A data transmission vulnerability detection method, device and equipment of a data interface

Abstract

The application provides a data transmission vulnerability detection method, device and equipment of a data interface, the method comprises the following steps: obtaining a to-be-detected data packet transmitted by a first system in a network collaborative manufacturing integrated platform to a second system through a data interface; performing analysis processing on the to-be-detected data packet to obtain an analysis result; performing data transmission vulnerability detection on the analysis result according to a preset vulnerability detection strategy to obtain a vulnerability detection result; the preset vulnerability detection strategy comprises at least one rule expression; the scheme of the application can analyze interface data security, identify sensitive data in the interface, monitor and analyze the use behavior of the interface, and improve the security control of data in the sharing transmission.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, apparatus, and device for detecting data transmission vulnerabilities in a data interface. Background Technology

[0002] The construction of a network-based collaborative manufacturing integration platform that integrates design, manufacturing, and service, as well as supply, marketing, and service, involves data exchange between systems and shared services with third-party systems. Currently, this data transmission mainly uses APIs (Application Programming Interfaces). If APIs are not properly secured, three types of security issues can easily arise: information interception, tampering, and leakage. These issues are generally addressed through the following methods:

[0003] 1. Token authorization authentication to prevent unauthorized users from obtaining data;

[0004] 2. Timestamp timeout mechanism;

[0005] 3. Use Uniform Resource Locator (URL) parameter signing to prevent request parameters from being tampered with;

[0006] 4. Anti-replay function: Prevents the interface from being requested a second time and prevents data collection.

[0007] 5. Use HTTPS (Hypertext Transfer Security Protocol) to prevent data from being transmitted in plaintext;

[0008] To ensure the security of data transmission through service interfaces, it is necessary to monitor and analyze interface usage behavior, identify abnormal interface call behavior, and improve the security management of data during shared transmission. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to provide a method, apparatus and equipment for detecting data transmission vulnerabilities in a data interface, which can analyze the security of interface data, identify sensitive data in the interface, monitor and analyze interface usage behavior, and improve the security management of data in shared transmission.

[0010] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0011] A method for detecting data transmission vulnerabilities in a data interface, comprising:

[0012] Acquire the data packets to be tested transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform;

[0013] The data packet to be detected is parsed to obtain the parsing result;

[0014] The parsing results are subjected to data transmission vulnerability detection according to a preset vulnerability detection strategy to obtain vulnerability detection results; the preset vulnerability detection strategy includes at least one rule expression.

[0015] Optionally, the data packets to be detected transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform are acquired, including:

[0016] The gateway intercepts data packets to be tested transmitted from the first system to the second system via a data interface within the network collaborative manufacturing integration platform.

[0017] Optionally, the data packet to be detected is parsed to obtain a parsing result, including:

[0018] The data packet to be detected is parsed to obtain the header information, input parameters and output parameters of the data packet, and the header information, input parameters and output parameters of the data packet to be detected are used as the parsing result.

[0019] Optionally, the parsing results are subjected to data transmission vulnerability detection according to a preset vulnerability detection strategy to obtain vulnerability detection results, including:

[0020] Obtain the rule expression corresponding to the preset vulnerability detection strategy;

[0021] The header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression to obtain the matching result;

[0022] Based on the matching results, it is determined whether there are vulnerabilities in the data transmission, and the vulnerability detection results are obtained.

[0023] Optionally, the header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression to obtain a matching result, including:

[0024] The header information, input parameter information, and output parameter information are matched with the rule expression using regular expressions and / or the target language field is parsed to obtain the matching result.

[0025] Optionally, the header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression using regular expressions to obtain the matching result, including:

[0026] The header information, input parameters, and output parameters of the data packet to be detected are input into the target function and matched against the target string of the rule expression. If the output result of the target function reaches a dangerous state, it is determined that the data packet to be detected matches the target string of the rule expression, and the matching result of the data packet to be detected being a data packet with a vulnerability is obtained.

[0027] Optionally, the header information, input parameter information, and output parameter information of the data packet to be detected are parsed with the rule expression using the target language field to obtain the matching result, including:

[0028] The header information, input parameter information, and output parameter information of the data packet to be detected are parsed according to the target language string to obtain the intermediate string;

[0029] The intermediate string is matched with the target language string. If the match is successful, the data packet to be detected is found to be a vulnerable data packet.

[0030] The present invention also provides a data transmission vulnerability detection device for a data interface, comprising:

[0031] The acquisition module acquires the data packets to be detected transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform;

[0032] The detection module is used to parse the data packet to be detected to obtain a parsing result; and to perform data transmission vulnerability detection on the parsing result according to a preset vulnerability detection strategy to obtain a vulnerability detection result; the preset vulnerability detection strategy includes at least one rule expression.

[0033] The present invention also provides a computing device, comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described above.

[0034] The present invention also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described above.

[0035] The above-described solution of the present invention has at least the following beneficial effects:

[0036] The above-described solution of the present invention acquires a data packet to be tested transmitted from a first system to a second system through a data interface within a network collaborative manufacturing integration platform; parses the data packet to be tested to obtain a parsing result; and performs data transmission vulnerability detection on the parsing result according to a preset vulnerability detection strategy to obtain a vulnerability detection result; the preset vulnerability detection strategy includes at least one rule expression; it can analyze interface data security, identify sensitive data in the interface, monitor and analyze interface usage behavior, and improve the security management of data in shared transmission. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating the data transmission vulnerability detection method for a data interface according to an embodiment of the present invention.

[0038] Figure 2This is a schematic diagram of vulnerability detection in the data transmission vulnerability detection of the data interface according to an embodiment of the present invention;

[0039] Figure 3 This is a tree structure diagram of vulnerability detection in the data transmission vulnerability detection of the data interface in an embodiment of the present invention;

[0040] Figure 4 This is a schematic diagram of the vulnerability detection results in the data transmission vulnerability detection of the data interface according to an embodiment of the present invention.

[0041] Figure 5 This is a schematic diagram of the data transmission vulnerability detection device for the data interface according to an embodiment of the present invention. Detailed Implementation

[0042] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0043] like Figure 1 As shown, an embodiment of the present invention proposes a method for detecting data transmission vulnerabilities in a data interface, comprising:

[0044] Step 11: Obtain the data packet to be tested transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform;

[0045] Step 12: Parse the data packet to be detected to obtain the parsing result;

[0046] Step 13: Perform data transmission vulnerability detection on the parsed results according to the preset vulnerability detection strategy to obtain vulnerability detection results; the preset vulnerability detection strategy includes at least one rule expression.

[0047] In this embodiment, when the various systems of the network collaborative manufacturing integration platform interact with each other, the network card data is captured in real time on the server communicating with each system, and the captured HTTP (Hypertext Transfer Protocol) data packets are parsed into the required target data. According to the preset vulnerability detection strategy, the parsing results are used to detect vulnerabilities in the interfaces. Furthermore, the interfaces with vulnerabilities can be reported to improve the security management of data in shared transmission.

[0048] In this embodiment, the preset vulnerability detection strategy may include at least one of the following: SQL (Structured Query Language) injection vulnerability detection strategy, XSS (Cross-Site Scripting) vulnerability detection strategy, XXE (XML External Entity Injection) vulnerability detection strategy, CSRF (Cross-Site Request Forgery) vulnerability detection strategy, and SSRF (Server Request Forgery) vulnerability detection strategy, etc. According to the vulnerability risk, the vulnerability detection strategy is divided into risk levels of warning, low risk, and high risk.

[0049] In an optional embodiment of the present invention, step 11 may include:

[0050] Step 111: Intercept the data packets to be detected transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform via the gateway.

[0051] In this embodiment, data transmission occurs between various systems within the network collaborative manufacturing integration platform. Data packets are intercepted through a gateway, and the security of the data interface API (Application Programming Interface) is detected by analyzing the data packets to be tested.

[0052] In this embodiment, the information of each system to be tested and the API interface information of each system in the network collaborative manufacturing integration platform are pre-stored in the detection system corresponding to this method. At the same time, the detection system performs information auditing and interface status detection on the stored API interfaces to determine the availability of the interfaces and batch detect whether the interfaces are online.

[0053] In an optional embodiment of the present invention, step 12 may include:

[0054] Step 121: Perform field parsing on the data packet to be detected to obtain the data packet header information, input parameter information and output parameter information of the data packet, and use the data packet header information, input parameter information and output parameter information of the data packet to be detected as the parsing result.

[0055] In this embodiment, the header of the data packet to be detected is parsed to obtain at least one data field included in the data packet to be detected. The at least one data field includes the encoding method field used by the data packet to be detected and the data transmission parameter field. The data transmission parameter field includes the transmission parameters of the data packet to be detected, which serve as the input parameters of the data packet to be detected. After the input parameters are input to a preset parsing function for parsing processing, output parameters for vulnerability detection are obtained. The preset parsing function may be a tree-structured data processing function, etc.

[0056] like Figure 2 As shown, in an optional embodiment of the present invention, step 13 may include:

[0057] Step 131: Obtain the rule expression corresponding to the preset vulnerability detection strategy;

[0058] Step 132: Match the header information, input parameter information, and output parameter information of the data packet to be detected with the rule expression to obtain the matching result;

[0059] Step 133: Based on the matching results, determine whether there are vulnerabilities in the data transmission and obtain the vulnerability detection results.

[0060] In this embodiment, the header information, input parameter information, and output parameter information of the data packet to be detected are retrieved and matched using existing rule expressions in the preset vulnerability detection strategy. If information matching the rule expression is found, it is determined that there is a vulnerability in the data transmission of the interface.

[0061] like Figure 2 As shown, in one feasible example, the target data required for vulnerability detection includes: the encoding used by the data packet to be detected, input parameter information, data payload, etc., and may further include the server-side processing code of the data packet to be detected transmitted from the interface to the server, configuring an identifier for each data.

[0062] like Figure 3 As shown, the encoding, input parameter information, data payload, server-side processing code, etc., are processed using a tree-structured data processing function to obtain a preprocessing tree structure diagram.

[0063] like Figure 4 As shown, the data of each node in the preprocessed tree diagram is matched according to the rule expression to obtain the matching result; if the matching result is determined to match the rule expression, it is determined that the interface has a vulnerability. In particular, after matching, it is determined that the data chain of server-side processing code-encoding-input parameter information has a vulnerability.

[0064] In an optional embodiment of the present invention, step 132 may include:

[0065] Step 1321: Perform regular expression matching and / or target language field parsing on the header information, input parameter information, and output parameter information with the rule expression to obtain the matching result.

[0066] In this embodiment, two matching methods are set, including regular expression matching and target language field parsing. Each preset vulnerability detection strategy corresponds to the matching method of regular expression matching and / or target language field parsing, and vulnerability detection is achieved through the corresponding matching method.

[0067] When the preset vulnerability detection strategy is SQL (Structured Query Language) injection, arbitrary command or code execution, directory traversal or directory looping, brute force attack, unauthorized access, CRLF (Carriage Return and Line Feed) injection, LDAP (Lightweight Directory Access Protocol) injection, URL (Uniform Resource Locator) redirection or plaintext transmission, the vulnerability detection is performed by matching the target language field parsing.

[0068] When the preset vulnerability detection strategy is XSS (Cross-Site Scripting), XXE (XML External Entity Injection), CSRF (Cross-Site Request Forgery), SSRF (Server Request Forgery), directory listing, sensitive information disclosure, application error information disclosure, and the target server has enabled insecure HTTP (Hypertext Transfer Protocol) methods, the vulnerability detection is performed using regular expression matching.

[0069] In an optional embodiment of the present invention, step 1321 may include:

[0070] Step 13211: Input the header information, input parameter information, and output parameter information of the data packet to be detected into the target function, and match them with the target string of the rule expression respectively. If the matching result reaches a dangerous state, it is determined that the data packet to be detected matches the target string of the rule expression, and the matching result of the data packet to be detected being a data packet with a vulnerability is obtained.

[0071] In this embodiment, the preset vulnerability detection strategy is sensitive information leakage. Taking regular expression matching as an example, when detecting whether the data packet to be detected has sensitive information leakage, such as whether the input parameter information contains sensitive information such as ID card, mobile phone number and telephone number, a reminder will be issued if it does.

[0072] For example, when detecting the existence of ID card number leakage vulnerabilities, the rule expression \d{17}[\d|x]|\d{15} can be set to match a string that requires matching a numeric character 17 times, with the 18th character being a numeric character or x, or matching a numeric character 15 times. This corresponds to the 18-digit second-generation ID card and the 15-digit first-generation ID card. When the input data to be detected successfully matches the target string, it indicates that there is a risk of ID card number information leakage.

[0073] In an optional embodiment of the present invention, step 1321 may include:

[0074] Step 13212: Parse the header information, input parameter information, and output parameter information of the data packet to be detected according to the target language string to obtain the intermediate string;

[0075] Step 13213: Match the intermediate string with the target language string. If the match is successful, the matching result is that the data packet to be detected is a data packet with a vulnerability.

[0076] In this embodiment, the information to be detected is first converted into an intermediate string in a specific format, and then the intermediate string is matched with the target language string according to a preset matching rule;

[0077] For example, when detecting SQL (Structured Query Language) injection vulnerabilities, these vulnerabilities occur when user-submitted parameters are not filtered and are directly concatenated into SQL statements for execution in web application programs. This causes special characters in the parameters to corrupt the original logic of the SQL statement, allowing attackers to exploit this vulnerability to execute arbitrary SQL statements, such as querying data, downloading data, writing webshells (web backend management scripts), executing system commands, and bypassing login restrictions.

[0078] When performing vulnerability detection, regular expressions are used to match whether the input and output parameters contain the keyword "sql". The matching rule is: .[]|sqli|if.!=null then.else empty end. When sending data via POST: [{"api_outer_no":"1002014"}{"outer_no":"76290239"}{"sqli":"or 1=1"}], the matching result "or 1=1" is obtained, indicating that there is an SQL injection vulnerability in the transmission of target language fields.

[0079] In an optional embodiment of the present invention, the data transmission vulnerability detection method for the data interface may further include:

[0080] Step 14: Perform vulnerability checks again on the interfaces corresponding to the vulnerable data packets.

[0081] In this embodiment, as vulnerabilities are continuously discovered, the relevant vulnerability detection strategies will also be updated. When a new vulnerability detection strategy is input, the existing vulnerability logs will be re-tested for vulnerability adaptation, and the existing vulnerability information will be updated so that the new vulnerability detection strategy is more applicable to the relevant interfaces, making it easier to adjust interface vulnerability issues in a timely manner.

[0082] In an optional embodiment of the present invention, the data transmission vulnerability detection method for the data interface may further include:

[0083] Step 15: Based on the vulnerability detection results, classify the vulnerabilities of the interfaces corresponding to the vulnerable data packets in order to output a more specific vulnerability detection report.

[0084] The details are shown in the table below:

[0085]

[0086] In an optional embodiment of the present invention, the data transmission vulnerability detection method for the data interface may further include:

[0087] Step 16: Fix the vulnerabilities in the interfaces corresponding to the vulnerable data packets.

[0088] The first remediation method: If the vulnerability is that the parameters of the transmitted data are not filtered and are directly concatenated into the SQL statement for execution, the special characters in the parameters will destroy the original logic of the SQL statement. Attackers can use this vulnerability to execute arbitrary SQL statements, such as querying data, downloading data, writing webshells, executing system commands, and bypassing login restrictions.

[0089] Step 16 may include:

[0090] Step 161 involves using prepared SQL statements to query and bind variables to patch the vulnerabilities in the interfaces corresponding to the vulnerable data packets. Specifically, this may include:

[0091] 1. Use prepared statements. When using PDO, be careful not to directly append variables to the PDO statement. All query statements should use the parameterized query interface provided by the database. Parameterized statements use parameters instead of embedding user-input variables into the SQL statement. Almost all current database systems provide parameterized SQL statement execution interfaces, which can effectively prevent SQL injection attacks.

[0092] 2. Escape or encode special characters ('", "<", "&", "; etc.) entering the database.

[0093] 3. Confirm the data type for each type of data. For example, numeric data must be numeric, and the storage field in the database must correspond to the int type.

[0094] 4. Data length should be strictly regulated to prevent long SQL injection statements from failing to execute correctly.

[0095] 5. Ensure consistent encoding across all data layers on the website. It is recommended to use UTF-8 encoding for all data. Inconsistent encoding between layers may allow some filtering models to be bypassed.

[0096] 6. Strictly limit the database operation permissions of website users, granting them only the permissions necessary for their work, thereby minimizing the damage to the database caused by injection attacks.

[0097] 7. Avoid displaying SQL error messages on the website, such as type error or field mismatch, to prevent attackers from using these error messages to make judgments.

[0098] 8. Filter dangerous characters, such as: use regular expressions to match keywords such as union, sleep, and, select, load_file, etc., and terminate the process if a match is found.

[0099] The second remediation method: If the vulnerability is an XSS vulnerability, the web application code does not filter or filters user-submitted parameters poorly, causing special characters in the parameters to corrupt the original logic of the HTML page. Attackers can exploit this vulnerability to execute malicious HTML / JS code, construct worms, tamper with pages to carry out phishing attacks, and trick users into logging in again to obtain their login credentials, etc.

[0100] While XSS attacks do not directly harm the web server itself, they spread through websites, attacking website users and stealing their account and identity information, thus posing a serious threat to the website.

[0101] Step 16 may include:

[0102] Step 162: When displaying the user-submitted HTML code on the page, perform HTML code filtering and escaping; the specific repair process is as follows:

[0103] 1. Filter input data, strictly checking for dangerous characters such as "'", "", "<", ">", "on*", script, iframe, etc. This input includes not only user-interactive input interfaces, but also variables in cookies and HTTP request headers.

[0104] 2. In addition to verifying the data type, it is also necessary to verify its format, length, range and content.

[0105] 3. Data validation and filtering are performed not only on the client side, but also on the server side for critical filtering steps.

[0106] 4. Perform appropriate encoding conversions on the data output to the page, such as HTML entity encoding and JS encoding. The output data also needs to be checked, as values ​​from the database may be output in multiple places on a large website. Even if encoding operations are performed on the input, checks should still be performed at each output point.

[0107] The third remediation method: If the vulnerability is an XXE vulnerability, in order for the application to use custom XML messages, the application must first parse the XML document and check whether the XML format is correct. When the parser allows the parsing of external XML entities, it will cause an XXE vulnerability, leading to server attacks.

[0108] Step 16 may include:

[0109] Step 163: Perform at least one of the following operations on the interface corresponding to the vulnerable data packet: First, check the underlying XML parsing library used, and disable the parsing of external entities by default; second, if third-party application code is used, the patch needs to be upgraded in time; third, filter the XML data submitted by the user, such as the keywords: <!DOCTYPE and <!ENTITY or SYSTEM and PUBLIC, etc.

[0110] The fourth remediation method: If the vulnerability is a CSRF vulnerability (Cross-Site Request Forgery), it doesn't attack the website server but impersonates the user's normal actions within the site. This is usually caused by the server's lack of strict filtering of request headers. CSRF can lead to password resets, user spoofing, and other problems, potentially causing serious consequences. Most websites identify users and authorize them through cookies. Therefore, the best way to forge normal user actions is through XSS or link spoofing, causing the user to initiate requests on their local machine (i.e., the browser with the identity cookie) without their knowledge. A CSRF attack allows the user to unknowingly attack the system they are already logged into.

[0111] Step 16 may include:

[0112] Step 164: Verify the Referer of the request to the interface corresponding to the vulnerable data packet to see if it comes from this website, but this can be bypassed; add an unforgeable token to the request, and verify on the server side whether the token is consistent or correct. If it is incorrect, discard the request and deny service.

[0113] The fifth remediation method: If the vulnerability is an SSRF vulnerability (Server-Side Request Forgery), simply put, it means we can forge requests initiated by the server to obtain data that the client cannot obtain. SSRF vulnerabilities mainly occur because the interface provided by the server contains the URL parameters of the requested content, and the URL parameters transmitted by the client are not filtered.

[0114] Step 16 may include:

[0115] Step 165: Perform at least one of the following operations on the interface corresponding to the vulnerable data packet:

[0116] 1. Disabling unnecessary protocols and allowing only HTTP and HTTPS requests can prevent problems caused by protocols such as file: / / , gopher: / / , and ftp: / / .

[0117] 2. Use a whitelist to restrict access to target addresses and prohibit requests to the internal network;

[0118] 3. Filtering or masking the detailed information returned by the request and verifying the remote server's response to the request are relatively easy methods. If the web application is retrieving a certain type of file, then verify that the returned information conforms to the standards before displaying the results to the user.

[0119] 4. Verify the requested file format

[0120] 5. Redirection is prohibited.

[0121] 6. Restrict the request port to commonly used HTTP ports, such as 80, 443, 8080, 8000, etc.

[0122] 7. Standardize error messages to prevent users from judging the port status of remote servers based on error messages.

[0123] The sixth remediation method: If the vulnerability is arbitrary command / code execution, a command or code execution vulnerability means that the code does not filter user-controllable parameters, allowing direct execution of commands and code. This vulnerability enables the execution of maliciously crafted statements and arbitrary commands or code. Attackers can execute arbitrary commands on the server, perform file read / write operations, etc., causing significant harm.

[0124] Step 16 may include:

[0125] Step 166: Perform at least one of the following operations on the interface corresponding to the vulnerable data packet:

[0126] 1. Strictly filter user input data and prohibit the execution of unexpected system commands.

[0127] 2. Reduce or eliminate the use of code or command execution functions.

[0128] 3. Variables submitted by the client are checked before being put into the function.

[0129] 4. Reduce or eliminate the use of dangerous functions.

[0130] The seventh fix: If the vulnerability is directory traversal / directory looping, the file download or file display page does not filter the passed filenames. By using the path backtracking character .. / to jump out of the program's restricted directory, arbitrary files can be downloaded or displayed.

[0131] Step 16 may include:

[0132] Step 167: Perform the following operations on the interface corresponding to the vulnerable data packet: filter the incoming file name parameter, determine whether it is an allowed file type, and filter the backtrace character .. / .

[0133] The eighth remediation method: If the vulnerability is a brute-force attack, the lack of relevant human verification mechanisms on the login page, such as no CAPTCHA, CAPTCHA that can be reused, and no limit on the number of login errors, allows attackers to obtain user login accounts and passwords through brute-force attacks.

[0134] Step 16 may include:

[0135] Step 168: Perform at least one of the following operations on the interface corresponding to the vulnerable data packet:

[0136] 1. If a user's login attempts exceed the set threshold, the account will be locked (there is a risk of malicious logins resulting in account locking).

[0137] 2. If the number of login attempts by a certain IP address exceeds the set threshold, the IP address will be locked.

[0138] 3. Add a human-machine verification mechanism;

[0139] 4. Verification codes must be validated on the server side; any verification on the client side is insecure.

[0140] The ninth remediation method: If the vulnerability is unauthorized access, it means that because there is no check on the login status and access permissions of sensitive pages on the website, attackers can access them without authorization, obtain sensitive information and perform unauthorized operations.

[0141] Step 16 may include:

[0142] Step 169: Perform at least one of the following operations on the interface corresponding to the vulnerable data packet: First, strictly control access permissions to the page and perform permission checks on access roles; second, use session to determine and control the user's identity.

[0143] The tenth remediation method: If the vulnerability is a directory listing vulnerability, due to improper web server configuration that enables directory browsing, attackers can obtain the file directory structure on the server and acquire sensitive files.

[0144] Step 16 may include:

[0145] Step 1610: For the API filtering request URL corresponding to the vulnerable data packet, check whether it contains directory jump characters such as ... / . At least one of the following operations can be performed: First, modify the configuration file to disable the file directory indexing function of the middleware (such as IIS, Apache, Tomcat); second, set directory access permissions.

[0146] Eleventh remediation method: If the vulnerability is an HTTP slow denial-of-service attack, by design, the HTTP protocol requires the server to fully receive a request before processing it. If an HTTP request is not completed, or the transmission rate is very low, the server will keep its resources busy waiting for the remaining data. If the server holds too many resource requests and processes, this will cause a denial-of-service attack. In severe cases, a single host can slow down or even crash the web.

[0147] Step 16 may include:

[0148] Step 1611: Add a timeout attribute to the client. If the API interface returns too slowly, an alarm will be triggered.

[0149] Specifically, it can be:

[0150] 1. Set appropriate timeout values ​​(Apache has the reqtimeout module enabled by default), specifying the time and frequency for sending the Header and Body.

[0151] 2. Increase MaxClients (MaxRequestWorkers): Increases the maximum number of connections. According to the official documentation, these two parameters refer to the same thing, just different versions. MaxRequestWorkers was called MaxClients before version 2.3.13. The old name is still supported.

[0152] 3. The default Apache installation is vulnerable to Slow Attacks because although the timeout is set, the maximum number of connections is insufficient. If the attacking request frequency is high enough, it will still fill up all of Apache's connections.

[0153] The twelfth remediation method: If the vulnerability is CRLF injection, CRLF stands for "carriage return + newline" (\r\n). In the HTTP protocol, the HTTP Header and HTTP Body are separated by two CRLF symbols, and the browser uses these two CRLF symbols to obtain and display the HTTP content. Therefore, once an attacker can control the characters in the HTTP message header and inject malicious newlines, they can inject session cookies or HTML code.

[0154] Step 16 may include:

[0155] Step 1612: Filter out \r, \n and other newline characters in various encodings to prevent the input data from polluting other HTTP message headers.

[0156] The thirteenth remediation method: If the vulnerability is LDAP injection, because the web application does not properly filter and inspect the data sent by the user, attackers can modify the structure of LDAP statements and execute arbitrary commands with the privileges of the database server, web server, etc. The permissions may allow querying, modifying, or removing any data in the LDAP tree structure.

[0157] Step 16 may include:

[0158] Step 1613: Strictly filter the user's input, such as filtering out special query characters like =*|!.

[0159] The fourteenth remediation method: If the vulnerability is a URL redirection, some web applications use the address in the URL parameter as a redirection link, which attackers can use to carry out phishing, malicious website redirection and other attacks.

[0160] Step 16 may include:

[0161] Step 1614: Perform the following operations on the interface corresponding to the vulnerable data packet: First, verify whether the passed URL is a trusted domain name before redirecting the page; second, specify the redirect link through a whitelist.

[0162] The fifteenth remediation method: If the vulnerability involves plaintext transmission, and the user login information is transmitted in plaintext during the user login process, if the user suffers a man-in-the-middle attack, the attacker can directly obtain the user's login account and thus carry out further penetration.

[0163] Step 16 may include:

[0164] Step 1615: Perform the following operations on the interface corresponding to the vulnerable data packet: First, use encrypted transmission for user login information. For example, encrypt the password using a secure algorithm before transmission. Algorithms that can be used include: irreversible hash algorithm with salt (4-bit or higher random number generated by the server); secure symmetric encryption algorithms, such as AES (128, 192, 256 bits), and ensure that the client key is secure and cannot be cracked or read; asymmetric encryption algorithms, such as RSA (not less than 1024 bits), SM2, etc. Second, use HTTPS to ensure secure transmission.

[0165] The sixteenth remediation method: If the vulnerability involves the leakage of backup files, and the website's backup files or sensitive information files are stored in a certain website directory, attackers can discover and download the backup files through methods such as file scanning, leading to the leakage of sensitive information on the website.

[0166] Step 16 may include:

[0167] Step 1616: Perform the following operations on the interfaces corresponding to the vulnerable data packets: First, do not store website backup files or files containing sensitive information in the website directory; second, if such files need to be stored, name them with a random string that is difficult to guess.

[0168] The seventeenth remediation method: If the vulnerability involves the leakage of sensitive information, such as information leaked in the page or the returned response packet, this information provides attackers with a great deal of useful information for penetration.

[0169] Step 16 may include:

[0170] Step 1617: Perform the following operations on the interface corresponding to the vulnerable data packet:

[0171] 1. If it is a useless program such as a probe or test page, it is recommended to delete it or change it to a name that is difficult to guess;

[0172] 2. Delete or block access to pages that leak sensitive information without affecting business operations or functionality;

[0173] 3. Obfuscate sensitive information on the server side;

[0174] 4. Perform rigorous checks on the data returned by the server to ensure that the queried data matches the data displayed on the page.

[0175] The eighteenth fix: If the vulnerability is SMS / email bombing, the lack of restrictions on the number of times SMS or emails can be sent allows for an unlimited number of SMS or emails to be sent to users, resulting in SMS bombing and potentially leading to numerous user complaints.

[0176] Step 16 may include:

[0177] Step 1618: Limit the frequency of sending SMS or emails on the server. For example, an account can only send one SMS or email per minute and three times per day.

[0178] The nineteenth remediation method: If the vulnerability is the leakage of application error information, attackers can use special attack vectors to cause the web server to have 500, 403 and other related errors, resulting in the leakage of sensitive information such as absolute paths, web server versions, source code, SQL statements, etc. Malicious attackers are very likely to use this information to carry out further attacks.

[0179] Step 16 may include:

[0180] Step 1619: Customize the error page or use a uniform error page prompt.

[0181] The twentieth remediation method: If the vulnerability is that the target server has enabled insecure HTTP methods, such as PUT, TRACE, DELETE, MOVE, etc., these methods indicate that WebDAV may be used on the server. Since DAV methods allow clients to manipulate files on the server, such as uploading, modifying, and deleting related files, if DAV is not properly configured, it may allow unauthorized users to exploit it and modify files on the server.

[0182] Step 16 may include:

[0183] Step 1620: Perform the following operations on the interface corresponding to the vulnerable data packet: First, disable insecure transmission methods and only enable POST and GET methods; Second, if the server does not use WebDAV, it can be directly disabled, or strict access permissions can be configured for directories that allow WebDAV, such as authentication methods, usernames and passwords required for authentication.

[0184] In the above embodiments of the present invention, vulnerability detection is performed by performing regular expression matching and / or target language field parsing on the data packets transmitted through the interface according to relevant vulnerability detection strategies, thereby making vulnerability detection more accurate. Furthermore, vulnerable interfaces can be re-detected to improve the accuracy of interface vulnerability detection. Specifically, after vulnerability detection is completed, vulnerability logs, interface status logs, and interface vulnerability detection logs are generated. Based on the system interface vulnerability information, system vulnerability rankings and score rankings are generated to analyze the vulnerability of the detected system. Simultaneously, as new vulnerabilities are continuously detected and discovered, new vulnerabilities are updated in the vulnerability detection strategy, and the system is re-adapted for vulnerability detection, updating existing vulnerability information to make the new vulnerability detection strategy more applicable to relevant interfaces, facilitating timely adjustment of interface vulnerability issues. Furthermore, vulnerability detection results can be categorized to output clearer vulnerability detection results. Furthermore, vulnerabilities can be patched to improve the security of the system interface.

[0185] like Figure 5 As shown, embodiments of the present invention also provide a data transmission vulnerability detection device 50 for a data interface, comprising:

[0186] Module 51 acquires the data packet to be detected transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform;

[0187] The detection module 52 is used to parse the data packet to be detected to obtain a parsing result; and to perform data transmission vulnerability detection on the parsing result according to a preset vulnerability detection strategy to obtain a vulnerability detection result; the preset vulnerability detection strategy includes at least one rule expression.

[0188] Optionally, the data packets to be detected transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform are acquired, including:

[0189] The gateway intercepts data packets to be tested transmitted from the first system to the second system via a data interface within the network collaborative manufacturing integration platform.

[0190] Optionally, the data packet to be detected is parsed to obtain a parsing result, including:

[0191] The data packet to be detected is parsed to obtain the header information, input parameters and output parameters of the data packet, and the header information, input parameters and output parameters of the data packet to be detected are used as the parsing result.

[0192] Optionally, the parsing results are subjected to data transmission vulnerability detection according to a preset vulnerability detection strategy to obtain vulnerability detection results, including:

[0193] Obtain the rule expression corresponding to the preset vulnerability detection strategy;

[0194] The header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression to obtain the matching result;

[0195] Based on the matching results, it is determined whether there are vulnerabilities in the data transmission, and the vulnerability detection results are obtained.

[0196] Optionally, the header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression to obtain a matching result, including:

[0197] The header information, input parameter information, and output parameter information are matched with the rule expression using regular expressions and / or the target language field is parsed to obtain the matching result.

[0198] Optionally, the header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression using regular expressions to obtain the matching result, including:

[0199] The header information, input parameters, and output parameters of the data packet to be detected are input into the target function and matched against the target string of the rule expression. If the output result of the target function reaches a dangerous state, it is determined that the data packet to be detected matches the target string of the rule expression, and the matching result of the data packet to be detected being a data packet with a vulnerability is obtained.

[0200] Optionally, the header information, input parameter information, and output parameter information of the data packet to be detected are parsed with the rule expression using the target language field to obtain the matching result, including:

[0201] The header information, input parameter information, and output parameter information of the data packet to be detected are parsed according to the target language string to obtain the intermediate string;

[0202] The intermediate string is matched with the target language string. If the match is successful, the data packet to be detected is found to be a vulnerable data packet.

[0203] It should be noted that this device is the same as the method described above. All implementations in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0204] An embodiment of the present invention provides a computing device, comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0205] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0206] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0207] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0208] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0209] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0210] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0211] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0212] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above-described series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve by using their basic programming skills after reading the description of the present invention.

[0213] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0214] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting data transmission vulnerabilities in a data interface, characterized in that, include: Acquire the data packets to be tested transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform; The data packet to be detected is parsed to obtain the parsing result; The parsing results are subjected to data transmission vulnerability detection according to a preset vulnerability detection strategy to obtain vulnerability detection results; the preset vulnerability detection strategy includes at least one rule expression. Specifically, the parsing results are subjected to data transmission vulnerability detection according to a preset vulnerability detection strategy to obtain vulnerability detection results, including: Obtain the rule expression corresponding to the preset vulnerability detection strategy; The header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression using regular expression matching or target language field parsing matching to obtain the matching result; Based on the matching results, it is determined whether there are vulnerabilities in the data transmission, and the vulnerability detection results are obtained; The target data required for vulnerability detection includes: the encoding used by the data packet to be detected, input parameter information, data payload, and server-side processing code for the data packet to be detected being transmitted from the interface to the server. The encoding, input parameter information, data payload, and server-side processing code are processed using a tree-structured data processing function to obtain a preprocessing tree structure diagram. Specifically, the header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression using regular expression matching or target language field parsing matching to obtain the matching result. Based on the matching result, it is determined whether there is a vulnerability in the data transmission to obtain the vulnerability detection result, including: The data of each node in the preprocessed tree structure diagram is matched according to the rule expression to obtain the matching result; If the matching result confirms a match with the rule expression, then the interface is found to have a vulnerability; after the matching is confirmed, it is determined that the data chain of server-side processing code, encoding, and input parameter information has a vulnerability. When the preset vulnerability detection strategy is Structured Query Language (SQL) injection, arbitrary command or code execution, directory traversal or directory looping, brute force attack, unauthorized access, CRLF injection, Lightweight Directory Access Protocol (LDAP) injection, Uniform Resource Locator (URL) redirection or plaintext transmission, the target language field parsing matching method is used for vulnerability detection. When the preset vulnerability detection strategy is cross-site scripting (XSS), extensible markup language (XML) external entity injection, cross-site request forgery (CSRF), server request forgery (SSRF), directory listing, sensitive information disclosure, application error information disclosure, and the target server has enabled the insecure Hypertext Transfer Protocol (HTTP) method, regular expression matching is used for vulnerability detection. After obtaining the vulnerability detection results, the method further includes: The vulnerability is patched for the interface corresponding to the vulnerable data packet. The patching method includes any of the following: Use prepared SQL statements to query and bind variables to patch the vulnerabilities in the interfaces corresponding to the vulnerable data packets; When displaying user-submitted HTML code on the page, the HTML code is filtered and escaped.

2. The data transmission vulnerability detection method for a data interface according to claim 1, characterized in that, Acquire the data packets to be detected transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform, including: The gateway intercepts data packets to be tested transmitted from the first system to the second system via a data interface within the network collaborative manufacturing integration platform.

3. The data transmission vulnerability detection method for a data interface according to claim 1, characterized in that, The data packet to be detected is parsed to obtain the parsing result, including: The data packet to be detected is parsed to obtain the header information, input parameters and output parameters of the data packet, and the header information, input parameters and output parameters of the data packet to be detected are used as the parsing result.

4. The data transmission vulnerability detection method for a data interface according to claim 1, characterized in that, The header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression using regular expressions to obtain the matching results, including: The header information, input parameters, and output parameters of the data packet to be detected are input into the target function and matched against the target string of the rule expression. If the output result of the target function reaches a dangerous state, it is determined that the data packet to be detected matches the target string of the rule expression, and the matching result of the data packet to be detected being a data packet with a vulnerability is obtained.

5. The data transmission vulnerability detection method for a data interface according to claim 1, characterized in that, The header information, input parameters, and output parameters of the data packet to be detected are compared with the rule expression using target language fields to obtain matching results, including: The header information, input parameter information, and output parameter information of the data packet to be detected are parsed according to the target language string to obtain the intermediate string; The intermediate string is matched with the target language string. If the match is successful, the result is that the data packet to be detected is a data packet with a vulnerability.

6. A data interface data transmission vulnerability detection device, characterized in that, include: The acquisition module acquires the data packets to be detected transmitted from the first system to the second system through the data interface within the network collaborative manufacturing integration platform; The detection module is used to parse the data packet to be detected to obtain a parsing result; and to perform data transmission vulnerability detection on the parsing result according to a preset vulnerability detection strategy to obtain a vulnerability detection result; the preset vulnerability detection strategy includes at least one rule expression; Specifically, the parsing results are subjected to data transmission vulnerability detection according to a preset vulnerability detection strategy to obtain vulnerability detection results, including: Obtain the rule expression corresponding to the preset vulnerability detection strategy; The header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression using regular expression matching or target language field parsing matching to obtain the matching result; Based on the matching results, it is determined whether there are vulnerabilities in the data transmission, and the vulnerability detection results are obtained; The target data required for vulnerability detection includes: the encoding used by the data packet to be detected, input parameter information, data payload, and server-side processing code for the data packet to be detected being transmitted from the interface to the server. The encoding, input parameter information, data payload, and server-side processing code are processed using a tree-structured data processing function to obtain a preprocessing tree structure diagram. Specifically, the header information, input parameter information, and output parameter information of the data packet to be detected are matched with the rule expression using regular expression matching or target language field parsing matching to obtain the matching result. Based on the matching result, it is determined whether there is a vulnerability in the data transmission to obtain the vulnerability detection result, including: The data of each node in the preprocessed tree structure diagram is matched according to the rule expression to obtain the matching result; If the matching result confirms a match with the rule expression, then the interface is found to have a vulnerability; after the matching is confirmed, it is determined that the data chain of server-side processing code, encoding, and input parameter information has a vulnerability. When the preset vulnerability detection strategy is Structured Query Language (SQL) injection, arbitrary command or code execution, directory traversal or directory looping, brute force attack, unauthorized access, CRLF injection, Lightweight Directory Access Protocol (LDAP) injection, Uniform Resource Locator (URL) redirection or plaintext transmission, the target language field parsing matching method is used for vulnerability detection. When the preset vulnerability detection strategy is cross-site scripting (XSS), extensible markup language (XML) external entity injection, cross-site request forgery (CSRF), server request forgery (SSRF), directory listing, sensitive information disclosure, application error information disclosure, and the target server has enabled the insecure Hypertext Transfer Protocol (HTTP) method, regular expression matching is used for vulnerability detection. After obtaining the vulnerability detection results, the detection module can also be used for: The vulnerability is patched for the interface corresponding to the vulnerable data packet. The patching method includes any of the following: Use prepared SQL statements to query and bind variables to patch the vulnerabilities in the interfaces corresponding to the vulnerable data packets; When displaying user-submitted HTML code on the page, the HTML code is filtered and escaped.

7. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, A storage instruction that, when executed on a computer, causes the computer to perform the method as described in any one of claims 1 to 5.

Images