Malicious attack defense method and device, edge server and storage medium

Abstract

Embodiments of the present application provide a malicious attack defense method and device, an edge server and a storage medium, relating to the technical field of network security, which forwards the HTTP request of a browser to an original server, so that the original server sends corresponding source code to the edge server according to the HTTP request; obtains third-party HTTP requests according to the source code; when the target file name corresponding to the target third-party code is saved in the local cache of the database server, replaces the target domain name address in the third-party HTTP request in the source code with the domain name address of the edge server, and returns the modified source code to the browser; the target third-party code is the code obtained from the third-party server and not maliciously tampered with. The malicious attack is prevented by saving the third-party code not maliciously tampered with in the local cache, thereby ensuring the security of the supply chain website.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a malicious attack defense method and device, an edge server and a storage medium. BACKGROUND

[0002] In a cloud defense architecture based on a content delivery network (CDN), a client's website usually references a large number of third-party JavaScript code libraries of external websites, which aims to improve the loading speed. However, since the original code is saved in the third-party code library, once the third-party code library is maliciously tampered with, the website has a security risk and may be attacked, resulting in data leakage, service interruption or other adverse effects.

[0003] At present, the situation of third-party code library being implanted with malicious code is mainly dealt with by means of active detection or monitoring, which usually scans the code in the webpage regularly to determine whether it contains malicious code. However, this method has timeliness problems and only plays a detection role, and cannot achieve a defense effect. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a malicious attack defense method and device, an edge server and a storage medium, which can defend against malicious attacks by saving the third-party code that has not been maliciously tampered with in a local cache, thereby ensuring the security of the supply chain website.

[0005] To achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows:

[0006] In a first aspect, the present application provides a malicious attack defense method applied to an edge server, wherein the edge server is in communication connection with an original server, a database server and a third-party server; the method comprises the following steps:

[0007] forwarding the HTTP request of the browser to the original server, so that the original server sends the corresponding source code to the edge server according to the HTTP request;

[0008] obtaining a third-party HTTP request according to the source code; the third-party HTTP request comprises a URL address, and the URL address comprises a target domain name address and a target file name;

[0009] when the target third-party code corresponding to the target file name is saved in the local cache of the database server, replacing the target domain name address in the third-party HTTP request in the source code with the domain name address of the edge server, and returning the modified source code to the browser; the target third-party code is the code obtained from the third-party server and not maliciously tampered with.

[0010] In an optional embodiment, the method further comprises:

[0011] when the target third-party code corresponding to the target file name is not saved in the local cache of the database server, obtaining the third-party code from the third-party server according to the third-party HTTP request;

[0012] calling an antivirus software to detect whether the third-party code includes malicious code;

[0013] if the third-party code does not include malicious code, taking the third-party code as the target third-party code, and synchronizing the target third-party code and the target file name to the database server, so that the database server saves the target file name and the target third-party code into the local cache.

[0014] In an optional embodiment, the method further comprises:

[0015] if the third-party code includes malicious code, deleting the URL address in the third-party HTTP request in the source code, and returning the modified source code to the browser.

[0016] In an optional embodiment, the method further comprises:

[0017] sending a query instruction to the database server according to the target file name in the query request sent by the browser, so that the database server finds the target third-party code corresponding to the target file name according to the target file name in the query instruction, and returns the target third-party code to the edge server;

[0018] returning the received target third-party code to the browser.

[0019] In an optional embodiment, the method further comprises:

[0020] sending a cache clearing instruction to the database server according to the user's update cache operation, so that the database server clears the local cache according to the cache clearing instruction.

[0021] In an optional embodiment, the third-party HTTP request is obtained from the source code, including:

[0022] The parser is used to parse all the third-party HTTP requests from the source code.

[0023] In a second aspect, the present application provides a malicious attack defense device, which is applied to an edge server, and the edge server is in communication connection with an original server, a database server and a third-party server; the device comprises:

[0024] A source code query module is configured to forward an HTTP request of a browser to the original server, so that the original server sends corresponding source code to the edge server according to the HTTP request;

[0025] A parsing module is configured to obtain a third-party HTTP request from the source code; the third-party HTTP request comprises a URL address, and the URL address comprises a target domain name address and a target file name;

[0026] A processing module is configured to replace the target domain name address in the third-party HTTP request in the source code with a domain name address of the edge server when the target third-party code corresponding to the target file name is saved in a local cache of the database server, and return the modified source code to the browser; the target third-party code is unmaliciously tampered code obtained from the third-party server.

[0027] In an optional embodiment, the processing module is further configured to obtain third-party code from the third-party server according to the third-party HTTP request when the target third-party code corresponding to the target file name is not saved in the local cache of the database server; call an antivirus software to detect whether the third-party code comprises malicious code; if the third-party code does not comprise malicious code, the third-party code is used as the target third-party code, and the target third-party code is synchronized to the database server with the target file name, so that the database server saves the target file name and the target third-party code into the local cache.

[0028] In a third aspect, the present application provides an edge server, which comprises a memory and a processor; the memory is configured to store a computer program; and the processor is configured to execute the malicious attack defense method according to any one of the preceding embodiments when the computer program is called.

[0029] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program; and the computer program is executed by a processor to implement the malicious attack defense method according to any one of the preceding embodiments.

[0030] Compared with the prior art, the malicious attack defense method, device, edge server and storage medium provided by the embodiments of the present application, the method is applied to an edge server, the edge server is in communication connection with an original server, a database server and a third-party server, forwards an HTTP request of a browser to the original server, so that the original server sends corresponding source code to the edge server according to the HTTP request; obtaining a third-party HTTP request according to the source code; the third-party HTTP request includes a URL address, and the URL address includes a target domain name address and a target file name; when the target third-party code corresponding to the target file name is saved in the local cache of the database server, the target domain name address in the third-party HTTP request in the source code is replaced with the domain name address of the edge server, and the modified source code is returned to the browser; the target third-party code is the code obtained from the third-party server and not maliciously tampered with. The malicious attack is prevented by saving the third-party code not maliciously tampered with in the local cache, thereby ensuring the security of the supply chain website.

[0031] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the following preferred embodiments are specifically described below, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0033] Figure 1 A kind of application scenario schematic diagram provided by the embodiments of the present application is shown.

[0034] Figure 2 A kind of schematic diagram of the malicious attack defense method provided by the embodiments of the present application is shown.

[0035] Figure 3 Another kind of schematic diagram of the malicious attack defense method provided by the embodiments of the present application is shown.

[0036] Figure 4 A kind of schematic diagram of processing browser query request provided by the embodiments of the present application is shown.

[0037] Figure 5 The block schematic diagram of the malicious attack defense device provided by the embodiments of the present application is shown.

[0038] Figure 6A block diagram of an edge server is shown.

[0039] Icon: 10-edge server; 20-original server; 30-database server; 40-third-party server; 110-memory; 120-processor; 130-communication module; 200-malicious attack defense device; 201-source code query module; 202-parsing module; 203-processing module. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations.

[0041] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0042] It should be noted that the relational terms such as "first" and "second" and the like are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus including a series of elements includes not only those elements, but also other elements not explicitly listed or inherent to such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus including the element.

[0043] With the rapid development of modern software development, software architecture becomes more and more complex, consisting of a large number of third-party libraries and services. Since the reliability and security of third-party code libraries and third-party tools cannot be guaranteed. Therefore, when using third-party tools and third-party code libraries, the enterprise is most concerned about the risk of supply chain attacks.

[0044] The supply chain refers to a series of organizations, personnel, activities, information and resources that jointly realize the whole process from raw material production to user use of a product or service. In the technical field, the supply chain usually includes third-party services, code libraries and the like. Attackers can spread malicious code through any one or more key links in the supply chain to implement a supply chain attack on an enterprise. A supply chain attack can involve multiple different participants, such as code libraries, third-party code libraries, third-party tools, encoders and infrastructure providers and the like.

[0045] The CDN-based cloud defense architecture is an architecture that uses a CDN in a cloud environment to enhance network security, which combines the fast delivery capability of the CDN with security protection. The CDN is an intelligent virtual network built on the existing network infrastructure, which relies on edge servers deployed around the world to ensure that users can access network resources nearby through the functions of load balancing, content distribution and scheduling of the central platform, effectively reducing network congestion and improving user access response speed and hit rate.

[0046] In order to improve the website loading speed, the customer website of the CDN-based cloud defense architecture usually references a large number of third-party JavaScript code libraries, so that the latest JavaScript code library code can be loaded in the case of demand for updating the local code. For example, by third-party HTTP request <script src＝”https: aaa.bbb.cc.com tcaptcha.js”class＝”next-head”>< / script> Load the JavaScript code library of the "verification code" provided by the third party.

[0047] The benefits of loading third-party code libraries through external connections are obvious, but at the same time, it also brings uncontrollable security problems. Since the third-party code is saved on the third-party server, if the third-party code is maliciously tampered with, the business cannot be controlled. In order to ensure the security of its own system, the enterprise usually uses active detection or monitoring to regularly scan the code of the webpage to determine whether it contains malicious code. Once malicious code is detected, the webpage may have suffered a network attack, causing data leakage or service interruption and other major losses.

[0048] Based on this, the embodiments of the present application provide a malicious attack defense method and device, an edge server and a storage medium, which defend against malicious attacks by saving third-party code that has not been maliciously tampered with in a local cache, thereby ensuring the security of the supply chain website.

[0049] Please refer to Figure 1 , Figure 1 An application scenario diagram suitable for the embodiments of the present application is shown. In Figure 1In the specific implementation, the edge server 10 is in communication connection with the origin server 20, the database server 30 and the third-party server 40. The edge server is configured to respond to a request of a browser, and perform the steps S10-S90 and corresponding sub-steps in the following examples according to the received access request, so as to achieve the technical effect of defending against malicious attacks. Meanwhile, the edge server is also configured to respond to an operation of updating a cache of a user, and perform the step of clearing the local cache according to the received operation, so as to achieve the corresponding technical effect.

[0050] The origin server 20 is mainly responsible for storing source codes, the database server 30 is mainly responsible for caching file names of third-party files and corresponding third-party codes, and the third-party server 40 is mainly responsible for storing file names of third-party files and corresponding codes. It should be noted that the number of the edge server 10, the origin server 20 and the third-party server 40 can be one or more, which is not limited in the present application.

[0051] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0052] Figure 2 Fig. 1 shows a schematic diagram of a method for defending against malicious attacks according to an embodiment of the present application. The method can be performed by the edge server as described above. The method comprises the following steps. Figure 2

[0053] In step S10, the HTTP request of the browser is forwarded to the origin server, so that the origin server sends corresponding source codes to the edge server according to the HTTP request.

[0054] In the embodiment of the present application, the browser of the client initiates an HTTP request to a target website, and the edge server forwards the HTTP request of the browser to the origin server of the target website as a proxy node, so that the origin server sends corresponding source codes to the edge server according to the HTTP request.

[0055] In step S20, a third-party HTTP request is obtained according to the source codes. The third-party HTTP request comprises a URL address, and the URL address comprises a target domain name address and a target file name.

[0056] In the embodiment of the present application, all third-party HTTP requests contained in the source codes (for example, HTML codes) are obtained according to the source codes, and the corresponding third-party codes are obtained by accessing a third-party JavaScript code library according to the third-party HTTP requests.

[0057] ​As an implementation, assuming that the source code includes <script src="https: / / ssl.captcha.aa.com / TCaptcha.js" class="next-head">, whether the third-party JavaScript code library needs to be accessed is determined according to the protocol and domain name address in the code segment; when the protocol and the target domain name address different from the domain name address in the HTTP request of the browser are contained, the third-party JavaScript code library needs to be accessed; the third-party HTTP request obtained from the source code includes the URL address https: / / ssl.captcha.aa.com / TCaptcha.js, the URL address includes the protocol, the target domain name address, and the target file name, wherein the protocol is https, the target domain name address is https: / / ssl.captcha.aa.com, and the target file name is TCaptcha.js.

[0058] In step S60, when the target third-party code corresponding to the target file name is saved in the local cache of the database server, the target domain name address in the third-party HTTP request in the source code is replaced with the domain name address of the edge server, and the modified source code is returned to the browser; the target third-party code is the code obtained from the third-party server and not maliciously tampered with.

[0059] In the embodiment of the application, whether the target third-party code corresponding to the target file name is cached locally in the database server is determined; if the target third-party code is cached locally in the database server, the target domain name address in the third-party HTTP request in the source code is replaced with the domain name address of the edge server, so that the browser accesses the third-party code cached locally in the database server according to the updated third-party request, and the code does not need to be obtained from the third-party server again, which can effectively avoid the web page loading virus caused by the third-party code being injected with malicious code.

[0060] Continuing to take the source code including <script src＝"https: ssl.captcha.aa.com tcaptcha.js"class＝"next-head">< / script> as an example, the target domain name address ssl.captcha.aa.com in the third-party request is replaced with the domain name address of the edge server, and the modified source code includes <script src="https: / / cdnserver.com / TCaptcha.js"

[0061] class="next-head">, after the target domain name addresses in all third-party HTTP requests in the source code are replaced with the domain name address of the edge server, the modified source code is returned to the browser.

[0062] In summary, the malicious attack defense method provided by the embodiment of the application is applied to an edge server, the edge server is in communication connection with an original server, a database server and a third-party server, an HTTP request of a browser is forwarded to the original server, so that the original server sends corresponding source code to the edge server according to the HTTP request; the source code is obtained according to the third-party HTTP request; the third-party HTTP request includes a URL address, and the URL address includes a target domain name address and a target file name; when the target file name corresponds to target third-party code saved in the local cache of the database server, the target domain name address in the third-party HTTP request in the source code is replaced with the domain name address of the edge server, and the modified source code is returned to the browser; the target third-party code is code obtained from the third-party server and not maliciously tampered with. The malicious attack is defended by saving the third-party code not maliciously tampered with in the local cache, so as to guarantee the security of the supply chain website.

[0063] Optionally, in actual application, when the target file is accessed for the first time, the target file name and the corresponding third-party code are not saved in the local cache of the database server and need to be obtained from the third-party server. Please refer to Figure 3 , the malicious attack defense method further includes the following steps:

[0064] Step S30, when the target file name corresponds to target third-party code not saved in the local cache of the database server, the third-party code is obtained from the third-party server according to the third-party HTTP request.

[0065] In the embodiment of the application, the domain name address of the server is the identity of the server on the network, which is a string with high readability and can be used to conveniently identify and access the server. When accessing resources on the server, the actual IP address of the server needs to be obtained according to the domain name address, and the access request is sent to the server at the IP address.

[0066] When the target file name and the corresponding target third-party code are not saved in the local cache of the database server, the corresponding IP address is obtained according to the target domain name address in the third-party HTTP request, and the third-party HTTP request is sent to the third-party server, so that the third-party server obtains the corresponding third-party code according to the target file name in the third-party HTTP request and sends the third-party code to the edge server.

[0067] Step S40, calling the antivirus software to detect whether the third-party code includes malicious code.

[0068] In the embodiment of the application, after receiving the third-party code sent by the third-party server, the third-party code is detected once for security, that is, the antivirus software is called to detect whether the third-party code includes malicious code.

[0069] Step S50, if the third-party code does not include malicious code, the third-party code is taken as target third-party code, and the target third-party code is synchronized with the target file name to the database server, so that the database server saves the target file name and the target third-party code into the local cache.

[0070] In the embodiment of the present application, if the third-party code is not detected with malicious code, the third-party code is cached as target third-party code with the target file name in the local of the database server.

[0071] Optionally, in practical application, if the third-party code is maliciously tampered, the third-party code can not run any more, otherwise, data leakage or webpage service interruption will be caused. Please continue to refer to Figure 3 , the malicious attack defense method further includes the following steps:

[0072] Step S70, if the third-party code includes malicious code, the URL address in the third-party HTTP request in the source code is deleted, and the modified source code is returned to the browser.

[0073] As an embodiment, assuming that the third-party code in the third-party server with the target domain name address of ssl.captcha.aa.com has detected the implanted malicious code, the URL address in the third-party HTTP request is deleted, and the modified source code includes <script src＝""class＝"next-head">< / script> , so that the browser will not run the target third-party code implanted with malicious code according to the received source code, thereby effectively defending the malicious attack of the network.

[0074] Optionally, in practical application, when the edge server receives the request of the browser querying the target file code, the edge server returns the target third-party code in the local cache of the database server to the browser. Please refer to Figure 4 , the step of the edge server responding to the query request of the browser includes:

[0075] Step S80, according to the target file name in the query request sent by the browser, a query instruction is sent to the database server, so that the database server finds the corresponding target third-party code according to the target file name in the query instruction, and returns the target third-party code to the edge server;

[0076] Step S90, the received target third-party code is returned to the browser.

[0077] In the embodiment of the present application, when the browser is to render the website webpage content corresponding to the target file, a target file code query request is sent to the edge server, the edge server sends a query instruction to the database server according to the target file name in the query request, so that the database server queries the target third-party code corresponding to the target file name from the local cache, and sends the target third-party code to the edge server, and the edge server returns the target third-party code to the browser, so that the browser renders the webpage content by running the target third-party code.

[0078] Optionally, in actual application, when the third-party server upgrades the code, the administrator clears the local cached third-party code through the webpage configuration interface, so that the upgraded code is pulled again from the third-party server when the third-party code is accessed again, and the code that passes the verification is cached in the database server locally. The step of the edge server responding to the user's update cache operation includes:

[0079] According to the user's update cache operation, a cache clearing instruction is sent to the database server, so that the database server clears the local cache according to the cache clearing instruction.

[0080] As an implementation, it is assumed that the user, for example, the administrator, clicks to clear the local cache through the client login configuration interface, the client generates an update cache operation in response to the administrator's operation of clearing the local cache, and sends the update cache operation to the edge server. The edge server responds to the user's update cache operation, and notifies the database server to clear the local cache, so that the database server deletes all file names and corresponding third-party codes cached in the local cache.

[0081] As another implementation, when the user logs in to the configuration interface to clear the local cache, the target file name to be cleared can be specified, the edge server sends a cache clearing instruction to the database server according to the target file name in the user's update cache operation, so that the database server clears the target file name and the corresponding target third-party code cached in the local cache according to the target file name in the cache clearing instruction. The specific implementation of clearing the local cache is not limited in the present application.

[0082] Optionally, in actual application, all third-party HTTP requests need to be parsed from the source code. Please continue to refer to Figure 2 , the sub-step of step S20 can include:

[0083] All third-party HTTP requests are parsed from the source code by using the parser.

[0084] In the embodiment of the present application, the parser usually performs text segmentation and pattern matching by using regular expressions, and parses all third-party HTTP requests from the source code by using a preset regular expression pattern.

[0085] Based on the same inventive concept, the embodiment of the present application also provides a malicious attack defense device. The basic principle and the technical effects are the same as the above-mentioned embodiment, and for brief description, the part not mentioned in this embodiment can refer to the corresponding content in the above-mentioned embodiment.

[0086] Please refer to Figure 5 , Figure 5 The block diagram of the malicious attack defense device 200 provided by the embodiment of the present application is shown. The malicious attack defense device 200 is applied to an edge server, and the edge server is in communication connection with an original server, a database server and a third-party server; the malicious attack defense device 200 comprises a source code query module 201, an analysis module 202 and a processing module 203.

[0087] The source code query module 201 is used for forwarding the HTTP request of the browser to the original server, so that the original server sends the corresponding source code to the edge server according to the HTTP request;

[0088] The analysis module 202 is used for obtaining the third-party HTTP request according to the source code; the third-party HTTP request comprises a URL address, and the URL address comprises a target domain name address and a target file name;

[0089] The processing module 203 is used for replacing the target domain name address in the third-party HTTP request in the source code with the domain name address of the edge server when the target third-party code corresponding to the target file name is saved in the local cache of the database server, and returning the modified source code to the browser; the target third-party code is the code obtained from the third-party server without being maliciously tampered with.

[0090] In summary, the malicious attack defense device provided by the embodiment of the present application comprises a source code query module, an analysis module and a processing module, the source code query module is used for forwarding the HTTP request of the browser to the original server, so that the original server sends the corresponding source code to the edge server according to the HTTP request; the analysis module is used for obtaining the third-party HTTP request according to the source code; the third-party HTTP request comprises a URL address, and the URL address comprises a target domain name address and a target file name; the processing module is used for replacing the target domain name address in the third-party HTTP request in the source code with the domain name address of the edge server when the target third-party code corresponding to the target file name is saved in the local cache of the database server, and returning the modified source code to the browser; the target third-party code is the code obtained from the third-party server without being maliciously tampered with. The malicious attack is prevented by saving the third-party code without being maliciously tampered with in the local cache, so as to ensure the security of the supply chain website.

[0091] Optionally, the processing module 203 is further configured to, when the target file name corresponding to the target third-party code is not saved in the local cache of the database server, acquire the third-party code from the third-party server according to the third-party HTTP request; call the antivirus software to detect whether the third-party code includes malicious code; if the third-party code does not include malicious code, take the third-party code as the target third-party code, and synchronize the target third-party code and the target file name to the database server, so that the database server saves the target file name and the target third-party code in the local cache.

[0092] Optionally, the processing module 203 is further configured to, if the third-party code includes malicious code, delete the URL address in the third-party HTTP request in the source code, and return the modified source code to the browser.

[0093] Optionally, the processing module 203 is further configured to send a query instruction to the database server according to the target file name in the query request sent by the browser, so that the database server finds the corresponding target third-party code according to the target file name in the query instruction, and returns the target third-party code to the edge server; return the received target third-party code to the browser.

[0094] Optionally, the processing module 203 is further configured to send a cache clearing instruction to the database server according to the update cache operation of the user, so that the database server clears the local cache according to the cache clearing instruction.

[0095] Optionally, the parsing module 202 is specifically configured to parse all third-party HTTP requests from the source code by using a parser.

[0096] Please refer to Figure 6 , Figure 6 Fig. 1 shows a block schematic diagram of an edge server 10 provided by an embodiment of the present application. The edge server 10 can be a physical server, a virtual machine, a container, an edge computing node, a mobile edge computing server, etc., and the present application does not limit the same. The edge server 10 includes a memory 110, a processor 120 and a communication module 130. The memory 110, the processor 120 and the communication module 130 are directly or indirectly electrically connected to each other to realize the transmission or interaction of data. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines.

[0097] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0098] The processor 120 is used to read / write data or programs stored in the memory 110 and perform corresponding functions. For example, when a computer program stored in the memory 110 is executed by the processor 120, the malicious attack defense method disclosed in the above embodiments can be implemented.

[0099] The communication module 130 is used to establish a communication connection between the edge server 10 and other communication terminals via the network, and to send and receive data via the network.

[0100] It should be understood that, Figure 6 The structure shown is only a schematic diagram of the edge server 10. The edge server 10 may also include components such as... Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown. Figure 6 The components shown can be implemented using hardware, software, or a combination thereof.

[0101] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by processor 120, implements the malicious attack defense method disclosed in the above embodiments.

[0102] In several embodiments provided by the present application, it should be understood that the disclosed apparatus and method can also be implemented in other manners. The described embodiments of the apparatus are merely exemplary, and the present application can be implemented in other manners. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation modes of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a segment or a part of a code, which comprises one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementation modes, the functions noted in the blocks can occur in a different order from that noted in the accompanying drawings. For example, two consecutive blocks can actually be executed in a substantially parallel manner, or they can be executed in a reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system for implementing the specified functions or actions, or by a combination of dedicated hardware and computer instructions.

[0103] In addition, each functional module in the various embodiments of the present application can be integrated together to form a separate part, or each module can exist independently, or two or more modules can be integrated to form a separate part.

[0104] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0105] The above only represents the preferred embodiments of the present application, and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A malicious attack defense method characterized by comprising: The method is applied to an edge server, the edge server is in communication connection with an original server, a database server and a third-party server, and the method comprises the following steps: forwarding an HTTP request of a browser to the original server, so that the original server sends corresponding source code to the edge server according to the HTTP request; obtaining a third-party HTTP request according to the source code, wherein the third-party HTTP request comprises a URL address, and the URL address comprises a target domain name address and a target file name; when the target third-party code corresponding to the target file name is saved in the local cache of the database server, replacing the target domain name address in the third-party HTTP request in the source code with a domain name address of the edge server, and returning the modified source code to the browser; the target third-party code is unmaliciously tampered code obtained from the third-party server.

2. The malicious attack defense method according to claim 1, characterized by, The method further comprises the following steps: when the target third-party code corresponding to the target file name is not saved in the local cache of the database server, obtaining third-party code from the third-party server according to the third-party HTTP request; calling an antivirus software to detect whether the third-party code comprises malicious code; if the third-party code does not comprise malicious code, taking the third-party code as the target third-party code, and synchronizing the target third-party code and the target file name to the database server, so that the database server saves the target file name and the target third-party code into the local cache.

3. The method of claim 2, wherein, The method further comprises the following steps: if the third-party code comprises malicious code, deleting the URL address in the third-party HTTP request in the source code, and returning the modified source code to the browser.

4. The malicious attack defense method of claim 1, wherein, The method further comprises the following steps: sending a query instruction to the database server according to the target file name in a query request sent by the browser, so that the database server finds the target third-party code according to the target file name in the query instruction, and returns the target third-party code to the edge server; returning the received target third-party code to the browser.

5. The method of malicious attack defense of claim 1, wherein, The method further comprises the following steps: sending a cache clearing instruction to the database server according to an update cache operation of a user, so that the database server clears the local cache according to the cache clearing instruction.

6. The method of malicious attack defense of claim 1, wherein, The step of obtaining a third-party HTTP request according to the source code comprises the following steps: parsing all the third-party HTTP requests from the source code by using a parser.

7. A malicious attack defense apparatus characterized by comprising: The method is applied to an edge server, the edge server is in communication connection with an original server, a database server and a third-party server, and the method comprises the following steps: a source code query module is configured to forward an HTTP request of a browser to the original server, so that the original server sends corresponding source code to the edge server according to the HTTP request; The parsing module is configured to obtain a third-party HTTP request according to the source code; the third-party HTTP request comprises a URL address, and the URL address comprises a target domain name address and a target file name; The processing module is configured to replace the target domain name address in the third-party HTTP request in the source code with a domain name address of the edge server when the target third-party code corresponding to the target file name is saved in the local cache of the database server, and return the modified source code to the browser; the target third-party code is a code obtained from the third-party server and not maliciously tampered.

8. The malicious attack defense apparatus according to claim 7, characterized by, The processing module is further configured to obtain a third-party code from the third-party server according to the third-party HTTP request when the target third-party code corresponding to the target file name is not saved in the local cache of the database server. The processing module is further configured to call an antivirus software to detect whether the third-party code comprises malicious code; if the third-party code does not comprise malicious code, the third-party code is taken as the target third-party code, and the target third-party code is synchronized to the database server with the target file name, so that the database server saves the target file name and the target third-party code into the local cache.

9. An edge server, characterized by The edge server comprises a memory and a processor; the memory is configured to store a computer program; and the processor is configured to execute the malicious attack defense method according to any one of claims 1-6 when the computer program is called.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the malicious attack defense method according to any one of claims 1-6.

Images