A method for processing network abnormal access and related device

Abstract

Embodiments of the present application provide a network exception access processing method and related device, which are used for shortening the time interval from discovery to disposal of the exception access, and improving the security of the zero-trust network control system. Specifically, the method comprises: receiving a login request sent by a terminal device, the login request comprising an access subject identifier and a first to-be-verified parameter, the first to-be-verified parameter comprising an interface calling parameter and a parameter value content thereof, a device identifier of the terminal device, and a URL feature; when the response to the login request fails, recording the access subject identifier and the to-be-verified parameter; calling a corresponding legal parameter of the access subject identifier; matching the first to-be-verified parameter with the legal parameter to obtain a first matching result; and when the first matching result indicates a hit on an exception access rule, sending a first interception indication to the terminal device.

Claims

1. A method for handling abnormal network access, characterized in that, include: The system receives a login request sent by a terminal device. The login request includes an access subject identifier and a first parameter to be verified. The first parameter to be verified includes an interface call parameter, the parameter value of the interface call parameter, the device identifier of the terminal device, and a Uniform Resource Locator (URL) feature. When the login request fails, the access subject identifier and the first parameter to be verified are recorded; The access subject identifier is used to invoke its corresponding valid parameters, which include the interface call parameters corresponding to the access subject, the parameter value content of the interface call parameters corresponding to the access subject, the device identifier of the terminal device corresponding to the access subject, and the URL characteristics corresponding to the access subject. The first parameter to be verified is matched with the legal parameter to obtain the first matching result; When the first matching result indicates that an abnormal access rule has been matched, a first interception instruction is sent to the terminal device; After successfully responding to the login request, a network access ticket request sent by the terminal device is received. The network access ticket request carries the access subject identifier and a second parameter to be verified. The second parameter to be verified includes interface call parameters, the parameter value content of the interface call parameters, the terminal device identifier, and URL characteristics. When the network access ticket request fails, the access subject identifier and the second parameter to be verified are recorded; The access subject identifier is used to invoke its corresponding valid parameters, which include the interface call parameters corresponding to the access subject, the parameter value content of the interface call parameters corresponding to the access subject, the device identifier of the terminal device corresponding to the access subject, and the URL characteristics corresponding to the access subject. The second parameter to be verified is matched with the legal parameter to obtain a second matching result; When the second matching result indicates that an abnormal access rule has been matched, a second interception instruction is sent to the terminal device.

2. The method according to claim 1, characterized in that, After receiving the login request sent by the terminal device, the method further includes: After successfully responding to the login request, a first authentication credential is sent to the terminal device, the first authentication credential being used to indicate that the access subject's identity authentication has been successful; Receive network access ticket request sent by the terminal device; A third matching result is obtained by matching the network access ticket request with the first identity authentication credential; When the third matching result indicates that an abnormal access rule has been matched, a third interception instruction is sent to the terminal device.

3. The method according to claim 2, characterized in that, The third matching result includes: During the lifetime of the first authentication credential and when the network access ticket request carries a second authentication credential to be verified, the second authentication credential is inconsistent with the first authentication credential. During the lifetime of the first authentication credential, the network access ticket request does not carry the first authentication credential; After the lifecycle of the first authentication credential ends, the network access ticket request carries the first authentication credential.

4. The method according to any one of claims 1 to 3, characterized in that, After matching the first parameter to be verified with the legal parameter to obtain a first matching result, and before sending a first interception instruction to the terminal device, the method further includes: The number of times the first parameter to be verified fails to match the legal parameter in the login request sent by the terminal device within a first preset time period is counted. When the number of hits exceeds a first preset threshold, an action is triggered to send a first interception instruction to the terminal device.

5. The method according to any one of claims 1 to 3, characterized in that, The first interception indication includes: The user corresponding to the terminal device is prompted to perform secondary identity authentication; Control the user corresponding to the terminal device to log out of login; Prevent the user corresponding to the terminal device from logging in; Block access permissions for the terminal device or the user corresponding to the terminal device; Prevent the terminal device from connecting to the network; Add the terminal device or the user corresponding to the terminal device to the blacklist.

6. The method according to claim 1 or 2, characterized in that, The method further includes: After the network access ticket request response is successful, obtain the traffic characteristics, target access result and application programming interface (API) call data corresponding to the network access; The traffic characteristics, the target access result, and the API call data are matched with the abnormal access model to obtain a fourth matching result; When the fourth matching result indicates that the network access matches the abnormal access model, a third interception indication is sent to the terminal device.

7. The method according to claim 6, characterized in that, After matching the traffic characteristics, the target access result, and the API call data with the abnormal access model to obtain a fourth matching result, and before marking the network access as abnormal access and sending a third interception instruction to the terminal device, the method further includes: Within a second preset time period, count the number of times the network access hits the abnormal access model for the second time. When the number of hits exceeds the second preset threshold, an action is triggered to send a third interception instruction to the terminal device.

8. The method according to claim 2, characterized in that, The method further includes: After the network access ticket request response is successful, obtain the traffic characteristics, target access result, application programming interface (API) call data, URL characteristics, and log file corresponding to the network access; The network access is analyzed based on the traffic characteristics, the target access results, the API call data, the Uniform Resource Locator (URL) characteristics, and the log files to obtain the analysis results. When the analysis results indicate that the network access is abnormal, a third interception instruction is sent to the terminal device.

9. The method according to claim 8, characterized in that, The analysis results obtained by analyzing the network access based on the traffic characteristics, the target access results, the API call data, the Uniform Resource Locator (URL) characteristics, and the log files include: The URL with the same prefix as the URL feature is associated with the target access result to obtain a status code. If the number of status codes indicating that the server cannot respond exceeds the threshold, the analysis result is determined to be a duplicate scan.

10. The method according to claim 8, characterized in that, The analysis results obtained by analyzing the network access based on the traffic characteristics, the target access results, the API call data, the Uniform Resource Locator (URL) characteristics, and the log files include: If the API call data is compared with the API call data corresponding to other access data, and it is determined that there is a difference between the API call data and the API call data corresponding to other access data, then the analysis result is determined to be a potential malicious scanning attack.

11. The method according to any one of claims 1 to 3, characterized in that, The first matching result includes: The device identifier in the first parameter to be verified is the same as the device identifier in the legal parameter; the Internet Protocol IP address in the first parameter to be verified is the same as the interface IP address in the legal parameter; the URL feature in the first parameter to be verified is the same as the URL feature in the legal parameter; and the parameter value in the first parameter to be verified cannot be decrypted. The device identifier in the first parameter to be verified is the same as the device identifier in the legal parameter; the Internet Protocol IP address in the first parameter to be verified is the same as the interface IP address in the legal parameter; the URL feature in the first parameter to be verified is the same as the URL feature in the legal parameter; the parameter value content in the first parameter to be verified is non-compliant. The device identifier in the first parameter to be verified is the same as the device identifier in the valid parameters, the Internet Protocol IP address in the first parameter to be verified is the same as the interface IP address in the valid parameters, and the cookies requested by the interface IP address are different. The device identifier in the first parameter to be verified is the same as the device identifier in the legal parameter; the Internet Protocol IP address in the first parameter to be verified is the same as the interface IP address in the legal parameter; and the parameter specifications carried by the URL feature in the first parameter to be verified are inconsistent with the parameter specifications carried by the URL feature in the legal parameter. The device identifier in the first parameter to be verified is the same as the device identifier in the valid parameters; the Internet Protocol IP address in the first parameter to be verified is the same as the interface IP address in the valid parameters; the parameter value in the first parameter to be verified is inconsistent with the parameter value in the valid parameters but is the same as the parameter value in the previous login request.

12. A device for handling abnormal network access, characterized in that, include: The receiving module is used to receive a login request sent by a terminal device. The login request includes an access subject identifier, a first parameter to be verified, and the first parameter to be verified includes an interface call parameter, the parameter value content of the interface call parameter, the device identifier of the terminal device, and a Uniform Resource Locator (URL) feature. The processing module is configured to, when responding to the login request failure, record the access subject identifier and the first parameter to be verified; and call the corresponding valid parameters according to the access subject identifier, wherein the valid parameters include the interface call parameters corresponding to the access subject, the parameter value content of the interface call parameters corresponding to the access subject, the device identifier of the terminal device corresponding to the access subject, and the URL feature corresponding to the access subject; The first parameter to be verified is matched with the legal parameter to obtain a first matching result; when the first matching result indicates that an abnormal access rule is hit, the login request is marked as abnormal access; The sending module is used to send a first interception instruction to the terminal device; The receiving module is further configured to receive a network access ticket request sent by the terminal device after the login request is successfully responded to. The network access ticket request carries the access subject identifier and a second parameter to be verified. The second parameter to be verified includes interface call parameters, the parameter value content of the interface call parameters, the terminal device identifier, and URL characteristics. The processing module is further configured to, when responding to the failure of the network access ticket request, record the access subject identifier and the second parameter to be verified; and call the corresponding valid parameters according to the access subject identifier, wherein the valid parameters include the interface call parameters corresponding to the access subject, the parameter value content of the interface call parameters corresponding to the access subject, the device identifier of the terminal device corresponding to the access subject, and the URL feature corresponding to the access subject; The second parameter to be verified is matched with the legal parameter to obtain a second matching result; The sending module is further configured to send a second interception instruction to the terminal device when the second matching result indicates that an abnormal access rule has been hit.

13. The apparatus according to claim 12, characterized in that, The sending module is further configured to send a first authentication credential to the terminal device after successfully responding to the login request, wherein the first authentication credential is used to indicate that the access subject's identity authentication is successful; The receiving module is also used to receive network access ticket requests sent by the terminal device; The processing module is further configured to match the network access ticket request with the first identity authentication credential to obtain a third matching result; The sending module is further configured to send a third interception instruction to the terminal device when the third matching result indicates that an abnormal access rule has been hit.

14. The apparatus according to claim 13, characterized in that, The third matching result includes: During the lifetime of the first authentication credential and when the network access ticket request carries a second authentication credential to be verified, the second authentication credential is inconsistent with the first authentication credential. During the lifetime of the first authentication credential, the network access ticket request does not carry the first authentication credential; After the lifecycle of the first authentication credential ends, the network access ticket request carries the first authentication credential.

15. A computer device, characterized in that, include: Memory, processor, and bus system; The memory is used to store programs; The processor is configured to execute a program in the memory, and the processor is configured to execute the method of any one of claims 1 to 11 according to instructions in the program code; The bus system is used to connect the memory and the processor to enable communication between the memory and the processor.

16. A computer-readable storage medium comprising instructions that, when executed on a computer, cause the computer to perform the method as claimed in any one of claims 1 to 11.

17. A computer program product, characterized in that, The method includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions to cause the computer device to perform the method as described in any one of claims 1 to 11.

Images