Methods, devices, processors, and electronic equipment for identifying network attack targets

Abstract

This application discloses a method, apparatus, processor, and electronic device for identifying network attack endpoints. Relating to the field of information security, the method includes: determining an application interface (API) deployment point based on the application interface of a network system; setting a decoy API at the API deployment point and detecting whether the decoy API receives an access request, wherein the decoy API is hidden when performing business operations through the network system; and identifying the sender of the access request when the decoy API receives an access request, and determining the sender of the access request as a network attack endpoint of the network system. This application solves the problems of low efficiency in identifying network attack endpoints and the easy overlooking of hidden network attack endpoints in related technologies.

Description

Technical Field

[0001] This application relates to the field of information security, and more specifically, to a method, apparatus, processor, and electronic device for identifying network attack endpoints. Background Technology

[0002] APIs (Application Programming Interfaces) serve as the core channel for connecting services and transmitting data, and their demand is rapidly increasing due to the accelerated digital transformation across industries. However, while bringing immense convenience, APIs also introduce new security challenges. Because many APIs directly connect to backend databases storing sensitive data, cyber attackers are increasingly using APIs as a means to access underlying infrastructure and steal sensitive information.

[0003] Currently, security strategies for Application Programming Interfaces (APIs) involve analyzing API call data. However, due to the diversity and complexity of APIs, traditional technologies cannot adequately meet business security needs, can negatively impact API performance, have low accuracy in identifying API attacks, and fail to effectively distinguish between legitimate users and network attackers.

[0004] There is currently no effective solution to the problem that related technologies are inefficient in identifying network attack terminals and easily overlook hidden network attack terminals. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, processor, and electronic device for identifying network attack terminals, in order to solve the problems of low efficiency in identifying network attack terminals and easy oversight of hidden network attack terminals in related technologies.

[0006] To achieve the above objectives, according to one aspect of this application, a method for identifying a network attack endpoint is provided. The method includes: determining an application interface (API) deployment point based on the application interface of a network system; setting a decoy API at the API deployment point and detecting whether the decoy API receives an access request, wherein the decoy API is hidden when performing business operations through the network system; and, if the decoy API receives an access request, identifying the sender of the access request and determining the sender of the access request as a network attack endpoint of the network system.

[0007] Optionally, setting the decoy application interface at the application interface delivery point includes: obtaining the type of the application interface, and determining the type of the decoy application interface based on the type of the application interface, wherein the type of the application interface includes at least one of the following: control, code, system file, document; and setting the decoy application interface at the application interface delivery point based on the type of the decoy application interface.

[0008] Optionally, setting the decoy application interface at the application interface delivery point according to the type of the decoy application interface includes: if the type of the decoy application interface is a control, inserting the decoy application interface into the system control of the network system and hiding the decoy application interface; if the type of the decoy application interface is code, compiling the decoy application interface into code comments and inserting the code comments into the code of the network system; if the type of the decoy application interface is a system file, compiling the decoy application interface into a system configuration file and storing the system configuration file in the configuration library of the network system, wherein the configuration library stores all system files of the network system; if the type of the decoy application interface is a document, creating a new text document in the document of the network system and writing the decoy application interface into the text document, wherein the text document containing the decoy application interface is accessible.

[0009] Optionally, determining the application interface deployment points based on the application interface of the network system includes: determining M preset application interfaces of the network system, where M is a positive integer; determining N setting locations of the M preset application interfaces in the network system, where N is a positive integer, M is greater than or equal to N, and at least one preset application interface is set at each setting location; and determining the N setting locations as application interface deployment points.

[0010] Optionally, determining the M preset application interfaces of the network system includes: determining whether the network system is associated with a list of risky application interfaces, wherein the list of risky application interfaces is determined by access information of application interfaces of different network systems by historical network attack terminals, and each risky application interface in the list of risky application interfaces has been attacked more than a preset number of times by historical network attack terminals; if the network system is associated with a list of risky application interfaces, filtering the application interfaces contained in the network system from the list of risky application interfaces to obtain the M preset application interfaces.

[0011] Optionally, after determining whether the network system is associated with a list of risky application interfaces, the method further includes: if the network system is not associated with a list of risky application interfaces, determining all application interfaces of the network system as preset application interfaces, thereby obtaining M preset application interfaces.

[0012] Optionally, after identifying the sender as a network attack target in the network system, the method further includes: obtaining the address information of the network attack target; adding the address information to a preset access list of the network system, wherein network devices in the preset access list do not have permission to access the application programming interface of the network system.

[0013] To achieve the above objectives, according to another aspect of this application, a device for identifying network attack endpoints is provided. The device includes: a first determining unit, configured to determine an application interface (API) deployment point based on the application interface of a network system; a setting unit, configured to set a decoy API at the API deployment point and detect whether the decoy API receives an access request, wherein the decoy API is in a hidden state when performing business operations through the network system; and an identifying unit, configured to identify the sender of the access request when the decoy API receives an access request, and determine the sender of the access request as a network attack endpoint of the network system.

[0014] According to another aspect of the present invention, a processor is also provided, which is used to run a program, wherein the program controls a device containing a non-volatile storage medium to perform a method for identifying network attack terminals.

[0015] According to another aspect of the present invention, an electronic device is also provided, comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is used to execute the computer-readable instructions, wherein the computer-readable instructions execute a method for identifying network attack terminals.

[0016] This application employs the following steps: determining the application interface (API) deployment point based on the network system's API; setting a decoy API at the API deployment point and detecting whether the decoy API receives an access request, wherein the decoy API is hidden when performing business operations through the network system; and identifying the sender of the access request when the decoy API receives an access request, thus identifying the sender as the network attack endpoint of the network system. This solves the problems of low efficiency in identifying network attack endpoints and the easy overlooking of hidden network attack endpoints in related technologies. By utilizing the API in the network system to determine the API deployment point and setting a decoy API at the API deployment point, network attack endpoints can be quickly identified when accessing the decoy API, thereby achieving the effect of effectively identifying network attack endpoints using the API. Attached Figure Description

[0017] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a flowchart of a method for identifying network attack terminals according to an embodiment of this application;

[0019] Figure 2 This is a schematic diagram of a method for determining a preset application programming interface according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of a network attack identification device provided according to an embodiment of this application;

[0021] Figure 4 This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties.

[0026] It should be noted that with the acceleration of digital transformation, the demand for Application Programming Interfaces (APIs), as the core channel for connecting services and transmitting data, is growing rapidly. Because APIs are directly connected to databases storing sensitive data, network attackers can use APIs to access the underlying infrastructure and obtain sensitive information. Therefore, to effectively protect network systems and accurately identify network attack targets, the APIs in the network system can be manipulated. This involves installing "decoys" at the locations of the APIs stored in the network system. These "decoys" can then be used to obtain the network attack targets used by attackers, thereby achieving secure protection of sensitive data.

[0027] The present invention will now be described in conjunction with preferred implementation steps. Figure 1 This is a flowchart of a network attack terminal identification method provided according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0028] Step S101: Determine the application interface deployment point based on the application interface of the network system.

[0029] It should be noted that an Application Programming Interface (API) is a predefined interface that primarily provides support for applications and developers to access a set of routines based on certain software or hardware.

[0030] First, obtain the normal application programming interfaces (APIs) in the network system. Then, use the settings of the normal APIs to determine the placement point of the "bait" API. The placement point is the location where the decoy API is set. Since the network attacker needs to collect relevant information in the network system before attacking it, and the relevant information in the network system is set with APIs, in order to effectively identify the access information sent by the network attacker and thus identify the network attacker, a decoy API can be set at the API.

[0031] Step S102: Set up a decoy application interface at the application interface deployment point and detect whether the decoy application interface receives an access request. When performing business operations through the network system, the decoy application interface is in a hidden state.

[0032] Specifically, after determining the application programming interface (API) deployment point, it is necessary to determine the "bait" based on the normal API, that is, to determine the bait API based on the type of normal API, and then deploy the bait API to the API deployment point.

[0033] Furthermore, when the network attacker initiates an access request to the network system, it will collect relevant information through various application interfaces in the network system. At this time, since the decoy application interface is set at the normal application interface of the network system, when the network attacker uses scanning tools to collect information, the access request will connect to the decoy application interface. The decoy application interface will promptly capture the scanning behavior generated by the scanning tool, and thus identify the relevant information of the network attacker.

[0034] Step S103: When the decoy application interface receives an access request, identify the sender of the access request and determine the sender of the access request as the network attack terminal of the network system.

[0035] Specifically, if a network attacker uses scanning tools to collect information about the location of a decoy, such as a database connected to an application programming interface (API), the decoy API will receive an access request from the network attacker. In other words, the decoy API set up at this API will promptly capture the scanning behavior and, based on the access request from the network attacker, can identify the address information of the network attacker. It can then use the address information to locate the network attacker, thereby enabling timely actions such as restricting the network attacker's permissions based on the address information before the network attacker begins its formal network attack operation. This can effectively protect sensitive data in the network system.

[0036] The network attack terminal identification method provided in this application embodiment determines the application interface (API) delivery point based on the application interface of the network system; sets a decoy API at the API delivery point and detects whether the decoy API receives an access request. The decoy API is hidden when performing business operations through the network system. When the decoy API receives an access request, the sender of the access request is identified and determined as the network attack terminal of the network system. This solves the problems of low efficiency and easy overlooking of hidden network attack terminals in related technologies. By using the application interface of the network system to determine the API delivery point and setting a decoy API at the API delivery point, the network attack terminal can be quickly identified when accessing the decoy API, thus achieving the effect of effectively identifying the network attack terminal using the application interface.

[0037] The decoy application interface can be determined based on the type of the application interface. Optionally, in the network attack terminal identification method provided in this application embodiment, setting the decoy application interface at the application interface placement point includes: obtaining the type of the application interface and determining the type of the decoy application interface based on the type of the application interface, wherein the type of the application interface includes at least one of the following: control, code, system file, document; and setting the decoy application interface at the application interface placement point according to the type of the decoy application interface.

[0038] Specifically, after obtaining the application interface deployment point, it is necessary to determine the decoy application interface. First, obtain the type of application interface in the network system, and determine the type of decoy application interface based on the type of application interface. That is, the decoy application interface set on different application interfaces needs to be consistent with the type of that application interface.

[0039] For example, if the application interface type in the network system is a control, and this application interface is set in the web control list of the network system, then if a decoy application interface needs to be installed at the location set by this application interface, the type of the decoy application interface needs to be set to control. If the application interface type in the network system is program code, then when a decoy application interface needs to be installed at the location set by this application interface, the type of the decoy application interface needs to be set to program code. If the application interface type in the network system is a system file such as a resource file, configuration file, or log file, then when a decoy application interface needs to be installed at the location set by this application interface, the type of the decoy application interface needs to be set to a system file of the same type. If the application interface type in the network system is a general document, then when a decoy application interface needs to be installed at the location set by this application interface, the type of the decoy application interface needs to be set to a general document of the same type. Through this embodiment, by using the type of the application interface to determine the type of the decoy application interface, and by setting the decoy application interface in the corresponding location, it can be ensured that when the network attacker uses scanning tools to collect information, the decoy application interface can capture relevant information about the network attacker in a timely and accurate manner, and use the relevant information to locate the network attacker in a timely manner.

[0040] There are various ways to set up a decoy application interface. Optionally, in the network attack terminal identification method provided in this application embodiment, setting the decoy application interface at the application interface placement point according to the type of the decoy application interface includes: when the type of the decoy application interface is a control, inserting the decoy application interface into the system control of the network system and hiding the decoy application interface; when the type of the decoy application interface is code, compiling the decoy application interface into code comments and inserting the code comments into the code of the network system; when the type of the decoy application interface is a system file, compiling the decoy application interface into a system configuration file and storing the system configuration file in the configuration library of the network system, wherein the configuration library stores all system files of the network system; when the type of the decoy application interface is a document, creating a new text document in the document of the network system and writing the decoy application interface into the text document, wherein the text document containing the decoy application interface is accessible.

[0041] The setup of decoy application interfaces (APIs) needs to be done in a hidden manner. For example, if the decoy API is a control, it needs to be inserted into the system controls of the network system and set to hidden mode. For example, when the decoy API is a button or text box, in order to prevent the decoy API from participating in the normal business functions of the network system and to ensure that normal users will not trigger the decoy API when using the network system for normal operations, the display property of the control needs to be set to hidden mode.

[0042] For example, if the decoy application interface is set to code based on the type of the normal application interface, the decoy application interface can be compiled into code comments and inserted into the code that builds the network system, or the decoy application interface can be compiled into a constant or function in the code and the compiled constant or code can be inserted into resource files such as js files.

[0043] For example, if the normal application interface is of type system file, then the decoy application interface is set to type system file. Furthermore, the decoy application interface is compiled into a system file of the relevant type, such as a system configuration file or a log file, and the compiled system configuration file or log file is inserted into the network system's configuration file and log file and stored in the configuration library.

[0044] In addition, the decoy application interface can also be set as a document according to the type of normal application interface. In this case, a new text document needs to be created in the network system, the decoy application document is written into the new document, and the display attribute of the document is set to allowed access mode.

[0045] This embodiment, by setting the decoy application interface to be deployed covertly, can promptly detect network attack terminals that use scanning tools to collect information, without affecting normal users' normal use of the network system due to the setting of the decoy application interface.

[0046] Application programming interface (API) deployment points can be determined based on the API. Optionally, in the network attack terminal identification method provided in this application embodiment, determining the API deployment points based on the network system's API includes: determining M preset APIs of the network system, where M is a positive integer; determining N setting locations of the M preset APIs in the network system, where N is a positive integer, M is greater than or equal to N, and at least one preset API is set at each setting location; and determining the N setting locations as API deployment points.

[0047] Specifically, first, obtain the normal application interfaces in the network system where the network security "decoy" needs to be set. Then, obtain the setting location of each application interface in the network system. For example, the setting location can be in the static page code of the network system, dynamically loaded resource files, configuration files, or log files.

[0048] Furthermore, each setting location in the network system can be configured with multiple preset application interfaces. For example, if there is a setting location in the network system that is a configuration file, and the configuration file contains two or more preset application interfaces, when it is necessary to set up a bait delivery application interface, a setting location can be selected from these preset application interfaces as the application interface delivery point for the bait delivery application interface. This can achieve the effect of protecting the security of the network system while saving human resources.

[0049] Furthermore, the placement point of the "bait" application interface (API) is determined based on the location of the normal API settings. For example, if the normal API settings are in the static page code of the network system, the API placement point can also be in the static page code, specifically in a function or variable. If the normal API settings are in a dynamically loaded resource file, the API placement point can also be in a dynamically loaded resource file. If the normal API settings are in a configuration file or log file, the API placement point can also be in a configuration file or log file. In addition, the API placement point can also be placed in the network system code as text or as a comment; it can also be in an existing file within the network system, or even as a newly created file.

[0050] This embodiment utilizes the location settings of some or all application programming interfaces (APIs) in the network system to determine the location of API deployment points. By setting multiple API deployment points in the network system, attacks launched by network attackers can be detected over a wider area. This can effectively protect the security of the network system while significantly reducing the maintenance time for staff after a network attack.

[0051] The default application programming interface (API) is determined by whether the network system is associated with a list of risky APIs. Figure 2 This is a schematic diagram of a method for determining a preset application programming interface according to an embodiment of this application, such as... Figure 2 As shown, optionally, in the network attack terminal identification method provided in this application embodiment, determining the M preset application programming interfaces of the network system includes:

[0052] Step S201: Determine whether the network system is associated with a list of risky application interfaces. The list of risky application interfaces is determined by the access information of application interfaces of different network systems by historical network attack terminals. Each risky application interface in the list of risky application interfaces has been attacked by historical network attack terminals more than a preset number of times.

[0053] Step S202: If the network system is associated with a list of risky application interfaces, filter the application interfaces contained in the network system from the list of risky application interfaces to obtain M preset application interfaces.

[0054] Specifically, before determining the deployment point of an application interface based on the normal application interfaces of the network system, it is necessary to determine whether the network system has a record of network attacks, that is, whether the network system is associated with a list of risky application interfaces. In this case, the application interfaces in the list of risky application interfaces have been attacked more than a preset number of times in the historical time period. For example, if the number of network attacks on an application interface in the previous quarter was more than the preset number, that is, more than 10 times, it indicates that the application interface is a "sensitive interface" and should be used as a preset application interface.

[0055] If a network system does not have a list of associated risky application interfaces, it indicates that it has not been attacked by network attackers during the historical time period, or that the application interfaces attacked by network attackers during the historical time period are not fixed.

[0056] If the network system is associated with a list of risky application programming interfaces (APIs), it indicates that the network system contains APIs that are vulnerable to network attacks. Therefore, preset APIs can be determined based on these APIs. Further, based on the location and type of the selected APIs, the API deployment points and the types of decoy APIs are determined. The decoy APIs are then deployed to the API deployment points, completing the "bait" setup for the network system.

[0057] This embodiment determines whether a network system is associated with a list of risky application interfaces, thereby determining whether a network attack event occurred in the network system during a historical period. If a network attack event occurred in the network system during the historical period, the application interfaces attacked in the network attack event are used to determine the application interfaces to place decoys. This can save network security engineers a lot of time and manpower when setting up decoy application interfaces, and improve the efficiency and accuracy of identifying network attack terminals.

[0058] The preset application interfaces can also be determined by all application interfaces in the network system. Optionally, in the network attack terminal identification method provided in the embodiments of this application, after determining whether the network system is associated with a list of risky application interfaces, the method further includes: if the network system is not associated with a list of risky application interfaces, determining all application interfaces of the network system as preset application interfaces, thereby obtaining M preset application interfaces.

[0059] Specifically, if the relevant application interface data for the network system is not included in the list of risky application interfaces, it indicates that no records of access by a cyberattack target were detected within the network system during the historical time period, and no cyberattack-related information was detected in similar network systems. This also suggests that the number of cyberattacks against the network system and similar network systems was relatively low during the historical time period. In this case, all normal application interfaces in the network system can be designated as preset application interfaces, and their locations can be designated as application interface deployment points. This method effectively prevents cyberattack targets from collecting sensitive information through an application interface without decoys and then launching cyberattacks against the network system after collection.

[0060] In this embodiment, by determining whether a network system is associated with a list of risky application interfaces, it is possible to identify decoy application interfaces in a short period of time, thereby maximizing the security of the network system and preventing information in the network system from being leaked by network attackers.

[0061] After identifying a network attack endpoint using a decoy application interface, relevant measures can be taken against it. Optionally, in the network attack endpoint identification method provided in this application embodiment, after determining that the sending end is a network attack endpoint of the network system, the method further includes: obtaining the address information of the network attack endpoint; adding the address information to a preset access list of the network system, wherein the network devices in the preset access list do not have the permission to access the application interface of the network system.

[0062] Specifically, the preset access list can be a blacklist of the network system. After detecting an access request from a network attacker, the address information of the network attacker is first obtained. For example, if the network attacker is a client, the address used by the client to access the network system can be obtained; if the network attacker is a server, the server address of the server can be obtained.

[0063] Furthermore, labeling the obtained address information of the network attacker can effectively prevent subsequent attacks on the network system, or the address information can be added to the network system's blacklist to prohibit the address from initiating access to the network system. Labeling the address information can involve setting partial access permissions and monitoring the address; for example, prohibiting the address from accessing the network system's configuration files, but allowing the address to perform basic operations on the network system.

[0064] This embodiment utilizes a decoy application programming interface to identify network attack terminals and takes timely measures after identification. This effectively detects potential vulnerabilities before the network attack terminal launches its attack, thereby improving the accuracy of identification and maximizing the security of the network system.

[0065] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0066] This application also provides a device for identifying network attack terminals. It should be noted that this device can be used to execute the network attack terminal identification method provided in this application. The following describes the network attack terminal identification device provided in this application.

[0067] Figure 3 This is a schematic diagram of a network attack identification device provided according to an embodiment of this application, such as... Figure 3 As shown, the device includes: a first determining unit 30, a setting unit 31, and an identification unit 32.

[0068] The first determining unit 30 is used to determine the application interface delivery point based on the application interface of the network system.

[0069] Setting unit 31 is used to set a decoy application interface at the application interface delivery point and detect whether the decoy application interface receives an access request. When performing business operations through the network system, the decoy application interface is in a hidden state.

[0070] The identification unit 32 is used to identify the sender of the access request when the decoy application interface receives the access request, and to determine the sender of the access request as the network attack end of the network system.

[0071] Optionally, in the network attack terminal identification device provided in this application embodiment, the setting unit 31 includes: an acquisition module, used to acquire the type of application interface and determine the type of decoy application interface according to the type of application interface, wherein the type of application interface includes at least one of the following: control, code, system file, document; and a setting module, used to set the decoy application interface at the application interface delivery point according to the type of decoy application interface.

[0072] Optionally, in the network attack terminal identification device provided in this application embodiment, the setting unit 31 includes: an insertion module, used to insert the decoy application interface into the system control of the network system and hide the decoy application interface when the type of the decoy application interface is a control; a first compilation module, used to compile the decoy application interface into code comments when the type of the decoy application interface is code, and insert the code comments into the code of the network system; a second compilation module, used to compile the decoy application interface into a system configuration file when the type of the decoy application interface is a system file, and store the system configuration file in the configuration library of the network system, wherein the configuration library stores all system files of the network system; and a creation module, used to create a new text document in the document of the network system when the type of the decoy application interface is a document, and write the decoy application interface into the text document, wherein the text document containing the decoy application interface is accessible.

[0073] Optionally, in the network attack terminal identification device provided in the embodiments of this application, the first determining unit 30 includes: a first determining module, used to determine M preset application programming interfaces (APIs) of the network system, where M is a positive integer; a second determining module, used to determine N setting locations of the M preset APIs in the network system, where N is a positive integer, M is greater than or equal to N, and at least one preset API is set at each setting location; and a third determining module, used to determine the N setting locations as API deployment points.

[0074] Optionally, in the network attack identification device provided in this application embodiment, the first determining unit 30 includes: a judging module, used to judge whether the network system is associated with a list of risky application interfaces, wherein the list of risky application interfaces is determined by access information of application interfaces of different network systems by historical network attack terminals, and each risky application interface in the list of risky application interfaces has been attacked by historical network attack terminals more than a preset number of times; and a filtering module, used to filter the application interfaces contained in the network system from the list of risky application interfaces when the network system is associated with a list of risky application interfaces, to obtain M preset application interfaces.

[0075] Optionally, in the network attack terminal identification device provided in the embodiments of this application, the device further includes: a second determining unit, used to determine all application interfaces of the network system as preset application interfaces after determining whether the network system is associated with a list of risky application interfaces, and if the network system is not associated with a list of risky application interfaces, to obtain M preset application interfaces.

[0076] Optionally, in the network attack terminal identification device provided in the embodiments of this application, the device further includes: an acquisition unit, used to acquire the address information of the network attack terminal after determining that the sending terminal is a network attack terminal of the network system; and an addition unit, used to add the address information to a preset access list of the network system, wherein the network devices in the preset access list do not have the permission to access the application programming interface of the network system.

[0077] The network attack terminal identification device provided in this application embodiment includes a first determining unit 30 for determining the application interface (API) delivery point based on the application interface of the network system; a setting unit 31 for setting a decoy API at the API delivery point and detecting whether the decoy API receives an access request, wherein the decoy API is in a hidden state when performing business operations through the network system; and an identification unit 32 for identifying the sender of the access request when the decoy API receives an access request, and identifying the sender of the access request as the network attack terminal of the network system. This solves the problems of low efficiency in identifying network attack terminals and easy neglect of hidden network attack terminals in related technologies. By using the application interface of the network system to determine the API delivery point and setting the decoy API at the API delivery point, the network attack terminal can be quickly identified when accessing the decoy API, thereby achieving the effect of effectively identifying the network attack terminal using the application interface.

[0078] The network attack identification device includes a processor and a memory. The first determining unit 30, setting unit 31, identification unit 32, etc. are all stored in the memory as program units. The processor executes the program units stored in the memory to realize the corresponding functions.

[0079] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured; adjusting kernel parameters can address the issues of low efficiency in identifying network attack targets and the tendency to overlook hidden attack targets in related technologies.

[0080] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0081] This invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements the method for identifying network attack terminals.

[0082] This invention provides a processor for running a program, wherein the program executes the method for identifying network attack terminals during runtime.

[0083] Figure 4 This is a schematic diagram of an electronic device provided according to an embodiment of this application, such as... Figure 4 As shown, this embodiment of the invention provides an electronic device 40, which includes a processor, a memory, and a program stored in the memory and executable on the processor. The processor is used to execute computer-readable instructions, wherein the computer-readable instructions execute a method for identifying network attack terminals. The device described herein can be a server, PC, PAD, mobile phone, etc.

[0084] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing a method for identifying network attack endpoints.

[0085] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0087] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0090] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0091] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0093] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0094] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying a network attack end, characterized in that, The application comprises the following steps: determining an application interface delivery point according to the application interface of the network system, wherein the application interface refers to the interface defined in advance by the network system; setting a decoy application interface in the application interface delivery point and detecting whether the decoy application interface receives an access application, wherein the decoy application interface is in a hidden state when a business operation is performed through the network system; wherein setting the decoy application interface in the application interface delivery point comprises: obtaining the type of the application interface and determining the type of the decoy application interface according to the type of the application interface, wherein the type of the application interface at least comprises one of the following: a control, a code, a system file, a document; setting the decoy application interface in the application interface delivery point according to the type of the decoy application interface; in the case that the decoy application interface receives the access application, identifying the sending end of the access application and determining the sending end of the access application as the network attack end of the network system.

2. The method of claim 1, wherein, setting the decoy application interface in the application interface delivery point according to the type of the decoy application interface comprises: in the case that the type of the decoy application interface is the control, inserting the decoy application interface into the system control of the network system and hiding the decoy application interface; in the case that the type of the decoy application interface is the code, compiling the decoy application interface into a code comment and inserting the code comment into the code of the network system; in the case that the type of the decoy application interface is the system file, compiling the decoy application interface into a system configuration file and storing the system configuration file in the configuration library of the network system, wherein the configuration library stores all system files of the network system; in the case that the type of the decoy application interface is the document, creating a text document in the document of the network system and writing the decoy application interface into the text document, wherein the text document where the decoy application interface is located allows access.

3. The method of claim 1, wherein, determining the application interface delivery point according to the application interface of the network system comprises: determining M preset application interfaces of the network system, wherein M is a positive integer; determining N setting positions of the M preset application interfaces in the network system, wherein N is a positive integer, M is greater than or equal to N, and each setting position is provided with at least one preset application interface; determining the N setting positions as the application interface delivery point.

4. The method of claim 3, wherein, determining the M preset application interfaces of the network system comprises: judging whether the network system is associated with a risk application interface list, wherein the risk application interface list is determined by the access information of different network systems by the historical network attack end, and each risk application interface in the risk application interface list is accessed by the historical network attack end more than a preset number of times; In a case where the network system is associated with the risk application interface list, the network system is screened from the risk application interface list to obtain the M preset application interfaces.

5. The method of claim 4, wherein, After judging whether the network system is associated with the risk application interface list, the method further comprises: In a case where the network system is not associated with the risk application interface list, all application interfaces of the network system are determined as the preset application interfaces to obtain the M preset application interfaces.

6. The method of claim 1, wherein, After determining the sending end as the network attack end of the network system, the method further comprises: obtaining address information of the network attack end; adding the address information to a preset access list of the network system, wherein a network device in the preset access list does not have the permission to access the application interfaces of the network system.

7. A device for identifying network attack terminals, characterized in that, Comprise: A first determination unit is configured to determine an application interface delivery point according to application interfaces of a network system, wherein the application interfaces refer to interfaces defined in advance by the network system. A setting unit is configured to set a decoy application interface in the application interface delivery point and detect whether the decoy application interface receives an access application, wherein the decoy application interface is in a hidden state when a business operation is performed through the network system. The setting unit comprises: an obtaining module configured to obtain a type of the application interfaces and determine a type of the decoy application interface according to the type of the application interfaces, wherein the type of the application interfaces comprises at least one of the following: a control, a code, a system file, and a document; and a setting module configured to set the decoy application interface in the application interface delivery point according to the type of the decoy application interface. An identification unit is configured to identify a sending end of the access application in a case where the decoy application interface receives the access application, and determine the sending end of the access application as a network attack end of the network system.

8. A processor, comprising: The processor is configured to run a program, wherein the program performs the identification method of the network attack end in any one of claims 1 to 6 when the program is run.

9. An electronic device, comprising: Comprise one or more processors and a memory, the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the identification method of the network attack end in any one of claims 1 to 6.

Images