parameters θ0-θ7 again using the detection information and corresponding actual attack behavior judgment results. Repeat this step until the parameters converge.

[0133] This invention, in its embodiments, acquires webpage request detection information, including at least one of the following: webpage request time, number of webpage requests, webpage request response status, webpage request interface address, number of times the webpage request triggered detection attack scripts, and webpage request call chain order. Based on this detection information, corresponding feature information is generated and input into a webpage attack detection model for processing to obtain a webpage attack detection result. The webpage attack detection result is then used to determine whether the webpage request is legitimate. This method combines multiple webpage request detection information to detect webpage attack behavior, thereby effectively identifying attack scripts in webpage requests and simultaneously detecting and protecting against privilege escalation and bypass attacks.

[0134] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0135] Reference Figure 4 The diagram shows a structural block diagram of a webpage attack detection device provided by an embodiment of the present invention, which may specifically include the following modules:

[0136] The detection information acquisition module 201 is used to acquire the detection information of web page requests. The detection information of web page requests includes at least one of the following: web page request time, number of web page requests, web page request response status, web page request interface address, number of times the web page request triggers the detection attack script, and web page request call chain order.

[0137] The feature information generation module 202 is used to generate corresponding feature information based on the detection information requested by the webpage.

[0138] The webpage attack detection module 203 is used to input feature information into the webpage attack detection model for processing and to obtain webpage attack detection results.

[0139] The webpage attack result judgment module 204 is used to determine whether a webpage request is a normal request based on the webpage attack detection result.

[0140] Optionally, the feature information generation module 202 is specifically used to obtain a preset abnormal time period interval, which includes the start time.

[0141] Determine if the webpage request time falls within an abnormal time range;

[0142] If the webpage request time is not in the abnormal time period range, the webpage request time characteristic value is the first preset value;

[0143] If the webpage request time falls within an abnormal time period, calculate the time difference between the webpage request time and the starting time; calculate the ratio of the time difference to a preset unit time period, round the ratio to an integer, and multiply the ratio by a preset attack risk score as the webpage request time feature value.

[0144] Optionally, the feature information generation module 202 is specifically used to calculate the time interval between each webpage request based on the webpage request time;

[0145] Calculate the average time interval between web page requests based on the time interval between each web page request;

[0146] The reciprocal of the average webpage request time interval is used as the characteristic value of the webpage request time interval.

[0147] Optionally, the feature information generation module 202 is specifically used to take the number of web page requests that exceeds the average number of web page requests as the feature value of the number of web page requests.

[0148] The average number of web page requests was calculated in advance based on the number of web page requests from multiple users.

[0149] Optionally, the feature information generation module 202 is specifically used to count the number of failed webpage request responses based on the webpage request response status;

[0150] The number of times a webpage request fails to respond exceeds the average number of times a webpage request fails to respond is used as a webpage request response status feature value.

[0151] The average number of failed webpage request responses was calculated in advance based on the webpage request response status of multiple users.

[0152] Optionally, the feature information generation module 202 is specifically used to obtain the list of high-privilege interface addresses and the total number of high-privilege interface addresses;

[0153] Based on the webpage request interface address and the list of high-privilege interface addresses, count the number of webpage requests that use high-privilege interface addresses.

[0154] The ratio of the number of high-privilege interface addresses in web page requests to the total number of high-privilege interface addresses is used as the characteristic value of the web page request interface address.

[0155] Optionally, the feature information generation module 202 is specifically used to obtain the pre-configured call chain order;

[0156] Based on the call chain order of the web page request and the pre-configured call chain order, count the number of web page requests whose call chain order does not conform to the pre-configured call chain order;

[0157] The number of calls that do not conform to the pre-configured call chain order is used as the web page request call chain order characteristic value.

[0158] Optionally, the web attack detection result is a web attack probability value. The web attack result judgment module 204 is specifically used to determine that the web request is an abnormal request if the web attack probability value is greater than or equal to a preset threshold.

[0159] If the probability of a webpage attack is less than a preset threshold, the webpage request is determined to be a normal request.

[0160] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0161] This invention also provides an electronic device, comprising:

[0162] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described web page attack detection method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0163] This invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described webpage attack detection method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0164] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0165] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0166] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0167] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0168] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0169] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0170] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0171] The foregoing has provided a detailed description of the webpage attack detection method, apparatus, electronic device, and storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for detecting webpage attacks, characterized in that, include: Obtain detection information for web page requests, which includes at least one of the following: web page request time, number of web page requests, web page request response status, web page request interface address, number of times the web page request triggers the detection attack script, and web page request call chain order. Generate corresponding feature information based on the detection information of the webpage request; The feature information is input into the web attack detection model for processing to obtain the web attack detection result. Determine whether the webpage request is a normal request based on the webpage attack detection results; The step of generating corresponding feature information based on the detection information of the webpage request includes: Obtain a preset abnormal time period interval, wherein the abnormal time period interval includes a start time; Determine whether the webpage request time falls within the abnormal time period; If the webpage request time is not within the abnormal time period, the webpage request time characteristic value is obtained as a first preset value; If the webpage request time is within the abnormal time period, then calculate the time difference between the webpage request time and the starting time; calculate the ratio of the time difference to a preset unit time period, the ratio being an integer, and multiply the ratio by a preset attack risk score as the webpage request time feature value; The detection information for web page requests also includes information obtained directly from the web page request message, information obtained by statistical processing of the web page request message, and information about the user's web page request. Information about web page requests from various users is obtained by intercepting web page requests through the system interceptor, and the intercepted web page requests are stored in the database using a message middleware asynchronous storage method; Before inputting the feature information into the webpage attack detection model for processing to obtain the webpage attack detection result, the process further includes: The various feature information is input into the web page attack detection model and calculated to generate an attack probability value. If the attack probability value is greater than or equal to a preset threshold, the user request is determined to be an attack behavior and an alert is issued. If the attack probability is less than the preset threshold, the user request is determined to be a normal request.

2. The webpage attack detection method according to claim 1, characterized in that, The step of generating corresponding feature information based on the detection information of the webpage request includes: Calculate the time interval between each webpage request based on the webpage request time; Calculate the average time interval between web page requests based on the time interval between each web page request; The reciprocal of the average webpage request time interval is used as the characteristic value of the webpage request time interval.

3. The webpage attack detection method according to claim 1, characterized in that, The step of generating corresponding feature information based on the detection information of the webpage request includes: The percentage by which the number of web page requests exceeds the average number of web page requests is used as a characteristic value of the number of web page requests. The average number of webpage requests is calculated in advance based on the number of webpage requests from multiple users.

4. The webpage attack detection method according to claim 1, characterized in that, The step of generating corresponding feature information based on the detection information of the webpage request includes: Based on the webpage request response status, count the number of webpage request response failures; The number of webpage request response failures exceeding the average number of webpage request response failures is used as the webpage request response status feature value. The average number of failed webpage request responses is calculated in advance based on the webpage request response status of multiple users.

5. The webpage attack detection method according to claim 1, characterized in that, The step of generating corresponding feature information based on the detection information of the webpage request includes: Obtain the list of high-privilege API addresses and the total number of high-privilege API addresses; Based on the webpage request interface address and the list of high-privilege interface addresses, count the number of webpage requests whose interface addresses are high-privilege interface addresses; The ratio of the number of high-privilege interface addresses in the web page request to the total number of high-privilege interface addresses is used as the feature value of the web page request interface address.

6. The webpage attack detection method according to claim 1, characterized in that, The step of generating corresponding feature information based on the detection information of the webpage request includes: Obtain the pre-configured call chain order; Based on the webpage request call chain order and the pre-configured call chain order, count the number of webpage requests whose call chain order does not conform to the pre-configured call chain order; The number of calls that do not conform to the pre-configured call chain order is used as the web page request call chain order feature value.

7. The webpage attack detection method according to claim 1, characterized in that, The webpage attack detection result is a webpage attack probability value. The step of determining whether a webpage request is a legitimate request based on the webpage attack detection result includes: If the webpage attack probability value is greater than or equal to a preset threshold, then the webpage request is determined to be an abnormal request. If the probability value of a webpage attack is less than a preset threshold, then the webpage request is determined to be a normal request.

8. A webpage attack detection device, characterized in that, The device includes: The detection information acquisition module is used to acquire detection information of web page requests. The detection information of web page requests includes at least one of the following: web page request time, number of web page requests, web page request response status, web page request interface address, number of times the web page request triggers the detection attack script, and web page request call chain order. The feature information generation module is used to generate corresponding feature information based on the detection information of the webpage request; The webpage attack detection module is used to input the feature information into the webpage attack detection model for processing, and obtain the webpage attack detection result. The webpage attack result judgment module is used to determine whether the webpage request is a normal request based on the webpage attack detection result. The feature information generation module is specifically used to obtain a preset abnormal time period interval, which includes a start time. Determine whether the webpage request time falls within the abnormal time period; If the webpage request time is not within the abnormal time period, the webpage request time characteristic value is obtained as a first preset value; If the webpage request time is within the abnormal time period, then calculate the time difference between the webpage request time and the starting time; calculate the ratio of the time difference to a preset unit time period, the ratio being an integer, and multiply the ratio by a preset attack risk score as the webpage request time feature value; The detection information for web page requests also includes information obtained directly from the web page request message, information obtained by statistical processing of the web page request message, and information about the user's web page request. Information about web page requests from various users is obtained by intercepting web page requests through the system interceptor, and the intercepted web page requests are stored in the database using a message middleware asynchronous storage method; The webpage attack detection module is also used to input various feature information into the webpage attack detection model and perform calculations to generate an attack probability value. If the attack probability value is greater than or equal to a preset threshold, the user request is determined to be an attack behavior, and an early warning is issued. When the attack probability is less than the preset threshold, the user request is determined to be a normal request.

9. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of the webpage attack detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the webpage attack detection method as described in any one of claims 1-7.

Images