Attack protection method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application disclose an attack protection method and device, electronic equipment and a storage medium. The attack protection method comprises: when it is determined that a first access request is an attack request, sending a request response to a client sending the first access request, wherein the request response comprises a code file; receiving a second access request sent by the client; when the second access request is a preset access request, returning an analog website to the client, wherein the preset access request is an access request for accessing a dynamic resource file triggered by the code file running in the client; and the analog website is used to obtain identity information of the client. In this way, the real hacker attack can be protected and handled.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, and in particular to an attack protection method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of Internet technology, website security problems are also paid more and more attention by people, and some budgeted units will deploy honeypot in their own network for tracing. The honeypot attracts attacks through simulated network and services, so as to record and analyze attack behavior and process during the honeypot is attacked, to collect information and trace. However, the deployment of honeypot is complex, which will involve hardware devices and software devices, and the tracking and identity recognition ability of honeypot product to attackers is limited.

[0003] Therefore, how to accurately distinguish hacker attacks from a large number of attacks, guide the flow to the honeypot while tracing the attack, and how to solve the problem of complex honeypot deployment process, are problems to be further solved in the prior art. SUMMARY

[0004] Therefore, the embodiments of the present application expect to provide an attack protection method and device, electronic equipment and storage medium.

[0005] The technical scheme of the present application is implemented as follows:

[0006] In a first aspect, the embodiments of the present application provide an attack protection method, comprising:

[0007] When it is determined that the first access request is an attack request, a request response is sent to the client sending the first access request, wherein the request response comprises a code file;

[0008] The second access request sent by the client is received;

[0009] When the second access request is a preset access request, a simulated website is returned to the client, wherein the preset access request is an access request for accessing a dynamic resource file triggered by the code file running in the client; and the simulated website is used to obtain the identity information of the client.

[0010] Based on the above scheme, the method further comprises at least one of the following:

[0011] When the request content of the first access request hits the features contained in the firewall filtering rule, it is determined that the first access request is an attack request;

[0012] When the path of the target website accessed by the first access request is a preset path, it is determined that the first access request is an attack request.

[0013] Based on the above scheme, the method further comprises:

[0014] generating an access record of the first access request;

[0015] verifying, according to the access record, whether there is a preset correlation between the second access request and the first access request;

[0016] when the second access request is a preset access request, returning a simulation website to the client, comprising:

[0017] when the second access request is the preset access request and the second access request and the first access request have the preset correlation, returning a simulation website to the client.

[0018] Based on the above scheme, the verifying, according to the access record, whether there is a preset correlation between the second access request and the first access request, comprises:

[0019] comparing the access record with historical access information carried by the second access request;

[0020] when the historical access information is contained in the access record, determining that the second access request has a preset correlation with the first access request.

[0021] Based on the above scheme, the access record comprises at least one of:

[0022] an access time of the first access request;

[0023] a website accessed by the first access request;

[0024] a request type of the first access request.

[0025] Based on the above scheme, the method further comprises:

[0026] when the second access request and the first access request do not have the preset correlation, sending a website of an abnormal webpage to the client.

[0027] Based on the above scheme, the abnormal webpage comprises at least one of:

[0028] a blank webpage;

[0029] a garbled webpage.

[0030] Based on the above scheme, when the second access request is the preset access request, the second access request further comprises: identification information of a browser in the client.

[0031] Based on the above scheme, the identification information comprises:

[0032] The summary information of the configuration information and / or running information of the browser.

[0033] Based on the above scheme, the method further comprises:

[0034] Obtaining the identity information of the client based on the simulated website.

[0035] Obtaining the identity information of the client based on the simulated website.

[0036] When the second access request and the first access request are from the same client, outputting the access information of the first access request and the identity information of the client.

[0037] In a second aspect, an attack protection device is provided, comprising:

[0038] The first sending module is configured to send a request response to the client sending the first access request when it is determined that the first access request is an attack request, wherein the request response comprises a code file.

[0039] The receiving module is configured to receive a second access request sent by the client.

[0040] The returning module is configured to return a simulated website to the client when the second access request is a preset access request, wherein the preset access request is an access request for accessing a dynamic resource file triggered by the code file running in the client; and the simulated website is used to obtain the identity information of the client.

[0041] Based on the above scheme, the device further comprises at least one of the following:

[0042] The first determining module is configured to determine that the first access request is an attack request when the request content of the first access request hits the features contained in the firewall filtering rules.

[0043] The second determining module is configured to determine that the first access request is an attack request when the path of the target website accessed by the first access request is a preset path.

[0044] Based on the above scheme, the device further comprises:

[0045] The generating module is configured to generate an access record of the first access request.

[0046] The verifying module is configured to verify whether there is a preset association between the second access request and the first access request according to the access record.

[0047] The method further includes: returning a simulated website to the client when the second access request is a preset access request.

[0048] The method further includes: returning a simulated website to the client when the second access request is the preset access request and the second access request and the first access request have the preset correlation.

[0049] According to the above scheme, the method further includes:

[0050] Comparing the access record with historical access information carried by the second access request;

[0051] When the historical access information is contained in the access record, determining that the second access request and the first access request have the preset correlation.

[0052] According to the above scheme, the access record includes at least one of:

[0053] An access time of the first access request;

[0054] A website accessed by the first access request;

[0055] A request type of the first access request.

[0056] According to the above scheme, the device further includes:

[0057] A second sending module, configured to send a website of an abnormal webpage to the client when the second access request and the first access request do not have the preset correlation.

[0058] According to the above scheme, the abnormal webpage includes at least one of:

[0059] A blank webpage;

[0060] A garbled webpage.

[0061] According to the above scheme, when the second access request is the preset access request, the second access request further includes identification information of a browser in the client.

[0062] According to the above scheme, the identification information includes:

[0063] Summary information of configuration information and / or running information of the browser.

[0064] According to the above scheme, the device further includes:

[0065] A first obtaining module, configured to obtain the identification information based on the simulated website.

[0066] The second obtaining module is configured to obtain identity information of the client based on the identification information.

[0067] The output module is configured to output the access information of the first access request and the identity information of the client when the second access request and the first access request are from the same client.

[0068] In a third aspect, an embodiment of the present application provides an electronic device, comprising:

[0069] The memory stores computer readable instructions.

[0070] The processor is connected with the memory, and is configured to realize the attack protection method provided in any technical solution of the first aspect or the second aspect by executing the computer executable instructions stored in the memory.

[0071] In a fourth aspect, an embodiment of the present application provides a computer storage medium, which stores computer executable instructions, and the computer executable instructions can realize the attack protection method provided in any technical solution of the first aspect or the second aspect after being executed.

[0072] The attack protection method, device, electronic device and storage medium provided by the embodiment of the present application can return a request response containing a code file to the client sending the first access request when it is determined that the first access request is an attack request. The code file in the request response will trigger the client to automatically send a second access request after running in the client, so that the attacker will send the second access request to access the dynamic file again after accessing once, so as to make the attacker access the simulated website again unconsciously, and then distinguish the real hacker attack from the attack request, exclude the scanner attack with low threat degree, and return the simulated website to the client to obtain the identity information of the attacker, so that the real hacker attack can be protected and processed in a targeted manner, and the user's business can be ensured to proceed normally. BRIEF DESCRIPTION OF DRAWINGS

[0073] Figure 1 A flowchart of an attack protection method provided by the embodiment of the present application;

[0074] Figure 2 A flowchart of another attack protection method provided by the embodiment of the present application;

[0075] Figure 3 A deployment mode diagram of a WAF provided by the embodiment of the present application;

[0076] Figure 4A working mechanism schematic diagram of a WAF-based honeypot induction linkage system provided by an embodiment of the present application is provided.

[0077] Figure 5 A switch schematic diagram of honeypot tracing provided by an embodiment of the present application is provided.

[0078] Figure 6 An output result list schematic diagram provided by an embodiment of the present application is provided.

[0079] Figure 7 An output result detail schematic diagram provided by an embodiment of the present application is provided.

[0080] Figure 8 A structure schematic diagram of an attack protection device provided by an embodiment of the present application is provided.

[0081] Figure 9 A structure schematic diagram of an electronic device provided by an embodiment of the present application is provided. DETAILED DESCRIPTION

[0082] In order to enable a person skilled in the art to more fully understand the features and technical contents of the present application, the implementation of the present application is described in detail below in conjunction with the accompanying drawings, which are only used for reference and do not limit the present application.

[0083] As shown in Figure 1 , an attack protection method is provided by an embodiment of the present application, which comprises:

[0084] Step S110: When it is determined that the first access request is an attack request, a request response is sent to a client sending the first access request, wherein the request response comprises a code file.

[0085] Step S120: A second access request sent by the client is received.

[0086] Step S130: When the second access request is a preset access request, a simulated website is returned to the client, wherein the preset access request is an access request for accessing a dynamic resource file triggered by the code file running in the client; and the simulated website is used to obtain identity information of the client.

[0087] The attack protection method can be implemented by a firewall system, and the firewall system can be arranged in the cloud.

[0088] The client is used to complete interaction with a server and present resource information requested by a user to the server.

[0089] For example, the firewall system is responsible for the security protection of the access request of the target website, and the access request of the target website is forwarded to the target website through the firewall system. At this time, the firewall of the firewall system intercepts the access request of the target website sent by the client. The first access request is one of the access requests intercepted by the firewall.

[0090] All received data traffic can be filtered by the firewall to identify the first access request sent by the client, and the access request identified as an attack request is protected to achieve the purpose of protecting the website. In practical applications, the firewall can be a WAF (Web Application Firewall).

[0091] The code file can obtain the unique fingerprint ID (Identity Document) of the attacker, and the information of the client can be obtained when the client receives and runs the code file.

[0092] The code file can be a file composed of executable code, including but not limited to a script language. The code can be JS code and the like. JS code is a Java script code. In practical applications, the code file can be a JS file, and the code file can be customized by WAF and returned to the client.

[0093] For example, after the attacker's browser receives and runs the code file, the browser's information such as the type of the browser, the programming language of the browser, etc. can be obtained and integrated to generate the fingerprint ID of the browser, and the fingerprint ID can uniquely identify the browser.

[0094] The static file can be a JS (JavaScript, a programming language) file, a CSS (Cascading Style Sheets) file, etc. The dynamic resource file can be a GIF file (Graphics Interchange Format).

[0095] The attack request includes hacker attacks and scanner attacks, and only the hacker attacks can be recorded and analyzed to obtain the exact identity of the attacker. The traditional honeypot product has the disadvantages of static configuration, fixed position, high false alarm rate, etc. Once the attacker identifies or bypasses the honeypot, the honeypot will immediately lose the decoy value.

[0096] Therefore, in the embodiment of the present application, the client sending the access request is sent a request response with the code file, which, after being run on the client, triggers the client to automatically send a second access request, so that the attacker accessing the dynamic file once again sends a second access request to access the simulated website, and the second access request is received and verified, so that the hacker attack with real threat is distinguished from the scanner attack with low threat, so that the real hacker attack can be distinguished, and the simulated website is returned to obtain the identity information of the client.

[0097] In the embodiment of the present application, the method further comprises at least one of the following:

[0098] When the request content of the first access request matches the features contained in the firewall filtering rule, it is determined that the first access request is an attack request.

[0099] When the path of the target website accessed by the first access request is a preset path, it is determined that the first access request is an attack request.

[0100] In the embodiment of the present application, whether the access request sent by the client is an attack request can be determined by the firewall, which can detect and verify the content of various access requests from the client to ensure its security and legality.

[0101] The request content can be a request type, a resource to be accessed, a communication protocol used, or a keyword contained.

[0102] The preset path is a pre-set access path, which can be an access path of the previous attack request to access the target website, or an access path that can access the target website but is used less frequently, wherein the usage frequency of the access path used less frequently is lower than that of a non-pre-set path for accessing the target website.

[0103] As shown in Figure 2 The method further comprises:

[0104] Step S210: generating an access record of the first access request;

[0105] Step S220: verifying whether there is a preset association between the second access request and the first access request according to the access record;

[0106] When the second access request is a preset access request, the simulated website is returned to the client, comprising:

[0107] When the second access request is the preset access request and the second access request and the first access request have the preset correlation, the simulation website is returned to the client.

[0108] In the embodiments of the present application, the verification of whether the second access request and the first access request have the preset correlation according to the access record comprises:

[0109] comparing the access record with historical access information carried by the second access request;

[0110] When the historical access information is contained in the access record, it is determined that the second access request and the first access request have the preset correlation.

[0111] The comparison of the access record with the historical access information carried by the second access request is that all parts of the historical access information contained in the access record, for example, all contents in the historical access information are contained in the access record, or specific contents in the historical access information, such as access time and access website, are contained in the access record, at this time, it can be determined that the second access request and the first access request have the preset correlation. If only part of the historical access information is contained in the access record, it is indicated that the second access request and the first access request are not necessarily sent by the same client, that is, the second access request and the first access request do not have the correlation.

[0112] In the embodiments of the present application, the access record comprises at least one of the following:

[0113] the access time of the first access request;

[0114] the website accessed by the first access request;

[0115] the request type of the first access request.

[0116] Of course, the above is only an example to describe the contents included in the access record.

[0117] In some embodiments, whether the first access request and the second access request have the preset correlation is determined by comparing request parameters of the first access request and the second access request. When the request parameters are tampered, it is determined that the second access request and the first access request do not have the preset correlation; when the request parameters are not tampered, it is determined that the second access request and the first access request have the preset correlation.

[0118] The history access information of the first access request is also included in the request response containing the code file sent to the client sending the first access request, so that when the code file is executed after the client receives the request response, the history access record information in the request response is carried in the message of the second access request triggered by the client sending the second access request, so that the second access request has the preset association with the first access request.

[0119] Based on this, if the access record of the first access request does not include all parts of the history access message carried by the second access request, it indicates that there is human intervention access, so that the second access request cannot be determined to have the preset association with the first access request.

[0120] In the embodiment of the application, the method further comprises:

[0121] When the second access request and the first access request do not have the preset association, the website address of an abnormal webpage is sent to the client.

[0122] When the second access request and the first access request do not have the preset association, it indicates that there is human intervention access, and the received second access request is not from an attacker, that is, the second access request is not an access request that needs special attention, so that the target website and the ongoing business are not affected, and therefore it is not necessary to return the simulation website to the client to obtain the identity information of the client.

[0123] In the embodiment of the application, the abnormal webpage comprises at least one of the following:

[0124] A blank webpage;

[0125] A garbled webpage.

[0126] Of course, the above is only an example of describing the condition of the abnormal webpage.

[0127] In the embodiment of the application, when the second access request is the preset access request, the second access request further comprises identification information of a browser in the client.

[0128] After the code file is executed, the client can return the second access request for accessing a dynamic resource file, and when it is verified that the first access request and the second access request are associated, the simulation website is returned. The simulation website can attract attacks as a decoy and can capture and analyze attack behaviors, and then obtain the identity information of the client. In practical applications, the simulation website includes but is not limited to a honeypot website.

[0129] In some embodiments, when the attacker browser accesses the simulation website, the attacker can be induced to use some account information to log in to other websites, such as a social account ID, through the content on the simulation website, or to download data from the simulation website through interaction, to obtain the identity information of the attacker. Here, this is only an example of obtaining the identity information of the attacker from the simulation website according to the identification information, and there are many specific implementation methods.

[0130] In the embodiments of the present application, the identification information includes:

[0131] The summary information of the configuration information and / or the running information of the browser.

[0132] The configuration information of the browser can be the type of the browser, the programming language of the browser, and the like.

[0133] The summary information of the running information can be obtained by integrating and calculating a plurality of running information.

[0134] The summary information can be generated by various summary algorithms. For example, the summary information can be generated by using a summary algorithm, an MD5 algorithm, or a hash algorithm.

[0135] In the embodiments of the present application, the method further includes:

[0136] Obtaining the identification information based on the simulation website;

[0137] Obtaining the identity information of the client based on the identification information;

[0138] When the second access request and the first access request are from the same client, the access information of the first access request and the identity information of the client are output.

[0139] When the second access request and the first access request are from the same client, it indicates that the client sends an attack request to the server, so that the access of the ID is blocked by outputting the access information of the first access request and the identity information of the client, thereby improving the protection ability of the firewall.

[0140] As shown in Figure 3 The WAF is one of the foregoing firewalls.

[0141] The working mechanism of the honeypot induction linkage system based on WAF is as shown in Figure 4The honeypot website is one of the aforementioned simulation websites. The scheme involves parts mainly including a WAF engine, an attacker browser, a human-computer identification system, a honeypot, and a WAF management platform. The following introduces the entire working mechanism.

[0142] As shown in the figure, after accessing the WAF protection system, the honeypot tracing function can be started. After starting the function, the WAF will identify and trace the attacker attacking the website. Figure 5

[0143] When the attacker accesses certain preset honeypot paths of the website, the WAF engine first checks the return result of the source station. The honeypot path is one of the aforementioned preset paths. If the return result of the source station is not 404, the content of the source station is returned normally. If the return code of the source station is 404 or the request content is directly identified by the WAF as an attack request, a WAF self-defined JS file is returned. The JS file is one of the aforementioned code files. The JS can obtain the unique fingerprint ID of the attacker, which is the attacker ID used for intelligence sharing later, and make the attacker browser access the human-computer identification system built in the WAF.

[0144] After the browser runs the JS file returned by the WAF engine, the 404.gif file is requested, which is in the human-computer identification system built in the WAF. The GIF file is one of the aforementioned dynamic resource files. After analyzing a large number of scanners and human attack requests, it is found that the regular scanner will access JS, CSS and other static files, but will not request the GIF file.

[0145] When the human-computer identification system receives the GIF request, it can prove that the request is not sent by a scanner, but by a real attacker's browser, because only a real attacker's browser will run the JS file and send the GIF request. The human-computer identification system further analyzes and analyzes the request parameters to further judge whether the parameters are tampered with, thereby preventing the attacker from fabricating the parameters for accessing the GIF file, and returns the verification result.

[0146] The attacker browser receives the verification result of the human-computer identification system. If the verification result is wrong, it jumps to the empty address, and if the verification result is correct, it jumps to the honeypot address. The honeypot website can trace the attacker according to the operation of the attacker, obtain the account of some social ID of the attacker, and even through the installation package downloaded by the attacker, the attacker is traced.

[0147] After the human-computer identification system verification passes, the corresponding attack request parameters are sent to the WAF management platform. As shown in the figure, Figure 6 ​As shown, after the WAF management platform receives the relevant request parameters transmitted by the human-computer identification system, the unique ID obtained by the JS is used to search for the corresponding traceability result in the honeypot, and the attack request information and the traceability result are displayed in the WAF management platform corresponding to the attacked website, and the ID uniquely identifying the attacker is included in the WAF threat intelligence library, and the access of the ID is banned throughout the network, thereby improving the protection capability of the WAF.

[0148] As shown in Figure 7 The honeypot traceability details displayed on the WAF management platform are shown, so that the attack time, attack source, unique fingerprint and other information of the attack request can be obtained, various attack methods can be obtained, and the WAF protection rules or model can be trained, thereby improving the protection capability of the WAF.

[0149] As shown in Figure 8 The attack protection device provided by the embodiment of the present disclosure comprises:

[0150] The first sending module 110 is configured to send a request response to a client sending a first access request when it is determined that the first access request is an attack request, wherein the request response comprises a code file.

[0151] The receiving module 120 is configured to receive a second access request sent by the client.

[0152] The returning module 130 is configured to return a simulation website to the client when the second access request is a preset access request, wherein the preset access request is an access request for accessing a dynamic resource file triggered by the code file running in the client; and the simulation website is used to obtain identity information of the client.

[0153] In some embodiments, the first sending module 110, the receiving module 120, and the returning module 130 can all be program modules, which can realize the functions of the above-mentioned modules after being executed by a processor.

[0154] In other embodiments, the first sending module 110, the receiving module 120, and the returning module 130 can all be soft and hard combined modules; the soft and hard combined modules include but are not limited to various programmable arrays; the field programmable array includes but is not limited to a field programmable array and / or a complex programmable array.

[0155] In still other embodiments, the first sending module 110, the receiving module 120, and the returning module 130 can all be pure hardware modules; the pure hardware modules include but are not limited to application specific integrated circuits.

[0156] In some embodiments, the device further comprises at least one of the following:

[0157] The first determining module is configured to determine that the first access request is an attack request when the request content of the first access request hits a feature contained in the firewall filtering rule.

[0158] The second determining module is configured to determine that the first access request is an attack request when a path of the target website accessed by the first access request is a preset path.

[0159] In some embodiments, the apparatus further comprises:

[0160] The generating module is configured to generate an access record of the first access request.

[0161] The verifying module is configured to verify, according to the access record, whether the second access request and the first access request have a preset association.

[0162] The returning, when the second access request is the preset access request, of the simulation website to the client comprises:

[0163] The returning, when the second access request is the preset access request and the second access request and the first access request have the preset association, of the simulation website to the client.

[0164] In some embodiments, the verifying, according to the access record, of whether the second access request and the first access request have a preset association comprises:

[0165] Comparing the access record with historical access information carried by the second access request.

[0166] When the historical access information is contained in the access record, it is determined that the second access request and the first access request have a preset association.

[0167] In some embodiments, the access record comprises at least one of:

[0168] An access time of the first access request.

[0169] A website accessed by the first access request.

[0170] A request type of the first access request.

[0171] In some embodiments, the apparatus further comprises:

[0172] The second sending module is configured to send, when the second access request and the first access request do not have the preset association, a website of an abnormal webpage to the client.

[0173] In some embodiments, the abnormal webpage comprises at least one of:

[0174] a blank webpage;

[0175] a garbled webpage.

[0176] In some embodiments, when the second access request is the preset access request, the second access request further comprises: identification information of the client-side browser.

[0177] In some embodiments, the identification information comprises:

[0178] summary information of configuration information and / or running information of the browser.

[0179] In some embodiments, the apparatus further comprises:

[0180] a first obtaining module, configured to obtain the identification information based on the simulated website;

[0181] a second obtaining module, configured to obtain the identity information of the client based on the identification information;

[0182] an output module, configured to output, when the second access request and the first access request are from the same client, the access information and the identity information of the client of the first access request.

[0183] As shown in Figure 9 , the embodiments of the present disclosure provide an electronic device, characterized in that the electronic device comprises:

[0184] a memory, configured to store computer readable instructions;

[0185] a processor, connected with the memory, configured to realize the attack protection method provided by any of the preceding embodiments by executing the computer readable instructions, for example, can execute the method shown in Figure 1 and / or Figure 2 .

[0186] The memory can be various types of memories, such as random access memory, read-only memory, flash memory, etc. The memory can be used for information storage, such as storing computer executable instructions, etc. The computer executable instructions can be various program instructions, such as object program instructions and / or source program instructions, etc.

[0187] The processor can be various types of processors, such as central processing units, microprocessors, digital signal processors, programmable arrays, digital signal processors, application specific integrated circuits, or image processors, etc. The processor can be connected with the memory through a bus. The bus can be an integrated circuit bus, etc.

[0188] As shown in Figure 9 The electronic device can further include a network interface, which can be used to interact with a peer device through a network.

[0189] The embodiments of the present application also provide a computer storage medium, which stores computer executable instructions. The computer executable instructions can implement the attack protection method provided by any of the foregoing embodiments when executed, for example, can implement the method shown in Figure 1 and / or Figure 2 .

[0190] The computer storage medium provided by the embodiments includes a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0191] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. The above described device embodiments are only schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling, or direct coupling or communication connection between the components can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0192] The units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units; some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0193] In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

[0194] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware, the foregoing program can be stored in a computer readable storage medium, and the program executes the steps including the above-mentioned method embodiments when executed; and the foregoing storage medium includes a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disc or an optical disc and various storage medium capable of storing program codes.

[0195] The above merely provides a specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An attack protection method, characterized in that, include: When the first access request is determined to be an attack request, a request response is sent to the client that sent the first access request, wherein the request response includes a code file; Receive the second access request sent by the client; When the second access request is a preset access request, a simulated website is returned to the client. The preset access request is an access request to a dynamic resource file triggered by the code file running within the client. The simulated website is used to obtain the client's identity information.

2. The method according to claim 1, characterized in that, The method further includes at least one of the following: When the content of the first access request matches a feature contained in the firewall filtering rule, the first access request is determined to be an attack request. When the path of the target URL accessed by the first access request is a preset path, the first access request is determined to be an attack request.

3. The method according to claim 1 or 2, characterized in that, The method further includes: Generate the access record for the first access request; Based on the access records, verify whether there is a preset correlation between the second access request and the first access request; When the second access request is a preset access request, returning the simulated website to the client includes: When the second access request is the preset access request, and the second access request and the first access request have the preset association, the simulated website is returned to the client.

4. The method according to claim 3, characterized in that, The step of verifying whether there is a preset correlation between the second access request and the first access request based on the access record includes: Compare the access record with the historical access information carried in the second access request; When the historical access information is included in the access record, it is determined that the second access request and the first access request have a preset association.

5. The method according to claim 4, characterized in that, The access records include at least one of the following: The access time of the first access request; The URL accessed by the first access request; The request type of the first access request.

6. The method according to claim 3, characterized in that, The method further includes: When the second access request and the first access request do not have the preset association, the URL of the abnormal webpage is sent to the client.

7. The method according to claim 6, characterized in that, The abnormal webpage includes at least one of the following: Blank webpage; A webpage with garbled text.

8. The method according to claim 7, characterized in that, When the second access request is the preset access request, the second access request further includes: the identification information of the browser in the client.

9. The method according to claim 8, characterized in that, The identification information includes: Summary information of the browser's configuration and / or runtime information.

10. The method according to claim 8, characterized in that, The method further includes: The identification information is obtained based on the simulated website; The client's identity information is obtained based on the identification information; When the second access request and the first access request are from the same client, the access information of the first access request and the identity information of the client are compared and output.

11. An attack protection device, characterized in that, include: The first sending module is used to send a request response to the client that sent the first access request when it is determined that the first access request is an attack request, wherein the request response includes a code file; The receiving module is used to receive the second access request sent by the client; The return module is used to return a simulated website to the client when the second access request is a preset access request, wherein the preset access request is an access request to a dynamic resource file triggered by the code file running in the client; the simulated website is used to obtain the client's identity information.

12. The apparatus according to claim 11, characterized in that, The device further includes at least one of the following: The first determining module is used to determine that the first access request is an attack request when the request content of the first access request matches the features contained in the firewall filtering rules. The second determining module is used to determine that the first access request is an attack request when the path of the target URL accessed by the first access request is a preset path.

13. The apparatus according to claim 11 or 12, characterized in that, The device further includes: A generation module is used to generate the access record for the first access request; The verification module is used to verify, based on the access record, whether there is a preset correlation between the second access request and the first access request; When the second access request is a preset access request, returning the simulated website to the client includes: When the second access request is the preset access request, and the second access request and the first access request have the preset association, the simulated website is returned to the client.

14. The apparatus according to claim 13, characterized in that, The step of verifying whether there is a preset correlation between the second access request and the first access request based on the access record includes: Compare the access record with the historical access information carried in the second access request; When the historical access information is included in the access record, it is determined that the second access request and the first access request have a preset association.

15. The apparatus according to claim 13, characterized in that, The access records include at least one of the following: The access time of the first access request; The URL accessed by the first access request; The request type of the first access request.

16. The apparatus according to claim 13, characterized in that, The device further includes: The second sending module is used to send the URL of the abnormal webpage to the client when the second access request and the first access request do not have the preset correlation.

17. The apparatus according to claim 16, characterized in that, The abnormal webpage includes at least one of the following: Blank webpage; A webpage with garbled text.

18. The apparatus according to claim 17, characterized in that, When the second access request is triggered by the code file running on the client, the second access request also includes: the identification information of the browser within the client.

19. The apparatus according to claim 18, characterized in that, The identification information includes: Summary information of the browser's configuration and / or runtime information.

20. The apparatus according to claim 18, characterized in that, The device further includes: The first acquisition module is used to acquire the identification information based on the simulated website; The second acquisition module is used to acquire the client's identity information based on the identification information; The output module is used to output the access information of the first access request and the identity information of the client when the second access request and the first access request are from the same client.

21. An electronic device, characterized in that, include: Memory, which stores computer-readable instructions; A processor, connected to the memory, is configured to implement the attack protection method according to any one of claims 1 to 10 by executing the computer-readable instructions.

22. A computer storage medium, characterized in that, The computer storage medium stores computer-executable instructions; after being executed by a processor, the computer-executable instructions can implement the attack protection method according to any one of claims 1 to 10.

Images