Interface attack detection method and device, electronic equipment and storage medium

Abstract

The present disclosure provides a method and device for detecting interface attacks, electronic equipment and storage medium, which relates to the technical fields of information flow, network security, artificial intelligence and machine learning. The specific implementation scheme is: obtaining an access request of an interface; obtaining a plurality of access triplets based on the access request; each access triplet includes user agent information, key information of a header, and value information corresponding to the key information; obtaining access feature information of each access triplet; based on the access feature information of each access triplet of the access request and a pre-trained trust score model, detecting whether the access request is an attack. The technology of the present disclosure can effectively improve the efficiency of interface attack detection.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, in particular to the technical field of information flow, network security, artificial intelligence and machine learning, and more particularly to an interface attack detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the development of Internet technology, more and more interfaces are exposed on the Internet, and various functions can be achieved through the interfaces, such as registering an account, posting a post, sending an instant message, etc. Interface attacks are usually manifested as Hyper Text Transfer Protocol (HTTP) requests or Hypertext Transfer Protocol Secure (HTTPS) requests. SUMMARY

[0003] The present disclosure provides an interface attack detection method and device, electronic equipment and storage medium.

[0004] According to an aspect of the present disclosure, an interface attack detection method is provided, comprising:

[0005] obtaining an access request of an interface;

[0006] based on the access request, obtaining a plurality of access triplets; each access triplet comprises user agent information, key information of a header, and value information corresponding to the key information;

[0007] obtaining access feature information of each access triplet;

[0008] based on the access feature information of each access triplet of the access request and a pre-trained trust score model, detecting whether the access request is an attack.

[0009] According to another aspect of the present disclosure, an interface attack detection device is provided, comprising:

[0010] a request obtaining module configured to obtain an access request of an interface;

[0011] a triplet obtaining module configured to obtain a plurality of access triplets based on the access request; each access triplet comprises user agent information, key information of a header, and value information corresponding to the key information;

[0012] a feature obtaining module configured to obtain access feature information of each access triplet;

[0013] The detection module is configured to detect whether the access request is an attack based on access feature information of each of the access triplets of the access request and a pre-trained trust score model. According to still another aspect of the present disclosure, an electronic device is provided, comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein

[0016] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any possible implementation of the above aspects.

[0017] According to still another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, the computer instructions being used to cause a computer to perform the method of any possible implementation of the above aspects.

[0018] According to still another aspect of the present disclosure, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the method of any possible implementation of the above aspects.

[0019] According to the technology of the present disclosure, the efficiency of interface attack detection can be effectively improved.

[0020] It should be understood that the content described in this section is not intended to identify key or important features of the embodiments of the present disclosure, nor is it used to limit the scope of the present disclosure. Other features of the present disclosure will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings are used to better understand the present scheme and do not limit the present disclosure. Among them:

[0022] Figure 1 is a schematic diagram according to a first embodiment of the present disclosure;

[0023] Figure 2 is a schematic diagram according to a second embodiment of the present disclosure;

[0024] Figure 3 is a schematic diagram according to a third embodiment of the present disclosure;

[0025] Figure 4 is a schematic diagram according to a fourth embodiment of the present disclosure;

[0026] Figure 5 is a block diagram of an electronic device for implementing the method of the embodiments of the present disclosure. DETAILED DESCRIPTION

[0027] Exemplary embodiments of the present disclosure are described herein with reference to the accompanying drawings, which are included to provide a thorough understanding of embodiments of the present disclosure by a person of ordinary skill in the art, and should not be construed as limiting the present disclosure to particular embodiments. Thus, it will be apparent to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Also, descriptions of well-known functions and constructions are omitted for clarity and conciseness.

[0028] It is apparent that the described embodiments are merely a part of embodiments of the present disclosure, but not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative effort fall within the scope of the present disclosure.

[0029] It should be noted that the terminal device involved in the embodiments of the present disclosure can include, but is not limited to, a mobile phone, a personal digital assistant (PDA), a wireless handheld device, a tablet computer, and the like. The display device can include, but is not limited to, a personal computer, a television, and the like.

[0030] In addition, the term "and / or" in the present disclosure is merely a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in the present disclosure generally represents an "or" relationship between the front and rear associated objects.

[0031] The conventional method for identifying interface attacks usually needs to use a Token / Sign mechanism, which needs to cooperate with a software development kit (SDK) of a client and protect the Token / Sign output mechanism. Specifically, the front-end SDK and the back-end interface need to be connected together, and each interface needs to be connected, otherwise the interface cannot be protected. In general, the back-end usually has dozens or even hundreds of interfaces, and it is difficult to connect each interface one by one. Therefore, the existing interface attack detection scheme has high access cost and low interface attack detection efficiency.

[0032] Figure 1 is a schematic diagram according to the first embodiment of the present disclosure; as Figure 1 shown, the present embodiment provides a method for detecting interface attacks, which can specifically include the following steps:

[0033] S101, obtaining an access request of an interface;

[0034] In this embodiment, the access request for the interface can be an access request sent by a browser.

[0035] S102. Based on the access request, obtain multiple access triples;

[0036] Each access triple includes (User Agent; UA) information, the key information of the header, and the value information corresponding to the key. That is, each access triple includes UA information, header key, and header value.

[0037] S103. Obtain the access characteristic information of each access triplet;

[0038] S104. Based on the access feature information of each access triplet in the access request and the pre-trained trustworthy scoring model, detect whether the access request is an attack.

[0039] The execution entity of the interface attack detection method in this embodiment is an interface attack detection device. This device can be deployed at the traffic entry point of the server to detect all interface access requests, identify traffic belonging to interface attacks, and effectively block them.

[0040] In this embodiment, the obtained interface access request can be an HTTP request initiated by the browser to any interface.

[0041] For an HTTP request, the HTTP header can include User-Agent (UA) information, multiple keys, and a value for each key. When retrieving the access triple based on the access request, the UA can be combined with each key and its corresponding value to form an access triple. Therefore, the number of access triples that can be included in the header of an HTTP request corresponds to the number of keys it contains.

[0042] Access feature information for accessing triples can be obtained based on all access information for accessing triples.

[0043] The interface attack detection method of this embodiment can provide protection for cloud interfaces without integrating a JS SDK, effectively reducing integration costs and improving the efficiency of interface attack detection. Furthermore, this interface attack detection method is applicable to detecting any attack on any interface, exhibiting strong dynamic protection performance. It can detect interface attacks in a timely, accurate, comprehensive, and continuous manner, identify risks, effectively improve the efficiency of interface attack detection, and enhance the interface's protection capabilities.

[0044] Figure 2 This is a schematic diagram based on the first embodiment of the present disclosure; as shownFigure 2 As shown, this embodiment provides a method for detecting interface attacks, which may specifically include the following steps:

[0045] S201. Obtain the access request for the interface;

[0046] In this embodiment, the access request for the interface can be a browser interface access request, that is, an access request initiated by the browser interface to the server.

[0047] The execution entity of the interface attack detection method in this embodiment is an interface attack detection device. This interface attack device is deployed at the traffic entry point on the server side to detect each access request received by the server in order to determine whether the corresponding access request is normal traffic or whether there is a risk of interface attack.

[0048] S202. Based on the access request, obtain the key sequence order identifier in the header;

[0049] Specifically, the header of an access request includes multiple keys. This step is used to obtain the sequence identifier of the keys in the header, thus obtaining the key sequence identifier of the header. For example, if the header of an access request contains four keys from beginning to end: Key1, Key2, Key3, and Key4, then based on this access request, the key sequence identifier of the header can be obtained as: [Key1, Key2, Key3].

[0050] S203. Based on the key sequence identifier in the header, detect whether the access request is an attack; if it is an attack, proceed to step S204; otherwise, proceed to step S205.

[0051] Specifically, it can detect whether the key sequence of the header matches a preset order; if it does not, the access request is determined to be an attack.

[0052] For example, a preset order requirement might stipulate that the key sequence identifiers in the header should be in ascending order, such as [Key1, Key2, Key3]. If the key sequence identifiers in the header are [Key1, Key3, Key2], this does not conform to the preset order requirement. In this case, the access request can be considered an attack.

[0053] S204. Intercept the access request and end.

[0054] S205. Based on the access request, obtain multiple access triples; each access triple includes UA information, HeaderKey, and Header Value; execute step S206.

[0055] In this embodiment, the access request is initiated by the browser. The UA information refers to the browser's UA information. The Header Key and Header Value refer to a key and its corresponding value in the header of the access request, respectively. The number of access triples that can be obtained corresponds to the number of keys in the header of the access request.

[0056] S206. For each access triplet, obtain the access feature information of the corresponding access triplet in terms of traffic, IP, and historical behavior dimensions; execute step S207.

[0057] For each access triplet, obtain the following access characteristic information for the access triplet within a preset time period prior to the current time:

[0058] The number of access requests initiated based on the access triplet, the number of normal access requests initiated based on the access triplet, the number of malicious attacks initiated based on the access triplet, the number of access requests corresponding to risky IPs in the access requests initiated based on the access triplet, the number of IPs corresponding to the access requests initiated based on the access triplet, the number of access requests with browser risks in the access requests initiated based on the access triplet, the number of users corresponding to the access requests initiated based on the access triplet, and the number of risky users in the access requests initiated based on the access triplet.

[0059] For example, within a preset time period, the more normal access requests initiated based on the access triplet and the fewer malicious attacks, the more trustworthy the access triplet is identified. The more access requests corresponding to risky IPs initiated based on the access triplet, the less trustworthy the access triplet is identified. The fewer IPs corresponding to the access requests based on the access triplet, the greater the likelihood of a malicious attack, and the less trustworthy the access triplet is identified. The more access requests with browser risks initiated based on the access triplet, the less trustworthy the access triplet is identified. The more users corresponding to the access requests initiated based on the access triplet, the more trustworthy the access triplet is identified; conversely, the fewer users corresponding to the access requests initiated based on the access triplet, the greater the likelihood of a malicious attack, and the less trustworthy the access triplet is identified. The more risky users in the access requests initiated based on the access triplet, the less trustworthy the access triplet is identified.

[0060] The aforementioned access feature information includes traffic, IP, and historical behavior dimensions of the access triplet. This information can more accurately and objectively identify the access features of the access triplet from multiple dimensions, and thus, based on the access feature information of each access triplet, access requests can be detected more accurately.

[0061] In practical applications, even more and richer access feature information can be obtained, which will not be listed here.

[0062] The preset time length in this embodiment can be 1 hour, 2 hours, or other time lengths. In practical applications, in order to obtain more accurate, comprehensive, and richer feature information of the access triples, the above feature information within multiple different preset time lengths before the current moment can be obtained simultaneously to obtain the score of each access triple more accurately.

[0063] S207. Based on the access feature information of each access triplet, a pre-trained reliable scoring model is used to obtain the score of each access triplet; proceed to step S208.

[0064] Specifically, for each access triple, the access feature information of the access triple is input into the trusted scoring model, and the trusted scoring model outputs the score of the access triple.

[0065] The closer the score output by this credibility scoring model is to 0, the more credible the access triple is. Conversely, the higher the score, the less credible the access triple is.

[0066] S208. Based on the scores of each access triplet and referring to the preset scoring threshold, determine whether there is an untrusted access triplet among the multiple access triplets; if so, proceed to step S209; otherwise, if not, determine that the access request is normal traffic, allow it, and end.

[0067] Specifically, it can be detected whether the scores of each access triplet are all less than or equal to a scoring threshold. If not, it means that there are access triplets among the access triplets whose scores are greater than the scoring threshold. If the score of an access triplet is greater than the scoring threshold, it indicates that the access triplet is risky. That is, it can be determined at this point that there is an untrusted access triplet among multiple access triplets; thus, it can be determined that the access request is an attack; furthermore, in the interface attack detection device, the access request can be intercepted to avoid further risks brought about by the attack.

[0068] If the scores of all access triples are less than or equal to the score threshold, then all access triples in the access request can be considered trustworthy and posed no risk. In this case, the access request can be determined to be normal traffic without any attack risk, and can be allowed to proceed.

[0069] S209. Determine that the access request is an attack, and proceed to step S204;

[0070] This detection method can quickly and accurately detect the presence of untrusted access triples in access triples, thereby identifying access requests as attacks. The detection method is accurate and efficient.

[0071] In this embodiment, steps S202 and S203 are first used to detect whether the access request is an attack based on the key sequence order identifier in the header. If it is not an attack, steps S205-S209 are further used to detect whether the access request is an attack based on multiple access triples in the access request. Optionally, in practical applications, steps S205-S209 can also be used first to detect whether the access request is an attack based on multiple access triples in the access request; if it is not an attack, steps S202 and S203 can then be used to detect whether the access request is an attack based on the key sequence order identifier in the header. In short, only when the access request is not detected as an attack by both methods can it be determined that the access request is not an attack. As long as one method determines that the access request is an attack, the access request is determined to be an attack and the access request is blocked to avoid the risk of attack.

[0072] The trustworthy scoring model in this embodiment is trained using trusted access request data. For example, training this trustworthy scoring model may specifically include the following steps:

[0073] (1) Obtain multiple trusted access requests;

[0074] For example, you can control the JS (JavaScript) SDK to send multiple trusted access requests to the secure cloud; and retrieve multiple trusted access requests from the secure cloud; and / or

[0075] An automated testing suite can be used to collect a list of all known secure browsers, such as all versions of Chrome and Firefox. Then, browsers from this list can be manipulated to send HTTP access requests to a secure cloud; these requests are also considered trusted access requests. Correspondingly, the secure cloud can receive multiple trusted access requests; and thus, multiple trusted access requests can be retrieved from the secure cloud.

[0076] Alternatively, in practical applications, multiple original access requests can be obtained; and multiple trusted access requests can be selected from the multiple original access requests according to a preset trusted access request filtering strategy.

[0077] The multiple raw access requests in this implementation can be considered genuine access traffic received by the backend server. However, some of these access requests are legitimate and trustworthy user requests, while others may be malicious attacks. Therefore, it is necessary to filter out multiple trustworthy access requests from the multiple raw access requests according to a preset trustworthy access request filtering strategy.

[0078] For example, a pre-defined trusted access request filtering strategy can be based on statistics of a user's normal historical access requests. This could include at least one of the following: the User Agent (UA) must be a legitimate browser UA; the Key value must be reasonable; the Key order must be reasonable; and the Value value must be reasonable. For example, the Key in the header of a browser's trusted access request should include the Content-Type. Internet Explorer's trusted access requests should not contain the Access-Control-Allow-Origin flag, which allows cross-domain access. For Internet Explorer, its trusted access requests... Encoding type The value of Accept-Encoding should not contain br.

[0079] (2) Based on each trusted access request, obtain the corresponding multiple access triples;

[0080] Referring to the method of obtaining multiple access triples from access requests in the above embodiments, multiple access triples can also be obtained for each trusted access request.

[0081] (3) Obtain the access feature information of each access triplet; and configure the trusted label of each access triplet as 0; that is, the score is 0;

[0082] In this embodiment, the method for obtaining the access feature information of each access triplet is the same as described in the above embodiment, and will not be repeated here.

[0083] In this embodiment, the trusted label of each access triple is configured to be 0, that is, the score of each access triple is configured to be 0. The scoring rule of this embodiment requires that the lower the score of the access triple, that is, the closer it is to 0, the more trusted the access triple is identified; conversely, if the score of the access triple is higher, that is, the further away from 0, the less trusted the access triple is identified.

[0084] (4) The credibility scoring model is trained based on the feature information and credibility labels of each access triplet.

[0085] In this embodiment, feature information and corresponding trust labels of all access triples corresponding to multiple trusted access requests are selected to train the trust scoring model. Since the access requests are trusted access requests, the corresponding access triples are also trusted access triples, and the corresponding trust label scores are all 0. This can be understood as the training data for training the trust scoring model in this embodiment being all positive sample data. Through this training, the trust scoring model can learn the ability to score access triples based on their access feature information.

[0086] After training, the credibility scoring model assigns a lower score to a visiting triple, indicating a more credible triple, and a higher score, indicating a less credible triple. This can be combined with a preset scoring threshold. For example, if the credibility scoring model scores a visiting triple less than or equal to the preset threshold, the visiting triple is considered credible; conversely, if the score exceeds the threshold, the visiting triple is considered untrustworthy.

[0087] For example, during training, the feature information of each access triplet is input into the trusted scoring model. Based on the input information, the trusted scoring model predicts a score. The parameters of the trusted scoring model are then adjusted based on the trusted label score (0) and the predicted score, so that the predicted score closely approximates the trusted label score. By using the access feature information of multiple access triplets from multiple trusted access requests and their corresponding trusted labels, and training the trusted scoring model in the above manner, the model can converge, resulting in the trusted scoring model.

[0088] The interface attack detection method in this embodiment detects whether the key sequence of the header conforms to a preset order. If it does not conform, the access request is determined to be an attack, which improves the detection efficiency of interface attacks. If the key sequence of the header conforms to the preset order, a pre-trained trusted scoring model is used to obtain the score of each access triplet based on the access feature information of each access triplet. If the scores of each access triplet are not all less than or equal to a scoring threshold, an untrusted access triplet is determined among the multiple access triplets, thus the access request is determined to be an attack and is blocked. This embodiment can dynamically detect interface attacks, providing very strong dynamic protection performance. It can detect interface attacks in a timely, accurate, comprehensive, and continuous manner, effectively improving the detection efficiency of interface attacks and enhancing the protection capability of the interface.

[0089] The API attack detection method in this embodiment is deployed on the backend of the access party. During detection, all traffic enters the access party's backend. Using the API attack detection method of this embodiment, all incoming traffic can be detected, and traffic that is an API attack can be intercepted. This solution can provide protection for cloud interfaces without integrating a JS SDK, and can also provide security protection for various types of interfaces, preventing them from being attacked.

[0090] Figure 3 This is a schematic diagram based on the third embodiment of this disclosure; as shown Figure 3 As shown, this embodiment provides an interface attack detection device 300, including:

[0091] The request retrieval module 301 is used to retrieve access requests for the interface;

[0092] The triplet acquisition module 302 is used to acquire multiple access triplets based on the access request; each access triplet includes user agent information, key information in the header, and value information corresponding to the key information;

[0093] Feature acquisition module 303 is used to acquire access feature information of each of the access triplets;

[0094] The detection module 304 is used to detect whether the access request is an attack based on the access feature information of each access triplet of the access request and a pre-trained trustworthy scoring model.

[0095] The interface attack detection device 300 in this embodiment achieves the same implementation principle and technical effect as the above-mentioned related method embodiments by using the above-mentioned modules. For details, please refer to the description of the above-mentioned related method embodiments, which will not be repeated here.

[0096] Figure 4 This is a schematic diagram based on the fourth embodiment of the present disclosure; as shown Figure 4 As shown, this embodiment provides an interface attack detection device 400, including: [the aforementioned...] Figure 3 The modules with the same name and function are: request acquisition module 401, triple acquisition module 402, feature acquisition module 403, and detection module 404.

[0097] In this embodiment, the feature acquisition module 403 is used for:

[0098] For each access triple, obtain access feature information of the corresponding access triple in terms of traffic, IP, and historical behavior dimensions.

[0099] In one embodiment of this disclosure, the feature acquisition module 403 is configured to:

[0100] For each access triplet, the following access characteristic information of the access triplet within a preset time length prior to the current time is obtained:

[0101] The number of access requests initiated based on the access triplet, the number of normal access requests initiated based on the access triplet, the number of malicious attacks initiated based on the access triplet, the number of access requests corresponding to risky IPs in the access requests initiated based on the access triplet, the number of IPs corresponding to the access requests initiated based on the access triplet, the number of access requests with browser risks in the access requests initiated based on the access triplet, the number of users corresponding to the access requests initiated based on the access triplet, and the number of risky users in the access requests initiated based on the access triplet.

[0102] In one embodiment of this disclosure, the detection module 404 is configured to:

[0103] Based on the access feature information of each access triplet, the pre-trained reliable scoring model is used to obtain the score of each access triplet.

[0104] Based on the scores of each access triplet, and with reference to a preset scoring threshold, it is determined whether there is an untrustworthy access triplet among the plurality of access triplets;

[0105] If it exists, the access request is determined to be an attack.

[0106] In one embodiment of this disclosure, the detection module 404 is configured to:

[0107] Detect whether the scores of each of the access triples are all less than or equal to the score threshold;

[0108] If not, it is determined that there is an untrusted access triple among the plurality of access triples.

[0109] like Figure 4 As shown, in one embodiment of this disclosure, the interface attack detection device 400 further includes:

[0110] The key sequence acquisition module 405 is used to acquire the key sequence order identifier in the header based on the access request.

[0111] In one embodiment of this disclosure, the detection module 404 is further configured to:

[0112] Based on the key sequence identifier in the header, it is determined whether the access request is an attack.

[0113] In one embodiment of this disclosure, the detection module 404 is used for:

[0114] Detect whether the key sequence order identifier in the header conforms to a preset order relationship;

[0115] If the conditions are not met, the access request is determined to be an attack.

[0116] like Figure 4 As shown, in one embodiment of this disclosure, the interface attack detection device 400 further includes:

[0117] The interception module 406 is used to intercept the access request if the access request is an attack.

[0118] The interface attack detection device 400 in this embodiment achieves the same implementation principle and technical effect as the above-mentioned related method embodiments by using the above-mentioned modules. For details, please refer to the description of the above-mentioned related method embodiments, which will not be repeated here.

[0119] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0120] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0121] like Figure 5 As shown, device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 502 or a computer program loaded from storage unit 508 into random access memory (RAM) 503. RAM 503 may also store various programs and data required for the operation of device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0122] Multiple components in device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0123] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as the methods of this disclosure. For example, in some embodiments, the methods of this disclosure may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the methods of this disclosure described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the methods of this disclosure by any other suitable means (e.g., by means of firmware).

[0124] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0125] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0126] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0127] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0128] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0129] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0130] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0131] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for detecting an interface attack, comprising: obtaining an access request of an interface; obtaining a plurality of access triplets based on the access request; each of the access triplets comprises user agent information, key information of a header, and value information corresponding to the key information; obtaining access feature information of each of the access triplets; detecting whether the access request is an attack based on the access feature information of each of the access triplets of the access request and a pre-trained trust score model; wherein detecting whether the access request is an attack based on the access feature information of each of the access triplets of the access request and the pre-trained trust score model comprises: obtaining a score of each of the access triplets by using the pre-trained trust score model based on the access feature information of each of the access triplets; determining whether there is an untrustworthy access triplet in the plurality of access triplets based on the score of each of the access triplets and a preset score threshold; if so, determining that the access request is an attack; wherein determining whether there is an untrustworthy access triplet in the plurality of access triplets based on the score of each of the access triplets and the preset score threshold comprises: detecting whether the score of each of the access triplets is less than or equal to the score threshold; if not, determining that there is an untrustworthy access triplet in the plurality of access triplets; wherein obtaining the access feature information of each of the access triplets comprises, for each of the access triplets, obtaining access feature information of corresponding traffic, IP, and historical behavior dimensions of the access triplet.

2. The method of claim 1, wherein, For each of the access triplets, obtaining access feature information of corresponding traffic, IP, and historical behavior dimensions of the access triplet comprises: for each of the access triplets, obtaining the following access feature information of the corresponding access triplet within a preset time length before the current time: at least one of the number of access requests initiated based on the access triplet, the number of normal access requests initiated based on the access triplet, the number of malicious attacks initiated based on the access triplet, the number of access requests corresponding to a risk IP in the access requests initiated based on the access triplet, the number of corresponding IPs in the access requests initiated based on the access triplet, the number of access requests with browser risks in the access requests initiated based on the access triplet, the number of corresponding users in the access requests initiated based on the access triplet, and the number of risk users in the access requests initiated based on the access triplet.

3. The method of claim 1, wherein, The method further comprises: obtaining a key sequence order identifier of the header based on the access request.

4. The method of claim 3, wherein, The method further comprises: detecting whether the access request is an attack based on the key sequence order identifier of the header.

5. The method of claim 4, wherein, Detecting whether the access request is an attack based on the key sequence order identifier of the header comprises: detecting whether the key sequence order identifier of the header conforms to a preset order relationship; if not, determining that the access request is an attack.

6. The method of any one of claims 1-5, wherein, The method further comprises: if the access request is an attack, intercepting the access request.

7. An apparatus for detecting an interface attack, comprising: a request obtaining module configured to obtain an access request of an interface; a triple obtaining module configured to obtain a plurality of access triples based on the access request; each of the access triples comprises user agent information, key information of a header, and value information corresponding to the key information; a feature obtaining module configured to obtain access feature information of each of the access triples; a detection module configured to detect whether the access request is an attack based on the access feature information of each of the access triples of the access request and a pre-trained trust score model; wherein the detection module is configured to: obtain a score of each of the access triples based on the access feature information of each of the access triples by using the pre-trained trust score model; determine whether there is an untrustworthy access triple in the plurality of access triples based on the score of each of the access triples and by referring to a preset score threshold; if there is, determine that the access request is an attack; wherein the detection module is configured to: detect whether the score of each of the access triples is less than or equal to the score threshold; if not, determine that there is an untrustworthy access triple in the plurality of access triples. The feature obtaining module is configured to: for each of the access triples, obtain access feature information of the corresponding access triple in the dimensions of traffic, IP, and historical behavior.

8. The apparatus of claim 7, wherein, The feature obtaining module is configured to: for each of the access triples, obtain the following access feature information of the corresponding access triple in a preset time length before the current time: at least one of the number of access requests initiated based on the access triple, the number of normal access requests initiated based on the access triple, the number of malicious attacks initiated based on the access triple, the number of access requests corresponding to a risk IP in the access requests initiated based on the access triple, the number of corresponding IPs in the access requests initiated based on the access triple, the number of access requests with browser risks in the access requests initiated based on the access triple, the number of corresponding users in the access requests initiated based on the access triple, and the number of risk users in the access requests initiated based on the access triple.

9. The apparatus of claim 7, wherein, The apparatus further comprises: a key sequence obtaining module configured to obtain a key sequence order identifier of a header based on the access request.

10. The apparatus of claim 9, wherein, The detection module is further configured to: detect whether the access request is an attack based on the key sequence order identifier of the header.

11. The apparatus of claim 10, wherein, The detection module is configured to: detect whether the key sequence order identifier of the header conforms to a preset order relationship; if not, determine that the access request is an attack.

12. The apparatus of any of claims 7-11, wherein, The apparatus further comprises: an interception module configured to intercept the access request if the access request is an attack.

13. An electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication; wherein, ​ The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

14. A non-transitory computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions are for causing the computer to perform the method of any one of claims 1-6.

15. A computer program product comprising a computer program which, when executed by a processor, implements the method of any one of claims 1-6.

Images