Request processing method, device, electronic device and storage medium

Abstract

The embodiments of the present invention disclose a request processing method, device, electronic device and storage medium. The method includes: determining a pending HTTP request, obtaining request source information and source site information corresponding to the pending HTTP request; generating an interface call sequence corresponding to the pending HTTP request based on the request source information and the source site information; performing an abnormality detection on the interface call sequence based on a preset abnormality detection method, and determining whether the interface call sequence has an abnormality according to the detection result; if not, processing the pending HTTP request. The technical solution of the embodiments of the present invention solves the technical problem in the related art that the use of specific feature values ​​cannot discover logical vulnerabilities in the API communication process, and realizes more efficient and reliable detection and processing of HTTP requests in the API communication process, thereby improving the security of API communication.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to a request processing method, device, electronic device, and storage medium. Background Art

[0002] With the development of Internet technology, API (Application Programming Interface) attacks are frequent, and the main reason is that API has security flaws. At present, API is mainly used by sending HTTP (Hypertext Transfer Protocol) requests.

[0003] In the related art, abnormal behaviors in the API communication process are usually identified based on set feature values, such as SQL injection, command execution, code execution, etc. However, using set feature values ​​cannot discover the logical vulnerabilities of the API. Since the logical vulnerabilities of the API are commonly found in the HTTP requests during the API communication process.

[0004] Therefore, it is urgent to propose an efficient and reliable solution to detect and process HTTP requests during API communication. Summary of the invention

[0005] The present invention provides a request processing method, device, electronic device and storage medium to achieve more efficient and reliable detection and processing of HTTP requests in the API communication process, thereby improving the security of API communication.

[0006] According to one aspect of the present invention, a request processing method is provided, the method comprising:

[0007] Determine the HTTP request to be processed, and obtain the request source information and source site information corresponding to the HTTP request to be processed;

[0008] Based on the request source information and the source site information, generate an interface call sequence corresponding to the HTTP request to be processed;

[0009] Based on a preset anomaly detection method, anomaly detection is performed on the interface call sequence, and whether the interface call sequence is abnormal is determined according to the detection result;

[0010] If not, the pending HTTP request is processed.

[0011] According to another aspect of the present invention, a request processing device is provided. The device comprises:

[0012] An information acquisition module, used to determine a pending HTTP request, and acquire request source information and source site information corresponding to the pending HTTP request;

[0013] A sequence generation module, used to generate an interface call sequence corresponding to the HTTP request to be processed based on the request source information and the source site information;

[0014] A sequence detection module, used to perform anomaly detection on the interface call sequence based on a preset anomaly detection method, and determine whether the interface call sequence has an anomaly according to the detection result;

[0015] The request processing module is used to process the pending HTTP request if no.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the request processing method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the request processing method described in any embodiment of the present invention when executed.

[0021] The technical solution of the embodiment of the present invention determines the pending HTTP request, obtains the request source information and source site information corresponding to the pending HTTP request; generates an interface call sequence corresponding to the pending HTTP request based on the request source information and the source site information; performs an abnormality detection on the interface call sequence based on a preset abnormality detection method, and determines whether the interface call sequence has an abnormality according to the detection result; if not, processes the pending HTTP request. The technical solution of the embodiment of the present invention solves the technical problem in the related art that the use of specific feature values ​​cannot discover logical vulnerabilities in the API communication process, and realizes more efficient and reliable detection and processing of HTTP requests in the API communication process, thereby improving the security of API communication.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 A flowchart of a request processing method provided in Embodiment 1 of the present invention;

[0025] Figure 2 An example diagram of an interface call relationship diagram applicable to a request processing method is provided for the first embodiment of the present invention;

[0026] Figure 3 A flowchart of a request processing method provided in Embodiment 2 of the present invention;

[0027] Figure 4 A flowchart of a request processing method provided in Embodiment 3 of the present invention;

[0028] Figure 5 A schematic diagram of the structure of a request processing device provided in Embodiment 4 of the present invention;

[0029] Figure 6 This is a schematic diagram of the structure of an electronic device provided in Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0032] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0033] Embodiment 1

[0034] Figure 1 A flowchart of a request processing method provided in Embodiment 1 of the present invention is provided. This embodiment is applicable to the case of detecting and processing HTTP requests in the process of API communication. The method can be executed by a request processing device. The request processing device can be implemented in the form of hardware and / or software. The request processing device can be configured in an electronic device such as a computer or a server.

[0035] like Figure 1 As shown, the method of this embodiment includes:

[0036] S110: Determine the HTTP request to be processed, and obtain the request source information and source site information corresponding to the HTTP request to be processed.

[0037] Among them, the pending HTTP request can be understood as the HTTP request that currently needs to be processed during the API communication process. The source of the pending HTTP request can be a business network environment. In an embodiment of the present invention, the request header of the pending HTTP request may include a request source field and a source site field. Among them, the request source field can be used to identify the request source information of the HTTP request during the API communication process, that is, to identify the basic call logic of the API. The request source information can be understood as the source information of the pending HTTP request. The source site field can be used to identify the source site information of the HTTP request during the API communication process, that is, to assist in identifying the basic call logic of the API. The source site information can be understood as the source site information of the pending HTTP request. In an embodiment of the present invention, for cross-domain requests, there may be inconsistencies between the domain name and the request source in the request header. In order to more accurately and effectively identify the basic call logic of the API, the source site field can be set to assist in identifying the basic call logic of the API.

[0038] In an embodiment of the present invention, an HTTP request that needs to be processed in a business network environment can be determined as a pending HTTP request. Then, a request header of the pending HTTP request can be determined based on the request structure of the pending HTTP request. Thus, request header information of the request header can be obtained. Then, request source information and source site information corresponding to the pending HTTP request can be obtained based on the request header information.

[0039] It should be noted that in the embodiment of the invention, the business network environment includes plain text business traffic. By performing traffic parsing, protocol parsing and session restoration processing on the plain text business traffic, the http traffic in the business network environment can be parsed to obtain the HTTP request. It should also be noted that the business network environment includes a switch, which is configured with traffic port mirroring and certificate unloading settings to facilitate obtaining plain text business traffic.

[0040] S120. Based on the request source information and the source site information, generate an interface call sequence corresponding to the HTTP request to be processed.

[0041] The interface call sequence may be understood as a sequence generated based on the request source information and the source site information.

[0042] In an embodiment of the present invention, generating an interface call sequence corresponding to the HTTP request to be processed based on the request source information and the source site information may include: based on a preset data structure, combining the request source information and the source site information to obtain a combined sequence, and using the combined sequence as the interface call sequence corresponding to the HTTP request to be processed.

[0043] The preset data structure may be understood as a pre-set data structure for combining the request source information and the source site information.

[0044] Specifically, a data structure for combining the request source information and the source site information is pre-set, i.e., a data structure of a preset interface call sequence. Based on the preset data structure, the request source information and the source site information can be combined and processed according to the preset data structure. Thus, a combined sequence can be obtained. At this time, the combined sequence is used as the interface call sequence corresponding to the HTTP request to be processed.

[0045] S130. Perform an anomaly detection on the interface call sequence based on a preset anomaly detection method, and determine whether there is an anomaly in the interface call sequence according to the detection result.

[0046] The preset anomaly detection method can be understood as a pre-set method for detecting anomalies in an interface call sequence, which can be used to detect logical vulnerabilities in the API. The detection results can include anomalies and non-abnormalities.

[0047] Specifically, after obtaining the interface call sequence, an abnormality detection can be performed on the interface call sequence based on a preset abnormality detection method, so as to obtain a detection result. After obtaining the detection result, it can be determined whether the interface call sequence has an abnormality according to the detection result.

[0048] S140: If not, process the pending HTTP request.

[0049] Specifically, if the detection result is non-abnormal, it can be indicated that there is no abnormality in the interface call sequence. At this time, the pending HTTP request can be processed.

[0050] In the above-mentioned embodiment of the invention, the method may further include: when it is determined according to the detection result that there is an abnormality in the interface call sequence, the pending HTTP request may be intercepted, and abnormal prompt information for the pending HTTP request may be generated and displayed.

[0051] The abnormal prompt information can be understood as information for abnormal prompting generated when it is determined according to the detection result that the interface call sequence has an abnormality. The abnormal prompt information can include request information of the HTTP request.

[0052] Specifically, when it is determined according to the detection result that the interface call sequence is abnormal, the pending HTTP request can be intercepted, and abnormal prompt information for the pending HTTP request can be generated. Then, the abnormal prompt information can be displayed in a preset prompt mode. Among them, the preset prompt mode can be set according to actual needs, which is not specifically limited here, for example, at least one of a text prompt, a warning icon prompt, and a voice prompt.

[0053] In the above-mentioned embodiment of the invention, the method may further include: generating an interface call relationship graph based on the interface call sequence when there is no abnormality in the interface call sequence, and displaying the interface call relationship graph.

[0054] Among them, the interface call relationship diagram can be understood as a relationship diagram generated based on the interface call sequence and used to display the calls between interfaces.

[0055] Specifically, when there is no abnormality in the interface call sequence, the interface call sequence can be parsed to determine at least one interface in the interface sequence. When the number of the interface is one, a node graph for the interface can be generated as an interface call relationship graph. When the number of the interfaces is multiple, each interface can be used as a separate node according to the call relationship between the interfaces, and each node can be connected. Thus, an interface call relationship graph can be obtained (see Figure 2 ). After obtaining the interface call relationship graph, the interface call relationship graph can be displayed.

[0056] Optionally, generating an interface call relationship graph based on the interface call sequence may include: generating a front-end page relationship graph based on the interface call sequence, and generating an interface call relationship graph based on the front-end page relationship graph.

[0057] Specifically, based on the interface call sequence, at least one front-end website corresponding to the interface call sequence is determined. Based on the at least one front-end website, a front-end page relationship graph can be generated. Based on the front-end page relationship graph, an interface call relationship graph can be constructed.

[0058] In the implementation of the present invention, a single node in the front-end page relationship graph is a front-end website. The connection between the nodes can be an association relationship between the front-end websites. For example, the association relationship can be a jump from a first website to a second website; or, the second website can return to the first website.

[0059] In an embodiment of the present invention, an interface call relationship graph is constructed based on a front-end page relationship graph. Specifically, for each node in the front-end page relationship graph, node information of the node is obtained, that is, the front-end website corresponding to the node is obtained. Interface information is extracted from the front-end website. Then, based on the association relationship of each node in the front-end page relationship graph and the interface information corresponding to each node, an interface call relationship graph can be generated.

[0060] The technical solution of the embodiment of the present invention determines the pending HTTP request, obtains the request source information and source site information corresponding to the pending HTTP request; generates an interface call sequence corresponding to the pending HTTP request based on the request source information and the source site information; performs an abnormality detection on the interface call sequence based on a preset abnormality detection method, and determines whether the interface call sequence has an abnormality according to the detection result; if not, processes the pending HTTP request. The technical solution of the embodiment of the present invention solves the technical problem in the related art that the use of specific feature values ​​cannot discover logical vulnerabilities in the API communication process, and realizes more efficient and reliable detection and processing of HTTP requests in the API communication process, thereby improving the security of API communication.

[0061] Embodiment 2

[0062] Figure 3 A flowchart of a request processing method provided for Embodiment 2 of the present invention, based on the aforementioned embodiment, optionally, the interface call sequence is subjected to an anomaly detection based on a preset anomaly detection method, and whether the interface call sequence has an anomaly is determined based on the detection result, including: inputting the interface call sequence into a preset detection model, obtaining a model output result, and determining whether the interface call sequence has an anomaly based on the model output result; wherein the preset detection model is a deep learning model trained based on a sample interface call sequence and an expected label corresponding to the sample interface call sequence. Among them, the technical features that are the same or similar to those in the aforementioned embodiment are not repeated here.

[0063] like Figure 3 As shown, the method of this embodiment specifically includes:

[0064] S210: Determine the HTTP request to be processed, and obtain the request source information and source site information corresponding to the HTTP request to be processed.

[0065] S220. Based on the request source information and the source site information, generate an interface call sequence corresponding to the HTTP request to be processed.

[0066] S230: Input the interface call sequence into a preset detection model to obtain a model output result, and determine whether the interface call sequence is abnormal based on the model output result.

[0067] The preset detection model may be a deep learning model trained based on a sample interface call sequence and an expected label corresponding to the sample interface call sequence. The expected label sample interface call sequence may be the output result expected after the sample interface call sequence is input into the preset detection model. The model output result may be understood as the actual output result obtained after the interface call sequence is input into the preset detection model.

[0068] Specifically, after obtaining the interface call sequence corresponding to the HTTP request to be processed, the interface call sequence can be input into a preset detection model, thereby obtaining a model output result, and then determining whether the interface call sequence is abnormal based on the model output result.

[0069] In an embodiment of the present invention, the preset detection model can be obtained by pre-building an initial network model. Inputting a sample interface call sequence into the initial network model to obtain an actual output result. Using the expected label corresponding to the sample interface call sequence as the expected output result. Further, based on the actual output result and the expected output result, the network parameters of the initial network model can be adjusted to obtain the preset detection model.

[0070] The embodiment of the present invention can identify and detect the interface call sequence relatively quickly and accurately by using a preset detection model, thereby avoiding the detection of the interface call sequence taking a long time and improving the processing efficiency of HTTP requests.

[0071] S240: If not, process the pending HTTP request.

[0072] The technical solution of an embodiment of the present invention is to input the interface call sequence into a preset detection model to obtain a model output result, and determine whether the interface call sequence has an abnormality based on the model output result; wherein the preset detection model is a deep learning model trained based on a sample interface call sequence and the expected labels corresponding to the sample interface call sequence, and realizes the function of detecting HTTP requests in the API communication process in a relatively efficient and reliable manner.

[0073] Embodiment 3

[0074] Figure 4 A flowchart of a request processing method provided for the third embodiment of the present invention, based on the above-mentioned embodiment, optionally, based on the preset exception detection method, the interface call sequence is detected for exceptions, and whether the interface call sequence has an exception is determined according to the detection result, including: if the pending HTTP request is not detected again or the pending HTTP request is detected again and the time interval between the two pending HTTP requests is greater than the preset interval, it is determined that the interface call sequence has an exception; if the pending HTTP request is detected again and the time interval between the two pending HTTP requests is less than the preset interval, it is determined that the interface call sequence has no exception. Among them, the technical features that are the same or similar to the above-mentioned embodiments are not repeated here.

[0075] like Figure 4 As shown, the method of this embodiment specifically includes:

[0076] S310: Determine the HTTP request to be processed, and obtain the request source information and source site information corresponding to the HTTP request to be processed.

[0077] S320. Based on the request source information and the source site information, generate an interface call sequence corresponding to the HTTP request to be processed.

[0078] S330: If no pending HTTP request is detected again or if a pending HTTP request is detected again and the time interval between two pending HTTP requests is greater than a preset interval, it is determined that an abnormality exists in the interface call sequence.

[0079] The preset interval may be set according to actual needs and is not specifically limited here, such as 10ms, 100ms or 1s.

[0080] Specifically, if the pending HTTP request is not detected again, it can be determined that there is an abnormality in the interface call sequence corresponding to the pending request; or, if the pending HTTP request is detected again and the time interval between two pending HTTP requests is greater than a preset interval, it can be determined that there is an abnormality in the interface call sequence corresponding to the pending request.

[0081] Exemplarily, the pending HTTP request is detected again and the time interval between two pending HTTP requests is greater than a preset interval, which may be that 20 ms after the HTTP request for a certain service is currently received, an HTTP request for the certain service is received again.

[0082] S340: If a pending HTTP request is detected again and the time interval between two pending HTTP requests is less than a preset interval, it is determined that there is no abnormality in the interface call sequence.

[0083] Specifically, when a pending HTTP request is currently received, the first receiving time of the currently received pending HTTP request can be determined. When an HTTP request belonging to the same service as the pending HTTP request is received again after the pending HTTP request is received, the second receiving time of the HTTP request received again can be determined. Then, the time interval between the first receiving time and the second receiving time, that is, the time interval between the two pending HTTP requests can be calculated. Further, the time interval can be compared with a preset interval. When the time interval is less than the preset interval, it can be determined that there is no abnormality in the interface call sequence.

[0084] S350: When it is determined that there is no abnormality in the interface call sequence, the pending HTTP request is processed.

[0085] It should be noted that if a pending HTTP request is detected again and the time interval between two pending HTTP requests is less than the preset interval, after determining that there is no abnormality in the interface call sequence, the interface call sequence can also be input into a preset detection model to obtain a model output result, and then determine whether there is an abnormality in the interface call sequence based on the model output result, thereby improving the accuracy and reliability of the interface call sequence.

[0086] The technical solution of the embodiment of the present invention determines that there is an abnormality in the interface call sequence if no pending HTTP request is detected again or if a pending HTTP request is detected again and the time interval between two pending HTTP requests is greater than a preset interval; if a pending HTTP request is detected again and the time interval between two pending HTTP requests is less than a preset interval, it determines that there is no abnormality in the interface call sequence, thereby realizing a function of more conveniently and quickly detecting HTTP requests in the API communication process.

[0087] Embodiment 4

[0088] Figure 5 This is a schematic diagram of the structure of a request processing device provided by Embodiment 4 of the present invention. Figure 5 As shown, the device includes: an information acquisition module 410, a sequence generation module 420, a sequence detection module 430 and a request processing module 440.

[0089] Among them, the information acquisition module 410 is used to determine the HTTP request to be processed and obtain the request source information and source site information corresponding to the HTTP request to be processed; the sequence generation module 420 is used to generate an interface call sequence corresponding to the HTTP request to be processed based on the request source information and the source site information; the sequence detection module 430 is used to perform anomaly detection on the interface call sequence based on a preset anomaly detection method, and determine whether the interface call sequence has an anomaly according to the detection result; the request processing module 440 is used to process the HTTP request to be processed if not.

[0090] The technical solution of the embodiment of the present invention determines the pending HTTP request through the information acquisition module, obtains the request source information and source site information corresponding to the pending HTTP request; the sequence generation module generates the interface call sequence corresponding to the pending HTTP request based on the request source information and the source site information; the sequence detection module performs anomaly detection on the interface call sequence based on a preset anomaly detection method, and determines whether the interface call sequence has an anomaly according to the detection result; if not, the request processing module processes the pending HTTP request. The technical solution of the embodiment of the present invention solves the technical problem in the related technology that the use of specific feature values ​​cannot discover logical vulnerabilities in the API communication process, and realizes more efficient and reliable detection and processing of HTTP requests in the API communication process, thereby improving the security of API communication.

[0091] Optionally, the sequence detection module 430 is specifically configured to:

[0092] Inputting the interface call sequence into a preset detection model to obtain a model output result, and determining whether the interface call sequence is abnormal based on the model output result;

[0093] Among them, the preset detection model is a deep learning model trained based on a sample interface call sequence and expected labels corresponding to the sample interface call sequence.

[0094] Optionally, the sequence detection module 430 is specifically configured to:

[0095] If no pending HTTP request is detected again or if a pending HTTP request is detected again and the time interval between two pending HTTP requests is greater than a preset interval, it is determined that an abnormality exists in the interface call sequence;

[0096] If a pending HTTP request is detected again and the time interval between two pending HTTP requests is less than a preset interval, it is determined that there is no abnormality in the interface call sequence.

[0097] Optionally, the device further includes an interface call relationship graph generation module; wherein the interface call relationship graph generation module is used to:

[0098] When there is no abnormality in the interface calling sequence, an interface calling relationship graph is generated based on the interface calling sequence, and the interface calling relationship graph is displayed.

[0099] Optionally, the interface calls a relationship graph generation module, which is used to:

[0100] Based on the interface call sequence, a front-end page relationship graph is generated, and based on the front-end page relationship graph, an interface call relationship graph is generated.

[0101] Optionally, the device further includes a prompt information generating module; wherein the prompt information generating module is used to:

[0102] When it is determined according to the detection result that the interface call sequence is abnormal, the pending HTTP request is intercepted, and abnormal prompt information for the pending HTTP request is generated and displayed.

[0103] Optionally, the sequence generation module 420 is specifically configured to:

[0104] Based on a preset data structure, the request source information and the source site information are combined to obtain a combined sequence, and the combined sequence is used as an interface call sequence corresponding to the HTTP request to be processed.

[0105] The request processing device provided in the embodiment of the present invention can execute the request processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0106] It is worth noting that the various units and modules included in the above-mentioned request processing device are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the embodiments of the present invention.

[0107] Embodiment 5

[0108] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0109] like Figure 6As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0110] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0111] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the request processing method.

[0112] In some embodiments, the request processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the request processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the request processing method in any other appropriate manner (e.g., by means of firmware).

[0113] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0114] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0115] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0116] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0117] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0118] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0119] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0120] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A request processing method, characterized in that: include: Determine a pending HTTP request, and obtain request source information and source site information corresponding to the pending HTTP request, wherein the request header of the pending HTTP request includes a request source field and a source site field, the request source field is used to identify the basic call logic of the API, and the source site field is used to assist in identifying the basic call logic of the API; Based on the request source information and the source site information, generate an interface call sequence corresponding to the HTTP request to be processed; Based on a preset anomaly detection method, an anomaly detection is performed on the interface call sequence, and whether the interface call sequence is abnormal is determined according to the detection result, wherein the preset anomaly detection method is used to detect logical vulnerabilities of the API; If not, process the pending HTTP request; The method of performing anomaly detection on the interface call sequence based on a preset anomaly detection method and determining whether the interface call sequence has an anomaly according to the detection result includes: Inputting the interface call sequence into a preset detection model to obtain a model output result, and determining whether the interface call sequence is abnormal based on the model output result; Wherein, the preset detection model is a deep learning model trained based on a sample interface call sequence and an expected label corresponding to the sample interface call sequence, the expected label corresponding to the sample interface call sequence is the expected output result after the sample interface call sequence is input into the preset detection model, and the model output result is the actual output result obtained after the interface call sequence is input into the preset detection model; Alternatively, performing anomaly detection on the interface call sequence based on a preset anomaly detection method, and determining whether the interface call sequence has an anomaly according to the detection result, includes: If no pending HTTP request is detected again or if a pending HTTP request is detected again and the time interval between two pending HTTP requests is greater than a preset interval, it is determined that an abnormality exists in the interface call sequence; If a pending HTTP request is detected again and the time interval between two pending HTTP requests is less than a preset interval, it is determined that there is no abnormality in the interface call sequence.

2. The method according to claim 1, characterized in that The method further comprises: When there is no abnormality in the interface calling sequence, an interface calling relationship graph is generated based on the interface calling sequence, and the interface calling relationship graph is displayed.

3. The method according to claim 2, characterized in that The generating an interface call relationship graph based on the interface call sequence includes: Based on the interface call sequence, a front-end page relationship graph is generated, and based on the front-end page relationship graph, an interface call relationship graph is generated.

4. The method according to claim 1, characterized in that: The method further comprises: When it is determined according to the detection result that the interface call sequence is abnormal, the pending HTTP request is intercepted, and abnormal prompt information for the pending HTTP request is generated and displayed.

5. The method according to claim 1, characterized in that The step of generating an interface call sequence corresponding to the HTTP request to be processed based on the request source information and the source site information includes: Based on a preset data structure, the request source information and the source site information are combined to obtain a combined sequence, and the combined sequence is used as an interface call sequence corresponding to the HTTP request to be processed.

6. A request processing device, characterized in that: include: An information acquisition module, used to determine a pending HTTP request, and acquire request source information and source site information corresponding to the pending HTTP request, wherein the request header of the pending HTTP request includes a request source field and a source site field, the request source field is used to identify the basic call logic of the API, and the source site field is used to assist in identifying the basic call logic of the API; A sequence generation module, used to generate an interface call sequence corresponding to the HTTP request to be processed based on the request source information and the source site information; A sequence detection module, used to perform anomaly detection on the interface call sequence based on a preset anomaly detection method, and determine whether the interface call sequence has an anomaly according to the detection result, wherein the preset anomaly detection method is used to detect logical vulnerabilities of the API; A request processing module, used for processing the pending HTTP request if no; Wherein, the sequence detection module is configured to: Inputting the interface call sequence into a preset detection model to obtain a model output result, and determining whether the interface call sequence is abnormal based on the model output result; Wherein, the preset detection model is a deep learning model trained based on a sample interface call sequence and an expected label corresponding to the sample interface call sequence, the expected label corresponding to the sample interface call sequence is the expected output result after the sample interface call sequence is input into the preset detection model, and the model output result is the actual output result obtained after the interface call sequence is input into the preset detection model; Alternatively, the sequence detection module is further configured to: If no pending HTTP request is detected again or if a pending HTTP request is detected again and the time interval between two pending HTTP requests is greater than a preset interval, it is determined that an abnormality exists in the interface call sequence; If a pending HTTP request is detected again and the time interval between two pending HTTP requests is less than a preset interval, it is determined that there is no abnormality in the interface call sequence.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the request processing method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the request processing method according to any one of claims 1 to 5 when executed.

Images